` 命名由其 Host 工作区解析相对或绝对路径的 Session（[语法](../../../../packages/util/workspace-path/README.zh.md)）。其它任何 scheme——`sidebar://guide`——是导航地址：它命名一个 tab 而非数据，模型对它回答 `none`（[tab 类型与导航](../../../../packages/client/ui-sidebar-right/README.zh.md)）。
### 服务
@@ -55,7 +55,7 @@ type UseResource = (address: string) => ResourceSnap
每个地址一条记录。持有只控制观察的启停，不控制底层文件或 Session 的生灭。持有者是 hook 的订阅者加 pin；第一个持有者在 `AbortController` 下打开提供方的流，之后的持有者共享它并立刻读到最新值，最后一个释放时中止流并把快照重置为空闲——有提供方注册时为 `loading`，否则为 `none`。地址已被持有时到达的提供方会打开该地址的流；离开的提供方中止它，地址读作 `none`。记录在页面存续期内保留，使 `source(address)` 在 React 渲染到订阅的窗口与 StrictMode 重挂载之间保持引用稳定，否则重建记录会让每次渲染重订阅、重开流。
-右侧 Sidebar 的 Tab 域在每条打开的 tab 记录存续期内钉住其地址，所以切 tab 卸载正文不关流、切回读到最新值；撤销恢复的记录是一次新的钉住，模型已放掉的资源会重新读取（[tab 类型与导航](2026-09-05-sidebar-tab-types-and-navigation.zh.md)）。`openResource(address)` 只收资源地址；引导页与文件树这类页面按 kind 打开，从不进入资源模型。
+右侧 Sidebar 的 Tab 域在每条打开的 tab 记录存续期内钉住其地址，所以切 tab 卸载正文不关流、切回读到最新值；撤销恢复的记录是一次新的钉住，模型已放掉的资源会重新读取（[tab 类型与导航](../../../../packages/client/ui-sidebar-right/README.zh.md)）。`openResource(address)` 只收资源地址；引导页与文件树这类页面按 kind 打开，从不进入资源模型。
## Alternatives considered
diff --git a/.agents/notes/implemented/architecture/2026-09-05-package-manifest-types.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-05-package-manifest-types.i18n.yaml
deleted file mode 100644
index 1cbd6713ec..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-05-package-manifest-types.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-05-package-manifest-types.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-05-package-manifest-types.md
-/agent-note-package-manifest-declaration-ownership:
- en: 26d50551c7d49cf8
- zh: eac4a93af773c945
-/agent-note-package-manifest-declaration-ownership/problem:
- en: bdc0fcaf27081889
- zh: 45eb034edd0bed82
-/agent-note-package-manifest-declaration-ownership/decision:
- en: da43234e14fa9bd5
- zh: 0389015e086f4e25
-/agent-note-package-manifest-declaration-ownership/alternatives-considered:
- en: bf99e75ffab5cb45
- zh: 398f5934858aaca5
-/agent-note-package-manifest-declaration-ownership/consequences:
- en: ce7c3df526622bf2
- zh: 91d51dff77371cb0
diff --git a/.agents/notes/implemented/architecture/2026-09-05-shared-client-control-primitives.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-05-shared-client-control-primitives.i18n.yaml
deleted file mode 100644
index d7f7c0dc3b..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-05-shared-client-control-primitives.i18n.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-05-shared-client-control-primitives.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-05-shared-client-control-primitives.md
-/agent-note-shared-client-control-primitives:
- en: 53e5c771078f4383
- zh: 59e4cc45d06adbee
-/agent-note-shared-client-control-primitives/problem:
- en: 7a711c1cafe0be88
- zh: 7275b36fdd5094f6
-/agent-note-shared-client-control-primitives/decision:
- en: cc335d6820b9ab1c
- zh: e375bababc0fccdb
-/agent-note-shared-client-control-primitives/finding-the-duplicates:
- en: f50ed2aea00a34c5
- zh: a8a27c1d1e0177a8
-/agent-note-shared-client-control-primitives/what-stays-local:
- en: e4fb0a84b9924d5a
- zh: 30545265b2159f04
-/agent-note-shared-client-control-primitives/alternatives-considered:
- en: f77deaa327bc5395
- zh: be8450b665be04bf
-/agent-note-shared-client-control-primitives/testing:
- en: 578f6bad674e4c40
- zh: 0a8f2e72bb4d1f61
-/agent-note-shared-client-control-primitives/consequences:
- en: f94dd6f669d00276
- zh: a67de4bd3f242232
diff --git a/.agents/notes/implemented/architecture/2026-09-05-shared-client-control-primitives.md b/.agents/notes/implemented/architecture/2026-09-05-shared-client-control-primitives.md
deleted file mode 100644
index db8cb9a8bc..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-05-shared-client-control-primitives.md
+++ /dev/null
@@ -1,73 +0,0 @@
-# Agent Note: Shared client control primitives
-
-Status: implemented
-
-English | [中文](2026-09-05-shared-client-control-primitives.zh.md)
-
-## Problem
-
-Client feature plugins compose through slots and never import one another's values, so `@deepseek-ai/dsh-client-ui-primitives` is their only channel for sharing a React component. A control that grows inside one feature package is invisible to the next package that needs the same thing, and copying its markup and CSS is the cheapest move available. Three families had diverged that way. A 36×20 toggle switch existed only inside `ui-settings-plugins`. Read-only capsule badges were declared five separate times across `ui-agent-preset`, `ui-settings-plugins`, and `ui-settings-plugin-inventory`, with two different corner radii and separately authored palettes. A plugin-phase status dot was reimplemented in `ui-settings-plugin-inventory` next to the shared `StateDot` it duplicates.
-
-Neither half of the fix was available to an author. No checklist told them to look in `ui-primitives` before writing a control, and the package gave them nothing to look at: its README named six source files while the package exported more than forty symbols.
-
-## Decision
-
-**A control that a second client package needs lives in `ui-primitives`.** The rule is guidance for authors, not a gate: a feature package may still write its own component when its need is genuinely specific, and the [what stays local](#what-stays-local) list below records the cases from this change. What the rule forbids is the copy — when a control already exists, the author either uses it or lifts the deliberate difference into a prop.
-
-`Tag` is the read-only capsule badge. Its geometry is fixed at the size `ui-agent-preset` established: `999px` radius, `1px 8px` padding, 11px text on a 17px line, 500 weight, `inline-flex`, no wrapping. A single closed `TagTone` union selects the palette, and every member exists because a shipped call site needed it: `outline` and `solid` from the agent-preset section, `neutral` and `quiet` from the plugin settings fields, and `success`, `info`, `warning`, and `danger` from the plugin inventory's enablement tags. The component carries no copy of its own, as every Cordis-free primitive must.
-
-`Switch` is the two-state toggle, at the 36×20 track and 16px thumb `ui-settings-plugins` established. `label` is required and has no default, so a render site cannot omit the accessible name; `title` carries a lock reason where a deployment disables the control.
-
-`StateDotState` includes `idle` for a tracked subject with no activity in progress. The plugin inventory's `pending` and `unloading` phases need that semantic member; without it those two phases lose their marker entirely. The five-state union remains safe for consumers because each package produces a `StateDotState` from its own closed status union and none switches over `StateDotState` itself. The current solid-dot palette and rotating `ongoing` loader are owned by the later [StateDot visual language decision](../feature/2026-09-17-state-dot-visual-language.md).
-
-**The component catalog in the `ui-primitives` README is what makes the rule usable.** It lists every exported component with its purpose and the case it is wrong for, and it names the three pairs that are easy to confuse: `Tag` against `Pill`, `DisclosureRow` against card-shaped disclosure, and the package-internal `FoldToggle` against the exported surface. `Pill` is the selectable capsule button — it takes `active` and `onClick` and drives view switchers and filters; `Tag` is the read-only badge and takes neither. The component comments use the same distinction.
-
-The rule is stated in [packages/client/AGENTS.md](../../../../packages/client/AGENTS.md) as the first step of the new-component checklist, and [docs/web-styling.md](../../../../docs/web-styling.md) points at the catalog so an author arriving from the styling side reaches it too.
-
-## Finding the duplicates
-
-A name-based search undercounts. `.badge`, `.tag`, `.chip`, and `.configTag` miss a capsule named for its role rather than its appearance — `PluginCard`'s unsaved marker is `.pending`. Geometry is the reliable probe: search CSS Modules rules carrying both `border-radius: 999px` and `padding: 1px 8px`. That signature belongs to `Tag` and the deliberately local broken badge below; the unsaved marker keeps only its `flex: none` placement class.
-
-
-## What stays local
-
-A mechanical search groups these controls with the promoted three. They stay in their own packages, because the grouping is superficial:
-
-- **`ui-trajectory`'s toolbar toggle** carries `role="switch"` but is an 88px labelled control with an inline track, and it currently renders `hidden`. It is not the same widget as `Switch`.
-- **`ui-plan`'s mode chip** and **`ui-conversation`'s `ReferenceChip`** are interactive: the first is a warning-toned button with hover, focus, disabled, and a close affordance; the second is a Lexical atom node with its own truncation. Neither is a read-only badge.
-- **`ui-trajectory`'s cell tag** and **`ui-user-questions`'s recommendation badge** use their own geometry — a 6px radius at table density, and a 6px radius at 600 weight on the sidebar accent. Forcing either into the capsule baseline would change a deliberate design, not an accidental one.
-- **`TerminalBlock`'s exit-status pill** stays a static `Pill`. It sits on a 24px command line at the pill's own geometry, and `Tag`'s 11px capsule would not fit that row. The read-only/selectable split is the usual guide, but size decides this one, and the catalog says so.
-- **`ui-agent-preset`'s broken badge** shares the capsule geometry but carries a solid error fill that no second site uses, and it is the hover anchor for a tooltip element of its own. `Tag` would have to keep a palette override in the feature stylesheet and depend on cross-file CSS ordering to win it.
-
-## Alternatives considered
-
-**A `SettingsCard` primitive.** Rejected. `.card` appears in fifteen packages, but only three carry settings-page semantics, and those three differ in behaviour rather than appearance: `ui-settings-plugins`' `PluginCard` stages edits and collapses only after a Host-confirmed save, `ui-agent-preset`'s cards are selectable, and the plugin inventory's are read-only. `PluginCard`'s own header comment already records why it cannot use the shared disclosure row. A single component would have to accept all three behaviours through props that no caller uses more than one of.
-
-**A gate rejecting `role="switch"` or a `.switch` rule outside `ui-primitives`.** Rejected. The goal is that authors reuse what exists, not that they are prevented from building. A gate would fail a package with a legitimately specific control — `ui-trajectory`'s labelled toolbar toggle is exactly that case — and the cost of the false rejection lands on the author least able to argue with it. The catalog plus the checklist step address the actual failure, which is that authors did not know the control existed.
-
-**Preserving every current appearance behind extra `Tag` props.** Rejected. The plugin inventory's 5px radius and the agent-preset capsule are the same kind of tag in two shapes, and neither difference was decided. Keeping both would fix an accident into a public union and leave the next author to guess which one to pick.
-
-**Extending `Pill` instead of adding `Tag`.** Rejected. `Pill` is 24px tall on a 12px radius with 12px text; the badge baseline is denser and rounder. Merging them would produce one component whose size depends on whether `onClick` is present, and would erase the read-only/selectable distinction that the catalog needs in order to answer "which one do I want".
-
-**A two-axis `variant × tone` API for `Tag`.** Rejected. Three variants against six tones describes eighteen combinations of which eight ship, and it lets a caller request combinations with no defined appearance. The flat eight-member union maps each value to exactly one shipped appearance.
-
-**Rendering no dot for `pending` and `unloading` instead of adding `idle`.** Rejected. Those phases need a compact inactive or transitional marker; dropping it would remove information from the inventory in a change whose purpose is to consolidate presentation.
-
-**Putting the reuse rule in the root `AGENTS.md`.** Rejected. The rule governs `packages/client` alone, and the root file sits exactly at its 1950-word ceiling in `scripts/doc-budgets.manifest.json`, so stating it there would have to displace an unrelated repository-wide rule.
-
-## Testing
-
-`Tag`, `Switch`, and the extended `StateDot` carry component specs in `packages/client/ui-primitives/tests`, inside the per-file 100% coverage gate. `StateDot`'s palette is pinned by reading its stylesheet: CSS Modules resolve to class-name maps in the component suites, so a state whose color rule is missing renders on the inherited color and no render assertion notices.
-
-The migrated render sites keep package specs for their role, accessible name, state mapping, and interaction. Web ARIA snapshots cover the assembled presentations — `Switch` keeps `role="switch"` with `aria-checked`, and the inventory's phase dot keeps its `role="img"` name on a wrapper because `StateDot` is `aria-hidden`.
-
-The component and stylesheet specs pin the capsule geometry, StateDot artwork, animation, tokens, and font weight; Web snapshots pin accessible structure. Manual visual inspection remains responsible for the rendered result across themes.
-
-## Consequences
-
-- A new client control now has one place to check and one place to add, and the catalog makes the check a single file read rather than a `grep` over forty exports.
-- `TagTone` is eight members wide because eight appearances shipped. Adding a ninth requires a render site that needs it, not a symmetry argument.
-- The plugin inventory uses capsule tags; the disabled tag uses the `neutral` tone's visible `--dsw-alias-bg-module-platform` fill. Its phase markers use the shared `StateDot`, including the rotating loader for active transitions. The unconfigured-secret badge in the plugin settings fields uses the baseline 500 weight.
-- The plugin inventory palette contains no literal `#b45309`. The conditional tag uses the real `--dsw-alias-state-warn-primary` token rather than the nonexistent `--dsw-alias-state-warning-primary` alias and its hardcoded fallback.
-- The rule cannot be checked mechanically. A future author can still copy a control, and only review will catch it. That is the accepted cost of not gating: the alternative rejects legitimate work, and the packages that stay local above are proof that legitimate work exists.
-- `Tag` and `Switch` are shared across settings and preset packages; future consumers extend these primitives only when an existing prop cannot express a deliberate difference.
diff --git a/.agents/notes/implemented/architecture/2026-09-05-shared-client-control-primitives.zh.md b/.agents/notes/implemented/architecture/2026-09-05-shared-client-control-primitives.zh.md
deleted file mode 100644
index 6d4b04a21b..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-05-shared-client-control-primitives.zh.md
+++ /dev/null
@@ -1,73 +0,0 @@
-# Agent Note: Shared client control primitives
-
-Status: implemented
-
-[English](2026-09-05-shared-client-control-primitives.md) | 中文
-
-## Problem
-
-客户端功能插件通过 slot 组合，彼此从不 import 对方的值，因此 `@deepseek-ai/dsh-client-ui-primitives` 是它们共享 React 组件的唯一通道。在某个功能包内部长出来的控件，对下一个需要同样东西的包不可见，而复制它的标记与 CSS 是当时最省事的做法。三类控件已经这样分叉：36×20 的开关只存在于 `ui-settings-plugins`；只读胶囊徽章在 `ui-agent-preset`、`ui-settings-plugins`、`ui-settings-plugin-inventory` 里被分别声明了五次，带着两种圆角和各自编写的配色；插件相位状态点在 `ui-settings-plugin-inventory` 里被重新实现，就在它所复制的共享 `StateDot` 旁边。
-
-修复所需的两半，作者当时一半也拿不到。没有任何清单要求他们在写控件前先看 `ui-primitives`，而这个包也没给他们可看的东西：README 只列了六个源文件，包却导出了四十多个符号。
-
-## Decision
-
-**第二个客户端包需要的控件，住在 `ui-primitives`。** 这条规则是对作者的引导，不是门禁：功能包在需求确实特殊时仍可以自己写组件，下面的[保留在原包的控件](#what-stays-local)记录了本次改动中的这些例子。规则禁止的是复制——控件已经存在时，作者要么用它，要么把那处有意的差异提升成一个 prop。
-
-`Tag` 是只读胶囊徽章。几何锁定在 `ui-agent-preset` 确立的尺寸：`999px` 圆角、`1px 8px` 内边距、11px 字号配 17px 行高、500 字重、`inline-flex`、不换行。单个闭合的 `TagTone` 联合选择配色，每个成员都因为有已发布的调用点需要它而存在：`outline` 与 `solid` 来自 agent preset 区块，`neutral` 与 `quiet` 来自插件设置字段，`success`、`info`、`warning`、`danger` 来自插件清单的启用标签。与所有 Cordis-free 原语一样，这个组件不自带任何文案。
-
-`Switch` 是双态开关，采用 `ui-settings-plugins` 确立的 36×20 轨道与 16px 滑块。`label` 必填且没有默认值，渲染点无法省略无障碍名称；`title` 在部署禁用该控件时承载锁定原因。
-
-`StateDotState` 包含 `idle`，表示一个被跟踪的对象当前没有进行中的活动。插件清单的 `pending` 与 `unloading` 相位需要这个语义成员；没有 `idle`，这两个相位会彻底失去标记。五态联合对消费方保持安全，因为每个包都从自己的闭合状态联合**产生** `StateDotState`，没有任何一个对 `StateDotState` 本身做 switch。当前的纯色点配色与旋转 `ongoing` loading 由后续的 [StateDot 视觉语言决策](../feature/2026-09-17-state-dot-visual-language.zh.md)负责。
-
-**`ui-primitives` README 里的组件目录，是这条规则得以可用的前提。** 它列出每个导出组件的用途，以及它不适用的场合，并点名三组容易混淆的配对：`Tag` 与 `Pill`、`DisclosureRow` 与卡片式折叠、包内的 `FoldToggle` 与对外导出面。`Pill` 是可选中的胶囊按钮——它接受 `active` 与 `onClick`，用于视图切换与筛选器；`Tag` 是只读徽章，两者都不接受。组件注释使用同一套区分。
-
-规则写在 [packages/client/AGENTS.md](../../../../packages/client/AGENTS.md) 新组件清单的第一步，[docs/web-styling.md](../../../../docs/web-styling.zh.md) 指向该目录，让从样式一侧进来的作者也能到达。
-
-## 如何找出重复
-
-按名字搜会漏。`.badge`、`.tag`、`.chip`、`.configTag` 找不到以角色而非外观命名的胶囊——`PluginCard` 的未保存标记叫 `.pending`。几何特征才是可靠探针：搜索同时带有 `border-radius: 999px` 与 `padding: 1px 8px` 的 CSS Modules 规则。这个特征属于 `Tag` 与下面那个有意保留在原包的损坏徽章；未保存标记只保留自己的 `flex: none` 布局类。
-
-
-## 保留在原包的控件
-
-机械搜索会把下面这些控件归到被提升的那三类里。它们留在各自的包中，因为那种归并只是表面相似：
-
-- **`ui-trajectory` 的工具栏开关**带 `role="switch"`，但它是 88px 宽的带标签控件、轨道内联，而且当前渲染为 `hidden`。它和 `Switch` 不是同一个部件。
-- **`ui-plan` 的模式 chip** 与 **`ui-conversation` 的 `ReferenceChip`** 都是可交互的：前者是警告色调的按钮，带 hover、focus、disabled 与关闭操作；后者是带自有截断逻辑的 Lexical 原子节点。两者都不是只读徽章。
-- **`ui-trajectory` 的单元格 tag** 与 **`ui-user-questions` 的推荐徽章**使用各自的几何——一个是表格密度下的 6px 圆角，一个是侧栏强调色上 600 字重的 6px 圆角。把它们塞进胶囊基准，改掉的是有意的设计，不是意外的分歧。
-- **`TerminalBlock` 的退出状态胶囊**保持为静态 `Pill`。它落在 24px 的命令行上、用的是 pill 自己的几何，`Tag` 的 11px 胶囊放不进那一行。只读与可选中的区分是通常的判据，但这一处由尺寸决定，目录里也是这么写的。
-- **`ui-agent-preset` 的损坏徽章**共用胶囊几何，但带着没有第二处使用的实底错误色填充，而且它是自带提示元素的悬停锚点。改用 `Tag` 就得在功能包样式表里保留一份配色覆盖，并依赖跨文件 CSS 顺序来让它生效。
-
-## Alternatives considered
-
-**做一个 `SettingsCard` 原语。** 否决。`.card` 出现在十五个包里，但只有三处带设置页语义，而这三处的差异在行为而不在外观：`ui-settings-plugins` 的 `PluginCard` 暂存编辑，且只在 Host 确认保存后才折叠；`ui-agent-preset` 的卡片可选中；插件清单的卡片是只读的。`PluginCard` 自己的头注释已经记录了它为何不能使用共享折叠行。单个组件将不得不通过 props 接纳全部三种行为，而没有任何一个调用方会用到其中一种以上。
-
-**加门禁，拒绝 `ui-primitives` 之外的 `role="switch"` 或 `.switch` 规则。** 否决。目标是让作者复用已有的东西，不是阻止他们构建。门禁会挂掉一个确实有特殊控件的包——`ui-trajectory` 的带标签工具栏开关正是这种情况——而误拒的代价落在最没法跟它讲道理的作者身上。目录加清单条目针对的是真正的失败原因：作者不知道那个控件存在。
-
-**用额外的 `Tag` props 保留现有的每一种外观。** 否决。插件清单的 5px 圆角与 agent preset 的胶囊是同一类标签的两种形状，两处差异都不是决定出来的。两个都留会把一次意外固化进公开联合，并且让下一个作者去猜该挑哪个。
-
-**扩展 `Pill` 而不是新增 `Tag`。** 否决。`Pill` 高 24px、圆角 12px、字号 12px；徽章基准更密也更圆。合并会产生一个尺寸取决于是否传了 `onClick` 的组件，并抹掉只读与可选中的区分——而目录正需要这个区分来回答"我该用哪个"。
-
-**给 `Tag` 设计 `variant × tone` 双轴 API。** 否决。三个 variant 乘六个 tone 描述十八种组合，其中八种会发布，而且它允许调用方请求没有定义外观的组合。扁平的八成员联合把每个值映射到恰好一种已发布外观。
-
-**让 `pending` 与 `unloading` 不渲染点，而不是新增 `idle`。** 否决。这些阶段需要紧凑的未活动或过渡标记；在一个目的是统一呈现的改动里把它删掉，等于从清单中拿走信息。
-
-**把复用规则写进根 `AGENTS.md`。** 否决。这条规则只管 `packages/client`，而根文件正好处在 `scripts/doc-budgets.manifest.json` 给它的 1950 词上限上，写在那里就必须挤掉一条不相干的仓库级规则。
-
-## Testing
-
-`Tag`、`Switch` 与扩展后的 `StateDot` 在 `packages/client/ui-primitives/tests` 中各有组件测试，处于每文件 100% 覆盖率门禁之内。`StateDot` 的配色通过读取其样式表来钉住：CSS Modules 在组件测试里解析为类名映射，因此某个状态缺了配色规则时会落到继承色上，而任何渲染断言都不会察觉。
-
-迁移后的渲染点保留包级测试，覆盖 role、无障碍名称、状态映射与交互。Web ARIA 快照覆盖装配后的呈现——`Switch` 保留带 `aria-checked` 的 `role="switch"`，而由于 `StateDot` 是 `aria-hidden`，插件清单的相位点把 `role="img"` 名称保留在外层包裹元素上。
-
-组件与样式表测试固定胶囊几何、StateDot 图稿、动画、token 与字重；Web 快照固定无障碍结构。明暗主题下的最终渲染仍由人工视觉检查负责。
-
-## Consequences
-
-- 新的客户端控件现在有一处可查、一处可加，而目录把这次查询变成读一个文件，而不是在四十多个导出上 `grep`。
-- `TagTone` 有八个成员，因为发布了八种外观。加第九个需要一个真的需要它的渲染点，而不是一个对称性论证。
-- 插件清单使用胶囊标签；"已停用"标签使用 `neutral` 色调下可见的 `--dsw-alias-bg-module-platform` 填充。相位标记使用共享 `StateDot`，活动转换采用旋转 loading。插件设置字段中的"未配置"徽章使用基准 500 字重。
-- 插件清单调色板不含 `#b45309` 字面量。`conditional` 标签使用真实的 `--dsw-alias-state-warn-primary` token，而不是不存在的 `--dsw-alias-state-warning-primary` 别名及其硬编码兜底色。
-- 这条规则无法被机械检查。将来的作者仍然可以复制一个控件，只有评审能拦住。这是不设门禁所接受的代价：另一条路会拒绝正当的工作，而上面那份保留在原包的清单就是正当工作确实存在的证据。
-- `Tag` 与 `Switch` 由多个设置和预设包共享；只有现有 prop 无法表达明确差异时，后续消费方才扩展这些原语。
diff --git a/.agents/notes/implemented/architecture/2026-09-05-sidebar-tab-types-and-navigation.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-05-sidebar-tab-types-and-navigation.i18n.yaml
deleted file mode 100644
index e80e658859..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-05-sidebar-tab-types-and-navigation.i18n.yaml
+++ /dev/null
@@ -1,43 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-05-sidebar-tab-types-and-navigation.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-05-sidebar-tab-types-and-navigation.md
-/agent-note-right-sidebar-tab-types-and-navigation:
- en: 2860d8acc82e4a85
- zh: 7b09ac61a684e36d
-/agent-note-right-sidebar-tab-types-and-navigation/problem:
- en: 1db34c36cf2dc2bd
- zh: 4d4e8d3f09ac18c6
-/agent-note-right-sidebar-tab-types-and-navigation/decision:
- en: 905fd6fbedad540f
- zh: 5420c0dff38012d8
-/agent-note-right-sidebar-tab-types-and-navigation/decision/the-type-registry-ctx-sidebarrighttabs:
- en: 9c0a993b39b2c92f
- zh: 0e0c008e425f47e4
-/agent-note-right-sidebar-tab-types-and-navigation/decision/bodies-and-titles-keyed-slot-seats-under-the-definition-s-id:
- en: 9e80f2d213b394fe
- zh: 79f2e5c504b9863e
-/agent-note-right-sidebar-tab-types-and-navigation/decision/tab-occurrence-information:
- en: 774c3bf80a48ffbe
- zh: c513245789aa8efd
-/agent-note-right-sidebar-tab-types-and-navigation/decision/navigation-ctx-sidebarright:
- en: c52363f57001b7ac
- zh: bbcbdbc038cbf316
-/agent-note-right-sidebar-tab-types-and-navigation/decision/addresses:
- en: eeb1e7e7478a2f2c
- zh: bddbc5bc78245f63
-/agent-note-right-sidebar-tab-types-and-navigation/decision/entry-points:
- en: 6386bde2654f9a0a
- zh: 700439be6a01e162
-/agent-note-right-sidebar-tab-types-and-navigation/alternatives-considered:
- en: c47eb4e2f3c307f9
- zh: fd4515b8be88506e
-/agent-note-right-sidebar-tab-types-and-navigation/consequences:
- en: 3cdb1159ee55d851
- zh: dcd068005e678a89
-/agent-note-right-sidebar-tab-types-and-navigation/testing:
- en: 49449a6c8465c098
- zh: 1f476cc1226aa9cd
-/agent-note-right-sidebar-tab-types-and-navigation/deferred:
- en: 5b2416692028bf89
- zh: 65930102aa253bf2
diff --git a/.agents/notes/implemented/architecture/2026-09-05-workspace-files-service.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-05-workspace-files-service.i18n.yaml
index 561af11c1a..38d42e7d93 100644
--- a/.agents/notes/implemented/architecture/2026-09-05-workspace-files-service.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-05-workspace-files-service.i18n.yaml
@@ -9,14 +9,14 @@
en: 55d969715a48c9b3
zh: 755dab7523cd01c2
/agent-note-workspace-file-service/decision:
- en: 6ab2a1f635cfc87c
- zh: 369e3ed9b6cdc159
+ en: 17137a4e49e56470
+ zh: ed08cf3d2d7348c8
/agent-note-workspace-file-service/decision/package-topology:
- en: 59c3648960630ff8
- zh: 1891f8659e660e45
+ en: 5a8d81c95c031663
+ zh: 5bdeebe3b5e759c9
/agent-note-workspace-file-service/decision/the-workspacefiles-file-operations:
- en: efdecd9cf80c03e7
- zh: 5ea40e48ab0559a2
+ en: 434a2f6b3fab4756
+ zh: ea83124d00c6a79c
/agent-note-workspace-file-service/decision/paths-on-the-wire:
en: 7b5a96adc08177bc
zh: ae4692e5e62e7de0
@@ -36,11 +36,11 @@
en: 0d42d4716dde706f
zh: 4e95b8af2df232b6
/agent-note-workspace-file-service/decision/related-notes:
- en: 6e8cfa03b5222af6
- zh: efdf8f17757fc378
+ en: ef015f605f7b00ab
+ zh: eee9c79faebf3dff
/agent-note-workspace-file-service/alternatives-considered:
- en: 3d598eb6d03d05e5
- zh: 7dac0b7af471a651
+ en: 8eee658526db4465
+ zh: 4a655accf6a5c08a
/agent-note-workspace-file-service/consequences:
en: 246bb7aed62f6c9b
zh: debf6d4129ee477b
diff --git a/.agents/notes/implemented/architecture/2026-09-05-workspace-files-service.md b/.agents/notes/implemented/architecture/2026-09-05-workspace-files-service.md
index 7deb0dac14..02937e54e2 100644
--- a/.agents/notes/implemented/architecture/2026-09-05-workspace-files-service.md
+++ b/.agents/notes/implemented/architecture/2026-09-05-workspace-files-service.md
@@ -12,11 +12,11 @@ Two constraints frame the service. File reads through `ctx.fs` use the Session's
## Decision
-`packages/api/workspace-files` (`@deepseek-ai/dsh-api-workspace-files`) owns the Host `ctx.workspaceFiles` service, the `workspaceFiles` Remote namespace, and the Client `file` provider that turns `stat` and `changes` into live metadata for the [resource model](2026-09-05-client-resource-model.md); [dual-face packaging](2026-09-07-workspace-files-dual-face-package.md) governs their package organization. File methods resolve relative paths from the workspace root but inherit the Session filesystem backend's read authority; `list` and `changes` remain workspace-scoped. The [workspace file read authority](2026-09-09-workspace-file-read-authority.md) owns this split and its security consequences. Results name files by their absolute path in the filesystem's execution world, and content is bounded by page, byte window, or complete-file cap. The byte window rides on a new `dsh-fs` seam, `FileSystem.readByteRange`, implemented by every provider. The Session Controller carries no workspace-file code.
+`packages/api/workspace-files` (`@deepseek-ai/dsh-api-workspace-files`) owns the Host `ctx.workspaceFiles` service, the `workspaceFiles` Remote namespace, and the Client `file` provider that turns `stat` and `changes` into live metadata for the [resource model](2026-09-05-client-resource-model.md); [dual-face packaging](../../../../packages/api/workspace-files/README.md) governs their package organization. File methods resolve relative paths from the workspace root but inherit the Session filesystem backend's read authority; `list` and `changes` remain workspace-scoped. The [workspace file read authority](2026-09-09-workspace-file-read-authority.md) owns this split and its security consequences. Results name files by their absolute path in the filesystem's execution world, and content is bounded by page, byte window, or complete-file cap. The byte window rides on a new `dsh-fs` seam, `FileSystem.readByteRange`, implemented by every provider. The Session Controller carries no workspace-file code.
### Package topology
-[dual-face packaging](2026-09-07-workspace-files-dual-face-package.md) supersedes this note's choice of separate Host and Client packages; the file service, paging, and change-feed decisions here remain in force. The [workspace file read authority](2026-09-09-workspace-file-read-authority.md) supersedes the original workspace-containment choice for file methods. Host and Client compile in separate leaf configurations, share wire types, and the Client does not import the Host runtime entry.
+[dual-face packaging](../../../../packages/api/workspace-files/README.md) supersedes this note's choice of separate Host and Client packages; the file service, paging, and change-feed decisions here remain in force. The [workspace file read authority](2026-09-09-workspace-file-read-authority.md) supersedes the original workspace-containment choice for file methods. Host and Client compile in separate leaf configurations, share wire types, and the Client does not import the Host runtime entry.
| Face | Package | Files | Depends on |
|---|---|---|---|
@@ -41,7 +41,7 @@ Every Host method takes `WorkspaceFileScope` first. The `workspaceFileScope` Gat
- **`read`** returns one window of lines, `WorkspaceFileText = WorkspaceFileStat & { offset, text, lines, eof }`; `lines` counts the page's lines, so a page holding one empty line (`text: ''`, `lines: 1`) and a page past the end (`lines: 0`) read differently. `range.offset` is the 1-based first line and defaults to 1; `range.limit` is the largest number of lines and defaults to `maxLines`, which it may not exceed. Lines end at `\n` and a final `\n` terminates the last line rather than opening an empty one; `text` joins the page's lines with `\n` and carries no terminator; `eof` is true when the page includes the last line, and an offset past the end returns an empty page with `eof` true. The pager walks `streamText`, counts the lines before the window without keeping them, admits each in-window segment against `maxBytes` before buffering it, and returns at the first character past the window, so a file of any size costs one page of memory. The `version` and `bytes` on a page are the stat's, taken before the stream.
- **`readBytes`** returns native bytes with file metadata, offset, and EOF. The required options object selects a complete read under `maxFileBytes` when `range` is absent, or a bounded window under `maxBytes` when present. `range: {}` uses offset zero and the configured window cap; windows can read files above the complete-file cap. The [binary transfer decision](2026-09-17-workspace-file-binary-transfer.md) owns the Remote response encoding.
- **`baseFile`** selects target resolution independently of `range`: the target `path` must be relative and resolves from the base file's directory. The Host applies regular-file checks to both files and preserves backend read authority. [Document Preview](2026-09-08-document-preview-operations.md) owns content loading and address semantics.
-- **`list`** returns `WorkspaceDirectoryListing { path, entries, truncated }`: the listed directory as a workspace path relative to the root (empty for the root), its direct children in the backend's stable name order as `{ name, type, size? }`, and whether `maxEntries` cut the list. `type` is `file`, `directory`, or `other`; a symlink child reports the type of what it points to and a dangling one is `other`. A child the listing reports as a directory opens through its resolved target, including a Windows junction, and the listing then names that target; [directory link listing](../bug-fix/2026-09-18-windows-directory-junction-listing.md) owns the rule. Dotfiles are listed; nothing is filtered.
+- **`list`** returns `WorkspaceDirectoryListing { path, entries, truncated }`: the listed directory as a workspace path relative to the root (empty for the root), its direct children in the backend's stable name order as `{ name, type, size? }`, and whether `maxEntries` cut the list. `type` is `file`, `directory`, or `other`; a symlink child reports the type of what it points to and a dangling one is `other`. A child the listing reports as a directory opens through its resolved target, including a Windows junction, and the listing then names that target; [directory link listing](../../../../packages/api/workspace-files/README.md) owns the rule. Dotfiles are listed; nothing is filtered.
- **`changes`** yields `WorkspaceFileWatchFrame`: `{ kind: 'ready' }` after the observation queue is registered and the workspace root resolves, followed by `{ kind: 'change', change }`. The `WorkspaceFileChange` payload is `{ absolutePath, version }` for a present file or `{ absolutePath, absent: true }` for one observed gone. Its source is `fs/observed` inside the workspace root, never an OS watcher. Observations after the first pull are queued, including during root resolution; cancellation or plugin disposal ends the generation.
### Paths on the wire
@@ -107,13 +107,13 @@ The Client export registers one `ResourceProvider<'file'>` into `ctx.resources`
### Related notes
-The [resource model](2026-09-05-client-resource-model.md) owns `ctx.resources`, `useResource`, the `dsh-resource:///…` address grammar, and the reasoning for one resource per address; the [text preview and file tree](../feature/2026-09-05-sidebar-text-preview-and-file-tree.md) are the shipped consumers of `read`, `list`, and the `file` provider; the [right Sidebar docking infrastructure](../feature/2026-09-04-right-sidebar-docking-infrastructure.md) is the surface they open into; [workspace file links](../feature/2026-07-31-web-workspace-file-links.md) is where serving files over HTTP was rejected. Anyone extending this system reaches the same five methods through `remote.workspaceFiles` and the same `file` resource through `useResource<'file'>`; the wire types are published as `@deepseek-ai/dsh-api-workspace-files/types`. The [workspace file read authority](2026-09-09-workspace-file-read-authority.md) owns Host read access and the HTML security trade-off; [Document Preview](2026-09-08-document-preview-operations.md) owns content loading and per-tab freshness.
+The [resource model](2026-09-05-client-resource-model.md) owns `ctx.resources`, `useResource`, the `dsh-resource:///…` address grammar, and the reasoning for one resource per address; the [text preview and file tree](../../../../packages/client/ui-sidebar-documentpreview/README.md) are the shipped consumers of `read`, `list`, and the `file` provider; the [right Sidebar docking infrastructure](../feature/2026-09-04-right-sidebar-docking-infrastructure.md) is the surface they open into; [historical workspace file links](../../archived/feature/2026-07-31-web-workspace-file-links.md) is where serving files over HTTP was rejected. Anyone extending this system reaches the same five methods through `remote.workspaceFiles` and the same `file` resource through `useResource<'file'>`; the wire types are published as `@deepseek-ai/dsh-api-workspace-files/types`. The [workspace file read authority](2026-09-09-workspace-file-read-authority.md) owns Host read access and the HTML security trade-off; [Document Preview](2026-09-08-document-preview-operations.md) owns content loading and per-tab freshness.
## Alternatives considered
**Keeping the workspace file endpoint on the Session Controller.** The first form: one `read` under a total byte cap, registered as a sub-plugin of the Session Controller because that is where the wire entry already was. Rejected because a Workspace File service is its own capability — reading and statting files plus listing and observing the workspace — and those queries belong together, while the Session Controller's concern is session lifecycle. The move also let the service grow to five methods without the Controller's file gaining a second purpose.
-**A dual-face package with reverse UI dependencies.** The split-package choice followed two project-reference cycles after `api/remotes` referenced the Client leaf: the resource model imported Remote assembly for result types, and the file provider imported Sidebar UI for its parameter map. TypeScript rejected these cycles with `TS6202`. [dual-face packaging](2026-09-07-workspace-files-dual-face-package.md) supersedes that split: result types come directly from the protocol package, and Sidebar parameter registration belongs to the text preview; both root aggregates retain explicit compiler entries.
+**A dual-face package with reverse UI dependencies.** The split-package choice followed two project-reference cycles after `api/remotes` referenced the Client leaf: the resource model imported Remote assembly for result types, and the file provider imported Sidebar UI for its parameter map. TypeScript rejected these cycles with `TS6202`. [dual-face packaging](../../../../packages/api/workspace-files/README.md) supersedes that split: result types come directly from the protocol package, and Sidebar parameter registration belongs to the text preview; both root aggregates retain explicit compiler entries.
**Serving navigable workspace documents.** Rejected on origin grounds; the [binary transfer](2026-09-17-workspace-file-binary-transfer.md) returns multipart data while HTML remains isolated in a Blob iframe.
diff --git a/.agents/notes/implemented/architecture/2026-09-05-workspace-files-service.zh.md b/.agents/notes/implemented/architecture/2026-09-05-workspace-files-service.zh.md
index fe1dd00000..60b9597225 100644
--- a/.agents/notes/implemented/architecture/2026-09-05-workspace-files-service.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-05-workspace-files-service.zh.md
@@ -12,11 +12,11 @@ Web 客户端需要从一个未必在 Host 机器上的浏览器查看会话工
## Decision
-`packages/api/workspace-files`（`@deepseek-ai/dsh-api-workspace-files`）同时拥有 Host 服务 `ctx.workspaceFiles`、`workspaceFiles` Remote 命名空间，以及将 `stat` 与 `changes` 转成[资源模型](2026-09-05-client-resource-model.zh.md)实时元数据的 Client `file` 提供者；包组织方式由[双面包组织](2026-09-07-workspace-files-dual-face-package.zh.md)规定。文件方法从工作区根解析相对路径，但继承 Session 文件系统后端的读取权限；`list` 与 `changes` 仍限于工作区。[工作区文件读取权限](2026-09-09-workspace-file-read-authority.zh.md)拥有这一分层及其安全后果。结果以文件在文件系统执行环境中的绝对路径命名文件，内容则受页、字节窗口或整文件上限约束。字节窗口依托 `dsh-fs` 新增的 seam `FileSystem.readByteRange`，由每个提供者实现。Session Controller 不再携带任何工作区文件代码。
+`packages/api/workspace-files`（`@deepseek-ai/dsh-api-workspace-files`）同时拥有 Host 服务 `ctx.workspaceFiles`、`workspaceFiles` Remote 命名空间，以及将 `stat` 与 `changes` 转成[资源模型](2026-09-05-client-resource-model.zh.md)实时元数据的 Client `file` 提供者；包组织方式由[双面包组织](../../../../packages/api/workspace-files/README.zh.md)规定。文件方法从工作区根解析相对路径，但继承 Session 文件系统后端的读取权限；`list` 与 `changes` 仍限于工作区。[工作区文件读取权限](2026-09-09-workspace-file-read-authority.zh.md)拥有这一分层及其安全后果。结果以文件在文件系统执行环境中的绝对路径命名文件，内容则受页、字节窗口或整文件上限约束。字节窗口依托 `dsh-fs` 新增的 seam `FileSystem.readByteRange`，由每个提供者实现。Session Controller 不再携带任何工作区文件代码。
### 包拓扑
-[双面包组织](2026-09-07-workspace-files-dual-face-package.zh.md)取代本记录中把 Host 与 Client 分成两个包的组织选择；这里的文件服务、分页和变更流约定保持不变。[工作区文件读取权限](2026-09-09-workspace-file-read-authority.zh.md)取代文件方法原有的工作区包含选择。Host 与 Client 分别编译在两个叶配置中，共享线路类型，Client 不导入 Host 运行时入口。
+[双面包组织](../../../../packages/api/workspace-files/README.zh.md)取代本记录中把 Host 与 Client 分成两个包的组织选择；这里的文件服务、分页和变更流约定保持不变。[工作区文件读取权限](2026-09-09-workspace-file-read-authority.zh.md)取代文件方法原有的工作区包含选择。Host 与 Client 分别编译在两个叶配置中，共享线路类型，Client 不导入 Host 运行时入口。
| 面 | 包 | 文件 | 依赖 |
|---|---|---|---|
@@ -41,7 +41,7 @@ Web 客户端需要从一个未必在 Host 机器上的浏览器查看会话工
- **`read`** 返回一个行窗口 `WorkspaceFileText = WorkspaceFileStat & { offset, text, lines, eof }`；`lines` 计页内行数，使只含一个空行的页（`text: ''`、`lines: 1`）与越过文件末尾的页（`lines: 0`）可区分。`range.offset` 是 1 起算的首行，缺省 1；`range.limit` 是最多行数，缺省 `maxLines` 且不得超过。行以 `\n` 结束，末尾的 `\n` 终止最后一行而不是开启一空行；`text` 以 `\n` 连接本页各行且不带终止符；页含最后一行时 `eof` 为 true，越过末尾的 offset 返回 `eof` 为 true 的空页。切页器沿 `streamText` 前进，数过窗口前的行而不保留，把每个窗内片段先按 `maxBytes` 核准再缓冲，并在越过窗口的第一个字符处返回，因此任意大小的文件只花一页内存。页上的 `version` 与 `bytes` 来自流之前的那次 stat。
- **`readBytes`** 返回原生字节、文件元数据、偏移量和 EOF。必填选项对象未传 `range` 时，在 `maxFileBytes` 上限内完整读取；传入时，在 `maxBytes` 上限内读取有界窗口。`range: {}` 使用零偏移和配置的窗口上限；窗口可读取超过完整文件上限的文件。[二进制传输决议](2026-09-17-workspace-file-binary-transfer.zh.md)负责 Remote 响应编码。
- **`baseFile`** 独立于 `range` 选择目标解析方式：目标 `path` 必须为相对路径，从基准文件所在目录解析。Host 对两个文件执行普通文件检查，并保留后端读取权限。[Document Preview](2026-09-08-document-preview-operations.zh.md)负责内容加载与地址语义。
-- **`list`** 返回 `WorkspaceDirectoryListing { path, entries, truncated }`：被列目录相对根的工作区路径（根为空串）、其直接子项按后端的稳定名序以 `{ name, type, size? }` 给出，以及 `maxEntries` 是否截断了列表。`type` 为 `file`、`directory` 或 `other`；符号链接子项报告其指向目标的类型，悬空者为 `other`。列表报告为目录的子项经其解析目标打开，Windows 目录联接亦然，此时列表以该目标命名；[目录链接列举](../bug-fix/2026-09-18-windows-directory-junction-listing.zh.md)拥有该规则。dotfile 照常列出，不做任何过滤。
+- **`list`** 返回 `WorkspaceDirectoryListing { path, entries, truncated }`：被列目录相对根的工作区路径（根为空串）、其直接子项按后端的稳定名序以 `{ name, type, size? }` 给出，以及 `maxEntries` 是否截断了列表。`type` 为 `file`、`directory` 或 `other`；符号链接子项报告其指向目标的类型，悬空者为 `other`。列表报告为目录的子项经其解析目标打开，Windows 目录联接亦然，此时列表以该目标命名；[目录链接列举](../../../../packages/api/workspace-files/README.zh.md)拥有该规则。dotfile 照常列出，不做任何过滤。
- **`changes`** 产出 `WorkspaceFileWatchFrame`：在观察队列注册且工作区根解析完成后先发 `{ kind: 'ready' }`，随后为 `{ kind: 'change', change }`。载荷 `WorkspaceFileChange` 对存在的文件为 `{ absolutePath, version }`，对消失的文件为 `{ absolutePath, absent: true }`。来源是工作区根内的 `fs/observed`，不监视操作系统。首次拉取后的观察都会排队，包括根解析期间的观察；取消或插件释放会结束该代流。
### 线路上的路径
@@ -107,13 +107,13 @@ Client 导出向 `ctx.resources` 注册一个 `ResourceProvider<'file'>`，存
### 相关记录
-[资源模型](2026-09-05-client-resource-model.zh.md)拥有 `ctx.resources`、`useResource`、`dsh-resource:///…` 地址语法以及"每个地址一份资源"的推理；[文本预览与文件树](../feature/2026-09-05-sidebar-text-preview-and-file-tree.zh.md)是 `read`、`list` 与 `file` 提供者随包交付的消费方；[右侧 Sidebar 停靠基础设施](../feature/2026-09-04-right-sidebar-docking-infrastructure.zh.md)是它们打开进去的界面；[工作区文件链接](../feature/2026-07-31-web-workspace-file-links.zh.md)是经 HTTP 供文件被否决之处。任何在这套体系上扩展的人都经 `remote.workspaceFiles` 触达同样的五个方法、经 `useResource<'file'>` 触达同样的 `file` 资源；线路类型以 `@deepseek-ai/dsh-api-workspace-files/types` 发布。[工作区文件读取权限](2026-09-09-workspace-file-read-authority.zh.md)负责 Host 读取权限与 HTML 安全取舍；[Document Preview](2026-09-08-document-preview-operations.zh.md)负责内容加载和逐 tab 新鲜度。
+[资源模型](2026-09-05-client-resource-model.zh.md)拥有 `ctx.resources`、`useResource`、`dsh-resource:///…` 地址语法以及"每个地址一份资源"的推理；[文本预览与文件树](../../../../packages/client/ui-sidebar-documentpreview/README.zh.md)是 `read`、`list` 与 `file` 提供者随包交付的消费方；[右侧 Sidebar 停靠基础设施](../feature/2026-09-04-right-sidebar-docking-infrastructure.zh.md)是它们打开进去的界面；[历史工作区文件链接](../../archived/feature/2026-07-31-web-workspace-file-links.md)是经 HTTP 供文件被否决之处。任何在这套体系上扩展的人都经 `remote.workspaceFiles` 触达同样的五个方法、经 `useResource<'file'>` 触达同样的 `file` 资源；线路类型以 `@deepseek-ai/dsh-api-workspace-files/types` 发布。[工作区文件读取权限](2026-09-09-workspace-file-read-authority.zh.md)负责 Host 读取权限与 HTML 安全取舍；[Document Preview](2026-09-08-document-preview-operations.zh.md)负责内容加载和逐 tab 新鲜度。
## Alternatives considered
**把工作区文件端点留在 Session Controller 上。** 最初形态：总字节上限之下的一个 `read`，作为 Session Controller 的子插件注册，因为线路入口本来就在那里。被否，因为 Workspace File 服务是自己的能力——读取和 stat 文件，并列举和观察工作区——这些查询应归于一处，而 Session Controller 关心的是会话生命周期。搬出也让服务长到五个方法而不给 Controller 的文件添第二重目的。
-**带有反向 UI 依赖的双面包。** 拆包选择源于 `api/remotes` 引用 Client 叶子后形成的两条工程引用环：资源模型为了结果类型引用 Remote 装配，文件提供者为了 Sidebar 参数表引用右栏 UI。TypeScript 以 `TS6202` 拒绝这些环。[双面包组织](2026-09-07-workspace-files-dual-face-package.zh.md)取代拆包选择：结果类型直接取自协议包，Sidebar 参数注册移至文本预览；保留两个根聚合中的显式编译入口。
+**带有反向 UI 依赖的双面包。** 拆包选择源于 `api/remotes` 引用 Client 叶子后形成的两条工程引用环：资源模型为了结果类型引用 Remote 装配，文件提供者为了 Sidebar 参数表引用右栏 UI。TypeScript 以 `TS6202` 拒绝这些环。[双面包组织](../../../../packages/api/workspace-files/README.zh.md)取代拆包选择：结果类型直接取自协议包，Sidebar 参数注册移至文本预览；保留两个根聚合中的显式编译入口。
**提供可导航的工作区文档。** 因源隔离问题不采用；[二进制传输](2026-09-17-workspace-file-binary-transfer.zh.md)返回 multipart 数据，HTML 仍隔离在 Blob iframe 中。
diff --git a/.agents/notes/implemented/architecture/2026-09-06-embedded-stream-record-readers.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-06-embedded-stream-record-readers.i18n.yaml
deleted file mode 100644
index f95de9ad8f..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-06-embedded-stream-record-readers.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-06-embedded-stream-record-readers.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-06-embedded-stream-record-readers.md
-/agent-note-embedded-assistant-stream-consumers-read-compact-records:
- en: ddc3fed8aa76c1b8
- zh: 409dcb67ef28080e
-/agent-note-embedded-assistant-stream-consumers-read-compact-records/problem:
- en: 34ceceb99e246ae6
- zh: 0a18314b78557205
-/agent-note-embedded-assistant-stream-consumers-read-compact-records/decision:
- en: ad50509c41a7dacf
- zh: c8170641203a3184
-/agent-note-embedded-assistant-stream-consumers-read-compact-records/decision/measurements:
- en: 2eedf644fa07e35a
- zh: cb691c75fbeda518
-/agent-note-embedded-assistant-stream-consumers-read-compact-records/alternatives-considered:
- en: 66b6007d582f7521
- zh: a33aa19f7c912fa2
-/agent-note-embedded-assistant-stream-consumers-read-compact-records/consequences:
- en: 05cf037a97b4254d
- zh: 1a45fae2447678c2
diff --git a/.agents/notes/implemented/architecture/2026-09-07-sidebar-responsive-tab-info.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-07-sidebar-responsive-tab-info.i18n.yaml
deleted file mode 100644
index dd4a23fe04..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-07-sidebar-responsive-tab-info.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-07-sidebar-responsive-tab-info.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-07-sidebar-responsive-tab-info.md
-/agent-note-responsive-sidebar-and-injected-tab-information:
- en: 63ced560202cf1a3
- zh: 1ec49cd5ae68f909
-/agent-note-responsive-sidebar-and-injected-tab-information/problem:
- en: f9824b1d6f93d329
- zh: 36bc474f646a1a25
-/agent-note-responsive-sidebar-and-injected-tab-information/decision:
- en: 1a055f79cb0afcde
- zh: 78467751791d42d1
-/agent-note-responsive-sidebar-and-injected-tab-information/alternatives-considered:
- en: c05a3ca9a201f01a
- zh: b1b30e134a92c8ed
-/agent-note-responsive-sidebar-and-injected-tab-information/consequences:
- en: 852e827be572c626
- zh: 125ac90be15a5187
diff --git a/.agents/notes/implemented/architecture/2026-09-07-workspace-files-dual-face-package.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-07-workspace-files-dual-face-package.i18n.yaml
deleted file mode 100644
index 2d222100c4..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-07-workspace-files-dual-face-package.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-07-workspace-files-dual-face-package.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-07-workspace-files-dual-face-package.md
-/agent-note-workspace-files-as-one-dual-face-api-package:
- en: fee20bed1c4f69d2
- zh: 8897bf7430250d46
-/agent-note-workspace-files-as-one-dual-face-api-package/problem:
- en: 057ac188f6269740
- zh: 4ed1c2f6c3015efb
-/agent-note-workspace-files-as-one-dual-face-api-package/decision:
- en: 36fdbb0b44b1bb5e
- zh: 87a7a9b45231cf28
-/agent-note-workspace-files-as-one-dual-face-api-package/alternatives-considered:
- en: 45a93fced31f5980
- zh: 9283fbda48828416
-/agent-note-workspace-files-as-one-dual-face-api-package/consequences:
- en: d4558eea4ac3a00b
- zh: e625747fd469f146
-/agent-note-workspace-files-as-one-dual-face-api-package/verification:
- en: 4c49a2ec778623e8
- zh: 94eacb1ee8e4d36d
diff --git a/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.i18n.yaml
index 6e302c76a3..72e167ce59 100644
--- a/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.i18n.yaml
@@ -3,8 +3,8 @@
# After editing either side, bring the other along and re-record with:
# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.md
/agent-note-bundle-the-desktop-runtime-and-retain-external-plugins:
- en: f4c2a14c7f0dbd02
- zh: 5c9b9b68885f3ee0
+ en: 6a87387a952b6d28
+ zh: 5fd41d2dd5545637
/agent-note-bundle-the-desktop-runtime-and-retain-external-plugins/problem:
en: fe97fe6ba33cb23a
zh: c83a1f023c4e352d
@@ -15,11 +15,11 @@
en: 37cae6b28fd359ef
zh: 63118e361fa8f84c
/agent-note-bundle-the-desktop-runtime-and-retain-external-plugins/transactions-and-upgrades:
- en: 5bdc450be55832fb
- zh: 3312fc9e5497e139
+ en: 53d48f71fcc1c52e
+ zh: 7d61923484dbec1c
/agent-note-bundle-the-desktop-runtime-and-retain-external-plugins/alternatives-considered:
- en: 1558bba473382cbb
- zh: b6a6467866ee254d
+ en: ead5bbd94044c3de
+ zh: 057cf069413d2a49
/agent-note-bundle-the-desktop-runtime-and-retain-external-plugins/consequences:
en: 6dfa581ec6879c5b
zh: f6c735ad6a00b2b3
diff --git a/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.md b/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.md
index 61fa9eafb7..f8f6599fe6 100644
--- a/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.md
+++ b/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.md
@@ -6,7 +6,7 @@ English | [中文](2026-09-08-desktop-bundled-runtime-and-external-plugins.zh.md
Plugin management and native recovery follow the [shared Web wrapper decision](2026-09-10-desktop-web-wrapper.md).
-The [Electron runtime decision](2026-09-11-desktop-electron-node-runtime.md) supersedes the separate upstream Node executable; other decisions in this note remain applicable.
+Desktop uses Electron as its Node runtime under the [current runtime reference](../../../../apps/desktop/README.md); other decisions in this note remain applicable.
## Problem
@@ -44,11 +44,11 @@ The shared [plugin manager](../../../../packages/boot/plugin-manager/README.md)
The shared Web plugin manager owns package mutations and activation; Electron retains profile preparation and native recovery. The [Web wrapper decision](2026-09-10-desktop-web-wrapper.md) owns these responsibilities.
-The [immediate-window decision](2026-09-09-desktop-immediate-window-and-direct-start.md) owns direct Host startup. The native recovery dialog can disable third-party bundles and back up the profile patch when the Web application cannot start. Installed plugin files remain available for repair.
+The [immediate-window reference](../../../../apps/desktop/README.md) owns direct Host startup. The native recovery dialog can disable third-party bundles and back up the profile patch when the Web application cannot start. Installed plugin files remain available for repair.
## Alternatives considered
-Full runtime verification belongs to packaging. Startup reads the resource descriptor and checks shared package records and required Host entries. The [release-validation decision](2026-09-09-desktop-build-release-validation.md) assigns release and target compatibility checks to packaging. Startup neither enumerates nor hashes installed runtime files. Reading every file before backend loading adds I/O proportional to distribution size; unusable modules instead fail when loaded. Build-time verification rejects changed, missing, extra, or linked files against the recorded inventory.
+Full runtime verification belongs to packaging. Startup reads the resource descriptor and checks shared package records and required Host entries. The [release-validation reference](../../../../apps/desktop/README.md) assigns release and target compatibility checks to packaging. Startup neither enumerates nor hashes installed runtime files. Reading every file before backend loading adds I/O proportional to distribution size; unusable modules instead fail when loaded. Build-time verification rejects changed, missing, extra, or linked files against the recorded inventory.
- **Install the bundled offline seed at startup.** This preserves an ordinary pnpm installation procedure but repeats core extraction and installation on every affected machine. Materialized resources remove that work at the cost of more application files and release-builder responsibility.
- **Force host dependency versions into plugins.** This unnecessarily couples ordinary plugin dependencies to the host. The runtime resolution supplies missing packages while pnpm-owned entries retain independent versions.
diff --git a/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.zh.md b/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.zh.md
index 8d94d58235..6d14494858 100644
--- a/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.zh.md
@@ -6,7 +6,7 @@ Status: implemented
插件管理和原生恢复遵循[共享 Web 薄壳决策](2026-09-10-desktop-web-wrapper.zh.md)。
-[Electron 运行时决策](2026-09-11-desktop-electron-node-runtime.zh.md)替代独立上游 Node 可执行文件的选择；本文其他决策仍然适用。
+Desktop 按[当前运行时参考](../../../../apps/desktop/README.zh.md)使用 Electron 作为 Node 运行时；本文其他决策仍然适用。
## 问题
@@ -44,11 +44,11 @@ profile manifest 分别记录 pnpm 安装的依赖及已启用 bundle 列表。
共享 Web 插件管理器负责包变更和激活；Electron 保留 profile 准备和原生恢复。[Web 薄壳决策](2026-09-10-desktop-web-wrapper.zh.md)负责这些职责。
-[立即显示窗口决策](2026-09-09-desktop-immediate-window-and-direct-start.zh.md)负责直接启动 Host。Web 应用无法启动时，原生恢复对话框可禁用第三方 bundle 并备份 profile patch。已安装插件文件保留以供修复。
+[立即显示窗口参考](../../../../apps/desktop/README.zh.md)负责直接启动 Host。Web 应用无法启动时，原生恢复对话框可禁用第三方 bundle 并备份 profile patch。已安装插件文件保留以供修复。
## 考虑过的替代方案
-完整运行时验证属于打包流程。启动读取资源描述文件，并检查共享包记录及必要的 Host 入口。[发布验证决策](2026-09-09-desktop-build-release-validation.zh.md)将发布与目标兼容性检查交给打包流程。启动既不枚举已安装运行时文件，也不计算其哈希。后端加载前读取每个文件会增加与分发体积成正比的 I/O；不可用模块改由加载时失败暴露。构建时验证按记录清单拒绝内容变化、缺失、多余或链接文件。
+完整运行时验证属于打包流程。启动读取资源描述文件，并检查共享包记录及必要的 Host 入口。[发布验证参考](../../../../apps/desktop/README.zh.md)将发布与目标兼容性检查交给打包流程。启动既不枚举已安装运行时文件，也不计算其哈希。后端加载前读取每个文件会增加与分发体积成正比的 I/O；不可用模块改由加载时失败暴露。构建时验证按记录清单拒绝内容变化、缺失、多余或链接文件。
- **启动时安装内置离线 seed。** 这保留普通 pnpm 安装流程，但会在每台受影响机器上重复核心解压与安装。物化资源消除了这部分工作，代价是更多应用文件和发布构建器责任。
- **强制插件使用 Host 依赖版本。** 这会让普通插件依赖不必要地耦合于 Host。runtime resolution 提供缺失的包，pnpm 拥有的条目保留独立版本。
diff --git a/.agents/notes/implemented/architecture/2026-09-08-desktop-welcome-window-material.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-08-desktop-welcome-window-material.i18n.yaml
index 9de126a4e4..98414d1dd2 100644
--- a/.agents/notes/implemented/architecture/2026-09-08-desktop-welcome-window-material.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-08-desktop-welcome-window-material.i18n.yaml
@@ -9,8 +9,8 @@
en: 8578b584bda3abdc
zh: 85dcf44aab2cfd51
/agent-note-desktop-welcome-window-material/decision:
- en: df7f9dc0c48769ab
- zh: 5e667c736dd58a1c
+ en: 1affa7f1fccc945f
+ zh: e5aea959e7886a59
/agent-note-desktop-welcome-window-material/alternatives-considered:
en: cf42e200b1d0f00a
zh: de96b5647f5ffb23
diff --git a/.agents/notes/implemented/architecture/2026-09-08-desktop-welcome-window-material.md b/.agents/notes/implemented/architecture/2026-09-08-desktop-welcome-window-material.md
index e3961481f8..e285a57699 100644
--- a/.agents/notes/implemented/architecture/2026-09-08-desktop-welcome-window-material.md
+++ b/.agents/notes/implemented/architecture/2026-09-08-desktop-welcome-window-material.md
@@ -12,7 +12,7 @@ The desktop welcome design blurs the desktop behind its entire window. Chromium
The [Electron welcome window](../../../../apps/desktop/src/welcome-window.ts) owns native material and window controls. Its independently bundled React renderer supplies the entry, account sign-in states and API-key form. It shares the `StateDot` loading component with the Web UI without booting the Web plugin graph. The Desktop build emits local JavaScript and CSS under `lib/welcome`, included in packaged applications; the document keeps its network-denying content security policy. A narrow preload supplies typed shell copy, a write-only key operation, and a skip operation; IPC rejects other windows and subframes. Each sandboxed preload is bundled independently because Electron’s restricted require cannot load sibling chunks. The Electron main process authenticates through the shared Web launch URL and resolves the official provider's reference through the existing settings and credential RPC methods. The [thin Web wrapper](2026-09-10-desktop-web-wrapper.md) owns the HTTP server; onboarding adds no Host endpoint or child IPC operation. Responses contain metadata or a safe outcome, never a key or private provider diagnostics.
-Cold startup opens the entry when neither an account credential nor a model API key is configured. Saving enters the workspace after persistence succeeds; skipping enters without saving a draft or a credential-entry completion flag. The next process launch checks credentials again. The Desktop preload marker suppresses the automatic Web credential step and welcome notice; settings and explicit API-key editing remain available. The [Desktop onboarding decision](../feature/2026-09-16-desktop-onboarding.md) owns the separate device-local introduction after account login. Other native shells can disable only the credential step through the Models Host plugin's `credentialOnboarding` page-injection value. The module graph carries package identities rather than arbitrary Host config, so a Host row alone does not configure its Client half. The [account provider](2026-09-14-deepseek-account-login.md) supplies login and sign-out state while preserving independently stored API keys.
+Cold startup opens the entry when neither an account credential nor a model API key is configured. Saving enters the workspace after persistence succeeds; skipping enters without saving a draft or a credential-entry completion flag. The next process launch checks credentials again. The Desktop preload marker suppresses the automatic Web credential step and welcome notice; settings and explicit API-key editing remain available. The [Desktop onboarding reference](../../../../packages/client/ui-settings-account/README.md) owns the separate device-local introduction after account login. Other native shells can disable only the credential step through the Models Host plugin's `credentialOnboarding` page-injection value. The module graph carries package identities rather than arbitrary Host config, so a Host row alone does not configure its Client half. The [account provider](2026-09-14-deepseek-account-login.md) supplies login and sign-out state while preserving independently stored API keys.
The generated project follows declared workspace dependencies because pnpm’s hoist index alone can omit configured plugins.
diff --git a/.agents/notes/implemented/architecture/2026-09-08-desktop-welcome-window-material.zh.md b/.agents/notes/implemented/architecture/2026-09-08-desktop-welcome-window-material.zh.md
index 17504368e8..e708b53447 100644
--- a/.agents/notes/implemented/architecture/2026-09-08-desktop-welcome-window-material.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-08-desktop-welcome-window-material.zh.md
@@ -12,7 +12,7 @@ Status: implemented
[Electron 欢迎窗口](../../../../apps/desktop/src/welcome-window.ts)负责原生材质和窗口控件。独立打包的 React 渲染器提供入口、账号登录状态和 API Key 表单。它与 Web UI 共用 `StateDot` 加载组件，不启动 Web 插件图。Desktop 构建将本地 JavaScript 和 CSS 输出到 `lib/welcome`，并纳入应用安装包；文档继续使用禁止网络访问的内容安全策略。窄接口 preload 提供强类型桌面文案、仅写密钥操作和跳过操作；IPC 拒绝其他窗口和子 frame。每个沙箱 preload 都独立打包，因为 Electron 受限的 require 无法加载同目录中的拆分模块。Electron 主进程通过共享 Web 启动 URL 认证，并通过现有设置和凭证 RPC 方法解析官方提供方的引用。[Web 薄壳](2026-09-10-desktop-web-wrapper.zh.md)负责 HTTP 服务；引导不增加 Host 端点或子进程 IPC 操作。响应只包含元数据或安全结果，不包含密钥或提供方的私有诊断。
-冷启动在账号凭证与模型 API Key 均未配置时打开入口。保存会在持久化成功后进入工作区；跳过会直接进入，不保存草稿或凭证入口完成标记。下次进程启动时会重新检查凭证。Desktop preload 标记抑制自动 Web 凭证步骤和欢迎须知；设置与显式 API Key 编辑仍然可用。[Desktop 引导决策](../feature/2026-09-16-desktop-onboarding.zh.md)负责账号登录后独立的设备本地介绍流程。其他原生壳可以通过 Models Host 插件注入页面的 `credentialOnboarding` 值仅禁用凭证步骤。模块图传递的是包标识，而不是任意 Host 配置，因此单独配置 Host 行不会配置其 Client 半部。[账号提供方](2026-09-14-deepseek-account-login.zh.md)提供登录与退出登录状态，同时保留独立存储的 API Key。
+冷启动在账号凭证与模型 API Key 均未配置时打开入口。保存会在持久化成功后进入工作区；跳过会直接进入，不保存草稿或凭证入口完成标记。下次进程启动时会重新检查凭证。Desktop preload 标记抑制自动 Web 凭证步骤和欢迎须知；设置与显式 API Key 编辑仍然可用。[Desktop 引导参考](../../../../packages/client/ui-settings-account/README.zh.md)负责账号登录后独立的设备本地介绍流程。其他原生壳可以通过 Models Host 插件注入页面的 `credentialOnboarding` 值仅禁用凭证步骤。模块图传递的是包标识，而不是任意 Host 配置，因此单独配置 Host 行不会配置其 Client 半部。[账号提供方](2026-09-14-deepseek-account-login.zh.md)提供登录与退出登录状态，同时保留独立存储的 API Key。
生成的开发项目沿已声明的 workspace 依赖建立链接，因为单独依赖 pnpm 的提升索引会漏掉配置插件。
diff --git a/.agents/notes/implemented/architecture/2026-09-08-document-preview-operations.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-08-document-preview-operations.i18n.yaml
index ec7374517f..064ed4f762 100644
--- a/.agents/notes/implemented/architecture/2026-09-08-document-preview-operations.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-08-document-preview-operations.i18n.yaml
@@ -9,8 +9,8 @@
en: a35075e6babe3f7a
zh: 3a64ac57761e1009
/agent-note-document-preview-and-file-addresses/decision:
- en: d0a2923efefbcfe1
- zh: 34f71d092c0e706b
+ en: 75b40970e401f2e3
+ zh: 970b2cc044ea17f4
/agent-note-document-preview-and-file-addresses/alternatives-considered:
en: 8e9616e954df488c
zh: 10801341ec53bbe8
diff --git a/.agents/notes/implemented/architecture/2026-09-08-document-preview-operations.md b/.agents/notes/implemented/architecture/2026-09-08-document-preview-operations.md
index 220db6db04..55845a7718 100644
--- a/.agents/notes/implemented/architecture/2026-09-08-document-preview-operations.md
+++ b/.agents/notes/implemented/architecture/2026-09-08-document-preview-operations.md
@@ -16,9 +16,9 @@ Document Preview separates resource observation from content reads. The [resourc
Readable files use `dsh-resource://file/session//`. The path may be workspace-relative or absolute; an encoded absolute path retains its leading slash. `fileAddressFor` always emits this Session-address form. The provider and Preview RPC take the Session only from that address, never from the current selection, first holder, or owning tab. A Session-less `absolute` URI cannot be read; the provider reports `workspace-file/unknown-workspace`. Session authorization is a file-protocol rule, not an additional Resource identity.
-[Document Preview](../../../../packages/client/ui-sidebar-documentpreview/README.md) owns format selection and loading policy. Metadata registers with `ctx.documentPreviews`; components register separately into the keyed `sidebar.right.tab.document` Slot. Extension registrations precede builtins, then longer suffixes and registration order decide. The toolbar lists supported alternatives and remembers a manual choice per tab. Plain text remains available for unknown extensions and text-compatible renderers. Registered binary suffixes determine text compatibility independently of loading mode; HTML and SVG remain outside those suffixes and retain source viewing. A single candidate renders no viewer control. Registered binary suffixes omit plain text; known binary suffixes without a renderer show an unsupported state without reading the file ([sidebar preview polish](../feature/2026-09-11-sidebar-document-preview-polish.md)). The child receives accumulated text or complete native bytes, the original resource address, and the standard `useResource` and `useTabInfo` hooks. Preview calls `ctx.remote.workspaceFiles.read` for text and `ctx.remote.workspaceFiles.readBytes` for native bytes, with `baseFile` for related resources. Refresh remains per tab, with no resource reload, shared `changed` acknowledgement, extra resource wrapper, or content Session.
+[Document Preview](../../../../packages/client/ui-sidebar-documentpreview/README.md) owns format selection and loading policy. Metadata registers with `ctx.documentPreviews`; components register separately into the keyed `sidebar.right.tab.document` Slot. Extension registrations precede builtins, then longer suffixes and registration order decide. The toolbar lists supported alternatives and remembers a manual choice per tab. Plain text remains available for unknown extensions and text-compatible renderers. Registered binary suffixes determine text compatibility independently of loading mode; HTML and SVG remain outside those suffixes and retain source viewing. A single candidate renders no viewer control. Registered binary suffixes omit plain text; known binary suffixes without a renderer show an unsupported state without reading the file ([sidebar preview polish](../../../../packages/client/ui-sidebar-documentpreview/README.md)). The child receives accumulated text or complete native bytes, the original resource address, and the standard `useResource` and `useTabInfo` hooks. Preview calls `ctx.remote.workspaceFiles.read` for text and `ctx.remote.workspaceFiles.readBytes` for native bytes, with `baseFile` for related resources. Refresh remains per tab, with no resource reload, shared `changed` acknowledgement, extra resource wrapper, or content Session.
-Markdown and code reuse the incremental primitives with cumulative paged text. HTML, PDF, and images read complete `Uint8Array` data; Host transport uses the [binary workspace file transfer](2026-09-17-workspace-file-binary-transfer.md). Published buffers are borrowed read-only and never persist into layout or Session JSON. PDF.js runs in an owned Worker with version-matched bundled font and decoder data, and copies input before transfer to preserve Preview's retained buffer. With [Developer tools](../feature/2026-09-17-developer-tools-settings.md) enabled, HTML runs in a Blob iframe with `sandbox="allow-scripts"`, without same-origin, popup, form, download, or top-navigation privileges. The browser retains its normal external-network rules. Bounded static local JS/CSS reads stay in the parent; the opaque frame creates its own asset Blobs, because it cannot load parent-origin Blobs. PNG, JPEG, GIF, WebP, BMP, ICO, and SVG use image-specific Blob URLs in an `![]()
` static-image context. An image wider than the pane scales down to its width at its aspect ratio; a smaller image keeps its intrinsic CSS-pixel dimensions centred by auto margins, and a taller image extends the shared scroller's vertical range ([sidebar preview polish](../feature/2026-09-11-sidebar-document-preview-polish.md)). The renderer provides no zoom or drag-to-pan. SVG markup never enters the application DOM or an iframe, so scripts remain inert and cannot reach the parent page. Replacing HTML or an image revokes its root Blob URL.
+Markdown and code reuse the incremental primitives with cumulative paged text. HTML, PDF, and images read complete `Uint8Array` data; Host transport uses the [binary workspace file transfer](2026-09-17-workspace-file-binary-transfer.md). Published buffers are borrowed read-only and never persist into layout or Session JSON. PDF.js runs in an owned Worker with version-matched bundled font and decoder data, and copies input before transfer to preserve Preview's retained buffer. With [Developer tools](../../../../packages/client/ui-sidebar-documentpreview/README.md) enabled, HTML runs in a Blob iframe with `sandbox="allow-scripts"`, without same-origin, popup, form, download, or top-navigation privileges. The browser retains its normal external-network rules. Bounded static local JS/CSS reads stay in the parent; the opaque frame creates its own asset Blobs, because it cannot load parent-origin Blobs. PNG, JPEG, GIF, WebP, BMP, ICO, and SVG use image-specific Blob URLs in an `![]()
` static-image context. An image wider than the pane scales down to its width at its aspect ratio; a smaller image keeps its intrinsic CSS-pixel dimensions centred by auto margins, and a taller image extends the shared scroller's vertical range ([sidebar preview polish](../../../../packages/client/ui-sidebar-documentpreview/README.md)). The renderer provides no zoom or drag-to-pan. SVG markup never enters the application DOM or an iframe, so scripts remain inert and cannot reach the parent page. Replacing HTML or an image revokes its root Blob URL.
PDF.js's official TextLayerBuilder owns selection boundaries and copy normalization over the width-fitted canvas, with shared page cleanup and a component-owned resize observer. Responsive sizing uses the CSS `scale` property independently of PDF.js's page rotation and translation transforms. Its end-of-content marker and stacking rules constrain selection in blank regions; line-break highlighting is suppressed. Per-page cancellation uses the builder's cleanup rather than aborting the first page's signal, because the official selection listeners are shared across pages.
diff --git a/.agents/notes/implemented/architecture/2026-09-08-document-preview-operations.zh.md b/.agents/notes/implemented/architecture/2026-09-08-document-preview-operations.zh.md
index 7b838711e5..2945cc823d 100644
--- a/.agents/notes/implemented/architecture/2026-09-08-document-preview-operations.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-08-document-preview-operations.zh.md
@@ -16,9 +16,9 @@ Document Preview 将资源观察与内容读取分开。[资源模型](2026-09-0
可读取的文件使用 `dsh-resource://file/session//`。路径可以相对工作区，也可以是绝对路径；编码后的绝对路径保留前导斜杠。`fileAddressFor` 始终生成这种 Session 地址。提供方与 Preview RPC 只从该地址取 Session，不取当前选择、首个持有者或 tab 所属 Session。不带 Session 的 `absolute` URI 无法读取；提供方报告 `workspace-file/unknown-workspace`。Session 授权是文件协议规则，不是额外的 Resource 身份。
-[Document Preview](../../../../packages/client/ui-sidebar-documentpreview/README.zh.md) 负责格式选择和加载策略。元数据通过 `ctx.documentPreviews` 注册；组件单独注册到 keyed `sidebar.right.tab.document` Slot。扩展注册优先于内置注册，其次比较后缀长度和注册顺序。工具栏列出受支持的候选，按 tab 记住手动选择。未知扩展名及文本兼容的渲染器仍可使用纯文本。文本兼容性由注册的二进制后缀决定，与加载方式无关；HTML 和 SVG 不属于二进制后缀，保留源码查看。只有一个候选时不显示查看器控件。注册声明为二进制的后缀不提供纯文本；已知二进制后缀没有注册渲染器时不发起读取，并显示不支持预览的空态（[侧边栏预览打磨](../feature/2026-09-11-sidebar-document-preview-polish.zh.md)）。子组件收到累积文本或完整原生字节、原始资源地址，以及标准 `useResource` 和 `useTabInfo` 钩子。Preview 通过 `ctx.remote.workspaceFiles.read` 读取文本，通过 `ctx.remote.workspaceFiles.readBytes` 读取原生字节，关联资源使用 `baseFile`。刷新仍按 tab 独立进行，不引入资源 reload、共享 `changed` 确认、额外资源包装层或内容 Session。
+[Document Preview](../../../../packages/client/ui-sidebar-documentpreview/README.zh.md) 负责格式选择和加载策略。元数据通过 `ctx.documentPreviews` 注册；组件单独注册到 keyed `sidebar.right.tab.document` Slot。扩展注册优先于内置注册，其次比较后缀长度和注册顺序。工具栏列出受支持的候选，按 tab 记住手动选择。未知扩展名及文本兼容的渲染器仍可使用纯文本。文本兼容性由注册的二进制后缀决定，与加载方式无关；HTML 和 SVG 不属于二进制后缀，保留源码查看。只有一个候选时不显示查看器控件。注册声明为二进制的后缀不提供纯文本；已知二进制后缀没有注册渲染器时不发起读取，并显示不支持预览的空态（[侧边栏预览打磨](../../../../packages/client/ui-sidebar-documentpreview/README.zh.md)）。子组件收到累积文本或完整原生字节、原始资源地址，以及标准 `useResource` 和 `useTabInfo` 钩子。Preview 通过 `ctx.remote.workspaceFiles.read` 读取文本，通过 `ctx.remote.workspaceFiles.readBytes` 读取原生字节，关联资源使用 `baseFile`。刷新仍按 tab 独立进行，不引入资源 reload、共享 `changed` 确认、额外资源包装层或内容 Session。
-Markdown 和代码通过累积的分页文本复用增量渲染原语。HTML、PDF 和图片读取完整 `Uint8Array` 数据；Host 传输使用[工作区文件二进制传输](2026-09-17-workspace-file-binary-transfer.zh.md)。发布后的缓冲区只读借用，绝不持久化进布局或 Session JSON。PDF.js 在自有 Worker 中运行，字体和解码数据以相同版本随包发布，转移输入前先复制，以保留 Preview 的缓冲区。开启[开发者工具](../feature/2026-09-17-developer-tools-settings.zh.md)时，HTML 在 Blob iframe 中运行，设置 `sandbox="allow-scripts"`，不授予同源、弹窗、表单、下载或顶层导航权限。浏览器保持正常的外部网络规则。有上限的静态本地 JS/CSS 读取由父页面负责；不透明源 iframe 创建自己的资源 Blob，因为它不能加载父源创建的 Blob。PNG、JPEG、GIF、WebP、BMP、ICO 和 SVG 使用图片专用 Blob URL，在 `![]()
` 静态图片上下文中渲染。比面板宽的图片按纵横比缩小到面板宽度；较小的图片保留固有 CSS 像素尺寸并由 auto margin 居中，较高的图片扩展共享滚动区的纵向范围（[侧边栏预览打磨](../feature/2026-09-11-sidebar-document-preview-polish.zh.md)）。渲染器不提供缩放或拖拽平移。SVG 标记绝不进入应用 DOM 或 iframe，因此脚本保持不可执行，也无法访问父页面。替换 HTML 或图片时会撤销其根 Blob URL。
+Markdown 和代码通过累积的分页文本复用增量渲染原语。HTML、PDF 和图片读取完整 `Uint8Array` 数据；Host 传输使用[工作区文件二进制传输](2026-09-17-workspace-file-binary-transfer.zh.md)。发布后的缓冲区只读借用，绝不持久化进布局或 Session JSON。PDF.js 在自有 Worker 中运行，字体和解码数据以相同版本随包发布，转移输入前先复制，以保留 Preview 的缓冲区。开启[开发者工具](../../../../packages/client/ui-sidebar-documentpreview/README.zh.md)时，HTML 在 Blob iframe 中运行，设置 `sandbox="allow-scripts"`，不授予同源、弹窗、表单、下载或顶层导航权限。浏览器保持正常的外部网络规则。有上限的静态本地 JS/CSS 读取由父页面负责；不透明源 iframe 创建自己的资源 Blob，因为它不能加载父源创建的 Blob。PNG、JPEG、GIF、WebP、BMP、ICO 和 SVG 使用图片专用 Blob URL，在 `![]()
` 静态图片上下文中渲染。比面板宽的图片按纵横比缩小到面板宽度；较小的图片保留固有 CSS 像素尺寸并由 auto margin 居中，较高的图片扩展共享滚动区的纵向范围（[侧边栏预览打磨](../../../../packages/client/ui-sidebar-documentpreview/README.zh.md)）。渲染器不提供缩放或拖拽平移。SVG 标记绝不进入应用 DOM 或 iframe，因此脚本保持不可执行，也无法访问父页面。替换 HTML 或图片时会撤销其根 Blob URL。
PDF.js 官方 TextLayerBuilder 在适配宽度的 canvas 上负责选择边界和复制规范化，共享页面清理，并使用由组件拥有的 resize observer。响应式尺寸适配使用独立的 CSS `scale` 属性，与 PDF.js 的页面旋转和平移变换组合。其内容结束标记和堆叠规则限制空白区域中的选择；换行高亮被抑制。逐页取消使用 builder 的清理操作，而不 abort 第一页的信号，因为官方选择监听器跨页面共享。
diff --git a/.agents/notes/implemented/architecture/2026-09-08-global-main-panels.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-08-global-main-panels.i18n.yaml
deleted file mode 100644
index d16bba3786..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-08-global-main-panels.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-08-global-main-panels.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-08-global-main-panels.md
-/agent-note-global-main-panels-without-default-ui-additions:
- en: df950323f9032f3b
- zh: d08172be0c9ca71c
-/agent-note-global-main-panels-without-default-ui-additions/problem:
- en: da6aa479acac3baf
- zh: ed6316ea9953ff99
-/agent-note-global-main-panels-without-default-ui-additions/decision:
- en: e732d64ac12c0ac5
- zh: e8ff462ae93bf259
-/agent-note-global-main-panels-without-default-ui-additions/alternatives-considered:
- en: 18c8461d961490ee
- zh: a26b37ff3aa15bbc
-/agent-note-global-main-panels-without-default-ui-additions/consequences:
- en: 31db82c87448a292
- zh: 1923a60d2f0845f9
diff --git a/.agents/notes/implemented/architecture/2026-09-09-awaited-agent-creation.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-09-awaited-agent-creation.i18n.yaml
index a8255aa82a..47d3a65a12 100644
--- a/.agents/notes/implemented/architecture/2026-09-09-awaited-agent-creation.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-09-awaited-agent-creation.i18n.yaml
@@ -9,8 +9,8 @@
en: 03e6b75365b29406
zh: cc880a33cf2303d0
/agent-note-awaited-per-agent-initialization/decision:
- en: f1db71d1fdb4388e
- zh: 6c5a43a770f4cffd
+ en: 48cdb570d3feb222
+ zh: 904a1169540e3111
/agent-note-awaited-per-agent-initialization/alternatives-considered:
en: 466a9ebbb13f68c6
zh: ab88fb34786d2c2b
diff --git a/.agents/notes/implemented/architecture/2026-09-09-awaited-agent-creation.md b/.agents/notes/implemented/architecture/2026-09-09-awaited-agent-creation.md
index 27353225a8..40dcec53a8 100644
--- a/.agents/notes/implemented/architecture/2026-09-09-awaited-agent-creation.md
+++ b/.agents/notes/implemented/architecture/2026-09-09-awaited-agent-creation.md
@@ -16,7 +16,7 @@ AgentLoop holds its existing maintenance activity through setup and creation dis
Creation dispatch retains the scope and Session while listeners await. Disposal cancels initialization and joins the dispatch before releasing those resources. A listener must not await its own Agent's idle state or its owner's disposal, because each waits for that listener to finish. Background work on another Agent follows that Agent's own initialization lifecycle.
-This decision owns asynchronous creation timing. The [scope runtime decision](2026-07-12-agent-scope-runtime-design.md) retains registry identity and teardown ownership, while the [interception decision](../feature/2026-06-30-interception-extension-points.md) retains policy and tool-event semantics.
+This decision owns asynchronous creation timing. The [scope runtime reference](../../../../packages/core/agent-loop/README.md) retains registry identity and teardown ownership, while the [interception reference](../../../../docs/tool-execution-pipeline.md) retains policy and tool-event semantics.
## Alternatives considered
diff --git a/.agents/notes/implemented/architecture/2026-09-09-awaited-agent-creation.zh.md b/.agents/notes/implemented/architecture/2026-09-09-awaited-agent-creation.zh.md
index f664e89da0..43b0bfa7d1 100644
--- a/.agents/notes/implemented/architecture/2026-09-09-awaited-agent-creation.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-09-awaited-agent-creation.zh.md
@@ -16,7 +16,7 @@ AgentLoop 在 setup 与创建分发期间保留现有的维护活动。初始化
创建分发在监听器等待期间保留作用域与 Session。Dispose（资源释放）会取消初始化，并在释放这些资源前等待分发结束。监听器不得等待自身 Agent 的空闲状态或自身所有者的 dispose，因为两者都要等待该监听器完成。另一个 Agent 上的后台工作遵循该 Agent 自己的初始化生命周期。
-本决策拥有异步创建时序。[作用域运行时决策](2026-07-12-agent-scope-runtime-design.zh.md)继续拥有注册表身份与 teardown 归属，[拦截决策](../feature/2026-06-30-interception-extension-points.zh.md)继续拥有策略与工具事件语义。
+本决策拥有异步创建时序。[作用域运行时参考](../../../../packages/core/agent-loop/README.zh.md)继续拥有注册表身份与 teardown 归属，[拦截参考](../../../../docs/tool-execution-pipeline.zh.md)继续拥有策略与工具事件语义。
## 考虑过的替代方案
diff --git a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml
index 51149ea2fb..f7082b3940 100644
--- a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml
@@ -9,8 +9,8 @@
en: 4548e7fbdbee5b5a
zh: 0078762ea92fa180
/agent-note-consumer-owned-startup-strictness/decision:
- en: eb2b83f5f65c6b6a
- zh: b85a9aa4645c9a20
+ en: 1f11e04162e19ad1
+ zh: d102e300eba9a2ea
/agent-note-consumer-owned-startup-strictness/alternatives-considered:
en: 1b67e062213184cd
zh: 91cc8a015de2bfe4
@@ -18,5 +18,5 @@
en: 283dec1b336c540d
zh: 2ed358079072cfff
/agent-note-consumer-owned-startup-strictness/testing:
- en: d8cafae30ea1347b
- zh: de47e4e7ba863261
+ en: c38221069ce98fd3
+ zh: 9a2f91f539eba4d4
diff --git a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md
index bbe975e13b..cf17823e72 100644
--- a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md
+++ b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md
@@ -18,7 +18,7 @@ The audit treats a throwing `disabled` expression as an entry failure, not a dis
The audit runs only during initial application boot. Later config HMR remains best effort and keeps the failed candidate visible for repair.
-This policy governs [Web host boot](2026-07-24-web-config-tree-boot-and-transport-layering.md), including its [client plugin roster](2026-07-23-client-plugin-loading-model.md). [Per-session presets](2026-09-18-declarative-agent-presets.md) own a separate strict subtree audit.
+This policy governs [Web host boot](../../../../packages/boot/app-boot/README.md), including its [client plugin roster](2026-07-23-client-plugin-loading-model.md). [Per-session presets](2026-09-18-declarative-agent-presets.md) own a separate strict subtree audit.
## Alternatives considered
@@ -36,6 +36,6 @@ The compact terminal report keeps the failing plugins visible; a separate file r
App-boot unit tests cover absent and disabled required ids, optional import failure, config evaluation failure, synchronous and asynchronous `apply()` failure, pending dependencies, and required failure teardown. Unit expectations pin diagnostic grouping, preservation of original error objects and import logs, exporter cleanup, complete diagnostic values, private file creation, concurrent report names, and failed-write fallback. The built Web-profile acceptance asserts a single port-conflict stack without Node wrapper output, verifies the saved diagnostic file and its stderr fallback, serves the full UI with optional failures and exits nonzero without readiness when the required HTTP port is occupied or `modules` or `connection` cannot activate.
-The [Web process matrix](../../../../apps/cli/tests/profiles/web/tests/web-failure-matrix.expected.e2e.ts) independently exercises optional and required failures at startup and after native patch-file edits. Authenticated HTTP requests and plugin lifecycle files distinguish a usable application from a surviving process. These keyless process checks complement the [controlled-delivery unit tests](../testing/2026-09-09-user-patch-hmr-test-delivery.md): unit tests isolate reconciliation failures, while the process tests also require the shipped launcher, native watcher, and bounded shutdown to work together.
+The [Web process matrix](../../../../apps/cli/tests/profiles/web/tests/web-failure-matrix.expected.e2e.ts) independently exercises optional and required failures at startup and after native patch-file edits. Authenticated HTTP requests and plugin lifecycle files distinguish a usable application from a surviving process. These keyless process checks complement the [controlled-delivery unit tests](../../../../packages/boot/app-boot/tests/user-patches.spec.ts): unit tests isolate reconciliation failures, while the process tests also require the shipped launcher, native watcher, and bounded shutdown to work together.
The matrix enables Chokidar's `awaitWriteFinish` to acknowledge stable file contents before each reload; otherwise its short change-event suppression window can discard the next test edit. Native events remain required, and assertions wait for observed activation or failure rather than a fixed settling sleep. This is explicit test configuration, not evidence for the default watcher timing.
diff --git a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md
index 4bd2bfe026..c8bda5cb20 100644
--- a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md
@@ -18,7 +18,7 @@ Required id 为 `agent-loop`、`webserver`、`modules`、`connection`、`headles
该审计只在应用首次启动时运行。之后的 config HMR 仍采用 best effort，并保留 failed candidate 供后续修复。
-该策略适用于 [Web host 启动](2026-07-24-web-config-tree-boot-and-transport-layering.zh.md)，包括其 [client 插件名册](2026-07-23-client-plugin-loading-model.zh.md)。[按会话的 preset](2026-09-18-declarative-agent-presets.zh.md)持有独立的严格子树审计。
+该策略适用于 [Web host 启动](../../../../packages/boot/app-boot/README.zh.md)，包括其 [client 插件名册](2026-07-23-client-plugin-loading-model.zh.md)。[按会话的 preset](2026-09-18-declarative-agent-presets.zh.md)持有独立的严格子树审计。
## 考虑过的替代方案
@@ -36,6 +36,6 @@ Required id 为 `agent-loop`、`webserver`、`modules`、`connection`、`headles
App-boot 单元测试覆盖缺失和禁用的 required id、optional import failure、config evaluation failure、同步和异步 `apply()` failure、pending dependency，以及 required failure teardown。单元预期输出固定诊断分组、原始错误对象与导入日志的保留、exporter 清理、完整诊断值、私有文件创建、并发报告命名以及写入失败回退行为。构建后的 Web-profile acceptance 断言端口冲突堆栈只输出一次且不包含 Node 包装输出，验证已保存的诊断文件及其 stderr 回退，并会在 optional failure 存在时继续提供完整 UI，并在 required HTTP port 被占用或 `modules`、`connection` 无法激活时以非零码退出，且不报告就绪。
-[Web 进程矩阵](../../../../apps/cli/tests/profiles/web/tests/web-failure-matrix.expected.e2e.ts)分别验证启动时和原生补丁文件修改后的 optional 与 required 失败。经过认证的 HTTP 请求和插件生命周期文件区分可用应用与仅存活的进程。这些无需密钥的进程检查与[受控事件投递单元测试](../testing/2026-09-09-user-patch-hmr-test-delivery.zh.md)互补：单元测试隔离配置协调失败，进程测试还要求随附启动器、原生监听器和有界关闭流程协同工作。
+[Web 进程矩阵](../../../../apps/cli/tests/profiles/web/tests/web-failure-matrix.expected.e2e.ts)分别验证启动时和原生补丁文件修改后的 optional 与 required 失败。经过认证的 HTTP 请求和插件生命周期文件区分可用应用与仅存活的进程。这些无需密钥的进程检查与[受控事件投递单元测试](../../../../packages/boot/app-boot/tests/user-patches.spec.ts)互补：单元测试隔离配置协调失败，进程测试还要求随附启动器、原生监听器和有界关闭流程协同工作。
矩阵启用 Chokidar 的 `awaitWriteFinish`，在每次重载前确认文件内容已稳定；否则它的短暂 change 事件抑制窗口可能丢弃下一次测试编辑。测试仍然依赖原生事件，并等待观察到激活或失败，而不是固定时长的休眠。这是显式测试配置，不能证明默认监听器的时序行为。
diff --git a/.agents/notes/implemented/architecture/2026-09-09-desktop-build-release-validation.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-09-desktop-build-release-validation.i18n.yaml
deleted file mode 100644
index 2516370b2e..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-09-desktop-build-release-validation.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-09-desktop-build-release-validation.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-09-desktop-build-release-validation.md
-/agent-note-verify-desktop-release-compatibility-during-packaging:
- en: 4183cb362d89a8fb
- zh: ede5e45ba6245b6b
-/agent-note-verify-desktop-release-compatibility-during-packaging/problem:
- en: ae3f1e31ba929c0e
- zh: 1a42684e41531547
-/agent-note-verify-desktop-release-compatibility-during-packaging/decision:
- en: 352372f213c43a76
- zh: 54dc9826254e56f2
-/agent-note-verify-desktop-release-compatibility-during-packaging/alternatives-considered:
- en: 515cec0d22c8373c
- zh: e3a5b3058b6316c2
-/agent-note-verify-desktop-release-compatibility-during-packaging/consequences:
- en: 5193e3ce82faa984
- zh: 1bd7a31152e3b71c
diff --git a/.agents/notes/implemented/architecture/2026-09-09-desktop-immediate-window-and-direct-start.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-09-desktop-immediate-window-and-direct-start.i18n.yaml
deleted file mode 100644
index ecc422ab61..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-09-desktop-immediate-window-and-direct-start.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-09-desktop-immediate-window-and-direct-start.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-09-desktop-immediate-window-and-direct-start.md
-/agent-note-show-the-desktop-window-before-starting-the-host:
- en: aed1efe0e21399a1
- zh: dd45a0ed4bfa731e
-/agent-note-show-the-desktop-window-before-starting-the-host/problem:
- en: bd8f14bc0beaac9e
- zh: 20b0521f27ad231f
-/agent-note-show-the-desktop-window-before-starting-the-host/decision:
- en: 6ac14061a85b3da6
- zh: ec35f11c15b34be8
-/agent-note-show-the-desktop-window-before-starting-the-host/alternatives-considered:
- en: 4d476b25f3647e1b
- zh: 4a1b0252005c8c22
-/agent-note-show-the-desktop-window-before-starting-the-host/consequences:
- en: 98119090f2133d33
- zh: 53ad4539d677ee4e
diff --git a/.agents/notes/implemented/architecture/2026-09-09-plugin-management-in-the-web-sidebar.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-09-plugin-management-in-the-web-sidebar.i18n.yaml
deleted file mode 100644
index 6c34e86274..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-09-plugin-management-in-the-web-sidebar.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-09-plugin-management-in-the-web-sidebar.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-09-plugin-management-in-the-web-sidebar.md
-/agent-note-plugin-management-moves-to-the-web-sidebar:
- en: efdb6c8f366dd2c2
- zh: 5c55e2882753d481
-/agent-note-plugin-management-moves-to-the-web-sidebar/problem:
- en: b0d11556425397b0
- zh: 00968088bec13102
-/agent-note-plugin-management-moves-to-the-web-sidebar/decision:
- en: eb93a33f64907b80
- zh: 4073f2da219ad798
-/agent-note-plugin-management-moves-to-the-web-sidebar/alternatives-considered:
- en: e5cea1a5e97884be
- zh: d5544ae935a48f0a
-/agent-note-plugin-management-moves-to-the-web-sidebar/consequences:
- en: 74c0051937f03444
- zh: 256b38ff34549a4d
-/agent-note-plugin-management-moves-to-the-web-sidebar/testing:
- en: 9d08eb02abc00595
- zh: 56c7d26016f9deec
diff --git a/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.i18n.yaml
index c1cc88bcdd..5cadfbef6f 100644
--- a/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.i18n.yaml
@@ -6,8 +6,8 @@
en: 6a4338564c01ad91
zh: 241248cff9bd4cfc
/agent-note-add-immutable-profile-resolution-generations/problem:
- en: 8e192c176fe48c4c
- zh: adb965d650088eb0
+ en: 907a40c722a6faff
+ zh: a471d7034d8c231f
/agent-note-add-immutable-profile-resolution-generations/decision:
en: a3022a87337058c5
zh: 1d53a08a25ed6eb3
@@ -21,8 +21,8 @@
en: 53a9e92698ce9a5d
zh: 6124d446e8d4a532
/agent-note-add-immutable-profile-resolution-generations/decision/immutable-generations:
- en: cd4e64bd80f448a2
- zh: 585e1fbd8721ae99
+ en: e10b224e0e68b701
+ zh: d43fbdf37e6bfc54
/agent-note-add-immutable-profile-resolution-generations/decision/shared-esm-and-commonjs-rule:
en: 0e0575a04a081b52
zh: 94c74334939e6d13
@@ -33,8 +33,8 @@
en: 99308bd758859e02
zh: 35f1e7719fe80d2e
/agent-note-add-immutable-profile-resolution-generations/decision/additive-package-changes:
- en: 718dfa7826783f2a
- zh: 21c3d5fdfae9cb99
+ en: 0e5e2006caec3c91
+ zh: fb3b61dd5692d2e3
/agent-note-add-immutable-profile-resolution-generations/decision/filesystem-and-runtime-carriers:
en: b0607713102a093d
zh: 2de9c33bfaa0e3e2
@@ -45,8 +45,8 @@
en: 2426173c58a17a48
zh: 0423b3700273accd
/agent-note-add-immutable-profile-resolution-generations/verification:
- en: fbb17aa8fe62b1e8
- zh: 2ed091fdfd995fc8
+ en: 74cb43ea2ccdb334
+ zh: b966bbed43a83c82
/agent-note-add-immutable-profile-resolution-generations/consequences:
- en: 54cae20b2734a07e
- zh: caa334f8f7a40452
+ en: 457a7d1e82b45fe0
+ zh: 800036e083a7674c
diff --git a/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.md b/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.md
index 649c6c358f..d933a4507e 100644
--- a/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.md
+++ b/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.md
@@ -8,7 +8,7 @@ English | [中文](2026-09-09-profile-resolution-generations.zh.md)
A profile loads plugin rows from its own package project, while Harness packages and packages carried by selected bundles can live outside that project's ordinary dependency tree. Bridging the trees through shared symlinks, profile-owned links, or packaged-executable proxy packages persists package selections across processes and installations. Those files require reconciliation and locking, expose generated proxy manifests to metadata readers, and cannot represent a process-local change atomically.
-The runtime design keeps installation-first, ordered-bundle, and local-before-fallback precedence. It covers imports performed by plugin modules as well as Loader row imports and works in the main thread and Harness-owned Workers. Generation replacement preserves existing package mappings and local package names, permits linked-root membership changes, and never mutates a live table entry by entry.
+The runtime design keeps installation-first, ordered-bundle, and local-before-fallback precedence. It covers imports performed by plugin modules as well as Loader row imports and works in the main thread and Harness-owned Workers. Generation replacement preserves retained package identities, permits removing profile packages and changing linked-root membership, and never mutates a live table entry by entry.
## Decision
@@ -75,7 +75,7 @@ Linked-root membership is immutable within a generation. A successor may add or
The router retains the real target of each successfully published link name for its lifetime, solely to validate successors. Removing a root does not erase that record or keep its directory intercepted. Re-adding the same name and target is allowed; a different target is rejected because Node caches real paths. Failed publication changes neither the current generation nor the recorded targets.
-The launcher constructs one startup generation. The service accepts a complete successor, but no package-manager transaction invokes replacement in this implementation.
+The launcher constructs one startup generation. `ProfileRuntimeResolution` retains only the installation anchor, Harness home, and optional profile directory as recomputation inputs; successors reread disk selection and layers rather than inheriting a supplied profile's synthetic layers. A generation without a profile directory can recompute installation packages. The [package refresh decision](2026-09-30-profile-package-refresh-and-manifest-invalidation.md) assigns successor publication to Plugin Manager operations.
### Shared ESM and CommonJS rule
@@ -105,9 +105,9 @@ New Workers inherit the latest published generation. Existing Workers keep the g
### Additive package changes
-A caller adding a package completes its pnpm transaction before constructing a successor generation. Replacement rejects any generation that changes the directory or version of an existing package. The caller publishes an additive successor before mounting the new Loader row; this implementation does not provide that package transaction. A mount failure may leave the package installed but inactive.
+A caller adding a package completes its pnpm transaction before constructing a successor generation. Replacement rejects any generation that changes the directory or version of a retained package. Plugin Manager publishes the successor before mounting the new Loader row. A mount failure may leave the package installed but inactive.
-Changing or removing an existing runtime package mapping, or removing a recorded profile-local package name, requires process restart because Node's ESM Module Map, CommonJS cache, existing object references, and running Workers can retain the old module identity. These restrictions do not prohibit removing a linked root from the interception scope. Generation replacement does not claim to unload modules.
+A retained package keeps its normalized directory, version, and scope; installation entries also keep their declaring anchor and cannot be removed. Violating these restrictions requires process restart because Node's ESM Module Map, CommonJS cache, existing object references, and running Workers can retain the old module identity. A profile entry may change its declaring anchor: deselecting the first bundle that reaches a shared dependency can leave another bundle selecting the same physical package. Profile-scoped mappings and profile-local package names may be removed; the caller stops their plugins before deleting package files. These restrictions do not prohibit removing a linked root from the interception scope. Generation replacement does not claim to unload modules.
### Filesystem and runtime carriers
@@ -142,7 +142,7 @@ Behavior tests exercise root order, transitive and peer dependencies, local and
## Verification
- One eager computation supplies the runtime resolution; startup neither writes nor retires module-resolution data.
-- [Generation tests](../../../../packages/boot/app-boot/tests/profile-resolution.spec.ts) cover installation and selected-bundle graphs with ordinary directories and recursive symlinks, including different dependency versions beside logical and real anchors. They also cover linked-root removal, same-target restoration, overlapping roots, native misses, new requests from loaded modules, and relink rejection after removal.
+- [Generation tests](../../../../packages/boot/app-boot/tests/profile-resolution.spec.ts) cover installation and selected-bundle graphs with ordinary directories and recursive symlinks, including different dependency versions beside logical and real anchors. They also cover same-package profile declarer changes, retained-identity rejection, captured-directory recomputation, linked-root removal, same-target restoration, overlapping roots, native misses, new requests from loaded modules, and relink rejection after removal.
- [Source-launch tests](../../../../apps/cli/tests/source-launch.compat.spec.ts) and [built-bin tests](../../../../apps/cli/tests/built-bin.e2e.ts) run both profile layouts through the real CLI. They assert ESM/CJS versions, loaded paths, per-format dependency identity, and consistent Tools/AgentLoop module instances with an accessible scheduler key.
- Pkg and Electron carriers select runtime resolution; Electron executes its Host in Node mode from the ASAR-backed dsh tree while native executable entries remain unpacked.
- ESM and CommonJS adapters share one router and delegate final resolution to Node without `module.registerHooks` or `_findPath` replacement.
@@ -152,4 +152,4 @@ Behavior tests exercise root order, transitive and peer dependencies, local and
## Consequences
-Runtime startup avoids disk mutation and proxy manifests while retaining package-precedence rules. Real-directory anchors align dependency discovery with default Node loading and tsx workspace mapping, including cases where a logical symlink path would select another version. The implementation accepts the maintenance cost of Node Internal compatibility tests and an early, self-contained bootstrap in each owned Worker; it provides no disk-only backend or dual comparison mode. Package mappings and local package names remain additive; linked-root membership may change without unloading modules.
+Runtime startup avoids disk mutation and proxy manifests while retaining package-precedence rules. Real-directory anchors align dependency discovery with default Node loading and tsx workspace mapping, including cases where a logical symlink path would select another version. The implementation accepts the maintenance cost of Node Internal compatibility tests and an early, self-contained bootstrap in each owned Worker; it provides no disk-only backend or dual comparison mode. Profile package records and linked-root membership may be removed without unloading modules; retained package identities stay unchanged.
diff --git a/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.zh.md b/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.zh.md
index 4e84cc1f1b..24da72defb 100644
--- a/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.zh.md
@@ -8,7 +8,7 @@ Status: implemented
profile 从自己的包项目加载插件配置项，而 Harness 包和所选 bundle 携带的包可能位于该项目普通依赖树之外。通过共享 symlink、profile 自有链接或打包可执行文件的代理包连接两棵依赖树，会让选包结果跨进程和安装版本持续存在。这些文件需要协调和锁来维护，并向元数据读取方暴露生成的代理 manifest（元数据清单），也无法原子表示进程内变更。
-运行时设计保留安装优先、有序 bundle 和本地包优先于 fallback 的顺序。它覆盖插件模块内部的 import 以及 Loader 配置项的 import，并在主线程和 Harness 自有 Worker 中工作。generation 替换保留既有包映射和本地包名，允许调整 linked root 集合，不会逐项修改正在使用的表。
+运行时设计保留安装优先、有序 bundle 和本地包优先于 fallback 的顺序。它覆盖插件模块内部的 import 以及 Loader 配置项的 import，并在主线程和 Harness 自有 Worker 中工作。generation 替换保持保留包的身份不变，允许移除 profile 包和调整 linked root 集合，不会逐项修改正在使用的表。
## Decision
@@ -75,7 +75,7 @@ linked root 集合在一个 generation 内不可变。后继 generation 可以
解析器在自身生命周期内保留每个已成功发布的 link 名称对应的真实目标，仅用于校验后继 generation。移除 root 不会抹掉该记录，也不会让其目录继续被拦截。同名、同目标可以重新加入；不同目标会被拒绝，因为 Node 缓存真实路径。发布失败时，当前 generation 和已记录目标均不变。
-launcher 只构造启动 generation。服务接受完整的后继 generation，但本实现没有包管理器事务调用替换操作。
+launcher 只构造启动 generation。`ProfileRuntimeResolution` 仅保留安装锚点、Harness home 和可选的 profile 目录作为重算输入；后继代重新读取磁盘上的选择与配置层，不继承传入 profile 的合成层。没有 profile 目录的 generation 可以重算安装包。[包操作刷新决策](2026-09-30-profile-package-refresh-and-manifest-invalidation.zh.md)规定由 Plugin Manager 的操作发布后继代。
### ESM 与 CommonJS 共用规则
@@ -105,9 +105,9 @@ runtime resolution 列出它提供的包；Loader entries 组成活动插件列
### 只增加包的变更
-添加包的调用方先完成 pnpm 事务，再构造下一代。替换操作会拒绝改变任何既有 package name 的目录或版本。调用方先发布只增加映射的后继 generation，再挂载新的 Loader 配置项；本实现不提供该包事务。挂载失败可以留下已安装但未启用的包。
+添加包的调用方先完成 pnpm 事务，再构造下一代。替换操作会拒绝改变任何保留包的目录或版本。Plugin Manager 先发布后继 generation，再挂载新的 Loader 配置项。挂载失败可以留下已安装但未启用的包。
-修改或删除既有运行时包映射，或删除已记录的 profile 本地包名，需要重启，因为 Node 的 ESM Module Map、CommonJS cache、现存对象引用和运行中的 Worker 都可能保留旧模块 identity。这些限制不禁止从拦截范围移除 linked root。generation 换代不声称卸载模块。
+保留包的规范化目录、版本和作用域必须不变；安装条目还必须保留声明锚点，且不能移除。违反这些限制需要重启，因为 Node 的 ESM Module Map、CommonJS cache、现存对象引用和运行中的 Worker 都可能保留旧模块 identity。profile 条目可以改变声明锚点：取消选入最先找到共享依赖的组合包后，另一个组合包仍可能选中同一物理包。profile 范围的映射和 profile 本地包名可以移除；调用方在删除包文件之前先停止相关插件。这些限制不禁止从拦截范围移除 linked root。generation 换代不声称卸载模块。
### 文件系统与运行时载体
@@ -142,7 +142,7 @@ generation 构造发生在启动或显式更新阶段，不属于单次 resolve
## Verification
- 一次 eager 计算供应 runtime resolution；启动既不写入也不退休模块解析数据。
-- [Generation 测试](../../../../packages/boot/app-boot/tests/profile-resolution.spec.ts)覆盖普通目录和递归软链接下的安装图与所选 bundle 图，包括逻辑锚点和真实锚点旁存在不同依赖版本的情况。测试还覆盖 linked root 移除、同目标恢复、重叠 root、原生缺包、已加载模块的新请求，以及移除后重新链接不同目标时的拒绝。
+- [Generation 测试](../../../../packages/boot/app-boot/tests/profile-resolution.spec.ts)覆盖普通目录和递归软链接下的安装图与所选 bundle 图，包括逻辑锚点和真实锚点旁存在不同依赖版本的情况。测试还覆盖同包 profile 声明者变更、保留包身份变更拒绝、捕获目录后的重算、linked root 移除、同目标恢复、重叠 root、原生缺包、已加载模块的新请求，以及移除后重新链接不同目标时的拒绝。
- [源码启动测试](../../../../apps/cli/tests/source-launch.compat.spec.ts)与[构建入口测试](../../../../apps/cli/tests/built-bin.e2e.ts)通过真实 CLI 运行两种 profile 布局，断言 ESM/CJS 版本、加载路径、各模块格式内的依赖身份，以及一致的 Tools/AgentLoop 模块实例和可访问的 scheduler 键。
- pkg 与 Electron 载体选择 runtime 解析；Electron 以 Node 模式从 ASAR 承载的 dsh 依赖树执行 Host，原生可执行条目保持 unpacked。
- ESM 与 CommonJS 适配器共享同一个路由器，并把最终解析委托给 Node，不使用 `module.registerHooks` 或替换 `_findPath`。
@@ -152,4 +152,4 @@ generation 构造发生在启动或显式更新阶段，不属于单次 resolve
## Consequences
-runtime 启动避免磁盘修改和代理 manifest，同时保留包优先级规则。真实目录锚点让依赖发现对齐 Node 默认加载与 tsx workspace 映射，也覆盖软链接逻辑路径会选中另一版本的情况。实现需要持续维护 Node Internal 兼容测试，并在每个自有 Worker 中尽早执行自包含 bootstrap；它不提供纯磁盘后端或 dual 对比模式。包映射和本地包名仍只允许新增；linked root 集合可以变化，而不卸载模块。
+runtime 启动避免磁盘修改和代理 manifest，同时保留包优先级规则。真实目录锚点让依赖发现对齐 Node 默认加载与 tsx workspace 映射，也覆盖软链接逻辑路径会选中另一版本的情况。实现需要持续维护 Node Internal 兼容测试，并在每个自有 Worker 中尽早执行自包含 bootstrap；它不提供纯磁盘后端或 dual 对比模式。profile 包记录和 linked root 集合可以移除，而不卸载模块；保留包的身份保持不变。
diff --git a/.agents/notes/implemented/architecture/2026-09-09-workspace-file-read-authority.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-09-workspace-file-read-authority.i18n.yaml
index 3d1c6c968a..55defc8dc9 100644
--- a/.agents/notes/implemented/architecture/2026-09-09-workspace-file-read-authority.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-09-workspace-file-read-authority.i18n.yaml
@@ -9,8 +9,8 @@
en: ee5703dcce5d81c5
zh: 6c1aec04723d211b
/agent-note-workspace-file-read-authority/decision:
- en: 92dbdf6087e00f04
- zh: 2c8720a081d492f9
+ en: b4b88d397452d083
+ zh: 14069d83e001082d
/agent-note-workspace-file-read-authority/alternatives-considered:
en: 329e575be02d7392
zh: a78f428b36d40f59
diff --git a/.agents/notes/implemented/architecture/2026-09-09-workspace-file-read-authority.md b/.agents/notes/implemented/architecture/2026-09-09-workspace-file-read-authority.md
index 140816e8c4..5550cfa003 100644
--- a/.agents/notes/implemented/architecture/2026-09-09-workspace-file-read-authority.md
+++ b/.agents/notes/implemented/architecture/2026-09-09-workspace-file-read-authority.md
@@ -14,7 +14,7 @@ Workspace Files serves both file content and workspace navigation. Applying work
`list` and `changes` remain workspace-scoped because they expose workspace navigation and observation rather than a named file read. `list` rejects a directory outside the root, and `changes` filters observations through the backend's workspace-containment predicate.
-`readBytes` with `baseFile` resolves a relative path from the base file's directory. A `..` path may therefore read JavaScript or CSS outside the workspace when the Session backend permits it. With [Developer tools](../feature/2026-09-17-developer-tools-settings.md) enabled, Document Preview packages bounded, statically declared local scripts and stylesheets into an HTML Blob iframe with `sandbox="allow-scripts"`; the opaque origin blocks parent access, but the browser retains normal network access. This exposure is an intentional security trade-off for rendering static generated HTML.
+`readBytes` with `baseFile` resolves a relative path from the base file's directory. A `..` path may therefore read JavaScript or CSS outside the workspace when the Session backend permits it. With [Developer tools](../../../../packages/client/ui-sidebar-documentpreview/README.md) enabled, Document Preview packages bounded, statically declared local scripts and stylesheets into an HTML Blob iframe with `sandbox="allow-scripts"`; the opaque origin blocks parent access, but the browser retains normal network access. This exposure is an intentional security trade-off for rendering static generated HTML.
The [Workspace Files service](2026-09-05-workspace-files-service.md) owns paging, file checks, listing, and observation. [Document Preview](2026-09-08-document-preview-operations.md) owns which related files are packaged and the iframe sandbox.
diff --git a/.agents/notes/implemented/architecture/2026-09-09-workspace-file-read-authority.zh.md b/.agents/notes/implemented/architecture/2026-09-09-workspace-file-read-authority.zh.md
index 75ffee32c4..f12c11ac9b 100644
--- a/.agents/notes/implemented/architecture/2026-09-09-workspace-file-read-authority.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-09-workspace-file-read-authority.zh.md
@@ -14,7 +14,7 @@ Workspace Files 同时提供文件内容与工作区导航。对所有操作应
`list` 与 `changes` 仍限于工作区，因为它们暴露工作区导航和观察，而不是读取一个具名文件。`list` 拒绝根外目录，`changes` 通过后端的工作区包含判定过滤观察。
-带 `baseFile` 的 `readBytes` 从基准文件所在目录解析相对路径。因此，只要 Session 后端允许，`..` 路径就可以读取工作区外的 JavaScript 或 CSS。开启[开发者工具](../feature/2026-09-17-developer-tools-settings.zh.md)时，Document Preview 把有界、静态声明的本地脚本与样式表打包进带 `sandbox="allow-scripts"` 的 HTML Blob iframe；不透明源阻止访问父应用，但浏览器保留正常网络访问。这种暴露是为渲染静态生成 HTML 而有意接受的安全取舍。
+带 `baseFile` 的 `readBytes` 从基准文件所在目录解析相对路径。因此，只要 Session 后端允许，`..` 路径就可以读取工作区外的 JavaScript 或 CSS。开启[开发者工具](../../../../packages/client/ui-sidebar-documentpreview/README.zh.md)时，Document Preview 把有界、静态声明的本地脚本与样式表打包进带 `sandbox="allow-scripts"` 的 HTML Blob iframe；不透明源阻止访问父应用，但浏览器保留正常网络访问。这种暴露是为渲染静态生成 HTML 而有意接受的安全取舍。
[Workspace Files 服务](2026-09-05-workspace-files-service.zh.md)负责分页、文件检查、列举和观察。[Document Preview](2026-09-08-document-preview-operations.zh.md)负责选择要打包的关联文件及 iframe sandbox。
diff --git a/.agents/notes/implemented/architecture/2026-09-10-command-identities-and-composer-file-action.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-10-command-identities-and-composer-file-action.i18n.yaml
deleted file mode 100644
index 85ab4e3c03..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-10-command-identities-and-composer-file-action.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-10-command-identities-and-composer-file-action.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-10-command-identities-and-composer-file-action.md
-/agent-note-command-identities-and-composer-owned-file-action:
- en: 96db2d4653b47858
- zh: b914d79ab95b0e51
-/agent-note-command-identities-and-composer-owned-file-action/problem:
- en: ad2c360593eb7a42
- zh: 503a9c31a5eb55e7
-/agent-note-command-identities-and-composer-owned-file-action/decision:
- en: c78d13ee6a59c04d
- zh: 53fc322d351e437b
-/agent-note-command-identities-and-composer-owned-file-action/alternatives-considered:
- en: 94ccabd1fe224408
- zh: bfa28806f0218ce8
-/agent-note-command-identities-and-composer-owned-file-action/consequences:
- en: 08f25ff5e0d227cf
- zh: a26663e5b7d9feeb
diff --git a/.agents/notes/implemented/architecture/2026-09-10-compact-tool-details.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-10-compact-tool-details.i18n.yaml
deleted file mode 100644
index 50d4ce7a3d..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-10-compact-tool-details.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-10-compact-tool-details.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-10-compact-tool-details.md
-/agent-note-compact-tool-details-from-recorded-results:
- en: 7495c26039484440
- zh: d1907caf1f139054
-/agent-note-compact-tool-details-from-recorded-results/problem:
- en: e4ce66f2cdb08516
- zh: 3f45374f23fa8f3b
-/agent-note-compact-tool-details-from-recorded-results/decision:
- en: 668e06f5146a78de
- zh: 4af1edf74eb8121c
-/agent-note-compact-tool-details-from-recorded-results/alternatives-considered:
- en: 1f0bf45e4ecc0bfa
- zh: c46b173dc7ee180b
-/agent-note-compact-tool-details-from-recorded-results/consequences:
- en: e02acb07b752c285
- zh: b29f9a5ad44ff10f
diff --git a/.agents/notes/implemented/architecture/2026-09-10-compact-tool-details.md b/.agents/notes/implemented/architecture/2026-09-10-compact-tool-details.md
deleted file mode 100644
index 6c1f29c555..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-10-compact-tool-details.md
+++ /dev/null
@@ -1,29 +0,0 @@
-# Agent Note: Compact Tool Details from Recorded Results
-
-Status: implemented
-
-English | [中文](2026-09-10-compact-tool-details.zh.md)
-
-## Problem
-
-Goal, todo, and schedule results contain a small set of user-facing facts that take more effort to read as JSON. Dedicated expanded bodies need to fit the existing conversation rows without adding a second presentation registry or live state to historical calls.
-
-## Decision
-
-The `ui-tool` package registers goal and schedule toolviews through the existing keyed slot and shares one package-internal fields/list component with the todo view. Successful, recognized results display recorded values; incomplete calls, errors, malformed values, and unsupported result formats retain generic input/output. Schedule domain errors, including uncertain persistence and an unknown deletion target, retain their original result.
-
-Tool rows keep their disclosure and Inspect interaction. Checklist marks are static and have accessible status labels. Schedule times use absolute dates with the viewer's time zone; states come from the recorded result. Goal details distinguish an active goal awaiting continuation from an armed goal. These display values do not subscribe to the current goal, todo, or schedule projection.
-
-Todo changes compare each root or nested call with its preceding durable `todo/write`, so later writes cannot alter an earlier card. The conversation assembler repairs predecessors when older history loads. Until the predecessor is known, the card shows the submitted list without inferred additions or removals.
-
-This scoped visual change is an exception to the visual-equivalence requirement in [Client-derived tool presentation](2026-08-23-client-derived-tool-presentation.md). Its raw-event ownership, generic fallback, and single keyed registry remain authoritative.
-
-## Alternatives considered
-
-**A shared presenter framework:** the existing keyed slot already dispatches tools. Reusing only the detail body keeps the abstraction local until another package needs it.
-
-**A dashboard inside each card:** interactive controls, progress graphics, and live states add visual weight and can misrepresent what a historical call returned. Compact read-only fields and lists preserve the conversation's hierarchy.
-
-## Consequences
-
-Registered tools gain readable details without changing Host tools, Session events, or public Client exports. Tool-specific adapters interpret recorded JSON and text; unrecognized formats retain generic output. The authored tool-details Session replay covers their assembled rendering.
diff --git a/.agents/notes/implemented/architecture/2026-09-10-compact-tool-details.zh.md b/.agents/notes/implemented/architecture/2026-09-10-compact-tool-details.zh.md
deleted file mode 100644
index d0822a48f1..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-10-compact-tool-details.zh.md
+++ /dev/null
@@ -1,29 +0,0 @@
-# Agent Note: Compact Tool Details from Recorded Results
-
-Status: implemented
-
-[English](2026-09-10-compact-tool-details.md) | 中文
-
-## 问题
-
-目标、任务清单和定时任务的结果包含少量面向用户的事实，以 JSON 阅读时较费力。专用展开内容需要融入现有对话行，不能为历史调用新增一套呈现注册表或实时状态。
-
-## 决策
-
-`ui-tool` 包通过现有按键分发的插槽注册目标和定时任务视图，并与任务清单视图共用一个包内字段/列表组件。成功且可识别的结果显示记录值；未完成调用、错误、格式异常和不支持的结果格式保留通用输入/输出。定时任务领域错误（包括持久化不确定和删除目标不存在）保留原始结果。
-
-工具行保留展开和 Inspect 交互。任务清单标记是静态的，并带有可访问的状态标签。定时任务使用查看者时区的绝对日期，状态取自记录的结果。目标详情区分等待继续的活动目标和已启动的目标。这些显示值不订阅当前目标、任务清单或定时任务投影。
-
-任务清单的变化将每个根调用或嵌套调用与之前的持久化 `todo/write` 比较，因此后续写入不会改变较早的卡片。对话组装器在加载更早的历史时修复前序记录。前序记录尚不明确时，卡片展示提交的列表，不推断新增或删除。
-
-这项有限的视觉调整是[客户端派生工具呈现](2026-08-23-client-derived-tool-presentation.zh.md)中视觉等价要求的例外。该决策中的原始事件所有权、通用回退和唯一按键注册表仍然有效。
-
-## 考虑过的替代方案
-
-**共享呈现框架：**现有按键插槽已负责工具分发。仅复用详情内容，可以在其他包出现需求前将抽象限制在包内。
-
-**在每张卡片中嵌入仪表盘：**交互控件、进度图形和实时状态会增加视觉负担，也可能歪曲历史调用返回的事实。紧凑的只读字段和列表保留了对话的层级。
-
-## 影响
-
-已注册的工具获得可读详情，无需改变 Host 工具、Session 事件或公开的 Client 导出。工具专用适配器解读记录中的 JSON 和文本；未识别的格式保留通用输出。手写的 tool-details Session 回放覆盖这些工具组装后的渲染。
diff --git a/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.i18n.yaml
index 2de0be6d61..5f22b758a9 100644
--- a/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.i18n.yaml
@@ -3,14 +3,14 @@
# After editing either side, bring the other along and re-record with:
# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.md
/agent-note-run-desktop-through-the-shared-web-application:
- en: 1803d1966797a555
- zh: 6ab64a673a217d34
+ en: aa8d39aff5589d4e
+ zh: f2d72d070f879f15
/agent-note-run-desktop-through-the-shared-web-application/problem:
en: 085b445846af76c1
zh: fdddf72401292bbd
/agent-note-run-desktop-through-the-shared-web-application/decision:
- en: 7767ab2839440970
- zh: 9a998e72b728fd17
+ en: 6a51259a49377680
+ zh: d18f7010ced738e7
/agent-note-run-desktop-through-the-shared-web-application/alternatives-considered:
en: 9c5dfbf9cc788040
zh: 631f851909dd7234
diff --git a/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.md b/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.md
index 4f43cc6507..d2c286c955 100644
--- a/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.md
+++ b/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.md
@@ -4,7 +4,7 @@ Status: implemented
English | [中文](2026-09-10-desktop-web-wrapper.zh.md)
-The [Electron runtime decision](2026-09-11-desktop-electron-node-runtime.md) supersedes the separate upstream Node executable; other decisions in this note remain applicable.
+Desktop uses Electron as its Node runtime under the [current runtime reference](../../../../apps/desktop/README.md); other decisions in this note remain applicable.
## Problem
@@ -12,7 +12,7 @@ Separate Desktop composition and request transport require their own configurati
## Decision
-The private Desktop Host invokes the CLI's shared profile runner against the independently owned Desktop profile. The complete Web composition owns authentication, HTTP routes, client assets, RPC, and response streaming. Electron loads packaged static Web assets before the child is ready. Child IPC carries readiness, structured boot injections, and shutdown. The [immediate-window decision](2026-09-09-desktop-immediate-window-and-direct-start.md) owns local-document HTTP forwarding and authenticated WebSocket access; Web retains application dispatch and stream framing.
+The private Desktop Host invokes the CLI's shared profile runner against the independently owned Desktop profile. The complete Web composition owns authentication, HTTP routes, client assets, RPC, and response streaming. Electron loads packaged static Web assets before the child is ready. Child IPC carries readiness, structured boot injections, and shutdown. The [immediate-window reference](../../../../apps/desktop/README.md) owns local-document HTTP forwarding and authenticated WebSocket access; Web retains application dispatch and stream framing.
The shared runner owns profile and Harness-home patches, proxy setup, telemetry defaults, the runtime resolution, configuration reload, and application lifecycle. Desktop initializes profiles from the shared Web template and uses its Plugin Manager in the main application. Electron owns windows, menus, native directory selection, recovery, and release updates.
diff --git a/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.zh.md b/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.zh.md
index bc41b4f8ef..dfe352d078 100644
--- a/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.zh.md
@@ -4,7 +4,7 @@ Status: implemented
[English](2026-09-10-desktop-web-wrapper.md) | 中文
-[Electron 运行时决策](2026-09-11-desktop-electron-node-runtime.zh.md)替代独立上游 Node 可执行文件的选择；本文其他决策仍然适用。
+Desktop 按[当前运行时参考](../../../../apps/desktop/README.zh.md)使用 Electron 作为 Node 运行时；本文其他决策仍然适用。
## Problem
@@ -12,7 +12,7 @@ Status: implemented
## Decision
-私有 Desktop Host 针对独立归属的 Desktop profile 调用 CLI 的共享 profile runner。完整 Web 组合负责认证、HTTP 路由、客户端资源、RPC 与响应流。Electron 在子进程就绪前加载打包静态 Web 资源。子进程 IPC 承载就绪、结构化启动注入与关闭。[立即显示窗口决策](2026-09-09-desktop-immediate-window-and-direct-start.zh.md)规定本地文档 HTTP 转发与认证 WebSocket 访问；Web 保留应用分派与流帧处理。
+私有 Desktop Host 针对独立归属的 Desktop profile 调用 CLI 的共享 profile runner。完整 Web 组合负责认证、HTTP 路由、客户端资源、RPC 与响应流。Electron 在子进程就绪前加载打包静态 Web 资源。子进程 IPC 承载就绪、结构化启动注入与关闭。[立即显示窗口参考](../../../../apps/desktop/README.zh.md)规定本地文档 HTTP 转发与认证 WebSocket 访问；Web 保留应用分派与流帧处理。
共享 runner 负责 profile 与 Harness-home patch、代理设置、遥测默认值、runtime resolution、配置重载和应用生命周期。Desktop 从共享 Web 模板初始化 profile，并在主应用中使用其插件管理器。Electron 负责窗口、菜单、原生目录选择、恢复和发布更新。
diff --git a/.agents/notes/implemented/architecture/2026-09-10-image-offload-events.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-10-image-offload-events.i18n.yaml
index 6a7a9b2152..aadac74410 100644
--- a/.agents/notes/implemented/architecture/2026-09-10-image-offload-events.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-10-image-offload-events.i18n.yaml
@@ -6,8 +6,8 @@
en: 13b817438040d321
zh: 490038f3c93551c7
/agent-note-durable-image-offload-events/problem:
- en: 93c2241e0f40fca1
- zh: fe3528cff00e07b3
+ en: 352f3f7912a08a3e
+ zh: bf3a16a5bd2c3a84
/agent-note-durable-image-offload-events/decision:
en: e1cbaf46e6a6a7be
zh: c3640a44c9be69af
diff --git a/.agents/notes/implemented/architecture/2026-09-10-image-offload-events.md b/.agents/notes/implemented/architecture/2026-09-10-image-offload-events.md
index e80c4ae17b..1115a66fab 100644
--- a/.agents/notes/implemented/architecture/2026-09-10-image-offload-events.md
+++ b/.agents/notes/implemented/architecture/2026-09-10-image-offload-events.md
@@ -6,7 +6,7 @@ English | [中文](2026-09-10-image-offload-events.zh.md)
## Problem
-A request can exceed an image-capable route's byte or image-count budget. Recomputing the omitted prefix for each request lets a route switch, inline fallback, or compaction restore previously omitted images. The model-visible image set then depends on unlogged request preparation. The [unified image pipeline](../feature/2026-08-20-unified-image-request-pipeline.md) owns attachment normalization and request versions; durable omission needs its own recorded decision.
+A request can exceed an image-capable route's byte or image-count budget. Recomputing the omitted prefix for each request lets a route switch, inline fallback, or compaction restore previously omitted images. The model-visible image set then depends on unlogged request preparation. The [unified image pipeline](../../../../packages/attachment/attachment-local/README.md) owns attachment normalization and request versions; durable omission needs its own recorded decision.
## Decision
diff --git a/.agents/notes/implemented/architecture/2026-09-10-image-offload-events.zh.md b/.agents/notes/implemented/architecture/2026-09-10-image-offload-events.zh.md
index 2aa2b8b1fb..a64c898215 100644
--- a/.agents/notes/implemented/architecture/2026-09-10-image-offload-events.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-10-image-offload-events.zh.md
@@ -6,7 +6,7 @@ Status: implemented
## 问题
-请求可能超过图片路由的字节或图片数量预算。每次请求重新计算省略前缀，会让路由切换、内联回退或压缩恢复先前省略的图片。模型可见的图片集合因此取决于未记录的请求准备过程。[统一图片流水线](../feature/2026-08-20-unified-image-request-pipeline.zh.md)负责附件归一化与请求版本，持久省略需要单独记录决策。
+请求可能超过图片路由的字节或图片数量预算。每次请求重新计算省略前缀，会让路由切换、内联回退或压缩恢复先前省略的图片。模型可见的图片集合因此取决于未记录的请求准备过程。[统一图片流水线](../../../../packages/attachment/attachment-local/README.zh.md)负责附件归一化与请求版本，持久省略需要单独记录决策。
## 决策
diff --git a/.agents/notes/implemented/architecture/2026-09-10-public-package-manifest.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-10-public-package-manifest.i18n.yaml
index 493f5002ab..4434bd49e6 100644
--- a/.agents/notes/implemented/architecture/2026-09-10-public-package-manifest.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-10-public-package-manifest.i18n.yaml
@@ -9,8 +9,8 @@
en: e4bafc2b26cae6d2
zh: f8226b200b627c55
/agent-note-public-package-manifest-fields/decision:
- en: 9351e430c86c51fe
- zh: 486496885b77824a
+ en: 8586a9687da8e327
+ zh: 2dcd1c1fdb856412
/agent-note-public-package-manifest-fields/alternatives-considered:
en: 656ef2c1e7853d01
zh: 21c525fda71c6def
diff --git a/.agents/notes/implemented/architecture/2026-09-10-public-package-manifest.md b/.agents/notes/implemented/architecture/2026-09-10-public-package-manifest.md
index 2d35a3ad17..4341d99d4e 100644
--- a/.agents/notes/implemented/architecture/2026-09-10-public-package-manifest.md
+++ b/.agents/notes/implemented/architecture/2026-09-10-public-package-manifest.md
@@ -14,7 +14,7 @@ Plugin authors need npm identity, runtime requirements, and DSH declarations fro
Runtime requirements live at top-level `engines`: `dsh`, `node`, and `npm` are optional version strings, and other engine names are allowed. `dsh.manifestVersion` identifies declaration format `1`. Format and DSH compatibility declarations are not enforced by current installers or loaders.
-The image packer owns `configTrees`, and the workspace catalog generator owns Session migration declarations. Their existing on-disk keys remain readable by those internal tools, but the public manifest types do not expose them. This scope refines the [shared declaration ownership decision](2026-09-05-package-manifest-types.md), whose package placement and dependency rules remain active.
+The image packer owns `configTrees`, and the workspace catalog generator owns Session migration declarations. Their existing on-disk keys remain readable by those internal tools, but the public manifest types do not expose them.
Each consumer owns JSON parsing, field validation, default resolution, and adaptation to runtime data. Interfaces do not validate parsed JSON. A helper belongs in the shared package only when multiple consumers need the same validation or normalization; getters that repeat property access add no shared policy.
diff --git a/.agents/notes/implemented/architecture/2026-09-10-public-package-manifest.zh.md b/.agents/notes/implemented/architecture/2026-09-10-public-package-manifest.zh.md
index 7dc03e5160..e4695b1ca7 100644
--- a/.agents/notes/implemented/architecture/2026-09-10-public-package-manifest.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-10-public-package-manifest.zh.md
@@ -14,7 +14,7 @@ Status: implemented
运行时要求位于顶层 `engines`：`dsh`、`node` 和 `npm` 均为可选版本字符串，也允许其他 engine 名称。`dsh.manifestVersion` 标识声明格式 `1`。当前安装器和加载器不强制检查格式与 DSH 兼容性声明。
-镜像打包器拥有 `configTrees`，工作区目录生成器拥有 Session 迁移声明。这些内部工具仍可读取既有磁盘字段，但公共 manifest 类型不暴露这些字段。此范围细化了[共享声明归属决策](2026-09-05-package-manifest-types.zh.md)，后者的包位置与依赖规则仍然有效。
+镜像打包器拥有 `configTrees`，工作区目录生成器拥有 Session 迁移声明。这些内部工具仍可读取既有磁盘字段，但公共 manifest 类型不暴露这些字段。
各消费方负责 JSON 解析、字段校验、默认值解析和运行时数据适配。接口不会校验已解析的 JSON。只有多个消费方需要相同校验或归一化时，helper 才属于共享包；重复属性访问的 getter 不提供共享策略。
diff --git a/.agents/notes/implemented/architecture/2026-09-10-windows-native-installer-pages.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-10-windows-native-installer-pages.i18n.yaml
deleted file mode 100644
index 30d6654c2d..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-10-windows-native-installer-pages.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-10-windows-native-installer-pages.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-10-windows-native-installer-pages.md
-/agent-note-native-windows-installer-pages:
- en: 2170ba78b248756f
- zh: 6e5852f4685fbc81
-/agent-note-native-windows-installer-pages/problem:
- en: 5d148a332b151928
- zh: a79cdfd0f1556c58
-/agent-note-native-windows-installer-pages/decision:
- en: 3357e9aca4862152
- zh: c2fa86534f9c8737
-/agent-note-native-windows-installer-pages/alternatives-considered:
- en: a5b1e11a1b30ab99
- zh: 8495f05dc87b831a
-/agent-note-native-windows-installer-pages/consequences:
- en: 16243ca0777d1ff8
- zh: e35cb7f33a756b47
diff --git a/.agents/notes/implemented/architecture/2026-09-11-desktop-electron-node-runtime.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-11-desktop-electron-node-runtime.i18n.yaml
deleted file mode 100644
index fdc33cea63..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-11-desktop-electron-node-runtime.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-11-desktop-electron-node-runtime.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-11-desktop-electron-node-runtime.md
-/agent-note-use-electron-as-the-desktop-node-runtime:
- en: 06290013c52b169d
- zh: 5e876829cf708f34
-/agent-note-use-electron-as-the-desktop-node-runtime/problem:
- en: 67e580ac6d9298d9
- zh: bb2bd7486090bde4
-/agent-note-use-electron-as-the-desktop-node-runtime/decision:
- en: 625ed4349cc70849
- zh: b0aa30ab993e858d
-/agent-note-use-electron-as-the-desktop-node-runtime/consequences:
- en: 3de90a3734d0f405
- zh: 4d26d953e05e0337
-/agent-note-use-electron-as-the-desktop-node-runtime/alternatives-considered:
- en: 402978396810dca3
- zh: 5146ec7ad3cabdc1
diff --git a/.agents/notes/implemented/architecture/2026-09-11-node-office-kit.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-11-node-office-kit.i18n.yaml
deleted file mode 100644
index 5879ae942a..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-11-node-office-kit.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-11-node-office-kit.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-11-node-office-kit.md
-/agent-note-node-office-conversion-with-independently-packaged-engines:
- en: 04142abd8eef58bc
- zh: 1a2fe733f74e88ef
-/agent-note-node-office-conversion-with-independently-packaged-engines/problem:
- en: ac8ace90fa115f0d
- zh: 18b9977031cbadeb
-/agent-note-node-office-conversion-with-independently-packaged-engines/decision:
- en: 61d2e96b5b3782c5
- zh: 49780b672e681b0e
-/agent-note-node-office-conversion-with-independently-packaged-engines/alternatives-considered:
- en: 70315a46124cbde7
- zh: ee258ed0ef7effb0
-/agent-note-node-office-conversion-with-independently-packaged-engines/consequences:
- en: bb32631217be9743
- zh: 1ea86613ade03732
diff --git a/.agents/notes/implemented/architecture/2026-09-11-plugin-owned-message-projections.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-11-plugin-owned-message-projections.i18n.yaml
index 552e27d0a6..90c7dfd954 100644
--- a/.agents/notes/implemented/architecture/2026-09-11-plugin-owned-message-projections.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-11-plugin-owned-message-projections.i18n.yaml
@@ -9,11 +9,11 @@
en: bd3ad5505204ec0b
zh: 770b6089c760d99f
/agent-note-plugin-owned-message-projections/decision:
- en: 2b33d4a1cfba0f53
- zh: 55347f3ecf234862
+ en: 50c02960b1f087c6
+ zh: fa3f5c18b897eab9
/agent-note-plugin-owned-message-projections/alternatives-considered:
- en: c6e4c770739dca68
- zh: 7bfcb3dda06a22a1
+ en: b0da1fbf24bc506a
+ zh: c4e35896599f824c
/agent-note-plugin-owned-message-projections/consequences:
en: c2f3ff0b9639bec5
zh: 357f90d9a3423751
diff --git a/.agents/notes/implemented/architecture/2026-09-11-plugin-owned-message-projections.md b/.agents/notes/implemented/architecture/2026-09-11-plugin-owned-message-projections.md
index 9e1eca9256..739d27644b 100644
--- a/.agents/notes/implemented/architecture/2026-09-11-plugin-owned-message-projections.md
+++ b/.agents/notes/implemented/architecture/2026-09-11-plugin-owned-message-projections.md
@@ -16,7 +16,7 @@ The `@messageProjection` tag on the owning `SessionEventMap` member generates th
The compaction-image-offload plugin registers its definition through a fiber-owned `ctx.sessions.registerMessageProjection()` effect. Each event has one registered owner. Removing a definition invalidates pending committed decisions and cached reads that used it; a replacement definition requires restoring the session. Rejected, uncommitted candidates retain no interpreter dependency.
-Detached readers pass definitions explicitly. The current Session format catalog assembles the same browser-safe plugin exports for persistence validation and offline queries. This static assembly does not mount recovery listeners. Live sessions use the registered composition, while compaction invariants borrow that composition's definitions. No process-global registry or import-time registration is involved.
+Detached readers pass definitions explicitly. The current Session format catalog assembles the same browser-safe plugin exports for persistence validation and offline queries. This static assembly does not mount recovery listeners. Live sessions use the registered composition. No process-global registry or import-time registration is involved.
The image event payload and required-on-read semantics remain owned by the image-offload note. Its indexes, selection policy, retry behavior, and SDK recordings are unchanged; this decision partially supersedes that note's core-owned interpretation.
@@ -26,7 +26,7 @@ The image event payload and required-on-read semantics remain owned by the image
**Use the ordinary session-projection registry.** Its folds expose domain state after commit. They cannot veto an invalid append or supply canonical `deriveMessages()` content without another integration point.
-**Transform only the outgoing request.** Compaction, fork, offline replay, and request invariants also derive messages. A send-time transformation does not cover these consumers.
+**Transform only the outgoing request.** Compaction, fork, and offline replay also derive messages. A send-time transformation does not cover these consumers.
## Consequences
diff --git a/.agents/notes/implemented/architecture/2026-09-11-plugin-owned-message-projections.zh.md b/.agents/notes/implemented/architecture/2026-09-11-plugin-owned-message-projections.zh.md
index b26b5d4549..74c85825bf 100644
--- a/.agents/notes/implemented/architecture/2026-09-11-plugin-owned-message-projections.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-11-plugin-owned-message-projections.zh.md
@@ -16,7 +16,7 @@ Status: implemented
compaction-image-offload 插件通过 fiber 拥有的 `ctx.sessions.registerMessageProjection()` effect 注册处理器。每种事件只有一个注册者。移除处理器后，尚未应用的已提交决策和使用过它的缓存读取都会失效。替换处理器需要重新恢复会话。被拒绝且未提交的候选事件不会保留对处理器的依赖。
-独立读取器显式传入处理器。当前 Session 格式目录装配相同的浏览器安全插件导出，供持久数据校验和离线查询使用。这项静态装配不挂载恢复监听器。实时会话使用已注册的组合，压缩 invariant 借用该组合的处理器。不使用进程全局注册表，也不在导入模块时注册。
+独立读取器显式传入处理器。当前 Session 格式目录装配相同的浏览器安全插件导出，供持久数据校验和离线查询使用。这项静态装配不挂载恢复监听器。实时会话使用已注册的组合。不使用进程全局注册表，也不在导入模块时注册。
图片事件载荷和读取时必须识别的语义仍由图片省略记录负责。索引、选图策略、重试行为和 SDK 录制保持不变。本决策部分取代该记录中由核心负责解释事件的职责划分。
@@ -26,7 +26,7 @@ compaction-image-offload 插件通过 fiber 拥有的 `ctx.sessions.registerMess
**使用普通的 session-projection 注册表。** 它的折叠在提交后公开领域状态。没有额外集成点，它无法否决无效追加，也无法提供标准 `deriveMessages()` 内容。
-**只转换发出的请求。** 压缩、分叉、离线回放和请求 invariant 也会派生消息。发送时转换无法覆盖这些消费方。
+**只转换发出的请求。** 压缩、分叉和离线回放也会派生消息。发送时转换无法覆盖这些消费方。
## 影响
diff --git a/.agents/notes/implemented/architecture/2026-09-11-sandboxed-node-ptc-runtime.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-11-sandboxed-node-ptc-runtime.i18n.yaml
index 834d15576d..d83f853c54 100644
--- a/.agents/notes/implemented/architecture/2026-09-11-sandboxed-node-ptc-runtime.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-11-sandboxed-node-ptc-runtime.i18n.yaml
@@ -12,8 +12,8 @@
en: cf072f53de09faca
zh: 9edd5c4a2bfaae5a
/agent-note-sandboxed-node-execution-for-ptc/decision/resolved-inputs-and-policy:
- en: e93df995efab569a
- zh: 850daf02d1207028
+ en: 3aef37bb4f8a8e53
+ zh: a7b477324d486ab3
/agent-note-sandboxed-node-execution-for-ptc/decision/control-and-lifetime:
en: 2c7a694b04951772
zh: 133b95b0477b127f
diff --git a/.agents/notes/implemented/architecture/2026-09-11-sandboxed-node-ptc-runtime.md b/.agents/notes/implemented/architecture/2026-09-11-sandboxed-node-ptc-runtime.md
index f851775460..2104e58e8e 100644
--- a/.agents/notes/implemented/architecture/2026-09-11-sandboxed-node-ptc-runtime.md
+++ b/.agents/notes/implemented/architecture/2026-09-11-sandboxed-node-ptc-runtime.md
@@ -22,7 +22,7 @@ The host preserves `ELECTRON_RUN_AS_NODE` for child startup; the bootstrap remov
File mode, observed denial and enforcement completeness travel in `PtcRunResult.sandbox` separately from the program outcome. Restricted execution fails if the required sandbox backend cannot launch. Full access is an explicit policy mode. Program success does not prove full enforcement, and neither the `process` descriptor nor the extra control pipe claims multi-tenant isolation.
-The private Python provider keeps its existing execution implementation and configured wall deadline. Its resolver accepts cwd but rejects an explicit file policy or per-call timeout override; a capability descriptor never silently grants unsupported protection.
+The [experimental Python provider](../../../../packages/experimental/ptc-runtime-python/README.md) shares the resolved file policy and sandbox diagnostics while retaining its local Unix execution and configured wall deadline. Per-call timeout overrides remain unsupported.
### Control and lifetime
diff --git a/.agents/notes/implemented/architecture/2026-09-11-sandboxed-node-ptc-runtime.zh.md b/.agents/notes/implemented/architecture/2026-09-11-sandboxed-node-ptc-runtime.zh.md
index 94f3a37eb7..429351cca2 100644
--- a/.agents/notes/implemented/architecture/2026-09-11-sandboxed-node-ptc-runtime.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-11-sandboxed-node-ptc-runtime.zh.md
@@ -22,7 +22,7 @@ Host 在子进程启动时保留 `ELECTRON_RUN_AS_NODE`；bootstrap 在求值前
文件模式、观察到的拒绝与强制完整性通过 `PtcRunResult.sandbox` 独立于程序结果传递。所需沙箱后端无法启动时，受限执行失败。完整访问是显式策略模式。程序成功不证明完整强制能力，`process` 描述符与额外控制管道也不声明多租户隔离。
-私有 Python 提供方保留现有执行实现与配置的经过时间截止。其解析器接受 cwd，但拒绝显式文件策略或单次 timeout 覆盖；能力描述符不会静默授予不受支持的保护。
+[实验性 Python 提供方](../../../../packages/experimental/ptc-runtime-python/README.zh.md)共享已解析文件策略与沙箱诊断，同时保留本地 Unix 执行和配置的经过时间截止。仍不支持单次 timeout 覆盖。
### 控制与生命周期
diff --git a/.agents/notes/implemented/architecture/2026-09-11-windows-directory-installation.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-11-windows-directory-installation.i18n.yaml
deleted file mode 100644
index 35bfbf6d4b..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-11-windows-directory-installation.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-11-windows-directory-installation.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-11-windows-directory-installation.md
-/agent-note-replace-windows-application-directories-after-staging:
- en: 7cdd071dd6ad760f
- zh: eb8510c6c09f0068
-/agent-note-replace-windows-application-directories-after-staging/problem:
- en: fa0015dca8cd9e85
- zh: a826baa59c0a3bd1
-/agent-note-replace-windows-application-directories-after-staging/decision:
- en: 5bec9a233d21bb35
- zh: 50e8ba778b14b48e
-/agent-note-replace-windows-application-directories-after-staging/consequences:
- en: 3562fbc117967fb3
- zh: 6600b28ea6202f68
-/agent-note-replace-windows-application-directories-after-staging/alternatives-considered:
- en: 0971baacd045ddef
- zh: c908624104e242f9
-/agent-note-replace-windows-application-directories-after-staging/verification:
- en: 650fdccdf35ad9d3
- zh: 6069b9acb5f03878
diff --git a/.agents/notes/implemented/architecture/2026-09-12-ptc-runtime-vocabulary.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-12-ptc-runtime-vocabulary.i18n.yaml
deleted file mode 100644
index ac5f77829d..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-12-ptc-runtime-vocabulary.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-12-ptc-runtime-vocabulary.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-12-ptc-runtime-vocabulary.md
-/agent-note-ptc-runtime-vocabulary:
- en: 4e585bb88c918c48
- zh: 1ee36889df928e84
-/agent-note-ptc-runtime-vocabulary/problem:
- en: 1281bbda56bc41e0
- zh: 719dc99572bd7921
-/agent-note-ptc-runtime-vocabulary/decision:
- en: b3ca07cb6a92f358
- zh: f3b763124b483563
-/agent-note-ptc-runtime-vocabulary/alternatives-considered:
- en: 38af2c476cc408bc
- zh: 9f1ebd14829250e3
-/agent-note-ptc-runtime-vocabulary/consequences:
- en: bb68774fb0a4bcc3
- zh: b866e8763b3a4f74
diff --git a/.agents/notes/implemented/architecture/2026-09-13-session-working-directory.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-13-session-working-directory.i18n.yaml
new file mode 100644
index 0000000000..49a9f432ee
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-13-session-working-directory.i18n.yaml
@@ -0,0 +1,19 @@
+# Bilingual-pair consistency record for 2026-09-13-session-working-directory.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-13-session-working-directory.md
+/agent-note-session-working-directory:
+ en: 4d5b74f6b55a2270
+ zh: 8323ea3fbdf8fd8d
+/agent-note-session-working-directory/problem:
+ en: 31fba384d90ce7d2
+ zh: f8b814868f3280c3
+/agent-note-session-working-directory/decision:
+ en: 9ccde1c5e635b9c0
+ zh: 4dc76229703d3ef7
+/agent-note-session-working-directory/alternatives-considered:
+ en: f0995feb9b6bcce8
+ zh: 97417085fd17f70f
+/agent-note-session-working-directory/consequences:
+ en: 2dd3a4de72ee6d74
+ zh: be5d8a80c8eaac6e
diff --git a/.agents/notes/implemented/architecture/2026-09-13-session-working-directory.md b/.agents/notes/implemented/architecture/2026-09-13-session-working-directory.md
new file mode 100644
index 0000000000..8151c0e85a
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-13-session-working-directory.md
@@ -0,0 +1,47 @@
+# Agent Note: Session working directory
+
+Status: implemented
+
+English | [中文](2026-09-13-session-working-directory.zh.md)
+
+## Problem
+
+A fixed Session creation directory cannot represent a task that changes checkout during its conversation. Independent tools resolving paths from different sources can read and write different projects, while changing the process directory also affects unrelated Sessions. Putting mutable directory information in the system prompt changes the reusable prompt prefix.
+
+## Decision
+
+`dsh-working-directory` owns one logged effective directory per Session. Its projection initializes from the immutable original project and folds `working-directory/change`; consumers read that owner instead of deriving execution paths from the header or sandbox root. Directory changes validate through the filesystem provider, serialize within the Session, and publish only after the new directory is available.
+
+The `dsh-base` composition mounts `working_directory({ cd? })` globally. The tool reads or changes the Session directory, so every Agent preset can select or recover it, including presets without file-editing tools. The Web composition keeps action tools in preset scopes.
+
+Required user-context snapshots carry the current value; each committed change attempts to queue a notice through the ordinary Agent inbox. Cancellation or disposal may discard unadmitted notices while the directory event survives for subsequent requests. The original project is the recovery destination when the selected directory disappears. Missing recovery destinations produce an error. Write permissions remain independent.
+
+Subagents capture the parent's current directory or an explicit override and commit their selected directory after inherited history. Existing processes, terminals, and persistent shells keep their process-local directory. Project instructions, skills, and completion follow the effective directory without changing Session identity, grouping, or runtime composition.
+
+Live Session skill catalogs and file completion validate through the same directory owner. These reads can commit recovery and queue its notice before discovery, keeping discovered files and subsequent operations tied to the committed Session directory. Cold skill catalogs read the recorded projection without activating an Agent.
+
+Web sidebar terminal environment lookup reads the effective directory without filesystem validation or recovery, so a missing directory does not prevent reconnecting to a retained terminal. New terminal creation validates and recovers through the directory owner before spawning; the process keeps that directory independently of later Session changes.
+
+Playwright MCP and Chrome DevTools MCP validate the effective directory when acquiring a Session's MCP connection and use it to launch the server. Later directory changes do not restart the retained server or change its process directory.
+
+File links and command directory labels use result metadata captured when each operation runs, so historical rows remain correct after later directory changes.
+
+The [prompt-variables note](2026-07-05-prompt-variables-and-tool-guidance-ownership.md) retains strict interpolation, route-variable ownership, and tool-guidance ownership. The [environment-suffix note](../../archived/bug-fix/2026-09-06-environment-prompt-suffix.md) retains ordered prefix/suffix placement for deployment, Harness source, and Web guidance. This decision owns directory state and placement in user context.
+
+## Alternatives considered
+
+**Rewrite the Session header.** The header is immutable identity metadata used by storage, grouping, and permission roots. Rewriting it would conflate current execution state with the original project.
+
+**Let worktree tools own directory state.** Ordinary directory changes, filesystem tools, and subagents need the same value. A Git-specific owner would duplicate selection and recovery.
+
+**Change the process directory or synchronize every shell.** Concurrent Sessions and existing subprocesses have independent lifetimes. A Session change affects new directory-based operations, while a shell's `cd` remains local.
+
+**Keep directory text in the system prompt.** Mutable operational context belongs after retained history, using the same user-context mechanism as permission state.
+
+## Consequences
+
+The runtime exposes one directory owner and preserves the original project. Consumers migrate together, including filesystem, shell, instructions, skills, subagents, and both SDKs. Directory existence can change outside the harness, so validation and logged recovery occur at use. Required runtime context remains visible even when optional context is suppressed.
+
+`{{cwd}}` has no loop-provided value; custom personas that depend on that built-in fail strict interpolation. Deployments remove those references using the [system-prompt migration guidance](../../../../packages/core/system-prompt/README.md). When both the current directory and its recovery destination are unavailable, prompt assembly rejects model turns; the [directory service recovery guidance](../../../../packages/session/working-directory/README.md#known-limitations-and-deferred-work) requires restoring the directory or selecting an existing absolute directory through the SDK or host service.
+
+Verification covers independent Sessions, relative changes, replay, cancellation, recovery, tool disposal, user-context rendering, provider inheritance, and real directory-based operations.
diff --git a/.agents/notes/implemented/architecture/2026-09-13-session-working-directory.zh.md b/.agents/notes/implemented/architecture/2026-09-13-session-working-directory.zh.md
new file mode 100644
index 0000000000..46246a9d67
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-13-session-working-directory.zh.md
@@ -0,0 +1,47 @@
+# Agent Note: Session working directory
+
+Status: implemented
+
+[English](2026-09-13-session-working-directory.md) | 中文
+
+## Problem
+
+固定的 Session 创建目录无法表示在对话中切换检出目录的任务。各工具从不同来源解析路径时，可能读写不同项目；改变进程目录还会影响其他 Session。把可变目录信息放入系统提示词会改变可复用的提示词前缀。
+
+## Decision
+
+`dsh-working-directory` 拥有每个 Session 的一个日志化有效目录。投影从不可变的原始项目初始化，并折叠 `working-directory/change`；消费者读取该服务，而不是从 header 或沙箱根目录派生执行路径。目录变更通过文件系统 provider 验证，在 Session 内串行执行，并只在新目录可用后发布。
+
+`dsh-base` 组合在全局挂载 `working_directory({ cd? })`。该工具读取或改变 Session 目录，使每个 Agent preset 都能选择或恢复它，包括没有文件编辑工具的 preset。Web 组合把操作工具放在 preset 作用域中。
+
+必需的用户上下文快照携带当前值；每次已提交变更都会尝试通过普通 Agent 收件箱排入通知。取消或销毁可能丢弃尚未进入请求的通知，但目录事件仍然保留，供后续请求使用。所选目录消失时恢复到原始项目。恢复目录也消失时返回错误。写权限保持独立。
+
+子代理捕获父代理当前目录或显式覆盖值，并在继承历史之后提交选定目录。已有进程、终端和持久 shell 保留进程局部目录。项目指令、技能和补全跟随有效目录，不改变 Session 身份、归属或运行时组合。
+
+活跃 Session 的技能目录与文件补全通过同一个目录 owner 验证目录。这些读取可在发现操作之前提交恢复并排入通知，使发现的文件与后续操作关联到已提交的 Session 目录。冷态技能目录读取已记录的投影，不激活 Agent。
+
+Web 侧栏终端的环境查询读取有效目录，不验证文件系统或执行恢复，因此目录缺失不会阻止重新连接保留的终端。新终端在创建进程前通过目录 owner 验证和恢复目录；后续 Session 目录变更不会改变该进程的目录。
+
+Playwright MCP 和 Chrome DevTools MCP 在获取 Session 的 MCP 连接时验证有效目录，并在该目录启动服务器。后续目录变更不会重启保留的服务器，也不会改变其进程目录。
+
+文件链接与命令目录标签使用各次操作执行时记录的结果元数据，因此后续目录变更不会使历史记录指向错误的位置。
+
+[提示词变量记录](2026-07-05-prompt-variables-and-tool-guidance-ownership.zh.md)保留严格插值、路由变量归属与工具指导归属。[环境后缀记录](../../archived/bug-fix/2026-09-06-environment-prompt-suffix.md)保留部署、Harness 源码与 Web 指导的有序前缀／后缀位置。本决策拥有目录状态及其用户上下文位置。
+
+## Alternatives considered
+
+**改写 Session header。** header 是存储、归属与权限根目录使用的不可变身份元数据。改写它会混淆当前执行状态与原始项目。
+
+**让 worktree 工具拥有目录状态。** 普通目录变更、文件系统工具和子代理需要同一个值。Git 专用 owner 会重复实现选择与恢复。
+
+**改变进程目录或同步所有 shell。** 并发 Session 与已有子进程具有独立生命周期。Session 变更影响新的目录相关操作，shell 内的 `cd` 则保持局部。
+
+**把目录文本留在系统提示词中。** 可变操作上下文应位于保留历史之后，复用权限状态的用户上下文机制。
+
+## Consequences
+
+运行时提供一个目录 owner，并保留原始项目。消费者一起迁移，包括文件系统、shell、指令、技能、子代理和两种 SDK。目录可能在 harness 之外消失，因此在使用时执行验证和日志化恢复。即使可选上下文被禁用，必需运行时上下文也仍然可见。
+
+`{{cwd}}` 没有循环提供的值；依赖该内置变量的自定义 persona 会触发严格插值错误。部署方按照[系统提示词迁移说明](../../../../packages/core/system-prompt/README.zh.md)移除这些引用。当前目录与恢复目标均不可用时，提示词组装会拒绝模型轮次；[目录服务恢复说明](../../../../packages/session/working-directory/README.zh.md#known-limitations-and-deferred-work)要求恢复目录，或通过 SDK 或 Host 服务选择现有的绝对目录。
+
+验证覆盖 Session 相互独立、相对路径变更、回放、取消、恢复、工具卸载、用户上下文渲染、provider 继承和真实目录操作。
diff --git a/.agents/notes/implemented/architecture/2026-09-13-workflow-ptc-sandbox-reuse.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-13-workflow-ptc-sandbox-reuse.i18n.yaml
index 46f602667d..ccb643fcc4 100644
--- a/.agents/notes/implemented/architecture/2026-09-13-workflow-ptc-sandbox-reuse.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-13-workflow-ptc-sandbox-reuse.i18n.yaml
@@ -9,8 +9,8 @@
en: 42235162e945e015
zh: 4edc5633720cd6cc
/agent-note-reuse-the-ptc-node-sandbox-for-workflows/decision:
- en: b55a2a59b8039cdd
- zh: fd6bbe987a49266f
+ en: 5112e6adc51b9c40
+ zh: 06277d1d753a9b6b
/agent-note-reuse-the-ptc-node-sandbox-for-workflows/alternatives-considered:
en: 56d9a25713227146
zh: 2cd89bf6ccc3b3bd
diff --git a/.agents/notes/implemented/architecture/2026-09-13-workflow-ptc-sandbox-reuse.md b/.agents/notes/implemented/architecture/2026-09-13-workflow-ptc-sandbox-reuse.md
index 9454ffef28..297ff20f3e 100644
--- a/.agents/notes/implemented/architecture/2026-09-13-workflow-ptc-sandbox-reuse.md
+++ b/.agents/notes/implemented/architecture/2026-09-13-workflow-ptc-sandbox-reuse.md
@@ -22,7 +22,7 @@ Progress uses one binding call at a time. The first batch starts synchronously;
The Node bootstrap keeps its control pipe open after sending the terminal frame until the host closes it. Unawaited binding replies may still be in flight, so eager child-side close would let an `EPIPE` race an already completed program.
-The [dynamic-workflows decision](../feature/2026-07-05-dynamic-workflows.md) retains the script, structured-output, event and tool semantics; this note supersedes only its execution substrate and trust realization. The [sandboxed Node PTC decision](2026-09-11-sandboxed-node-ptc-runtime.md) retains execution and control guarantees; the explicit null deadline extends its service options. The [agent-scope runtime design](2026-07-12-agent-scope-runtime-design.md#workflow-children-are-pending-starts-or-published-records) retains pending-start and child-cleanup ownership.
+The [dynamic-workflows reference](../../../../packages/workflow/workflow/README.md) retains the script, structured-output, event and tool semantics; this note supersedes only its execution substrate and trust realization. The [sandboxed Node PTC decision](2026-09-11-sandboxed-node-ptc-runtime.md) retains execution and control guarantees; the explicit null deadline extends its service options. The [agent-scope runtime design](../../../../packages/core/agent-loop/README.md) retains pending-start and child-cleanup ownership.
## Alternatives considered
diff --git a/.agents/notes/implemented/architecture/2026-09-13-workflow-ptc-sandbox-reuse.zh.md b/.agents/notes/implemented/architecture/2026-09-13-workflow-ptc-sandbox-reuse.zh.md
index c517060657..48dd4e4262 100644
--- a/.agents/notes/implemented/architecture/2026-09-13-workflow-ptc-sandbox-reuse.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-13-workflow-ptc-sandbox-reuse.zh.md
@@ -22,7 +22,7 @@ VM 定义辅助 API，以及协作式并发、agent 总数和条目上限。它
Node 引导程序发送终态帧后保持控制管道打开，直到 Host 将其关闭。未被等待的绑定回复可能仍在传输，因此子进程提前关闭会让 `EPIPE` 与已经完成的程序结果发生竞争。
-[动态工作流决策](../feature/2026-07-05-dynamic-workflows.zh.md)保留脚本、结构化输出、事件与工具语义；本文只取代其执行基底与信任实现。[沙箱化 Node PTC 决策](2026-09-11-sandboxed-node-ptc-runtime.zh.md)保留执行与控制保证；显式 null 截止扩展其服务选项。[agent 作用域运行时设计](2026-07-12-agent-scope-runtime-design.zh.md#workflow-children-are-pending-starts-or-published-records)保留待启动与子 agent 清理的归属规则。
+[动态工作流参考](../../../../packages/workflow/workflow/README.zh.md)保留脚本、结构化输出、事件与工具语义；本文只取代其执行基底与信任实现。[沙箱化 Node PTC 决策](2026-09-11-sandboxed-node-ptc-runtime.zh.md)保留执行与控制保证；显式 null 截止扩展其服务选项。[agent 作用域运行时设计](../../../../packages/core/agent-loop/README.zh.md)保留待启动与子 agent 清理的归属规则。
## 曾考虑的替代方案
diff --git a/.agents/notes/implemented/architecture/2026-09-14-independent-libreoffice-kit.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-14-independent-libreoffice-kit.i18n.yaml
index a0da60252b..175c7d9ac3 100644
--- a/.agents/notes/implemented/architecture/2026-09-14-independent-libreoffice-kit.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-14-independent-libreoffice-kit.i18n.yaml
@@ -9,8 +9,8 @@
en: 2fc4ac7bdd4a3474
zh: 21ebdd3ac9264132
/agent-note-independent-libreoffice-kit-ownership/decision:
- en: 31200a9be3940dc0
- zh: 8e22be1d160ec3e4
+ en: 0d8e05bcb940f88f
+ zh: b5b55f4ee82cf6a3
/agent-note-independent-libreoffice-kit-ownership/alternatives-considered:
en: 55175bb30630bf0c
zh: 788853ddd5f7a4e9
diff --git a/.agents/notes/implemented/architecture/2026-09-14-independent-libreoffice-kit.md b/.agents/notes/implemented/architecture/2026-09-14-independent-libreoffice-kit.md
index 13efc41e56..50e4ab6e0c 100644
--- a/.agents/notes/implemented/architecture/2026-09-14-independent-libreoffice-kit.md
+++ b/.agents/notes/implemented/architecture/2026-09-14-independent-libreoffice-kit.md
@@ -14,7 +14,7 @@ The `deepseek-harness/libreoffice-kit` repository owns the reusable `@deepseek-a
Kit releases run independently of Harness releases. The kit repository qualifies and publishes the Node API and engine npm packages at a shared version, starting at `0.0.1`. Harness consumes an exact npm version and commits its dependency resolution in `pnpm-lock.yaml`; Harness releases neither build nor publish kit packages.
-The upstream API declares platform engines as optional dependencies. The [platform engine decision](2026-09-15-platform-office-engines.md) supersedes the original required-WASM fallback policy. Desktop installs the kit as an external npm dependency. Python sidecars keep the Worker, selected engine, and their dependency closure on the real filesystem, outside the executable’s virtual filesystem. Conversion requires neither downloads nor GitHub credentials.
+The upstream API declares platform engines as optional dependencies. The [platform engine reference](../../../../packages/document/office-to-pdf/README.md) supersedes the original required-WASM fallback policy. Desktop installs the kit as an external npm dependency. Python sidecars keep the Worker, selected engine, and their dependency closure on the real filesystem, outside the executable’s virtual filesystem. Conversion requires neither downloads nor GitHub credentials.
The kit repository owns engine qualification and corresponding source materials. MPL-2.0 declarations, source availability, and redistribution notices accompany the API and engines; Harness retains these materials when packaging them. The notices check accepts the exact API, WASM, macOS ARM64/x64, and Windows ARM64/x64 package identities only at MPL-2.0; unrelated packages and changed license terms still reject.
diff --git a/.agents/notes/implemented/architecture/2026-09-14-independent-libreoffice-kit.zh.md b/.agents/notes/implemented/architecture/2026-09-14-independent-libreoffice-kit.zh.md
index 720ca2ba3f..222197ab5b 100644
--- a/.agents/notes/implemented/architecture/2026-09-14-independent-libreoffice-kit.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-14-independent-libreoffice-kit.zh.md
@@ -14,7 +14,7 @@ LibreOffice 编译、源码补丁、平台资格验证和大型二进制发布
kit 发布流程独立于 Harness 发布流程。kit 仓库验证并以统一版本发布 Node API 和引擎 npm 包，起始版本为 `0.0.1`。Harness 消费精确的 npm 版本，并在 `pnpm-lock.yaml` 中提交依赖解析结果；Harness 发布既不构建也不发布 kit 包。
-上游 API 将平台引擎声明为可选依赖。[平台引擎决策](2026-09-15-platform-office-engines.zh.md)取代最初强制携带 WASM 回退引擎的策略。Desktop 将 kit 作为外部 npm 依赖安装。Python sidecar 将 Worker、所选引擎及其依赖闭包保留在真实文件系统中，位于可执行文件的虚拟文件系统之外。转换无需下载或 GitHub 凭据。
+上游 API 将平台引擎声明为可选依赖。[平台引擎参考](../../../../packages/document/office-to-pdf/README.zh.md)取代最初强制携带 WASM 回退引擎的策略。Desktop 将 kit 作为外部 npm 依赖安装。Python sidecar 将 Worker、所选引擎及其依赖闭包保留在真实文件系统中，位于可执行文件的虚拟文件系统之外。转换无需下载或 GitHub 凭据。
kit 仓库负责引擎资格验证和对应源码材料。API 和引擎携带 MPL-2.0 声明、可访问源码及再分发声明；Harness 打包时保留这些材料。再分发声明检查仅在许可为 MPL-2.0 时接受 API、WASM、macOS ARM64/x64 和 Windows ARM64/x64 的精确包标识；无关包和改变后的许可条款仍被拒绝。
diff --git a/.agents/notes/implemented/architecture/2026-09-14-sidebar-layout-provider-recovery.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-14-sidebar-layout-provider-recovery.i18n.yaml
deleted file mode 100644
index 621d099284..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-14-sidebar-layout-provider-recovery.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-14-sidebar-layout-provider-recovery.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-14-sidebar-layout-provider-recovery.md
-/agent-note-sidebar-layout-persistence-and-provider-recovery:
- en: 78dee80210908b7d
- zh: 01a490734740a523
-/agent-note-sidebar-layout-persistence-and-provider-recovery/problem:
- en: 8adb7105e89be803
- zh: 96c4e92e85b6980e
-/agent-note-sidebar-layout-persistence-and-provider-recovery/decision:
- en: aa09cb90f663dfe8
- zh: edaabb76aa6dc8de
-/agent-note-sidebar-layout-persistence-and-provider-recovery/alternatives-considered:
- en: 4a9b1234b0289ae7
- zh: 81854e0e9d32b6da
-/agent-note-sidebar-layout-persistence-and-provider-recovery/consequences:
- en: 4daf813b59205ca3
- zh: 917c2b975c9a67dd
diff --git a/.agents/notes/implemented/architecture/2026-09-15-client-session-references.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-15-client-session-references.i18n.yaml
index d2b3a75106..f1173f2864 100644
--- a/.agents/notes/implemented/architecture/2026-09-15-client-session-references.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-15-client-session-references.i18n.yaml
@@ -12,8 +12,8 @@
en: a15c7c13f167e5ac
zh: 63bcc2ef60c2f344
/agent-note-client-session-references-reference-sources-and-ui-status/decision/scope-and-ownership:
- en: d9d52caab1468205
- zh: 1b7665610bb025c6
+ en: 3f04f9c2b7b0fc2b
+ zh: ebfcbac3de8463a3
/agent-note-client-session-references-reference-sources-and-ui-status/decision/addresses-bindings-and-references:
en: 3743abc8bca00348
zh: d79e6a9311f0a2fe
@@ -30,8 +30,8 @@
en: 04802baa0147fec1
zh: b86037bf2e4bc936
/agent-note-client-session-references-reference-sources-and-ui-status/decision/main-area-navigation-and-presentation:
- en: c46c9ca54ea9eaad
- zh: 918dc8eebff5edf3
+ en: 508268f083a644a9
+ zh: 9a3c0931d49fcedc
/agent-note-client-session-references-reference-sources-and-ui-status/decision/presets-and-creation-flows:
en: 70ef26a3cd399b14
zh: 5c81515ff896f91a
diff --git a/.agents/notes/implemented/architecture/2026-09-15-client-session-references.md b/.agents/notes/implemented/architecture/2026-09-15-client-session-references.md
index ca4055bd9e..83f2ec688b 100644
--- a/.agents/notes/implemented/architecture/2026-09-15-client-session-references.md
+++ b/.agents/notes/implemented/architecture/2026-09-15-client-session-references.md
@@ -30,7 +30,7 @@ Client Session objects, Agent-scoped Client Contexts, references, consumer-sourc
The [Client layering design](../../implemented/architecture/2026-08-20-client-session-conversation-ownership.md) defines one-way data, adapter, renderer, and presentation dependencies. Reference-source bookkeeping does not give the Controller a dependency on UI packages.
-This decision partially supersedes the list-selected scope lifecycle in the [Web Client Session scope and provide-channel decision](2026-07-25-web-client-session-scope-and-provide-channel.md); that note retains the blank-Session and adoption rationale under explicit Provider ownership.
+The [blank Session decision](2026-09-17-process-local-blank-sessions.md) owns creation and reuse; this decision owns explicit Provider references and adoption.
### Addresses, bindings, and references
@@ -156,7 +156,7 @@ The main view privately persists its target identity and subagent address under
| Chat/Trajectory restoration | Restore the view for the explicitly selected main target; independently bound views keep their own state |
| Cordis inventory panel | One list without current/other grouping; no public runner getter for main-area selection |
-Source metadata does not change when DOM focus moves or when a global panel hides a retained view. The [global main-panel design](../../implemented/architecture/2026-09-08-global-main-panels.md) owns panel selection and layout; Session reference ownership does not replace it.
+Source metadata does not change when DOM focus moves or when a global panel hides a retained view. The [global main-panel design](../../../../packages/client/ui-layout/README.md) owns panel selection and layout; Session reference ownership does not replace it.
Conversation retains its `hero`, `settling`, and `active` composition and existing history-loading and `openError` handling. Acquisition adds no outer loading/error phase presentation, extra composer-hiding condition, Retry button, or replacement Sidebar recovery panel. Existing error handlers continue to handle their errors; call sites without error presentation gain none. Promise rejection and correct reference release do not imply an additional UI handler.
diff --git a/.agents/notes/implemented/architecture/2026-09-15-client-session-references.zh.md b/.agents/notes/implemented/architecture/2026-09-15-client-session-references.zh.md
index b8c6c313f6..542def8a76 100644
--- a/.agents/notes/implemented/architecture/2026-09-15-client-session-references.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-15-client-session-references.zh.md
@@ -30,7 +30,7 @@ Client Session 对象、Agent 作用域的 Client Context、引用、使用方
[Client 分层设计](../../implemented/architecture/2026-08-20-client-session-conversation-ownership.zh.md)定义数据、适配器、渲染器与展示层的单向依赖。引用来源统计不会使 Controller 依赖 UI 包。
-本决策部分取代 [Web Client Session scope 与 provide channel 决策](2026-07-25-web-client-session-scope-and-provide-channel.zh.md)中由 list 选择驱动的 scope 生命周期；后者保留显式 Provider 所有权下的 blank Session 与收养语义理由。
+[空白 Session 决策](2026-09-17-process-local-blank-sessions.zh.md)负责创建与复用；本决策负责显式 Provider 引用与收养。
### 地址、binding 与引用
@@ -156,7 +156,7 @@ Conversation 的引用属于其视图所有者，不属于 Chat、Trajectory 或
| Chat/Trajectory 恢复 | 为显式选中的主目标恢复视图；独立绑定的视图保留自己的状态 |
| Cordis inventory 面板 | 使用不区分 current/other 的单一列表；runner 不提供主区域选择的公开 getter |
-DOM 焦点移动或全局面板隐藏仍被持有的视图时，来源元数据不变。[全局主面板设计](../../implemented/architecture/2026-09-08-global-main-panels.zh.md)拥有面板选择与布局；Session 引用所有权不替代它。
+DOM 焦点移动或全局面板隐藏仍被持有的视图时，来源元数据不变。[全局主面板设计](../../../../packages/client/ui-layout/README.zh.md)拥有面板选择与布局；Session 引用所有权不替代它。
Conversation 保留 `hero`、`settling`、`active` 组合与既有历史加载和 `openError` 处理。获取引用不增加外层 loading/error 阶段展示、额外隐藏 composer 的条件、Retry 按钮或替换 Sidebar 内容的恢复面板。已有错误处理方继续处理自己的错误；没有错误展示的调用点不增加展示。Promise 拒绝与正确释放引用不意味着额外增加 UI 处理方。
diff --git a/.agents/notes/implemented/architecture/2026-09-15-desktop-native-fatal-recovery.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-15-desktop-native-fatal-recovery.i18n.yaml
index b5ebc209af..8d942f2a1d 100644
--- a/.agents/notes/implemented/architecture/2026-09-15-desktop-native-fatal-recovery.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-15-desktop-native-fatal-recovery.i18n.yaml
@@ -9,8 +9,8 @@
en: 9cf7ba7dfd36aee0
zh: 356fdbb01870981e
/agent-note-native-desktop-fatal-recovery/decision:
- en: a3b9aa3659117524
- zh: 6f25cb295c37cddd
+ en: 02d07a5458e01321
+ zh: de9f480b7196f2c0
/agent-note-native-desktop-fatal-recovery/alternatives-considered:
en: 624d62bc0b73c37a
zh: 81c3d7cd66782f73
diff --git a/.agents/notes/implemented/architecture/2026-09-15-desktop-native-fatal-recovery.md b/.agents/notes/implemented/architecture/2026-09-15-desktop-native-fatal-recovery.md
index fc1564b02e..75364ae8ee 100644
--- a/.agents/notes/implemented/architecture/2026-09-15-desktop-native-fatal-recovery.md
+++ b/.agents/notes/implemented/architecture/2026-09-15-desktop-native-fatal-recovery.md
@@ -16,7 +16,7 @@ The first report claims presentation before awaiting the dialog. Later reports r
The Web document stays in place. A carrier callback owns startup failure presentation while the shared boot page retains its spinner; ordinary browser boot still renders its own failure report. Only the primary application frame may report a Web boot failure. Backend state remains in the main process, and native recovery directly owns disabling all third-party bundles. Desktop has no profile reset or emergency recovery document. A fatal backend failure requires one of the native recovery actions rather than an in-process retry.
-This supersedes recovery-page and reset behavior in the [immediate-window decision](2026-09-09-desktop-immediate-window-and-direct-start.md), whose immediate visibility and direct Host startup rationale remain active. The [Web wrapper decision](2026-09-10-desktop-web-wrapper.md) owns shared plugin management and native profile preparation.
+The [Desktop reference](../../../../apps/desktop/README.md) defines immediate window visibility and direct Host startup; this decision owns native fatal recovery. The [Web wrapper decision](2026-09-10-desktop-web-wrapper.md) owns shared plugin management and native profile preparation.
## Alternatives considered
diff --git a/.agents/notes/implemented/architecture/2026-09-15-desktop-native-fatal-recovery.zh.md b/.agents/notes/implemented/architecture/2026-09-15-desktop-native-fatal-recovery.zh.md
index ceda54b414..f5c1775278 100644
--- a/.agents/notes/implemented/architecture/2026-09-15-desktop-native-fatal-recovery.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-15-desktop-native-fatal-recovery.zh.md
@@ -16,7 +16,7 @@ Electron 在每个应用进程中提供一次原生致命错误对话框。明
Web 文档保留在原位。宿主回调负责启动失败展示，共享启动页保留加载动画；普通浏览器启动仍显示自身的失败报告。只有主应用框架可以上报 Web 启动失败。后端状态保留在主进程中，原生恢复直接负责禁用全部第三方 bundle。Desktop 不提供 profile 重置或应急恢复文档。后端致命故障必须通过原生恢复操作处理，不在当前进程中重试。
-本决策取代[立即显示窗口决策](2026-09-09-desktop-immediate-window-and-direct-start.zh.md)中的恢复页面和重置行为；其立即显示与直接启动 Host 的理由仍有效。[Web 薄壳决策](2026-09-10-desktop-web-wrapper.zh.md)负责共享插件管理和原生 profile 准备。
+[Desktop 参考](../../../../apps/desktop/README.zh.md)定义立即显示窗口与直接启动 Host；本决策负责原生致命故障恢复。[Web 薄壳决策](2026-09-10-desktop-web-wrapper.zh.md)负责共享插件管理和原生 profile 准备。
## Alternatives considered
diff --git a/.agents/notes/implemented/architecture/2026-09-15-guided-plugin-installation.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-15-guided-plugin-installation.i18n.yaml
index 9283aaa9e4..d1e00c2cd5 100644
--- a/.agents/notes/implemented/architecture/2026-09-15-guided-plugin-installation.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-15-guided-plugin-installation.i18n.yaml
@@ -9,14 +9,14 @@
en: edefff7cd986a509
zh: a270839fa86976a2
/agent-note-guided-plugin-installation/decision:
- en: b661fb786e7182c5
- zh: 4cdeb584639fda23
+ en: 30f1e636973df06a
+ zh: 0f874b88a5d4d7f5
/agent-note-guided-plugin-installation/alternatives-considered:
en: be64b541f4d81e7c
zh: 8600531c08ab4288
/agent-note-guided-plugin-installation/consequences:
- en: e4536b20f3587497
- zh: a8eeb1d3c578b785
+ en: bc1b116dd15ff420
+ zh: e886e84cc3081feb
/agent-note-guided-plugin-installation/testing:
en: 1e121dca5f7dc572
zh: bcdb1b6482cc1af6
diff --git a/.agents/notes/implemented/architecture/2026-09-15-guided-plugin-installation.md b/.agents/notes/implemented/architecture/2026-09-15-guided-plugin-installation.md
index 68bd519b7c..c0e9e68325 100644
--- a/.agents/notes/implemented/architecture/2026-09-15-guided-plugin-installation.md
+++ b/.agents/notes/implemented/architecture/2026-09-15-guided-plugin-installation.md
@@ -14,7 +14,7 @@ The install dialog put a spec straight into `pnpm add` and showed pnpm's termina
**A failed or cancelled installation restores the profile files.** `installBundle` snapshots `package.json` and `pnpm-lock.yaml` before pnpm runs and puts them back when pnpm fails, when the run is cancelled, or when the package pnpm added declares no bundle patch. This reverses, for installations only, the [manager's decision](2026-09-14-current-profile-plugin-management.md) to retain partial changes: an installation that did not produce a usable bundle must not leave a dependency the page cannot show. Removals keep that decision. Downloaded files can stay under `node_modules` and the pnpm store.
-**A failed run is classified where the facts are.** `classifyInstallFailure` reads how the run ended and what pnpm printed — its `ERR_PNPM_*` codes and Node's errno names — into `packageResult.kind`. A run the manager terminated is classified `timeout` whatever exit status the signal left behind, so installation restores the files and removal reports failure instead of reading it as a success ([run bounds](../bug-fix/2026-09-23-bounded-pnpm-runs.md)). The client shows the kind as one line and folds pnpm's output behind the details. Parsing the log is confined to this one function with a fixture-driven test.
+**A failed run is classified where the facts are.** `classifyInstallFailure` reads how the run ended and what pnpm printed — its `ERR_PNPM_*` codes and Node's errno names — into `packageResult.kind`. A run the manager terminated is classified `timeout` whatever exit status the signal left behind, so installation restores the files and removal reports failure instead of reading it as a success ([run bounds](../../../../packages/boot/plugin-manager/README.md)). The client shows the kind as one line and folds pnpm's output behind the details. Parsing the log is confined to this one function with a fixture-driven test.
**GitHub connection failures have a short budget before installation.** The Host runs a read-only `git ls-remote` check with the profile's Git and proxy configuration and a default `githubConnectionTimeoutMs` of 5000 ms. Credential helpers and prompts are disabled for this check, so authentication cannot consume the connection budget. Only network failures and timeouts prevent pnpm from starting; pnpm still owns authentication, HTTPS-to-SSH fallback, ref resolution and the full installation. The budget does not limit downloads or builds. The existing failure kind and `failedAt: 'spec-host'` let the Client show a connection error or timeout and offer a domestic registry for a replacement package spec. Cancellation and manager disposal terminate the check and its descendants before settling.
@@ -38,7 +38,7 @@ The install dialog put a spec straight into `pnpm add` and showed pnpm's termina
## Consequences
-`inspect`, `cancelInstall`, and the `plugin-manager/changed`, `plugin-manager/install-log`, and `plugin-manager/install-state` events join the manager's Remote; `listBundles` carries titles, rows, and overrides; `ChangeResult` gains `cancelled`, `bundle`, and `packageResult.kind`; the config gains `pnpmCommand`, `inspectTimeoutMs` and `githubConnectionTimeoutMs`. The dialog is four screens over one subject card.
+`inspect`, `cancelInstall`, and the `plugin-manager/changed`, `plugin-manager/install-log`, and `plugin-manager/install-state` events join the manager's Remote; `listBundles` carries titles, rows, and overrides; `ChangeResult` gains `cancelled`, `bundle`, `version`, and `packageResult.kind`; the config gains `pnpmCommand`, `inspectTimeoutMs` and `githubConnectionTimeoutMs`. The dialog is four screens over one subject card.
## Testing
diff --git a/.agents/notes/implemented/architecture/2026-09-15-guided-plugin-installation.zh.md b/.agents/notes/implemented/architecture/2026-09-15-guided-plugin-installation.zh.md
index f3cbefedeb..0d914869a3 100644
--- a/.agents/notes/implemented/architecture/2026-09-15-guided-plugin-installation.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-15-guided-plugin-installation.zh.md
@@ -14,7 +14,7 @@ Status: implemented
**失败或被取消的安装恢复 profile 文件。** `installBundle` 在 pnpm 运行前快照 `package.json` 与 `pnpm-lock.yaml`，在 pnpm 失败、运行被取消、或 pnpm 装入的包没有声明组合包 patch 时把它们放回去。这只针对安装反转了[管理器的决定](2026-09-14-current-profile-plugin-management.zh.md)中"保留部分改动"的部分：没有产出可用组合包的安装，不能留下一个页面无法显示的依赖。删除仍沿用那个决定。已下载文件可能留在 `node_modules` 与 pnpm 缓存中。
-**失败在事实所在处分类。** `classifyInstallFailure` 依据运行的结束方式和 pnpm 的输出——它的 `ERR_PNPM_*` 码和 Node 的 errno 名——给出 `packageResult.kind`。被管理器终止的运行，不论信号留下什么退出状态都归类为 `timeout`，因此安装会还原文件，删除则报告失败而不会读成成功（[运行上界](../bug-fix/2026-09-23-bounded-pnpm-runs.zh.md)）。客户端把 kind 显示成一句话，把 pnpm 输出折叠进详情。对日志的解析只存在于这一个函数，用夹具驱动的测试钉住。
+**失败在事实所在处分类。** `classifyInstallFailure` 依据运行的结束方式和 pnpm 的输出——它的 `ERR_PNPM_*` 码和 Node 的 errno 名——给出 `packageResult.kind`。被管理器终止的运行，不论信号留下什么退出状态都归类为 `timeout`，因此安装会还原文件，删除则报告失败而不会读成成功（[运行上界](../../../../packages/boot/plugin-manager/README.zh.md)）。客户端把 kind 显示成一句话，把 pnpm 输出折叠进详情。对日志的解析只存在于这一个函数，用夹具驱动的测试钉住。
**GitHub 连接失败在安装前有单独的短时限。** 宿主通过只读的 `git ls-remote` 检查连接，沿用 profile 的 Git 与代理配置，`githubConnectionTimeoutMs` 默认为 5000 毫秒。这次检查禁用凭据助手和认证提示，避免认证过程占用连接预算。只有网络失败与超时会阻止 pnpm 启动；认证、HTTPS 到 SSH 的回退、ref 解析及完整安装仍由 pnpm 负责。时限不约束下载或构建。已有的失败类型与 `failedAt: 'spec-host'` 让客户端显示连接失败或超时，并提供国内镜像供用户输入另一个包名。取消安装或销毁管理器会先终止检查及其子进程，再结束操作。
@@ -38,7 +38,7 @@ Status: implemented
## 后果
-`inspect`、`cancelInstall` 以及 `plugin-manager/changed`、`plugin-manager/install-log`、`plugin-manager/install-state` 事件加入管理器的 Remote；`listBundles` 携带标题、行与覆盖项；`ChangeResult` 增加 `cancelled`、`bundle` 与 `packageResult.kind`；配置增加 `pnpmCommand`、`inspectTimeoutMs` 与 `githubConnectionTimeoutMs`。对话框是围绕同一张主题卡的四个画面。
+`inspect`、`cancelInstall` 以及 `plugin-manager/changed`、`plugin-manager/install-log`、`plugin-manager/install-state` 事件加入管理器的 Remote；`listBundles` 携带标题、行与覆盖项；`ChangeResult` 增加 `cancelled`、`bundle`、`version` 与 `packageResult.kind`；配置增加 `pnpmCommand`、`inspectTimeoutMs` 与 `githubConnectionTimeoutMs`。对话框是围绕同一张主题卡的四个画面。
## 测试
diff --git a/.agents/notes/implemented/architecture/2026-09-15-narrow-pi-ai-runtime-imports.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-15-narrow-pi-ai-runtime-imports.i18n.yaml
deleted file mode 100644
index 7e6309f2da..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-15-narrow-pi-ai-runtime-imports.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-15-narrow-pi-ai-runtime-imports.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-15-narrow-pi-ai-runtime-imports.md
-/agent-note-narrow-pi-ai-runtime-imports:
- en: d29340bbc4bf0e5b
- zh: 12a39c4efe53b580
-/agent-note-narrow-pi-ai-runtime-imports/problem:
- en: 4b2048b356064ada
- zh: 9926d7c54da73852
-/agent-note-narrow-pi-ai-runtime-imports/decision:
- en: d425c01ec05ee7f2
- zh: 8d58d6db913720c4
-/agent-note-narrow-pi-ai-runtime-imports/alternatives-considered:
- en: c663ce67f3831d3f
- zh: de280dc149d5a6a0
-/agent-note-narrow-pi-ai-runtime-imports/consequences:
- en: 9707284a83c1294a
- zh: c53be621aac00fc9
diff --git a/.agents/notes/implemented/architecture/2026-09-15-platform-office-engines.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-15-platform-office-engines.i18n.yaml
deleted file mode 100644
index c20b10b6fe..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-15-platform-office-engines.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-15-platform-office-engines.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-15-platform-office-engines.md
-/agent-note-one-office-engine-per-platform:
- en: 5ba8eea6deb11824
- zh: 7d1cb289fa278c74
-/agent-note-one-office-engine-per-platform/problem:
- en: 803030fa18966fef
- zh: bb1bbd185860f533
-/agent-note-one-office-engine-per-platform/decision:
- en: 8cea2cb889666af7
- zh: 346adb1e99787c78
-/agent-note-one-office-engine-per-platform/alternatives-considered:
- en: d406d0a9f4dd503a
- zh: b2685e11d706799e
-/agent-note-one-office-engine-per-platform/consequences:
- en: 7e236c479975eee6
- zh: 94a8e0e8883bd324
diff --git a/.agents/notes/implemented/architecture/2026-09-16-creator-persistent-plugin-management.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-16-creator-persistent-plugin-management.i18n.yaml
index 0c59a93381..e2da7be945 100644
--- a/.agents/notes/implemented/architecture/2026-09-16-creator-persistent-plugin-management.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-16-creator-persistent-plugin-management.i18n.yaml
@@ -9,8 +9,8 @@
en: 44615a7a0939054e
zh: b8efa721321ba0d7
/agent-note-creator-mode-installs-persistent-plugin-bundles/decision:
- en: 3530a89a72e35bdd
- zh: 3601941563747b5d
+ en: c0d74db1b2b16576
+ zh: b8713a6aadf007f9
/agent-note-creator-mode-installs-persistent-plugin-bundles/alternatives-considered:
en: af527d8aabdfd59c
zh: 34388da992d2ab56
diff --git a/.agents/notes/implemented/architecture/2026-09-16-creator-persistent-plugin-management.md b/.agents/notes/implemented/architecture/2026-09-16-creator-persistent-plugin-management.md
index 04ccbb83fe..5723eba63e 100644
--- a/.agents/notes/implemented/architecture/2026-09-16-creator-persistent-plugin-management.md
+++ b/.agents/notes/implemented/architecture/2026-09-16-creator-persistent-plugin-management.md
@@ -12,7 +12,7 @@ Agents need to install capabilities and use them during the same conversation. G
Creator mode enables the existing `plugin_manager` tool. Agents author packages and Loader YAML patches as workspace files, then install them through `install_bundle`. An MCP connection is a configuration-only bundle inserting the installed `dsh-mcp-client`; a UI bundle includes a Host entry and a Client artifact. Profile locking, package installation, enablement and HMR remain owned by the existing manager. The entire management tool requires `danger-full-access` or approval for one call: profile changes can load code with host permissions and affect other sessions. Each execution, including inventory reads, uses the shared sandbox escalation helper and approval service before accessing the manager. Under lower sandbox modes, `ask` requests approval and `never` denies; a full-access session needs no additional approval. A grant does not change session permissions, but its profile changes persist. This keeps shell-equivalent Host access explicit without requiring a permanent session-wide elevation. Human-operated Web and CLI controls retain their existing behavior.
-The model sees two read-only Cordis inspection tools. Generated-code define/run/stop/undefine and dynamic self-inspection tool APIs are absent. Existing runtime and Client consumers retain their services; historical session cards remain readable. This supersedes only the model-facing mutation workflow in the [self-referential toolset decision](../feature/2026-07-08-self-referential-cordis-toolset.md); its runtime ownership and sandbox rationale remain independently relevant. The [profile transaction decision](2026-09-14-current-profile-plugin-management.md) continues to govern locking, package installation, and partial failures.
+The model sees two read-only Cordis inspection tools. Generated-code define/run/stop/undefine and dynamic self-inspection tool APIs are absent. Existing runtime and Client consumers retain their services; historical session cards remain readable. This supersedes only the model-facing mutation workflow in the [self-referential toolset reference](../../../../packages/extensions/cordis-host-runner/README.md); its runtime ownership and sandbox rationale remain independently relevant. The [profile transaction decision](2026-09-14-current-profile-plugin-management.md) continues to govern locking, package installation, and partial failures.
Visual creation requests default to an installed Client plugin rendered in the current Web page unless the user names another destination. The development skill supplies a minimal package and effect-owned Client registration. Discovery ends when the required APIs are known; a working first version is installed before optional visual refinement. Verification uses the connected page where available. Browser authentication or operating-system setup is not a prerequisite for plugin installation, and a mock preview cannot establish an in-app result.
diff --git a/.agents/notes/implemented/architecture/2026-09-16-creator-persistent-plugin-management.zh.md b/.agents/notes/implemented/architecture/2026-09-16-creator-persistent-plugin-management.zh.md
index 91afa00cd3..33c1fd867f 100644
--- a/.agents/notes/implemented/architecture/2026-09-16-creator-persistent-plugin-management.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-16-creator-persistent-plugin-management.zh.md
@@ -12,7 +12,7 @@ agent 需要安装能力并在同一段对话中使用。生成代码工具在
创造模式启用现有的 `plugin_manager` 工具。agent 将包和 Loader YAML patch 写入工作区文件，再通过 `install_bundle` 安装。MCP 连接是插入已安装 `dsh-mcp-client` 的纯配置组合包；UI 组合包包含 Host 入口和 Client 产物。profile 锁、包安装、启停和 HMR 继续由现有管理器负责。 整个管理工具要求 `danger-full-access` 或单次调用的批准：profile 变更能以宿主权限加载代码，并影响其他会话。每次执行（包括查询列表）都会先使用共享沙箱提权函数和审批服务，再访问管理器。在较低沙箱模式下，`ask` 请求审批，`never` 拒绝；完整权限会话无需额外审批。批准不改变会话权限，但本次操作的 profile 变更会持久化。这让与 shell 等价的宿主访问需要明确授权，同时不必永久提升整个会话的权限。由用户直接操作的 Web 和 CLI 控件保持原有行为。
-模型可见两个只读 Cordis 检查工具，不再提供生成代码的 define/run/stop/undefine 和动态自省工具 API。现有运行时和 Client 消费者保留其服务；历史会话卡片仍然可读。这仅取代[自引用工具集决策](../feature/2026-07-08-self-referential-cordis-toolset.zh.md)中的模型侧变更流程；其运行时所有权和沙箱依据仍有独立价值。[profile 事务决策](2026-09-14-current-profile-plugin-management.zh.md)继续规定锁、包安装和部分失败行为。
+模型可见两个只读 Cordis 检查工具，不再提供生成代码的 define/run/stop/undefine 和动态自省工具 API。现有运行时和 Client 消费者保留其服务；历史会话卡片仍然可读。这仅取代[自引用工具集参考](../../../../packages/extensions/cordis-host-runner/README.zh.md)中的模型侧变更流程；其运行时所有权和沙箱依据仍有独立价值。[profile 事务决策](2026-09-14-current-profile-plugin-management.zh.md)继续规定锁、包安装和部分失败行为。
除非用户指定其他目标，视觉创建请求默认通过已安装的 Client 插件显示在当前 Web 页面。开发 skill 提供最小包和由 effect 管理的 Client 注册示例。已知所需 API 后结束探查，在可选视觉优化之前先安装能工作的初版。有条件时使用已连接页面验证。浏览器认证或操作系统设置不是安装插件的前提，mock 预览不能证明应用内结果。
diff --git a/.agents/notes/implemented/architecture/2026-09-16-desktop-cos-upload-transport.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-16-desktop-cos-upload-transport.i18n.yaml
deleted file mode 100644
index 8a90598c63..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-16-desktop-cos-upload-transport.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-16-desktop-cos-upload-transport.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-16-desktop-cos-upload-transport.md
-/agent-note-upload-desktop-releases-through-the-tencent-cos-sdk:
- en: acead237faaa9390
- zh: ca5d23451f3b4577
-/agent-note-upload-desktop-releases-through-the-tencent-cos-sdk/problem:
- en: 74f8515cdbb2a0aa
- zh: a00d1b08db6d6158
-/agent-note-upload-desktop-releases-through-the-tencent-cos-sdk/decision:
- en: 54cef8eacccce2e8
- zh: 8bad9ce5c932e0dd
-/agent-note-upload-desktop-releases-through-the-tencent-cos-sdk/testing:
- en: c15a405f365ca499
- zh: ee59d1b593473ee7
-/agent-note-upload-desktop-releases-through-the-tencent-cos-sdk/alternatives-considered:
- en: faae1f132d6cd404
- zh: 1683143fbe6b07ce
-/agent-note-upload-desktop-releases-through-the-tencent-cos-sdk/consequences:
- en: 2453f558b12db1ec
- zh: 15d77bfb842f9b31
diff --git a/.agents/notes/implemented/architecture/2026-09-16-host-schedule-storage.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-16-host-schedule-storage.i18n.yaml
index 3be199a3df..a59c5e9371 100644
--- a/.agents/notes/implemented/architecture/2026-09-16-host-schedule-storage.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-16-host-schedule-storage.i18n.yaml
@@ -9,8 +9,8 @@
en: 2c774d05ae75784f
zh: 619ba7f281b13233
/agent-note-host-owned-scheduled-messages/decision:
- en: de81925284f13c12
- zh: d0ef35c8b58813f2
+ en: 1210b3975fd26bb3
+ zh: 3322e6d0aa63fdb0
/agent-note-host-owned-scheduled-messages/alternatives-considered:
en: 21d7ec9a9ff3cbf2
zh: 93d03b8b3012aa7e
diff --git a/.agents/notes/implemented/architecture/2026-09-16-host-schedule-storage.md b/.agents/notes/implemented/architecture/2026-09-16-host-schedule-storage.md
index 89d5952c9f..cd295da249 100644
--- a/.agents/notes/implemented/architecture/2026-09-16-host-schedule-storage.md
+++ b/.agents/notes/implemented/architecture/2026-09-16-host-schedule-storage.md
@@ -14,7 +14,7 @@ The existing Schedule package owns one Host storage domain containing each task'
The task domain declares the whole-unit layout. Tasks are authoritative, so the JSON backend rejects an unreadable file, malformed document, unsupported version, or invalid task as a complete load failure instead of interpreting it as deletion. Failed recovery leaves `schedule.json` unchanged, while an initially absent file opens as an empty domain; repairing the file preserves task identity. `Service.init` waits for both storage validation and runtime setup, management methods wait for the same initialization result, and an unloading owner releases late-acquired storage without starting dispatch. Dispatch admission is separate from initialization: an ancestor can close Agent admission after a task mutation commits but before runtime cleanup starts. That refusal is logged without automatic retry and does not turn the persisted mutation into a failed management result. Invalid storage and failed cleanup registration still reject startup.
-This supersedes the Session-log authority, live-only activation, and read-only catalog decisions in the [Session-local reminders note](../feature/2026-08-05-durable-web-schedule.md). Its explicit absolute-time validation, fixed-rate arithmetic, and distinction between queue admission and model completion remain applicable. Historical `schedule/change` creation, fold, and invariant types remain restricted to After, At, and Every through `LegacyScheduleRecord`; a separate Host decoder accepts the current `ScheduleRecord`, including Daily, Weekly, and Cron. The Host record decoder requires a stored `title` that is non-empty after trimming, already trimmed, and at most 120 characters, and the strict task schema rejects the whole domain open instead of dropping such a task. The historical change decoder tolerates an absent `title` so an already-written Session log stays readable, and it applies the same three checks when the member is present. The storage domain remains version 1. Historical events do not populate that domain, and existing `at` tasks are not converted into daily or weekly rules. Loading a Session with active legacy reminders warns that they must be recreated.
+This replaces the earlier Session-log authority, live-only activation, and read-only catalog decisions. The [Schedule reference](../../../../packages/schedule/schedule/README.md) owns explicit absolute-time validation, fixed-rate arithmetic, and the distinction between queue admission and model completion. Historical `schedule/change` creation and fold types remain restricted to After, At, and Every through `LegacyScheduleRecord`; a separate Host decoder accepts the current `ScheduleRecord`, including Daily, Weekly, and Cron. The Host record decoder requires a stored `title` that is non-empty after trimming, already trimmed, and at most 120 characters, and the strict task schema rejects the whole domain open instead of dropping such a task. The historical change decoder tolerates an absent `title` so an already-written Session log stays readable, and it applies the same three checks when the member is present. The storage domain remains version 1. Historical events do not populate that domain, and existing `at` tasks are not converted into daily or weekly rules. Loading a Session with active legacy reminders warns that they must be recreated.
A plugin-sourced `followup()` synchronously appends the message to the Session inbox. Successful Session flush acknowledges durable delivery. One task-record put stores `lastDelivery`, appends a delivery record with the occurrence target, acknowledgment time, actual message id, and instruction snapshot, and updates the one-shot's `inactive` status or the recurring task's next target and status. Task state and its saved history therefore share one commit. Inactive tasks remain stored and never schedule another delivery; explicit deletion stops future delivery and removes the row together with its saved records. These records acknowledge inbox delivery, not user receipt or model execution completion.
diff --git a/.agents/notes/implemented/architecture/2026-09-16-host-schedule-storage.zh.md b/.agents/notes/implemented/architecture/2026-09-16-host-schedule-storage.zh.md
index ecd15d790b..c5ee3ac455 100644
--- a/.agents/notes/implemented/architecture/2026-09-16-host-schedule-storage.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-16-host-schedule-storage.zh.md
@@ -14,7 +14,7 @@ Status: implemented
任务 domain 声明整 unit 布局。任务是权威数据，因此 JSON 后端会把文件不可读、文档损坏、版本不受支持或任务非法作为整批加载失败，而不是解释为删除。恢复失败不会改写 `schedule.json`，初始不存在的文件则作为空 domain 打开；修复该文件后会保留任务身份。`Service.init` 等待存储校验和运行时初始化，管理方法等待同一初始化结果；拥有方卸载时释放迟到的存储资源，而不开始投递。投递调度准入与初始化分开：任务变更提交后、运行时清理开始前，祖先可能关闭 Agent 准入。此类拒绝会记录日志而不自动重试，不会将已持久化的变更变成失败的管理结果。存储非法和清理注册失败仍拒绝启动。
-此决策替代[会话内提醒记录](../feature/2026-08-05-durable-web-schedule.zh.md)中的 Session 日志权威来源、仅 live 时激活和只读目录决策。其中显式绝对时间校验、固定速率计算，以及区分排队接纳与模型完成的决策仍然适用。历史 `schedule/change` 的创建、fold 和 invariant 类型通过 `LegacyScheduleRecord` 保持为 After、At 和 Every；独立的宿主解码器接受包含 Daily、Weekly 与 Cron 的当前 `ScheduleRecord`。宿主记录解码器要求已存储的 `title` 去除首尾空白后非空、本身已去除首尾空白且不超过 120 个字符，严格的 task schema 会拒绝整个 domain 的打开，而不是丢弃这样的任务。历史变更解码器容忍缺失的 `title`，以便已写入的 Session 日志仍可读取；该成员存在时，同样按这三项检查校验。storage domain 保持版本 1。历史事件不会填充该 domain，已有 `at` 任务也不会转换为每日或每周规则。加载含有活动旧提醒的 Session 时，会警告需要重新创建提醒。
+本决策替代先前的 Session 日志权威来源、仅 live 时激活和只读目录决策。[Schedule 参考](../../../../packages/schedule/schedule/README.zh.md)负责显式绝对时间校验、固定速率计算，以及区分排队接纳与模型完成。历史 `schedule/change` 的创建与 fold 类型通过 `LegacyScheduleRecord` 保持为 After、At 和 Every；独立的宿主解码器接受包含 Daily、Weekly 与 Cron 的当前 `ScheduleRecord`。宿主记录解码器要求已存储的 `title` 去除首尾空白后非空、本身已去除首尾空白且不超过 120 个字符，严格的 task schema 会拒绝整个 domain 的打开，而不是丢弃这样的任务。历史变更解码器容忍缺失的 `title`，以便已写入的 Session 日志仍可读取；该成员存在时，同样按这三项检查校验。storage domain 保持版本 1。历史事件不会填充该 domain，已有 `at` 任务也不会转换为每日或每周规则。加载含有活动旧提醒的 Session 时，会警告需要重新创建提醒。
插件来源的 `followup()` 同步将消息追加到 Session 收件箱。Session flush 成功后确认持久投递。一次任务记录 put 存储 `lastDelivery`，追加包含发生目标、确认时间、真实消息 id 和指令快照的发送记录，并更新一次性任务的 `inactive` 状态或重复任务的下一目标和状态。因此，任务状态与其保存的历史共用一次提交。未运行任务仍保留在存储中，且不会再次安排投递；显式删除会阻止后续投递，并把该行连同其已保存记录一并移除。这些记录确认收件箱投递，不表示用户收到消息或模型执行完成。
diff --git a/.agents/notes/implemented/architecture/2026-09-16-plugin-configuration-on-the-plugins-page.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-16-plugin-configuration-on-the-plugins-page.i18n.yaml
deleted file mode 100644
index 209838a431..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-16-plugin-configuration-on-the-plugins-page.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-16-plugin-configuration-on-the-plugins-page.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-16-plugin-configuration-on-the-plugins-page.md
-/agent-note-plugin-configuration-on-the-plugins-page:
- en: e3cb8f2cfd31ee99
- zh: 75c7c498bb5b29e4
-/agent-note-plugin-configuration-on-the-plugins-page/problem:
- en: 9ca845902f1df3a2
- zh: 41e3157a843a511e
-/agent-note-plugin-configuration-on-the-plugins-page/decision:
- en: ccee8068ea810fcb
- zh: c87c4e6c44b33a67
-/agent-note-plugin-configuration-on-the-plugins-page/consequences:
- en: d3d131d6c46bc32e
- zh: eb7c06f119dfbe8d
-/agent-note-plugin-configuration-on-the-plugins-page/alternatives-considered:
- en: 14c6db09f23c2005
- zh: 979730121cd837c3
-/agent-note-plugin-configuration-on-the-plugins-page/testing:
- en: b58fdf0d5922f52b
- zh: 0b999255d2b9b832
diff --git a/.agents/notes/implemented/architecture/2026-09-16-size-neutral-product-icon-weights.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-16-size-neutral-product-icon-weights.i18n.yaml
deleted file mode 100644
index de00746f9a..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-16-size-neutral-product-icon-weights.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-16-size-neutral-product-icon-weights.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-16-size-neutral-product-icon-weights.md
-/agent-note-size-neutral-product-icon-weights:
- en: f0d742af33e3297e
- zh: 5db6cdc26635d843
-/agent-note-size-neutral-product-icon-weights/problem:
- en: aae2bf56f8695ee8
- zh: 491fa683d7cc580f
-/agent-note-size-neutral-product-icon-weights/decision:
- en: c0680b384d4198c8
- zh: a34f4481b7784b4f
-/agent-note-size-neutral-product-icon-weights/alternatives-considered:
- en: bda83cdc7a7c59a9
- zh: d3592cdf068556ea
-/agent-note-size-neutral-product-icon-weights/consequences:
- en: bceee31f65a32e69
- zh: d8fad0a01f1a7e7a
diff --git a/.agents/notes/implemented/architecture/2026-09-16-size-neutral-product-icon-weights.md b/.agents/notes/implemented/architecture/2026-09-16-size-neutral-product-icon-weights.md
deleted file mode 100644
index 3850fcbddf..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-16-size-neutral-product-icon-weights.md
+++ /dev/null
@@ -1,29 +0,0 @@
-# Agent Note: Size-neutral product icon weights
-
-Status: implemented
-
-English | [中文](2026-09-16-size-neutral-product-icon-weights.zh.md)
-
-## Problem
-
-Shared product-icon exports encoded one historical render size in each symbol name even though every component accepted a `size` prop. Consumers also thickened selected icons through local CSS or separate drawings, so emphasis had no named library choice and could drift between features.
-
-## Decision
-
-Every shared product glyph exports a size-neutral `Regular` and `Medium` component. `Regular` renders the supplied one-pixel artwork, while `Medium` renders the same paths with a 1.3px inherited stroke; filled regions remain unchanged. The `size` prop controls rendered dimensions, and the former numeric suffix survives only as the default size when a glyph has no 16px source.
-
-`LinkIconRegular` and `LinkIconMedium`, `ReferenceIconRegular` and `ReferenceIconMedium`, and the three `PermissionIcon*Regular`/`PermissionIcon*Medium` pairs follow the same rule. Repository consumers use a named weight instead of a numeric export.
-
-Medium weight is reserved for deliberate emphasis: new-Session controls, Settings trigger and navigation icons, Appearance choices, the composer add button, and clickable artifact-link glyphs. Other existing consumers use Regular. The composer command menu uses `PermissionIconFullAccessRegular` for the permission command because that row names permission elevation rather than the current mode.
-
-## Alternatives considered
-
-**Keep pixel sizes in export names.** Rejected because the suffix duplicated the runtime `size` prop and created separate names for identical geometry.
-
-**Expose one component with a `weight` prop.** Rejected because call sites would hide the chosen weight inside props; explicit component names keep visual emphasis searchable and reviewable.
-
-**Override stroke width in consumer CSS.** Rejected because source SVG elements can carry their own stroke widths, and local overrides would recreate inconsistent weighting outside the library.
-
-## Consequences
-
-The icon API is intentionally breaking while pre-stable: every consumer names `Regular` or `Medium`, and former 14px call sites pass an explicit size when they share geometry with a 16px export. New product glyphs add both weights from one geometry definition. Fill-only artwork exposes both names for API consistency even when stroke weight does not change its appearance. The hierarchy choices above remain explicit at their render sites rather than becoming global size or opacity overrides.
diff --git a/.agents/notes/implemented/architecture/2026-09-16-size-neutral-product-icon-weights.zh.md b/.agents/notes/implemented/architecture/2026-09-16-size-neutral-product-icon-weights.zh.md
deleted file mode 100644
index 84031677e9..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-16-size-neutral-product-icon-weights.zh.md
+++ /dev/null
@@ -1,29 +0,0 @@
-# Agent Note: 尺寸无关的产品图标线重
-
-Status: implemented
-
-[English](2026-09-16-size-neutral-product-icon-weights.md) | 中文
-
-## 问题
-
-共享产品图标的导出名称包含一个历史渲染尺寸，但每个组件已经接受 `size` prop。消费方还会通过本地 CSS 或独立图稿加粗部分图标，视觉强调没有具名的图标库选项，因而可能在不同功能间漂移。
-
-## 决策
-
-每个共享产品图形都导出尺寸无关的 `Regular` 和 `Medium` 组件。`Regular` 渲染提供的 1px 图稿，`Medium` 使用相同路径并继承 1.3px 描边；填充区域保持不变。`size` prop 控制渲染尺寸；仅当图稿没有 16px 来源时，原数字后缀才作为默认尺寸保留。
-
-`LinkIconRegular` 与 `LinkIconMedium`、`ReferenceIconRegular` 与 `ReferenceIconMedium`，以及三组 `PermissionIcon*Regular`/`PermissionIcon*Medium` 遵循同一规则。仓库内消费方使用具名线重，不再使用带数字的导出名。
-
-Medium 线重只用于明确强调的场景：新建会话控件、设置入口与导航图标、外观选项、输入框加号按钮，以及可点击产物链接的图标。其他既有消费方使用 Regular。编辑器加号菜单中的权限命令使用 `PermissionIconFullAccessRegular`，因为该行表示权限提升，而不是当前权限模式。
-
-## 考虑过的替代方案
-
-**在导出名中保留像素尺寸。** 否决，因为后缀重复了运行时 `size` prop，并为相同几何创建了多个名称。
-
-**只导出一个带 `weight` prop 的组件。** 否决，因为调用点会把线重选择隐藏在 prop 中；显式组件名便于搜索和审查视觉强调。
-
-**在消费方 CSS 中覆盖描边宽度。** 否决，因为源 SVG 元素可能自带描边宽度，本地覆盖会在图标库外重新产生不一致线重。
-
-## 后果
-
-图标 API 在预稳定阶段有意进行破坏性调整：每个消费方明确选择 `Regular` 或 `Medium`；原 14px 调用点与 16px 导出共享几何时会显式传入尺寸。新增产品图形从同一份几何定义同时提供两种线重。仅填充的图稿也为 API 一致性导出两个名称，即使线重不会改变其外观。上述层级选择继续由对应渲染点显式声明，不会变成全局尺寸或透明度覆盖。
diff --git a/.agents/notes/implemented/architecture/2026-09-17-frame-shell-leading-window-chrome-seat.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-17-frame-shell-leading-window-chrome-seat.i18n.yaml
deleted file mode 100644
index 16d3ced836..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-17-frame-shell-leading-window-chrome-seat.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-17-frame-shell-leading-window-chrome-seat.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-17-frame-shell-leading-window-chrome-seat.md
-/agent-note-frame-owned-shell-leading-window-chrome-seat:
- en: 3e2cfa57af6b53e7
- zh: 78fe101ad11a6330
-/agent-note-frame-owned-shell-leading-window-chrome-seat/problem:
- en: 09b5defb78287f7e
- zh: b7333ce5077914a2
-/agent-note-frame-owned-shell-leading-window-chrome-seat/decision:
- en: 04853eeed03a00c5
- zh: 9542acfaa6258842
-/agent-note-frame-owned-shell-leading-window-chrome-seat/alternatives-considered:
- en: 81e997e43d185834
- zh: 38eda1f9a4bac318
-/agent-note-frame-owned-shell-leading-window-chrome-seat/consequences:
- en: 7d95c4c155f8e3c3
- zh: b3f88fe2fb7a77f0
-/agent-note-frame-owned-shell-leading-window-chrome-seat/testing:
- en: 2fcc157c9c4f0b81
- zh: 3b0e6135b1c10db1
diff --git a/.agents/notes/implemented/architecture/2026-09-17-frame-shell-leading-window-chrome-seat.md b/.agents/notes/implemented/architecture/2026-09-17-frame-shell-leading-window-chrome-seat.md
deleted file mode 100644
index cc3ef57690..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-17-frame-shell-leading-window-chrome-seat.md
+++ /dev/null
@@ -1,38 +0,0 @@
-# Agent Note: Frame-owned shell.leading window-chrome seat
-
-Status: implemented
-
-English | [中文](2026-09-17-frame-shell-leading-window-chrome-seat.zh.md)
-
-## Problem
-
-The [macOS hidden-titlebar work](../feature/2026-09-13-macos-hidden-titlebar-vibrancy.md) hid the collapsed sidebar column entirely on darwin and moved the reopen and New Session controls into a conversation-header slot (`conversation.session.header.leading`), shown via CSS while `data-sidebar-collapsed` was published. Only the Conversation had that seat: with any other main panel selected (the plugin manager, or any future global panel), a collapsed window kept the floating traffic lights over the panel's content with no reopen control anywhere on screen. Each new panel would have had to grow its own leading seat and repeat the same clearance geometry.
-
-## Decision
-
-The window chrome belongs to the frame, not to one panel. ui-layout declares a fifth root-scoped child slot, `shell.leading` (single), and AppFrame renders its seat as a frame-level box over the columns — mounted only on the darwin desktop while `sidebarCollapsed`, the full-hide state that leaves window chrome without a home (Windows' zero-width collapse keeps its fixed caption controls, so the seat must not mount a second set there). The seat sits at the frame's top-left (left 88px clears the hiddenInset traffic lights, top 11px centers the 28px controls on the conversation title row, z-index 15 above column content and below frame overlays) and carries `-webkit-app-region: no-drag`, subtracting itself from any drag band beneath it.
-
-Under the same collapsed condition the frame publishes `--dsh-frame-leading-clearance: 160px` — the inline band the traffic lights plus the seat's two controls occupy, measured from the frame's left edge. Window fullscreen hides the traffic lights (the desktop preload mirrors the state onto `html[data-fullscreen]`): the seat moves to `left: 12px` into their vacated band and the clearance drops to `84px`. The conversation title row is the one consumer: it pads `max(0px, clearance - 20px)` (its header already pads 20px). Entry pages that start below the window strip in both sidebar states (the plugin manager's page head) instead pad their top by `--dsh-frame-top-clearance` (48px, published on the darwin frame unconditionally), which clears the strip vertically rather than indenting inline.
-
-ui-sidebar registers `HeaderLeadingControls` into `shell.leading` instead of the conversation seat, reusing the shell's inject face and locale; the component renders unconditionally because the frame owns the mount condition, and its platform check and CSS collapse-gating are deleted. This also drops ui-sidebar's dependency on ui-conversation. The original `conversation.session.header.leading` slot is gone per the pre-stable API rule (every consumer updated, no compatibility shim); the conversation header now exposes its own sessionless `conversation.header.leading` seat (root-scoped, rendered without a Session) as a public extension point, empty in the shipped composition because the window-chrome controls live in `shell.leading`.
-
-## Alternatives considered
-
-**Keeping the conversation seat and adding one per panel.** Every main panel would repeat the seat markup, the drag-region subtraction, and the traffic-light geometry, and a panel that forgot would strand a collapsed window without a reopen control. One frame-owned seat makes the guarantee structural.
-
-**Mounting the occupant always and gating visibility in CSS (the prior mechanism).** This kept dead DOM and a no-drag subtraction in the header on every platform and every collapse state, and it could not help non-conversation panels at all. A frame-level TSX mount keeps the condition, the seat geometry, and the clearance publication in one file.
-
-**Gating the seat on rightbar fullscreen as well.** Unnecessary: the fullscreen right panel (z-index 40) covers the seat (15) visually, and it already opts its whole box out of window dragging, so the seat's geometry cannot puncture it.
-
-**Publishing clearance as a fixed padding each consumer hardcodes.** A raw `160px` in each panel would silently desynchronize from the seat's real band; one custom property published under exactly the mount condition keeps consumers correct when the geometry changes.
-
-## Consequences
-
-- Every current and future main panel keeps the reopen and New Session controls while the sidebar is hidden, at zero per-panel cost; the conversation opts into `--dsh-frame-leading-clearance`, and entry pages take the unconditional `--dsh-frame-top-clearance` instead.
-- `conversation.session.header.leading` no longer exists in the client catalog; `shell.leading` carries the window chrome as a public root-scoped seat, while the conversation header's sessionless `conversation.header.leading` remains a separate public seat with no shipped occupant.
-- ui-sidebar no longer depends on ui-conversation (inject list, devDependency, and tsconfig reference removed).
-- The mount condition names darwin explicitly: Windows' `data-windows-titlebar` collapse also yields a zero-width column but keeps its own fixed caption controls, which a frame seat would duplicate. A platform that later hides its column without leaving its own chrome opts in by widening the condition.
-
-## Testing
-
-The ui-layout app-frame spec pins the seat's mount and unmount across the darwin collapse and its absence beside the 56px rail; the apply spec pins the five-slot declaration and teardown. The ui-sidebar apply spec pins the `shell.leading` registration (component, locale, shared inject face) and its removal on dispose; the sidebar-root spec pins the two controls' actions.
diff --git a/.agents/notes/implemented/architecture/2026-09-17-frame-shell-leading-window-chrome-seat.zh.md b/.agents/notes/implemented/architecture/2026-09-17-frame-shell-leading-window-chrome-seat.zh.md
deleted file mode 100644
index c652f313d4..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-17-frame-shell-leading-window-chrome-seat.zh.md
+++ /dev/null
@@ -1,38 +0,0 @@
-# Agent Note: 框架持有的 shell.leading 窗口 chrome 座
-
-Status: implemented
-
-[English](2026-09-17-frame-shell-leading-window-chrome-seat.md) | 中文
-
-## Problem
-
-[macOS 隐藏标题栏工作](../feature/2026-09-13-macos-hidden-titlebar-vibrancy.zh.md)在 darwin 上把收起的侧边栏整列隐藏，并把重新打开与 New Session 控件移入会话头部的 slot（`conversation.session.header.leading`），在 `data-sidebar-collapsed` 发布期间由 CSS 显示。但只有会话界面有这个座：选中任何其他主面板（插件管理器或未来的全局面板）时，收起的窗口只剩悬浮的红绿灯压在面板内容上，屏幕上没有任何重新打开控件。每个新面板都得自建 leading 座并重复同一套避让几何。
-
-## Decision
-
-窗口 chrome 属于框架，不属于某个面板。ui-layout 声明第五个 root 作用域子 slot `shell.leading`（single），AppFrame 把它的座渲染为覆盖各列的框架级盒子——仅在 darwin 桌面且 `sidebarCollapsed` 时挂载，即让窗口 chrome 无处安放的全隐藏状态（Windows 的零宽收起保留其固定 caption 控件，该座在那里挂载会出现第二组控件）。座位于框架左上角（left 88px 避开 hiddenInset 红绿灯，top 11px 让 28px 控件对齐会话标题行中线，z-index 15 高于列内容、低于框架浮层），并带 `-webkit-app-region: no-drag`，把自己从下方任何拖拽带中减去。
-
-在同一收起条件下框架发布 `--dsh-frame-leading-clearance: 160px`——红绿灯加座内两个控件占据的行内带宽，自框架左边缘起量。窗口全屏隐藏红绿灯（桌面 preload 把状态镜像到 `html[data-fullscreen]`）：座移入其空出的带宽（`left: 12px`），避让量降到 `84px`。会话标题行是唯一消费者：它 pad `max(0px, clearance - 20px)`（其头部已 pad 20px）。两种侧栏状态下都始于窗口顶带之下的入口页（插件管理器页头）改用 `--dsh-frame-top-clearance`（48px，darwin 框架上无条件发布）做顶部内边距，纵向避开顶带而非行内缩进。
-
-ui-sidebar 把 `HeaderLeadingControls` 改注册到 `shell.leading` 而非会话座，复用 shell 的 inject face 与 locale；因挂载条件归框架所有，组件无条件渲染，其平台判断与 CSS 收起门控被删除，同时解除 ui-sidebar 对 ui-conversation 的依赖。原 `conversation.session.header.leading` slot 按 pre-stable API 规则不复存在（更新所有消费者，不留兼容垫层）；会话头现在自带无会话可用的 `conversation.header.leading` 座（root 作用域、无 Session 也渲染）作为公开扩展点，因窗口 chrome 控件已住进 `shell.leading`，出厂组合中它保持空置。
-
-## Alternatives considered
-
-**保留会话座并为每个面板各加一个。** 每个主面板都要重复座标记、拖拽区减除与红绿灯几何，漏掉的面板会让收起的窗口失去重新打开控件。框架持有的单一座使该保证成为结构性的。
-
-**始终挂载占用方、由 CSS 控制可见性（先前机制）。** 它在所有平台与所有收起状态下都保留死 DOM 和头部的 no-drag 减除，且完全帮不到非会话面板。框架级 TSX 挂载把条件、座几何与避让量发布集中在一个文件。
-
-**同时以右栏全屏为座的门控条件。** 不必要：全屏右面板（z-index 40）在视觉上盖住座（15），且它已让整个盒子退出窗口拖拽，座的几何无法穿透它。
-
-**把避让量作为各消费者硬编码的固定内边距。** 各面板写死 `160px` 会与座的真实带宽悄然失同步；在恰为挂载条件下发布一个自定义属性，几何变化时消费者仍保持正确。
-
-## Consequences
-
-- 侧边栏隐藏时，现有与未来的每个主面板都免费获得重新打开与 New Session 控件；会话接入 `--dsh-frame-leading-clearance`，入口页改用无条件发布的 `--dsh-frame-top-clearance`。
-- `conversation.session.header.leading` 从客户端目录中消失；`shell.leading` 作为公开 root 作用域座承载窗口 chrome，会话头无会话可用的 `conversation.header.leading` 则是另一个公开座，出厂组合中无占用者。
-- ui-sidebar 不再依赖 ui-conversation（inject 列表、devDependency 与 tsconfig 引用均已移除）。
-- 挂载条件显式点名 darwin：Windows 的 `data-windows-titlebar` 收起同样得到零宽列，但保留自己的固定 caption 控件，框架座会与之重复。未来某平台若隐藏整列且不留自己的 chrome，通过放宽该条件接入。
-
-## Testing
-
-ui-layout 的 app-frame spec 钉住 darwin 收起下座的挂载/卸载及 56px 控制栏旁座的缺席；apply spec 钉住五 slot 声明与拆除。ui-sidebar 的 apply spec 钉住 `shell.leading` 注册（组件、locale、共享 inject face）及 dispose 时的移除；sidebar-root spec 钉住两个控件的动作。
diff --git a/.agents/notes/implemented/architecture/2026-09-17-native-v4-read-validation.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-17-native-v4-read-validation.i18n.yaml
index cfe428cf55..ecb3c391ff 100644
--- a/.agents/notes/implemented/architecture/2026-09-17-native-v4-read-validation.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-17-native-v4-read-validation.i18n.yaml
@@ -9,11 +9,11 @@
en: cfb527c1c2ca661a
zh: b61a906330cdaf97
/agent-note-mandatory-native-v4-relationship-validation/decision:
- en: 14feaf74a58d5609
- zh: 8aea80c89110e638
+ en: 534efaae5eb9beb0
+ zh: ccb3734458248383
/agent-note-mandatory-native-v4-relationship-validation/alternatives-considered:
- en: d6296e00a6b30d48
- zh: 9f7074c69fb42e5f
+ en: 96a37d9ba0252630
+ zh: fdf2d085805f0010
/agent-note-mandatory-native-v4-relationship-validation/consequences:
en: b76aaca1c35dcc6c
zh: b933c2518c64c60c
diff --git a/.agents/notes/implemented/architecture/2026-09-17-native-v4-read-validation.md b/.agents/notes/implemented/architecture/2026-09-17-native-v4-read-validation.md
index b111e9f1dd..385377db23 100644
--- a/.agents/notes/implemented/architecture/2026-09-17-native-v4-read-validation.md
+++ b/.agents/notes/implemented/architecture/2026-09-17-native-v4-read-validation.md
@@ -16,7 +16,7 @@ The V4 format restorer and current JSONL scanner share one mandatory cross-event
An unfinished tail may retain an open turn, step, tool call, or compaction. A closing event must settle the relationships it closes. An inherited unfinished compaction ends at its `session/end-seed` marker; it does not constrain the child's lifecycle. Repair message identities retain their historical numeric suffix after earlier migrations change sequence coordinates. Fork repairs retain their separately validated native identities.
-Installed Session adoption continues to own event envelopes, message roles and metadata, canonical request headers, and surface replacement reference coverage. Optional runtime invariants provide diagnostics; their installation is not required for durable admission. Native system-message admission also validates coordinates, identity, content blocks, and known image/tool-call fields before physical recovery can discard rows. Additional JSON fields and unknown nonempty content tags remain intact; retired tool-result wrappers are refused. Retired `request/header.header.system` and required `tool/code-dispatch*` tags remain hard refusals before recovery; obsolete ignorable PTC records remain opaque. Physical framing alone does not establish semantic validity.
+Installed Session adoption continues to own event envelopes, message roles and metadata, canonical request headers, and surface replacement reference coverage. Native system-message admission also validates coordinates, identity, content blocks, and known image/tool-call fields before physical recovery can discard rows. Additional JSON fields and unknown nonempty content tags remain intact; retired tool-result wrappers are refused. Retired `request/header.header.system` and required `tool/code-dispatch*` tags remain hard refusals before recovery; obsolete ignorable PTC records remain opaque. Physical framing alone does not establish semantic validity.
A retired tool-result wrapper outside its owning `tool/result` row would require changing the event, role, or source to represent it in V4. The adjacent migration lifts only the canonical owned wrapper; target restoration refuses wrappers remaining in interpreted content. Native row admission applies the same refusal before recoverable tail suppression. The check follows declared message, content, and Assistant-stream slots instead of recursively inspecting JSON, so tool arguments, replay state, schema parameters, nested extensions, and unknown ignorable payloads retain their recorded values.
@@ -26,8 +26,6 @@ A retired tool-result wrapper outside its owning `tool/result` row would require
**Project V4 back into a frozen V3 validation view.** This couples current acceptance to retired representations and invites new fields to disappear in the projection. Frozen generations remain independently readable, while the current restorer interprets its own fields.
-**Rely on optional runtime invariants.** Detached readers and restoration paths may not install diagnostic companions. A required relationship must be checked before publication or consumption of the restored Session.
-
## Consequences
The native restorer maintains one bounded state machine per read and rejects contradictions before successor publication. Frozen V0–V3 validators and committed Session generations remain unchanged. Public catalog regressions cover invalid relationships alongside partial tails, inherited cuts, immutable unknown attribution, and complete tool exchanges; these checks enforce the declared V4 representation without changing its schemas. Breaking changes require a successor; compatible additions use new acknowledgements, and implementation fixes preserve the declared meaning.
diff --git a/.agents/notes/implemented/architecture/2026-09-17-native-v4-read-validation.zh.md b/.agents/notes/implemented/architecture/2026-09-17-native-v4-read-validation.zh.md
index 20f1dc53b6..169a80ecf7 100644
--- a/.agents/notes/implemented/architecture/2026-09-17-native-v4-read-validation.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-17-native-v4-read-validation.zh.md
@@ -16,7 +16,7 @@ V4 格式恢复器与当前 JSONL 扫描器共用同一强制跨事件关系校
未完成的尾部可以保留打开的 turn、step、工具调用或压缩事务。关闭事件必须结清它关闭的关系。继承的未完成压缩事务在其 `session/end-seed` 标记处结束，不约束子 Session 的生命周期。较早迁移改变序号坐标后，修复消息身份仍保留历史数字后缀。fork 修复保留经过独立校验的原生身份。
-已安装的 Session 接纳器继续负责事件封装、消息角色与元数据、规范请求头，以及 surface 替换的引用覆盖。可选运行时不变式提供诊断；持久化准入不要求安装它们。原生 system 消息准入还会在物理恢复可能丢弃行之前，校验坐标、身份、内容块及已知 image/tool-call 字段。额外 JSON 字段和非空的未知内容标签保持不变，退役的 tool-result 包装会被拒绝。退役的 `request/header.header.system` 和必需的 `tool/code-dispatch*` 标签仍在恢复前强制拒绝；标记为可忽略的过时 PTC 记录保持不透明。仅通过物理分帧不能证明语义有效。
+已安装的 Session 接纳器继续负责事件封装、消息角色与元数据、规范请求头，以及 surface 替换的引用覆盖。原生 system 消息准入还会在物理恢复可能丢弃行之前，校验坐标、身份、内容块及已知 image/tool-call 字段。额外 JSON 字段和非空的未知内容标签保持不变，退役的 tool-result 包装会被拒绝。退役的 `request/header.header.system` 和必需的 `tool/code-dispatch*` 标签仍在恢复前强制拒绝；标记为可忽略的过时 PTC 记录保持不透明。仅通过物理分帧不能证明语义有效。
退役的 tool-result 包装若不属于对应的 `tool/result` 行，就需要改变事件、角色或来源才能在 V4 中表示。相邻迁移只提升规范的自有包装；目标恢复器拒绝解释内容中剩余的包装。原生行准入在可恢复尾部被忽略之前执行同样的拒绝。检查沿声明的消息、内容和 Assistant stream 字段进行，不递归扫描 JSON，因此工具参数、replay state、schema 参数、嵌套扩展和未知可忽略载荷保留其记录值。
@@ -26,8 +26,6 @@ V4 格式恢复器与当前 JSONL 扫描器共用同一强制跨事件关系校
**将 V4 投影回冻结的 V3 校验视图。** 这会将当前准入与退役表示绑定，并容易让新增字段在投影中消失。冻结代际仍可独立读取，当前恢复器解释自己的字段。
-**依赖可选运行时不变式。** 分离读取器和恢复路径可能不安装诊断组件。必需关系必须在发布或消费恢复后的 Session 之前完成校验。
-
## Consequences
原生恢复器为每次读取维护独立状态机，在发布后继文件之前拒绝矛盾。冻结的 V0–V3 校验器及已提交的 Session 代际保持不变。公开目录回归覆盖无效关系、部分尾部、继承切分点、未知归属的不可变保存，以及完整工具交互；这些检查落实已声明的 V4 表示，不改变其 schema。破坏性变更要求后继版本；兼容新增使用新的确认记录，实现修复须保留声明的含义。
diff --git a/.agents/notes/implemented/architecture/2026-09-17-plugin-detail-page-extension-slots.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-17-plugin-detail-page-extension-slots.i18n.yaml
deleted file mode 100644
index 5b7f7e9b6b..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-17-plugin-detail-page-extension-slots.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-17-plugin-detail-page-extension-slots.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-17-plugin-detail-page-extension-slots.md
-/agent-note-plugin-detail-pages-as-an-extension-point:
- en: 71b432dfc4475c08
- zh: a9f9a7e272c32093
-/agent-note-plugin-detail-pages-as-an-extension-point/problem:
- en: 39f7e246e6ab3beb
- zh: dba3ba5206d81d8d
-/agent-note-plugin-detail-pages-as-an-extension-point/decision:
- en: df2cba037b6bcb4d
- zh: 82d0a5dc61a1716c
-/agent-note-plugin-detail-pages-as-an-extension-point/alternatives-considered:
- en: cdcc8710be8ab1be
- zh: d82781a3c353984f
-/agent-note-plugin-detail-pages-as-an-extension-point/consequences:
- en: 0567cb3fbfbdb4f8
- zh: 256811c9a7271da1
-/agent-note-plugin-detail-pages-as-an-extension-point/testing:
- en: 8957db157d2f743e
- zh: fb24db99bb5a55aa
diff --git a/.agents/notes/implemented/architecture/2026-09-17-process-local-blank-sessions.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-17-process-local-blank-sessions.i18n.yaml
index 25c6bed4ad..ae4cd23658 100644
--- a/.agents/notes/implemented/architecture/2026-09-17-process-local-blank-sessions.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-17-process-local-blank-sessions.i18n.yaml
@@ -9,8 +9,8 @@
en: 837ebb0071a5611b
zh: 23d0f0713889ead6
/agent-note-writer-acquisition-for-blank-session-reuse/decision:
- en: 932bc5c0be3721de
- zh: 000425c5f053e74e
+ en: 7f2676feb224e7ea
+ zh: babfda5b31dfd0fe
/agent-note-writer-acquisition-for-blank-session-reuse/alternatives-considered:
en: 2a67a53f7f396ba8
zh: 6df6ccc071fb0de2
diff --git a/.agents/notes/implemented/architecture/2026-09-17-process-local-blank-sessions.md b/.agents/notes/implemented/architecture/2026-09-17-process-local-blank-sessions.md
index 58d222185a..c832604dfb 100644
--- a/.agents/notes/implemented/architecture/2026-09-17-process-local-blank-sessions.md
+++ b/.agents/notes/implemented/architecture/2026-09-17-process-local-blank-sessions.md
@@ -14,7 +14,7 @@ The Session catalog includes persisted blanks. Startup restoration selects the s
The Agent retains the acquired handle throughout its lifetime. Checking ownership and releasing a probe lock would leave a race before resume. No PID or process identity enters persisted data or the Remote schema.
-This decision extends the blank-reuse policy in the [Client Session scope decision](2026-07-25-web-client-session-scope-and-provide-channel.md); its real-Session slash support and Provider adoption rationale remain active.
+This decision extends the blank-reuse policy in the [Client Session scope reference](2026-09-15-client-session-references.md); its real-Session slash support and Provider adoption rationale remain active.
## Alternatives considered
diff --git a/.agents/notes/implemented/architecture/2026-09-17-process-local-blank-sessions.zh.md b/.agents/notes/implemented/architecture/2026-09-17-process-local-blank-sessions.zh.md
index 0f3fdf0509..f5d5d58bc6 100644
--- a/.agents/notes/implemented/architecture/2026-09-17-process-local-blank-sessions.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-17-process-local-blank-sessions.zh.md
@@ -14,7 +14,7 @@ Session 列表包含持久化空白会话。启动恢复选择已保存的空白
Agent 在整个生命周期内持有取得的句柄。检查占用后释放探测锁，会在恢复前留下竞态。持久化数据与 Remote schema 均不引入 PID 或进程身份。
-本决策扩展 [Client Session scope 决策](2026-07-25-web-client-session-scope-and-provide-channel.zh.md)中的空白会话复用策略；其真实 Session 支持 slash 以及 Provider 收养的理由仍然有效。
+本决策扩展 [Client Session scope 参考](2026-09-15-client-session-references.zh.md)中的空白会话复用策略；其真实 Session 支持 slash 以及 Provider 收养的理由仍然有效。
## Alternatives considered
diff --git a/.agents/notes/implemented/architecture/2026-09-17-session-row-menu-actions-slot.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-17-session-row-menu-actions-slot.i18n.yaml
deleted file mode 100644
index 40bc5939fe..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-17-session-row-menu-actions-slot.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-17-session-row-menu-actions-slot.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-17-session-row-menu-actions-slot.md
-/agent-note-session-row-actions-as-slot-lists:
- en: 6c14eadc272cbe5f
- zh: d0fb9907cddcae5a
-/agent-note-session-row-actions-as-slot-lists/problem:
- en: 1afb986570a4bb49
- zh: 22862e82275038b7
-/agent-note-session-row-actions-as-slot-lists/decision:
- en: 7a353dd9c0642f56
- zh: e503a953cccfdc47
-/agent-note-session-row-actions-as-slot-lists/alternatives-considered:
- en: 19fc0c951e9e49b5
- zh: 9010c3fb55b71ce0
-/agent-note-session-row-actions-as-slot-lists/consequences:
- en: cfc90eb041452a48
- zh: 882748ceb29f21ea
diff --git a/.agents/notes/implemented/architecture/2026-09-17-settings-pages-as-companion-packages.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-17-settings-pages-as-companion-packages.i18n.yaml
deleted file mode 100644
index 34faaaba25..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-17-settings-pages-as-companion-packages.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-17-settings-pages-as-companion-packages.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-17-settings-pages-as-companion-packages.md
-/agent-note-settings-pages-as-companion-packages:
- en: ada5eadeb6e921e4
- zh: 1cc804b1720c2c98
-/agent-note-settings-pages-as-companion-packages/problem:
- en: 8c23fffd3cef6ea8
- zh: 6072e1e4197afd7c
-/agent-note-settings-pages-as-companion-packages/decision:
- en: d0610e0445b8fdb7
- zh: 5e8af1fce960cae5
-/agent-note-settings-pages-as-companion-packages/alternatives-considered:
- en: cc29e94d925d84b4
- zh: bdaec6d6ff2d511a
-/agent-note-settings-pages-as-companion-packages/consequences:
- en: ef4733505d43fb1e
- zh: 320475e4b5a0f5e0
-/agent-note-settings-pages-as-companion-packages/testing:
- en: 92bef8e1c609359b
- zh: c4f2016243441b1e
diff --git a/.agents/notes/implemented/architecture/2026-09-17-shared-office-runtime.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-17-shared-office-runtime.i18n.yaml
deleted file mode 100644
index 4aa201536b..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-17-shared-office-runtime.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-17-shared-office-runtime.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-17-shared-office-runtime.md
-/agent-note-shared-office-runtime-for-desktop-and-sdk:
- en: 28af688a50a2d5c6
- zh: ee73d6dd4fab9184
-/agent-note-shared-office-runtime-for-desktop-and-sdk/problem:
- en: 4d08aed08c8aff27
- zh: d618b4ac68832867
-/agent-note-shared-office-runtime-for-desktop-and-sdk/decision:
- en: f92ce88d82a076ed
- zh: 341e486effad4b6d
-/agent-note-shared-office-runtime-for-desktop-and-sdk/alternatives-considered:
- en: d85334a384a32a7d
- zh: 61c370390d9fdcf9
-/agent-note-shared-office-runtime-for-desktop-and-sdk/consequences:
- en: f236fec61d99ba16
- zh: 859ee94e05a95aa4
diff --git a/.agents/notes/implemented/architecture/2026-09-17-web-feature-routes-and-route-gate.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-17-web-feature-routes-and-route-gate.i18n.yaml
deleted file mode 100644
index 735a46bdc2..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-17-web-feature-routes-and-route-gate.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-17-web-feature-routes-and-route-gate.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-17-web-feature-routes-and-route-gate.md
-/agent-note-feature-routes-follow-the-document-base-and-a-gate-keeps-them-there:
- en: ca746e8d558cfc31
- zh: 3524931b0bf9991f
-/agent-note-feature-routes-follow-the-document-base-and-a-gate-keeps-them-there/problem:
- en: d4a1124ae3b6f6a8
- zh: 4814da5d08947bc7
-/agent-note-feature-routes-follow-the-document-base-and-a-gate-keeps-them-there/decision:
- en: 5b89e02010c2da46
- zh: d11e67d86ef27908
-/agent-note-feature-routes-follow-the-document-base-and-a-gate-keeps-them-there/alternatives-considered:
- en: d90dbd0c95914085
- zh: 6256f4fd76a7cb55
-/agent-note-feature-routes-follow-the-document-base-and-a-gate-keeps-them-there/consequences:
- en: 94530852d7746ddb
- zh: ad2383c465053822
-/agent-note-feature-routes-follow-the-document-base-and-a-gate-keeps-them-there/testing:
- en: 95c952092857cb53
- zh: 232cd731afcd3288
diff --git a/.agents/notes/implemented/architecture/2026-09-18-agent-teams-single-bundle.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-18-agent-teams-single-bundle.i18n.yaml
deleted file mode 100644
index 83ed8c5841..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-18-agent-teams-single-bundle.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-18-agent-teams-single-bundle.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-18-agent-teams-single-bundle.md
-/agent-note-enable-agent-teams-with-one-bundle:
- en: c595b526791a8dfd
- zh: 61f4bf6948e41bee
-/agent-note-enable-agent-teams-with-one-bundle/problem:
- en: 8dd802c775d24e42
- zh: 53cf2818dd93181e
-/agent-note-enable-agent-teams-with-one-bundle/decision:
- en: d513c3239b59b2ee
- zh: 7692b7ae43befc9d
-/agent-note-enable-agent-teams-with-one-bundle/alternatives-considered:
- en: 32952c4e1b6f486d
- zh: 6c9b91eaf0460d30
-/agent-note-enable-agent-teams-with-one-bundle/consequences:
- en: be92cb1ce7c86cb6
- zh: 0da06f76df72f97e
-/agent-note-enable-agent-teams-with-one-bundle/verification:
- en: 8fc694c4c84401f1
- zh: 6540462f6896bef7
diff --git a/.agents/notes/implemented/architecture/2026-09-18-chat-navigation-performance.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-18-chat-navigation-performance.i18n.yaml
deleted file mode 100644
index d8ea21a542..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-18-chat-navigation-performance.i18n.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-18-chat-navigation-performance.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-18-chat-navigation-performance.md
-/agent-note-bound-turn-navigation-work-and-batch-historical-jumps:
- en: c37ea37bfa045a00
- zh: 88a75b8739e99fb5
-/agent-note-bound-turn-navigation-work-and-batch-historical-jumps/problem:
- en: c3ca28379b414fc5
- zh: 4a25378cef3f2259
-/agent-note-bound-turn-navigation-work-and-batch-historical-jumps/decision:
- en: a15c7c13f167e5ac
- zh: a15c7c13f167e5ac
-/agent-note-bound-turn-navigation-work-and-batch-historical-jumps/decision/fixed-pitch-virtual-rail:
- en: 79e61c0dbffe6f01
- zh: 47dd4758d115f8bb
-/agent-note-bound-turn-navigation-work-and-batch-historical-jumps/decision/two-layer-transcript-navigation:
- en: 022a8ad83ac099f1
- zh: b4393e39bfdd401d
-/agent-note-bound-turn-navigation-work-and-batch-historical-jumps/decision/one-publication-per-historical-jump:
- en: 510e80edc58ebdea
- zh: cfbff46bff1e43bb
-/agent-note-bound-turn-navigation-work-and-batch-historical-jumps/decision/theoretical-work-model:
- en: 6786e39e812ad355
- zh: eca00072cf880a08
-/agent-note-bound-turn-navigation-work-and-batch-historical-jumps/alternatives-considered:
- en: f590762936560d5c
- zh: 0fc836bf1841733e
-/agent-note-bound-turn-navigation-work-and-batch-historical-jumps/consequences:
- en: 5f50c3d4a539f48c
- zh: 5aee80a99d52233e
diff --git a/.agents/notes/implemented/architecture/2026-09-18-localized-package-metadata.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-18-localized-package-metadata.i18n.yaml
deleted file mode 100644
index 828454ccca..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-18-localized-package-metadata.i18n.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-18-localized-package-metadata.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-18-localized-package-metadata.md
-/agent-note-plugin-owned-localized-display-metadata:
- en: b78ee8e580f068ea
- zh: 17dd59c9b6273897
-/agent-note-plugin-owned-localized-display-metadata/problem:
- en: 4022a58baf82e77d
- zh: 8439268ed4df9b69
-/agent-note-plugin-owned-localized-display-metadata/decision:
- en: f6c3e24681977f48
- zh: 84ae52ec62f4af96
-/agent-note-plugin-owned-localized-display-metadata/existing-decisions:
- en: a84f44d6a3179d47
- zh: 8fb62f08bec5f75d
-/agent-note-plugin-owned-localized-display-metadata/alternatives-considered:
- en: abbdb1b8ab360380
- zh: edfe6c06b1d67fd7
-/agent-note-plugin-owned-localized-display-metadata/verification:
- en: 8541a2431321ef61
- zh: 77599e0855d93da9
-/agent-note-plugin-owned-localized-display-metadata/consequences:
- en: 2a4547c9657038df
- zh: 1a4bebd06d2b9e38
diff --git a/.agents/notes/implemented/architecture/2026-09-18-profile-plugin-host-runtime-instances.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-18-profile-plugin-host-runtime-instances.i18n.yaml
deleted file mode 100644
index 4325837109..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-18-profile-plugin-host-runtime-instances.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-18-profile-plugin-host-runtime-instances.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-18-profile-plugin-host-runtime-instances.md
-/agent-note-profile-plugins-share-the-installation-s-host-runtime-instances:
- en: 04d5248dde932469
- zh: 877d263ca4b0beef
-/agent-note-profile-plugins-share-the-installation-s-host-runtime-instances/problem:
- en: f9c4830ba4be20bc
- zh: be46323e2eae9247
-/agent-note-profile-plugins-share-the-installation-s-host-runtime-instances/decision:
- en: bcd92c487ebfab32
- zh: c50478b864562f0d
-/agent-note-profile-plugins-share-the-installation-s-host-runtime-instances/alternatives-considered:
- en: 1443d5fc869ffcf9
- zh: 76b21473d2892e7f
-/agent-note-profile-plugins-share-the-installation-s-host-runtime-instances/consequences:
- en: 075067e84219ae67
- zh: 035c60f3e11783d5
diff --git a/.agents/notes/implemented/architecture/2026-09-19-lossless-projection-checkpoint-json.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-19-lossless-projection-checkpoint-json.i18n.yaml
deleted file mode 100644
index 93be98ebc5..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-19-lossless-projection-checkpoint-json.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-19-lossless-projection-checkpoint-json.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-19-lossless-projection-checkpoint-json.md
-/agent-note-lossless-projection-checkpoint-json:
- en: 2b7b5f9e5da030df
- zh: 76d65ddc85776939
-/agent-note-lossless-projection-checkpoint-json/problem:
- en: 26e613246f31ee5a
- zh: e0aa1e2f63bce802
-/agent-note-lossless-projection-checkpoint-json/decision:
- en: 01161e9c42142971
- zh: e05e52d2af7fc4c5
-/agent-note-lossless-projection-checkpoint-json/alternatives-considered:
- en: 1d64345d3d72ed5f
- zh: 4c9d3410cfd815b3
-/agent-note-lossless-projection-checkpoint-json/consequences:
- en: 94b619dc13cfff0b
- zh: c432227d3333175f
diff --git a/.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.i18n.yaml
index 8892007905..88254d458d 100644
--- a/.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.i18n.yaml
@@ -51,8 +51,8 @@
en: d0bed60317e6e3a8
zh: 5714160678adc049
/agent-note-resolve-profile-modules-along-the-ancestor-chain-with-an-interception-layer/decision/part-3-developer-integration-guide/2-development-mode-the-plugin-repository-is-outside-the-profile-tree:
- en: d7ec5a747ebcb93e
- zh: 7e1d0724973b32c1
+ en: 22259a568693c641
+ zh: d81d15671398d033
/agent-note-resolve-profile-modules-along-the-ancestor-chain-with-an-interception-layer/alternatives-considered:
en: 5466618bb5e3d4d9
zh: 7d0b6d727e33d0d1
diff --git a/.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.md b/.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.md
index 6dfb5511af..bb99cb2435 100644
--- a/.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.md
+++ b/.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.md
@@ -135,7 +135,7 @@ The plugin's own third-party dependencies are hoisted to `$DSH_HOME/profiles/` there, or link dsh packages to a local source repository and start dsh from that repository. Both make the running dsh and the repository's copies identical, but linked plugins do not require either layout.
diff --git a/.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.zh.md b/.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.zh.md
index 2474a9b040..4af29f7255 100644
--- a/.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.zh.md
@@ -135,7 +135,7 @@ ESM 与 CommonJS 两个适配器调用同一个路由函数，主线程与 Harne
`npm link`，或 `dsh plugin add ../my-plugin` 这类裸目录路径（pnpm 按 `link:` 处理），会让 profile 里的条目成为指向插件仓库的软链接，仓库目录成为 linked root。插件以真实路径加载。查找到其 manifest 的 peer 位置时，匹配的运行时条目由当前运行的安装提供，无论 dsh 来自 npm 全局安装、Desktop 内置还是源码仓启动。该位置的 devDependency 副本服务编译器，普通请求不会加载它。link 指向无 manifest 的 `src` 目录时，也可以通过同一条祖先查询使用父目录的 peer。
-manifest 的写法与 harness 自身的包相同：需要与宿主共享实例的 dsh 包同时声明在 `peerDependencies` 与 `devDependencies`，peer 让 `R/node_modules` 上的位置被占据，dev 副本给编译器和独立测试使用；第三方依赖以及 `@deepseek-ai/dsh-brand`、`@deepseek-ai/dsh-util-values` 这类无状态 dsh 工具包放在 `dependencies`。修改 `peerDependencies` 后，重新加载插件时的新解析会使用新声明；已加载模块的生命周期仍由 Node 和 Cordis 管理。
+manifest 的写法与 harness 自身的包相同：需要与宿主共享实例的 dsh 包同时声明在 `peerDependencies` 与 `devDependencies`，peer 让 `R/node_modules` 上的位置被占据，dev 副本给编译器和独立测试使用；第三方依赖以及 `@deepseek-ai/dsh-brand`、`@deepseek-ai/dsh-util-values` 这类无状态 dsh 工具包放在 `dependencies`。修改 `peerDependencies` 后，重新加载插件时的新解析会使用新声明；已加载模块的生命周期仍由 Node 和 Cordis 管理。版本相同也不会让不同目录中的副本共享模块局部状态。仅把 scope 标记改成 `Symbol.for` 同样无法共享 scope 父关系、carrier key 或注册表；承载身份的运行时必须解析到 Host 实例。
另两种可用布局：插件仓库自装 `@deepseek-ai/dsh` 并从仓库里启动 `pnpm exec dsh --profile `；或把 dsh 包 link 到本机源码仓并从源码仓启动。两者让运行中的 dsh 与仓库里的副本本来就是同一份，但 linked 插件不要求使用这两种布局。
diff --git a/.agents/notes/implemented/architecture/2026-09-19-projection-cache-listing-identity-and-cached-rows.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-19-projection-cache-listing-identity-and-cached-rows.i18n.yaml
index 938a007c31..604c1fe195 100644
--- a/.agents/notes/implemented/architecture/2026-09-19-projection-cache-listing-identity-and-cached-rows.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-19-projection-cache-listing-identity-and-cached-rows.i18n.yaml
@@ -9,8 +9,8 @@
en: 2e7f99c81fbc941f
zh: b0fac7cd5eb86ffe
/agent-note-projection-cache-read-only-face-matches-the-lifecycle-identity-the-client-store-separates-cached-and-sequenced-rows/problem/mechanism:
- en: 36d24e92eedf8cea
- zh: 5dafc5758ee0f380
+ en: 2594af08bbc79dba
+ zh: cdebd5d14d99cf3c
/agent-note-projection-cache-read-only-face-matches-the-lifecycle-identity-the-client-store-separates-cached-and-sequenced-rows/problem/the-cache-s-two-uses-and-where-validation-lives:
en: 055ead18162ca1cd
zh: 9046bf04229e45d1
diff --git a/.agents/notes/implemented/architecture/2026-09-19-projection-cache-listing-identity-and-cached-rows.md b/.agents/notes/implemented/architecture/2026-09-19-projection-cache-listing-identity-and-cached-rows.md
index bfdd8bda22..5ef27cb076 100644
--- a/.agents/notes/implemented/architecture/2026-09-19-projection-cache-listing-identity-and-cached-rows.md
+++ b/.agents/notes/implemented/architecture/2026-09-19-projection-cache-listing-identity-and-cached-rows.md
@@ -12,7 +12,7 @@ This is neither cache corruption nor a version mismatch. The projcache record's
### Mechanism
-A cache record (record format and predecessor recovery: [Projection-cache predecessor recovery and Session-format binding](2026-09-02-projcache-cross-version-read-compat.md)) is bound to a lifecycle identity: `formatVersion + createdAt + cwd + isSeeded + inheritedEventCount`, matched by `identityMatches` on full equality. Since #3346, `inheritedEventCount` (the length of the event prefix a fork inherits, the cut below) no longer appears in the logical header: the header keeps only the `isSeeded` bit and the exact cut follows the body. Since Session format v2 (#3398) the physical header line no longer stores `seedLength` either; the reader derives the cut from the seq of the `session/end-seed {inherited: true}` marker in the body.
+A cache record (record format and predecessor recovery: [Projection-cache predecessor recovery and Session-format binding](../../../../packages/session/session-projection-cache/README.md)) is bound to a lifecycle identity: `formatVersion + createdAt + cwd + isSeeded + inheritedEventCount`, matched by `identityMatches` on full equality. Since #3346, `inheritedEventCount` (the length of the event prefix a fork inherits, the cut below) no longer appears in the logical header: the header keeps only the `isSeeded` bit and the exact cut follows the body. Since Session format v2 (#3398) the physical header line no longer stores `seedLength` either; the reader derives the cut from the seq of the `session/end-seed {inherited: true}` marker in the body.
A header-only read therefore cannot obtain the cut: the JSONL backend's `fromHeaderLine` hard-codes `inheritedEventCount: 0` for header-only reads, and `SessionPersistenceSnapshot` carries only the header, the revision, and an optional eventCount. The Session-list and reference consumers grew the same guard:
diff --git a/.agents/notes/implemented/architecture/2026-09-19-projection-cache-listing-identity-and-cached-rows.zh.md b/.agents/notes/implemented/architecture/2026-09-19-projection-cache-listing-identity-and-cached-rows.zh.md
index 470c96385c..e69db37e7e 100644
--- a/.agents/notes/implemented/architecture/2026-09-19-projection-cache-listing-identity-and-cached-rows.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-19-projection-cache-listing-identity-and-cached-rows.zh.md
@@ -12,7 +12,7 @@ Host 进程重启后，所有 fork 出来的会话（`SessionHeader.isSeeded ===
### 机制
-缓存记录（记录格式与前代恢复见 [投影缓存前代恢复与 Session 格式绑定](2026-09-02-projcache-cross-version-read-compat.zh.md)）绑定一份 lifecycle identity：`formatVersion + createdAt + cwd + isSeeded + inheritedEventCount`，`identityMatches` 做全等匹配。其中 `inheritedEventCount`（fork 继承的事件前缀长度，下称 cut）从 #3346 起不再出现在逻辑 header 里：header 只保留 `isSeeded` 这一位，精确 cut 跟随正文。Session 格式 v2 起（#3398），物理 header 行也不再存 `seedLength`，reader 从正文里 `session/end-seed {inherited: true}` 标记的 seq 推出 cut。
+缓存记录（记录格式与前代恢复见 [投影缓存前代恢复与 Session 格式绑定](../../../../packages/session/session-projection-cache/README.zh.md)）绑定一份 lifecycle identity：`formatVersion + createdAt + cwd + isSeeded + inheritedEventCount`，`identityMatches` 做全等匹配。其中 `inheritedEventCount`（fork 继承的事件前缀长度，下称 cut）从 #3346 起不再出现在逻辑 header 里：header 只保留 `isSeeded` 这一位，精确 cut 跟随正文。Session 格式 v2 起（#3398），物理 header 行也不再存 `seedLength`，reader 从正文里 `session/end-seed {inherited: true}` 标记的 seq 推出 cut。
于是 header-only 的读取拿不到 cut：JSONL 后端 `fromHeaderLine` 对 header-only 读取硬编码 `inheritedEventCount: 0`，`SessionPersistenceSnapshot` 只有 header、revision 和可选的 eventCount。Session 列表与引用消费者都因此加了同一个守卫：
diff --git a/.agents/notes/implemented/architecture/2026-09-19-remote-duplex-stream.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-19-remote-duplex-stream.i18n.yaml
index eba3d7545a..3bd20ef0bc 100644
--- a/.agents/notes/implemented/architecture/2026-09-19-remote-duplex-stream.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-19-remote-duplex-stream.i18n.yaml
@@ -138,5 +138,5 @@
en: 3b99a327464edc3e
zh: dcffdc75369925dc
/agent-note-remote-duplex-stream-one-kind-of-stream-an-uplink-channel-and-an-invocation-context/related:
- en: f8995f478dc1d478
- zh: 96621e80a4d3cefc
+ en: 85d77fb246564024
+ zh: 8b400818a91a3e3a
diff --git a/.agents/notes/implemented/architecture/2026-09-19-remote-duplex-stream.md b/.agents/notes/implemented/architecture/2026-09-19-remote-duplex-stream.md
index ea8e8cebcc..c1333ef62f 100644
--- a/.agents/notes/implemented/architecture/2026-09-19-remote-duplex-stream.md
+++ b/.agents/notes/implemented/architecture/2026-09-19-remote-duplex-stream.md
@@ -604,6 +604,6 @@ Retention cases in `gateway-stream.host.spec.ts` and `gateway.client.spec.ts` co
## Related
-- [Remote event delivery](2026-08-10-remote-event-delivery.md): the unary `$events/result` answer path; the duplex `$events` item under Deferred partially supersedes it once it lands.
+- [Remote event delivery](../../../../packages/api/remotes/README.md): the unary `$events/result` answer path; the duplex `$events` item under Deferred partially supersedes it once it lands.
- [Session history and event transport](2026-08-18-session-history-and-event-transport.md): the `$stream()` supervisor and the journal / snapshot protocols above it, which this note leaves unchanged.
- [Web sidebar terminal](../feature/2026-09-09-web-sidebar-terminal.md): the unary terminal `write` and `attachmentId`; the `attach` stream under Deferred replaces it once it lands.
diff --git a/.agents/notes/implemented/architecture/2026-09-19-remote-duplex-stream.zh.md b/.agents/notes/implemented/architecture/2026-09-19-remote-duplex-stream.zh.md
index 2e119bf054..791b5e3c81 100644
--- a/.agents/notes/implemented/architecture/2026-09-19-remote-duplex-stream.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-19-remote-duplex-stream.zh.md
@@ -604,6 +604,6 @@ for await (const reply of stream) replies.push(reply) // ['> a', '> b']
## 相关
-- [Remote 事件投递](2026-08-10-remote-event-delivery.zh.md)：`$events/result` 的 unary 回答路径；「后续」里的双工 `$events` 落地后部分取代它。
+- [Remote 事件投递](../../../../packages/api/remotes/README.zh.md)：`$events/result` 的 unary 回答路径；「后续」里的双工 `$events` 落地后部分取代它。
- [会话历史与事件传输](2026-08-18-session-history-and-event-transport.zh.md)：`$stream()` 监督器与其上的 journal / snapshot 协议，本 Note 不改它们。
- [Web 侧边栏终端](../feature/2026-09-09-web-sidebar-terminal.zh.md)：终端按键的 unary `write` 与 `attachmentId`；「后续」里的 `attach` 流落地后取代它。
diff --git a/.agents/notes/implemented/architecture/2026-09-20-sidebar-retained-tab-layout.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-20-sidebar-retained-tab-layout.i18n.yaml
index 641b4a5806..26bf24ff02 100644
--- a/.agents/notes/implemented/architecture/2026-09-20-sidebar-retained-tab-layout.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-20-sidebar-retained-tab-layout.i18n.yaml
@@ -21,8 +21,8 @@
en: a34c228751a1a329
zh: 8e8b962b55e7c68e
/agent-note-stable-sidebar-tab-mounting-and-session-retention/decision/retention-versus-recovery:
- en: aabfa99401aa0f73
- zh: 465ebf723c4393aa
+ en: 61e4a975fea17a9a
+ zh: 911f4d1caab1efd0
/agent-note-stable-sidebar-tab-mounting-and-session-retention/alternatives-considered:
en: 84cfe7613657bfdb
zh: 4a0a499eb5d36d22
diff --git a/.agents/notes/implemented/architecture/2026-09-20-sidebar-retained-tab-layout.md b/.agents/notes/implemented/architecture/2026-09-20-sidebar-retained-tab-layout.md
index 3c1e23ad93..574667c79f 100644
--- a/.agents/notes/implemented/architecture/2026-09-20-sidebar-retained-tab-layout.md
+++ b/.agents/notes/implemented/architecture/2026-09-20-sidebar-retained-tab-layout.md
@@ -51,7 +51,7 @@ The [Desktop Browser decision](../feature/2026-09-20-desktop-browser-webview.md)
| Application restart or window reload | Show the saved title and URL; load only after an explicit restore or address submission. |
| Guest crash | Retry through the provider; page memory and native history are not durable. |
-[Layout and provider recovery](2026-09-14-sidebar-layout-provider-recovery.md) remains independent: persisted tab identity, placement and address support cold starts, not DOM serialization. A hidden page may continue scripts, media and networking.
+[Layout and provider recovery](../../../../packages/client/ui-sidebar-right/README.md) remains independent: persisted tab identity, placement and address support cold starts, not DOM serialization. A hidden page may continue scripts, media and networking.
## Alternatives considered
diff --git a/.agents/notes/implemented/architecture/2026-09-20-sidebar-retained-tab-layout.zh.md b/.agents/notes/implemented/architecture/2026-09-20-sidebar-retained-tab-layout.zh.md
index 000174a0c3..a2a88a209b 100644
--- a/.agents/notes/implemented/architecture/2026-09-20-sidebar-retained-tab-layout.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-20-sidebar-retained-tab-layout.zh.md
@@ -51,7 +51,7 @@ Tab 提供 Body 保活持有，而不独立申请会话引用。View 的稳定 `
| 应用重启或窗口刷新 | 展示保存的标题和 URL，显式恢复或提交地址后才加载。 |
| guest 崩溃 | 通过提供方重试；页面内存和原生 history 不持久化。 |
-[布局与提供方恢复](2026-09-14-sidebar-layout-provider-recovery.zh.md)仍然独立：持久化的 Tab 身份、位置和地址支持冷启动，而不是序列化 DOM。隐藏页面可能继续执行脚本、播放媒体或联网。
+[布局与提供方恢复](../../../../packages/client/ui-sidebar-right/README.zh.md)仍然独立：持久化的 Tab 身份、位置和地址支持冷启动，而不是序列化 DOM。隐藏页面可能继续执行脚本、播放媒体或联网。
## Alternatives considered
diff --git a/.agents/notes/implemented/architecture/2026-09-21-conversation-build-groups.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-21-conversation-build-groups.i18n.yaml
index f715253877..bbac97a7ad 100644
--- a/.agents/notes/implemented/architecture/2026-09-21-conversation-build-groups.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-21-conversation-build-groups.i18n.yaml
@@ -15,8 +15,8 @@
en: d7cf1bd544f163ee
zh: 2433f3faa5f5abcb
/agent-note-definition-owned-grouping-with-generic-node-group-assembly/decision/related-decisions:
- en: d8307dcaf2a9ac72
- zh: 4852b1e2a4d09af0
+ en: 0889aeb088ed31b2
+ zh: 539f03253b48c59b
/agent-note-definition-owned-grouping-with-generic-node-group-assembly/definition-input-state-and-registration:
en: 9fb89bddbfd75627
zh: 950c319db123c637
diff --git a/.agents/notes/implemented/architecture/2026-09-21-conversation-build-groups.md b/.agents/notes/implemented/architecture/2026-09-21-conversation-build-groups.md
index bccb48b0e4..39a31ae902 100644
--- a/.agents/notes/implemented/architecture/2026-09-21-conversation-build-groups.md
+++ b/.agents/notes/implemented/architecture/2026-09-21-conversation-build-groups.md
@@ -35,7 +35,7 @@ The grouping foundation provides a separate, Node-input `ConversationGroupDefini
| Record | Relationship |
|---|---|
| [Business Node assembly](2026-08-09-client-conversation-node-assembly.md) | Retains event matching, Contexts, Locations, one business Node per Context, and target Builders; grouping adds another input category. |
-| [Chat scroll and footer](../bug-fix/2026-09-22-chat-scroll-follow-and-footer-geometry.md) | Owns clipping and independent nested following without changing Group Definition membership. |
+| [Chat scroll and footer](../../../../packages/client/ui-chat/README.md) | Owns clipping and independent nested following without changing Group Definition membership. |
Grouping preserves the independent Node-assembly decisions. Cross-View navigation and `toolCallFocus` remain separate responsibilities; Group references carry no View handles or resource-navigation policy.
diff --git a/.agents/notes/implemented/architecture/2026-09-21-conversation-build-groups.zh.md b/.agents/notes/implemented/architecture/2026-09-21-conversation-build-groups.zh.md
index 5d2ec9e684..b469ad12ca 100644
--- a/.agents/notes/implemented/architecture/2026-09-21-conversation-build-groups.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-21-conversation-build-groups.zh.md
@@ -35,7 +35,7 @@ Chat Builder 汇总整个目标的节点及索引。在其中固定创建 Chat
| 记录 | 关系 |
|---|---|
| [业务节点组装](2026-08-09-client-conversation-node-assembly.zh.md) | 保留事件匹配、Context、Location、每个 Context 一个业务 Node 及目标 Builder，分组增加另一种输入类别。 |
-| [Chat 滚动与页脚](../bug-fix/2026-09-22-chat-scroll-follow-and-footer-geometry.zh.md) | 负责裁剪与独立的嵌套跟随，不改变 Group Definition 成员关系。 |
+| [Chat 滚动与页脚](../../../../packages/client/ui-chat/README.zh.md) | 负责裁剪与独立的嵌套跟随，不改变 Group Definition 成员关系。 |
分组保留独立的节点组装决策。跨 View 导航与 `toolCallFocus` 仍是独立职责，Group 引用不携带 View 句柄或资源导航策略。
diff --git a/.agents/notes/implemented/architecture/2026-09-21-creator-skills-progressive-disclosure.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-21-creator-skills-progressive-disclosure.i18n.yaml
deleted file mode 100644
index 4a59755b21..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-21-creator-skills-progressive-disclosure.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-21-creator-skills-progressive-disclosure.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-21-creator-skills-progressive-disclosure.md
-/agent-note-creator-skills-disclose-progressively-and-may-read-sources:
- en: 374f4a41f3026e59
- zh: 4e7f90d18b03fd14
-/agent-note-creator-skills-disclose-progressively-and-may-read-sources/problem:
- en: 1808717550a5e7ba
- zh: e18dd5a813a2398d
-/agent-note-creator-skills-disclose-progressively-and-may-read-sources/decision:
- en: b83fb74f03ca75a7
- zh: e4f6b1c73ef96787
-/agent-note-creator-skills-disclose-progressively-and-may-read-sources/alternatives-considered:
- en: d36d4f610925060a
- zh: c0ed56b6c631789e
-/agent-note-creator-skills-disclose-progressively-and-may-read-sources/consequences:
- en: ed908afe74adf3bc
- zh: 62a3cfba359dfbb6
diff --git a/.agents/notes/implemented/architecture/2026-09-21-desktop-page-close-shortcuts.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-21-desktop-page-close-shortcuts.i18n.yaml
index 55a0c25bdd..d2564b05ce 100644
--- a/.agents/notes/implemented/architecture/2026-09-21-desktop-page-close-shortcuts.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-21-desktop-page-close-shortcuts.i18n.yaml
@@ -9,8 +9,8 @@
en: feb9d491ad4a9016
zh: 291f0e6c913b0b19
/agent-note-desktop-close-shortcuts-follow-page-focus/decision:
- en: c587d88575b6ce7e
- zh: 2287cf4d6d2e7587
+ en: f076fb4b2098899d
+ zh: 6f136e9d11714e02
/agent-note-desktop-close-shortcuts-follow-page-focus/alternatives-considered:
en: 10c7bb2fc87bdd16
zh: 796ecde8bcf09d34
diff --git a/.agents/notes/implemented/architecture/2026-09-21-desktop-page-close-shortcuts.md b/.agents/notes/implemented/architecture/2026-09-21-desktop-page-close-shortcuts.md
index dc97680644..ef53a03de7 100644
--- a/.agents/notes/implemented/architecture/2026-09-21-desktop-page-close-shortcuts.md
+++ b/.agents/notes/implemented/architecture/2026-09-21-desktop-page-close-shortcuts.md
@@ -14,7 +14,7 @@ The sidebar page owner resolves close against live focus and captures the target
The macOS File menu routes Close Page or Window through the same owner and displays the accepted single-key binding. Native closure requires the current configuration revision, a focused and enabled product window, and inactive shortcut recording. The existing window lifecycle applies without a shortcut-specific confirmation: macOS keeps the application alive after its last window closes; Windows and Linux quit and stop the Host.
-This decision owns File-menu and close behavior in place of the close-role choice in [the standard macOS menu note](../bug-fix/2026-09-16-desktop-window-menus.md). That note retains the rationale for native Window and application hide commands. [Shortcut preference persistence](2026-09-20-device-local-shortcut-preferences.md) owns accepted bindings and revision publication.
+This decision owns File-menu and close behavior; the [Desktop reference](../../../../apps/desktop/README.md) documents native Window and application hide commands. [Shortcut preference persistence](2026-09-20-device-local-shortcut-preferences.md) owns accepted bindings and revision publication.
## Alternatives considered
diff --git a/.agents/notes/implemented/architecture/2026-09-21-desktop-page-close-shortcuts.zh.md b/.agents/notes/implemented/architecture/2026-09-21-desktop-page-close-shortcuts.zh.md
index 6ef60c084f..298c493bb7 100644
--- a/.agents/notes/implemented/architecture/2026-09-21-desktop-page-close-shortcuts.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-21-desktop-page-close-shortcuts.zh.md
@@ -14,7 +14,7 @@ Status: implemented
macOS File 菜单通过同一个 owner 路由“关闭页面或窗口”，并显示已接受的单键绑定。原生关闭要求配置 revision 仍为当前值、产品窗口已聚焦且启用，并且没有在录制快捷键。现有窗口生命周期直接生效，不增加快捷键专用确认：macOS 最后一个窗口关闭后保留应用；Windows 和 Linux 退出并停止 Host。
-本决策接管[标准 macOS 菜单记录](../bug-fix/2026-09-16-desktop-window-menus.zh.md)中 close role 选择所涉及的 File 菜单和关闭行为。该记录保留原生 Window 与应用隐藏命令的理由。[快捷键偏好持久化](2026-09-20-device-local-shortcut-preferences.zh.md)负责已接受绑定及 revision 发布。
+本决策负责 File 菜单与关闭行为；[Desktop 参考](../../../../apps/desktop/README.zh.md)说明原生 Window 与应用隐藏命令。[快捷键偏好持久化](2026-09-20-device-local-shortcut-preferences.zh.md)负责已接受绑定及 revision 发布。
## 考虑过的替代方案
diff --git a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.i18n.yaml
index e6f2fb8718..e7aef9adc0 100644
--- a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.i18n.yaml
@@ -9,11 +9,11 @@
en: 2ba6c43b20a3d347
zh: 5647179ddaa38ad9
/agent-note-ship-experimental-capabilities-as-optional-bundles/decision:
- en: 1c5a43b3ce2d3056
- zh: b59f549a12cf67d1
+ en: e6ffc783859d7509
+ zh: 8678f323985a24f4
/agent-note-ship-experimental-capabilities-as-optional-bundles/alternatives-considered:
- en: a65d84004e48b3ef
- zh: 17221f08e7a8a89b
+ en: 9ff0511566948d8b
+ zh: 4e1e37b79f63d390
/agent-note-ship-experimental-capabilities-as-optional-bundles/consequences:
- en: a5c9699904fa72f1
- zh: 80763881150593e2
+ en: 9d2b313f15fc9ce0
+ zh: 522341c83565ac33
diff --git a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md
index 9c3de87f91..d529b27542 100644
--- a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md
+++ b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md
@@ -10,9 +10,13 @@ The Web plugin page offered two optional bundles, Agent Teams and voice input. A
## Decision
-`OPTIONAL_BUNDLES` lists Agent Teams, voice input, and Auto review. Every optional bundle declares `icon` and exports `./locale/*.json` with `meta.title` and `meta.description`, so the Official group renders a localized title, description, and image; `verify-default-product-isolation` rejects an optional bundle without them. The Inspector's `cordis.patch.yml` names the package instead of a built-artifact path, so the same file is the bundle patch and the `--patch` overlay for a built Web launch.
+`OPTIONAL_BUNDLES` owns the installation's default-off selections, including maintained optional capabilities and experimental capabilities. Every bundle declares `icon` and exports `./locale/*.json` with `meta.title` and `meta.description`; the Official group displays that metadata. A bundle's presentation does not determine its [experimental status](../../../../packages/experimental/README.md#status). The isolation check validates admission and still rejects experimental dependencies of nonexperimental bundles.
-An optional bundle is a runtime dependency of the installation, so its dependency graph is downloaded by every `dsh` install. The list therefore admits only packages whose graph is already in the installation's closure; Auto review adds nothing. The Inspector stays available through explicit installation and does not appear in the default plugin list. The browser-use and computer-use providers stay explicit compositions: Playwright MCP, Chrome DevTools MCP, and the native Cua Driver runtime binaries add about 85 MB and 21 packages to every install whether or not the bundle is enabled, and a shipped Cua Driver MCP switch would offer a capability whose executable the installation does not carry. Those provider packages keep locale display metadata for their component rows. Two more packages stay out for other reasons: `ptc-runtime-python` replaces the PTC runtime, and `workflow-ptc` rejects a non-TypeScript runtime at load while the Web presets carry `workflow-ptc` rows a bundle patch cannot reach; `browser-use-stagehand-native` requires a native model name and API key at schema validation with no configuration form on the page.
+An optional bundle's dependencies are downloaded with every `dsh` installation. [Reasoning translation](2026-10-05-anonymous-reasoning-translation.md) uses three experimental packages without adding third-party runtime dependencies. Admission therefore considers installation cost and whether a switch supplies a usable composition without an additional configuration form. Browser and computer providers remain explicit compositions because they add substantial runtimes or require an external executable. Stagehand requires model credentials; Python PTC replaces a core provider and conflicts with TypeScript workflow consumers. Demonstrative hooks, webhooks, and mods stay outside the list. [Session Inspector](../feature/2026-09-24-session-inspector.md) owns the Inspector's distinct activation behavior.
+
+Bundles add scoped rows with the [profile patch operation](../../../../packages/boot/app-boot/README.md): `preset` names a declaration row, and the ordinary patch operates on its child list. Full Web presets receive the optional model tools; minimal retains its current shell and working-directory tools. Search, Ralph, and terminals supply their own isolated services. Search opens one in-memory index on demand per retained preset revision; the Host search policy stays unchanged. Badge skills and title providers act on the Host. Existing Agents retain their preset generation, and later user patch layers retain precedence. Title replacement waits for disposal of the previous provider.
+
+Claude Code and Codex install on demand through the separate `ON_DEMAND_BUNDLES` catalog; the [on-demand native-bundle decision](2026-10-05-official-on-demand-bundles.md) owns the cost, version, and offline-discovery trade-offs.
## Alternatives considered
@@ -20,6 +24,8 @@ An optional bundle is a runtime dependency of the installation, so its dependenc
**Mount the registration-only `computer-use` and `browser-use` services in `dsh-base`.** The shared composition would carry rows that only an optional provider bundle needs; a provider bundle can insert the service row from its own patch and dependencies.
+**Register preset extensions at runtime.** A separate registration path would need its own ordering, module resolution, generation updates, and inspection behavior. Profile patches keep one effective composition for boot, dumps, validation, and user overrides.
+
## Consequences
-The Official group carries three optional-bundle entries, each tagged experimental by its experimental name. The runtime dependency closure of the installation is unchanged. A browser-use or computer-use provider still needs its Service Definition and the provider in a profile patch or composition.
+Official discovery does not imply experimental status or a different plugin lifecycle. Switching a bundle off keeps its installed files; failed activation retains the existing saved-selection behavior. Scoped rows appear read-only under their bundle, and removal respects modules retained by live preset generations. Individual and combined composition tests cover the supported presets; live switching and recorded Sessions cover activation and model-visible behavior.
diff --git a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.zh.md b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.zh.md
index 3198b409c7..13abff45a0 100644
--- a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.zh.md
@@ -10,9 +10,13 @@ Web 插件页只提供两个可选 bundle：Agent Teams 与语音输入。Auto r
## 决策
-`OPTIONAL_BUNDLES` 列出 Agent Teams、语音输入与 Auto review。每个可选 bundle 都声明 `icon` 并导出带 `meta.title` 与 `meta.description` 的 `./locale/*.json`，官方分组因此能渲染本地化标题、描述和图片；`verify-default-product-isolation` 会拒绝缺少这些声明的可选 bundle。Inspector 的 `cordis.patch.yml` 直接写包名而非构建产物路径，所以同一文件既是 bundle patch，也是已构建 Web 启动的 `--patch` overlay。
+`OPTIONAL_BUNDLES` 管理安装随附且默认关闭的选项，包括维护中的可选能力与实验性能力。每个 bundle 声明 `icon`，并导出带 `meta.title` 与 `meta.description` 的 `./locale/*.json`；官方分组显示这些元数据。Bundle 的展示方式不决定其[实验性状态](../../../../packages/experimental/README.zh.md#status)。隔离检查校验准入，并继续拒绝非实验 bundle 的实验性依赖。
-可选 bundle 是安装的运行时依赖，其依赖图会随每次 `dsh` 安装一起下载。因此名单只接纳依赖图已在安装闭包内的包；Auto review 不增加任何依赖。Inspector 保留显式安装方式，不在默认插件列表中显示。浏览器操作与电脑操作提供方仍保持显式组合：Playwright MCP、Chrome DevTools MCP 与原生 Cua Driver 运行时二进制会让每次安装多出约 85 MB、21 个包，无论 bundle 是否启用；而随附的 Cua Driver MCP 开关会提供一个安装本身并不携带其可执行文件的能力。这些提供方包保留 locale 显示元数据，供组件行使用。另有两个包因其他原因不纳入：`ptc-runtime-python` 会替换 PTC 运行时，而 `workflow-ptc` 在加载时拒绝非 TypeScript 运行时，且 Web preset 内含 bundle patch 无法触及的 `workflow-ptc` 行；`browser-use-stagehand-native` 在 schema 校验时就要求原生模型名称与 API 密钥，而插件页没有对应的配置表单。
+可选 bundle 的依赖随每次 `dsh` 安装下载。[思考过程翻译](2026-10-05-anonymous-reasoning-translation.zh.md)使用三个实验包，不增加第三方运行时依赖。因此准入需要考虑安装成本，以及开关能否在不增加配置表单的情况下提供可用组合。浏览器与电脑提供方仍使用显式组合，因为它们会增加较大的运行时或要求外部可执行文件。Stagehand 需要模型凭据；Python PTC 替换核心提供方，并与 TypeScript workflow 消费方冲突。演示性钩子、webhook 与模组不进入名单。[Session Inspector](../feature/2026-09-24-session-inspector.zh.md) 管理 Inspector 特有的激活行为。
+
+Bundle 通过 [profile patch 操作](../../../../packages/boot/app-boot/README.zh.md)添加作用域行：`preset` 指定声明行，普通 patch 对其子列表生效。完整 Web 预设获得可选模型工具；minimal 保持当前的 shell 与工作目录工具。搜索、Ralph 与终端提供自己的隔离服务。搜索在每个保留的预设修订中按需打开一个内存索引；Host 搜索策略保持不变。徽章技能与标题提供方作用于 Host。已有 Agent 保留其预设代际，后续用户 patch 层继续优先。标题替换等待前一个提供方完成清理。
+
+Claude Code 与 Codex 通过独立的 `ON_DEMAND_BUNDLES` 目录按需安装，其成本、版本与离线发现取舍由[按需原生 bundle 决策](2026-10-05-official-on-demand-bundles.zh.md)管理。
## 考虑过的替代方案
@@ -20,6 +24,8 @@ Web 插件页只提供两个可选 bundle：Agent Teams 与语音输入。Auto r
**在 `dsh-base` 中挂载仅负责注册的 `computer-use` 与 `browser-use` 服务。** 共享组合将携带只有可选提供方 bundle 才需要的行；提供方 bundle 可以从自己的 patch 和依赖插入服务行。
+**在运行时注册预设扩展。** 独立注册路径需要自己的排序、模块解析、代际更新与检查行为。Profile patch 为启动、配置导出、校验和用户覆盖保留同一个有效组合。
+
## 后果
-官方分组包含三个可选 bundle 条目，每项都因实验包名而带实验性标签。安装的运行时依赖闭包保持不变。浏览器操作或电脑操作提供方仍需在 profile patch 或组合中同时挂载其 Service Definition 与提供方。
+官方发现不表示实验性状态，也不引入不同的插件生命周期。关闭 bundle 保留已安装文件；激活失败保留现有的已保存选择行为。作用域行在 bundle 内只读展示，删除操作尊重 live 预设代际仍持有的模块。独立与组合测试覆盖受支持的预设；实时切换与已记录 Session 覆盖激活和模型可见行为。
diff --git a/.agents/notes/implemented/architecture/2026-09-21-live-config-inspect-provider.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-21-live-config-inspect-provider.i18n.yaml
deleted file mode 100644
index a9e885fe52..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-21-live-config-inspect-provider.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-21-live-config-inspect-provider.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-21-live-config-inspect-provider.md
-/agent-note-live-plugin-config-inspection-replaces-the-host-builtin-provider:
- en: f57edbb8b3fa60ae
- zh: 8d0fa0eb73bbdaf1
-/agent-note-live-plugin-config-inspection-replaces-the-host-builtin-provider/problem:
- en: e01cc31ce200b24b
- zh: 7462a52c3e59ec87
-/agent-note-live-plugin-config-inspection-replaces-the-host-builtin-provider/decision:
- en: a7d21366030c31ac
- zh: 047299df13e504b7
-/agent-note-live-plugin-config-inspection-replaces-the-host-builtin-provider/alternatives-considered:
- en: a19dba57a4108fc6
- zh: 2e64893e8bcf6513
-/agent-note-live-plugin-config-inspection-replaces-the-host-builtin-provider/consequences:
- en: efa454977043c76d
- zh: d6bf61ac47310d3e
diff --git a/.agents/notes/implemented/architecture/2026-09-22-fatal-diagnostics-and-crash-reports.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-22-fatal-diagnostics-and-crash-reports.i18n.yaml
index 567f3220b2..fae09a79ee 100644
--- a/.agents/notes/implemented/architecture/2026-09-22-fatal-diagnostics-and-crash-reports.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-22-fatal-diagnostics-and-crash-reports.i18n.yaml
@@ -12,8 +12,8 @@
en: ac461e0ea1702ecc
zh: 745def8581dc7974
/agent-note-fatal-diagnostics-and-desktop-crash-reports/relationship-to-earlier-decisions:
- en: 157e52fc4036044a
- zh: e474d9c9a36f1381
+ en: eced414858f08ef9
+ zh: 40639593b0d5bb6f
/agent-note-fatal-diagnostics-and-desktop-crash-reports/relationship-to-the-desktop-logging-design:
en: 7dc438912d10574a
zh: 07d05f9f17043d67
diff --git a/.agents/notes/implemented/architecture/2026-09-22-fatal-diagnostics-and-crash-reports.md b/.agents/notes/implemented/architecture/2026-09-22-fatal-diagnostics-and-crash-reports.md
index 01cbb24fc8..0cf5f64b89 100644
--- a/.agents/notes/implemented/architecture/2026-09-22-fatal-diagnostics-and-crash-reports.md
+++ b/.agents/notes/implemented/architecture/2026-09-22-fatal-diagnostics-and-crash-reports.md
@@ -28,7 +28,7 @@ Four decisions ship together.
## Relationship to earlier decisions
-This partially supersedes the [native Desktop fatal recovery](2026-09-15-desktop-native-fatal-recovery.md) note: the crash report file, not the Electron console, is now the record the dialog points to, and the dialog detail carries the report-path line; that note's dialog ownership, button set, and profile recovery remain active. The `uncaughtException` handling extends the release mechanism of the [fail-loud release](../bug-fix/2026-07-31-fail-loud-releases-the-terminal.md) note to synchronous throws.
+This partially supersedes the [native Desktop fatal recovery](2026-09-15-desktop-native-fatal-recovery.md) note: the crash report file, not the Electron console, is now the record the dialog points to, and the dialog detail carries the report-path line; that note's dialog ownership, button set, and profile recovery remain active. The `uncaughtException` handling extends the release mechanism of the [fail-loud release](../../../../packages/boot/app-boot/README.md) note to synchronous throws.
## Relationship to the Desktop logging design
diff --git a/.agents/notes/implemented/architecture/2026-09-22-fatal-diagnostics-and-crash-reports.zh.md b/.agents/notes/implemented/architecture/2026-09-22-fatal-diagnostics-and-crash-reports.zh.md
index 38f6a6802b..c3513bbddd 100644
--- a/.agents/notes/implemented/architecture/2026-09-22-fatal-diagnostics-and-crash-reports.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-22-fatal-diagnostics-and-crash-reports.zh.md
@@ -28,7 +28,7 @@ macOS 上，启动审计把一组 Web 客户端行列为 `import failed (see con
## 与既有决定的关系
-本 note 部分取代 [Desktop 原生致命恢复](2026-09-15-desktop-native-fatal-recovery.zh.md)：对话框指向的记录现在是崩溃报告文件而非 Electron 控制台，对话框详情多出报告路径一行；该 note 对对话框归属、按钮集合与 profile 恢复的决定仍然有效。`uncaughtException` 的处理把 [fail-loud release](../bug-fix/2026-07-31-fail-loud-releases-the-terminal.zh.md) note 的 release 机制扩展到同步抛出。
+本 note 部分取代 [Desktop 原生致命恢复](2026-09-15-desktop-native-fatal-recovery.zh.md)：对话框指向的记录现在是崩溃报告文件而非 Electron 控制台，对话框详情多出报告路径一行；该 note 对对话框归属、按钮集合与 profile 恢复的决定仍然有效。`uncaughtException` 的处理把 [fail-loud release](../../../../packages/boot/app-boot/README.zh.md) note 的 release 机制扩展到同步抛出。
## 与 Desktop 日志体系设计的关系
diff --git a/.agents/notes/implemented/architecture/2026-09-22-tool-call-three-phases.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-22-tool-call-three-phases.i18n.yaml
index 48da0f768d..c1523d3b70 100644
--- a/.agents/notes/implemented/architecture/2026-09-22-tool-call-three-phases.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-22-tool-call-three-phases.i18n.yaml
@@ -12,17 +12,17 @@
en: a15c7c13f167e5ac
zh: 63bcc2ef60c2f344
/agent-note-tool-calls-own-preparation-dispatch-and-results-by-callid/decision/one-tool-owns-three-stages:
- en: ea65da88c3df35bb
- zh: a71afb4683a75290
+ en: c4bac1088a4fd3bc
+ zh: 549348deae5485c1
/agent-note-tool-calls-own-preparation-dispatch-and-results-by-callid/decision/start-marks-an-initialization-candidate:
- en: 696a180246e23391
- zh: aeb2b1fdcfdf9631
+ en: 7771032e6ad227e7
+ zh: 313d32ab5312d965
/agent-note-tool-calls-own-preparation-dispatch-and-results-by-callid/decision/converge-on-final-state-without-replaying-preparation:
en: 603cbcf3379ad4f7
zh: e34d87ea348c756b
/agent-note-tool-calls-own-preparation-dispatch-and-results-by-callid/decision/shared-rows-reuse-their-existing-presentation:
- en: 24536588cd0c979b
- zh: 992d4c4657d6d034
+ en: a5741c967212250b
+ zh: de6288916a054c6e
/agent-note-tool-calls-own-preparation-dispatch-and-results-by-callid/decision/relationship-to-existing-records:
en: bd4984f66c507785
zh: 4d2372fdbc4c3cec
@@ -30,5 +30,5 @@
en: 505095bec889700e
zh: b77c492de3e8641a
/agent-note-tool-calls-own-preparation-dispatch-and-results-by-callid/consequences:
- en: 3cf36b54240013da
- zh: 67e663b431bc67d2
+ en: dd0e4561c50b1188
+ zh: 0ec83177ef570a78
diff --git a/.agents/notes/implemented/architecture/2026-09-22-tool-call-three-phases.md b/.agents/notes/implemented/architecture/2026-09-22-tool-call-three-phases.md
index f43eaf1a68..a99545b58b 100644
--- a/.agents/notes/implemented/architecture/2026-09-22-tool-call-three-phases.md
+++ b/.agents/notes/implemented/architecture/2026-09-22-tool-call-three-phases.md
@@ -18,7 +18,7 @@ The [Tool Definition](../../../../packages/client/ui-chat/src/client/conversatio
| Stage | Creation or update evidence | Available data and presentation |
|---|---|---|
-| `preparing` | A live delta with a call ID and tool name | Call identity, name, and time; no complete arguments, and one non-expandable row. An opt-in Hook can read the raw argument prefix. |
+| `preparing` | A live delta with a call ID and tool name | Call identity, name, time, and a lazy partial-argument view; one non-expandable row. |
| `start` | `tool/call` | Complete arguments; enables the tool's existing call presentation. |
| `result` | `tool/result` | The result and any complete arguments paired within the loaded window. |
@@ -28,7 +28,7 @@ An argument block ending does not trigger dispatch presentation. Showing prepara
The [Conversation Definition](../../../../packages/client/ui-conversation/src/client/contract/conversation.ts) retains its match/start/update interface and existing roles. Durable events and transient deltas may both match as start. The earliest start in the current event sequence initializes State; every later Match, including another start for the same ID, goes through update.
-A named tool delta and `tool/call` are both initialization candidates. A live delta can create preparation; a historical `tool/call` creates the dispatched stage directly. Matching still reads only the current event, without Context lookup, additional roles, registries, or separate caches.
+Every tool delta and `tool/call` are initialization candidates. A named live delta creates the preparing row; a historical `tool/call` creates the dispatched stage directly. Matching still reads only the current event, without Context lookup, additional roles, registries, or separate caches.
Successful stream settlement publishes the final Assistant message while retaining transient deltas until `step/end`. Each `tool/call` updates its existing callId; the Assistant keeps its live ordering anchor until the same cleanup. Failed, interrupted, or abandoned streams retire their deltas immediately. On retirement the Assembler reselects starts and recomputes State from remaining Matches. Undispatched preparations hide without synthetic execution results.
@@ -40,9 +40,9 @@ Groups include Tool nodes from preparation onward and classify and count them by
### Shared rows reuse their existing presentation
-[ToolRow](../../../../packages/client/ui-tool/src/client/tool/components/ToolRow.tsx) reuses the existing icon, title, and row component across all stages. The shared row model selects the tool title and combines any generic tool-name prefix with the available argument summary. Preparation has no complete arguments or result, and the shared argument parser returns null without parsing JSON. The existing slot Hook binding optionally exposes a call-scoped raw prefix; it adds no preparation registration mechanism. ToolRow prevents preparation rows from expanding.
+[ToolRow](../../../../packages/client/ui-tool/src/client/tool/components/ToolRow.tsx) reuses the existing icon, title, and row component across all stages. The shared row model selects the tool title and combines any generic tool-name prefix with the available argument summary. All stages expose the [lazy argument view](2026-09-24-preparing-tool-arguments.md); cards requiring dispatched arguments still return no call during preparation. ToolRow prevents preparation rows from expanding.
-Read, read_image, write/edit, search, web, todo, question, details, and the generic fallback use this path. Custom rows such as Bash, Skill, Present, and Cordis keep their own preparation branches. No automatic/custom registration declaration or second tool-classification list in ToolTree is introduced.
+Read, read_image, write/edit, search, web, todo, question, details, and the generic fallback use this path. Bash shares its component across stages; Skill, Present, and Cordis retain their own preparation branches. No automatic/custom registration declaration or second tool-classification list in ToolTree is introduced.
### Relationship to existing records
@@ -60,8 +60,8 @@ This decision replaces the [business-node assembly](2026-08-09-client-conversati
## Consequences
-- A tool may appear before its arguments are complete, but preparation neither implies execution nor exposes interactions requiring arguments.
+- A tool may appear before its arguments are complete, but preparation never implies execution. Interactions use only fields already available.
- Multiple starts with one ID belong to one lifecycle. Independent calls must use distinct IDs; a second-start error no longer detects identity reuse.
-- The shared row primitive is reused across stages. Write/edit separate preparing and dispatched components so only the former subscribes to raw arguments; custom rows may also switch internal components by stage.
-- Partial JSON parsing and `useToolCallDelta` are not provided. `useToolCallArgumentsPartial` exposes the existing Step's raw prefix without a second accumulator; write/edit use only its length for preparation progress.
+- The shared row primitive is reused across stages. Write/edit and Bash keep their component identity; custom rows may switch internal components by stage.
+- Partial-argument access and its update policy follow the lazy argument view; no separate raw-prefix Hook is required.
- Assembly tests separately cover live preparation, withdrawal, active-stream reconstruction, durable history, and paged convergence. Component tests cover argument-free presentation and stage changes; a recorded session covers browser preparation and reload results.
diff --git a/.agents/notes/implemented/architecture/2026-09-22-tool-call-three-phases.zh.md b/.agents/notes/implemented/architecture/2026-09-22-tool-call-three-phases.zh.md
index accbd2e966..9bea117dd3 100644
--- a/.agents/notes/implemented/architecture/2026-09-22-tool-call-three-phases.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-22-tool-call-three-phases.zh.md
@@ -18,7 +18,7 @@ Status: implemented
| 阶段 | 创建或更新依据 | 可用数据与展示 |
|---|---|---|
-| `preparing` | 带调用 ID 和工具名的实时 delta | 调用身份、名称和时间；不提供完整参数，只显示不可展开的一行。可选钩子可读取原始参数前缀。 |
+| `preparing` | 带调用 ID 和工具名的实时 delta | 调用身份、名称、时间和懒计算的部分参数视图；显示不可展开的一行。 |
| `start` | `tool/call` | 完整参数；启用工具原有的调用展示。 |
| `result` | `tool/result` | 调用结果，以及当前窗口内可配对的完整参数。 |
@@ -28,7 +28,7 @@ Status: implemented
沿用 [Conversation Definition](../../../../packages/client/ui-conversation/src/client/contract/conversation.ts) 的 `match/start/update` 接口和既有角色。持久事件与瞬态 delta 都可以匹配为 start；当前事件序列中最早的 start 初始化 State，后续 Match，包括同 ID 的其他 start，都交给 update。
-Tool 的具名 delta 和 `tool/call` 都是创建入口。实时先收到 delta，就从 preparing 创建；历史先收到 `tool/call`，就从 start 创建。匹配函数仍然只读取当前事件，不查询 Context，不增加角色、注册表或旁路缓存。
+Tool 的每个 delta 和 `tool/call` 都是创建入口。具名实时 delta 创建准备行；历史 `tool/call` 直接创建派发阶段。匹配函数仍然只读取当前事件，不查询 Context，不增加角色、注册表或旁路缓存。
成功流结束时发布最终 Assistant 消息，瞬态 delta 保留到 `step/end`。每个 `tool/call` 更新已有 callId；Assistant 的实时排序锚点也保留到同一次清理。失败、中断或废弃的流立即移除 delta。清理时，Assembler 从剩余 Match 重新选择 start 并重算 State；未派发的准备节点隐藏，不合成执行结果。
@@ -40,9 +40,9 @@ Group 从准备阶段起就聚合 Tool 节点，按工具名分类和计数。As
### 通用行复用现有外壳
-[ToolRow](../../../../packages/client/ui-tool/src/client/tool/components/ToolRow.tsx) 在三个阶段复用既有图标、标题和行组件。公共行模型选择工具标题，并组合通用工具名前缀与已有参数摘要。准备阶段没有完整参数或结果，共享参数解析入口直接返回 null，不解析 JSON。既有 slot 钩子绑定可选地提供当前调用的原始前缀，不增加准备态注册机制；ToolRow 禁止准备行展开。
+[ToolRow](../../../../packages/client/ui-tool/src/client/tool/components/ToolRow.tsx) 在三个阶段复用既有图标、标题和行组件。公共行模型选择工具标题，并组合通用工具名前缀与已有参数摘要。所有阶段都提供[懒计算参数视图](2026-09-24-preparing-tool-arguments.zh.md)；需要完整派发参数的卡片在准备阶段仍返回无调用。ToolRow 禁止准备行展开。
-read、read_image、write/edit、search、web、todo、question、details 和通用回退使用这条路径。Bash、Skill、Present、Cordis 等自定义外壳保留自己的准备态分支。不增加自动／自管注册声明，不在 ToolTree 维护另一份工具分类名单。
+read、read_image、write/edit、search、web、todo、question、details 和通用回退使用这条路径。Bash 在各阶段共用组件；Skill、Present、Cordis 保留自己的准备态分支。不增加自动／自管注册声明，不在 ToolTree 维护另一份工具分类名单。
### 与已有记录的关系
@@ -60,8 +60,8 @@ read、read_image、write/edit、search、web、todo、question、details 和通
## 影响
-- 工具可以在参数完整前出现，但准备展示不表示工具已经执行，也不暴露依赖参数的交互。
+- 工具可以在参数完整前出现，但准备展示不表示工具已经执行；交互只使用已可用的字段。
- 同一 ID 的多个 start 被视为同一个生命周期；业务必须为独立调用提供不同 ID，不能再依赖第二个 start 报错检测身份复用。
-- 各阶段复用通用行基础组件。write/edit 分离准备态与派发后组件，只有前者订阅原始参数；自定义外壳也可按阶段切换内部组件。
-- 不提供部分 JSON 解析或 `useToolCallDelta`。`useToolCallArgumentsPartial` 暴露既有 Step 的原始前缀，不另建累积器；write/edit 只使用其长度展示准备进度。
+- 各阶段复用通用行基础组件。write/edit 和 Bash 保持组件身份；自定义外壳可按阶段切换内部组件。
+- 部分参数的读取与更新策略遵循懒计算参数视图，不需要独立的原始前缀钩子。
- 组装测试分别覆盖实时准备态、撤回、活跃流重建、持久历史与分页收敛；组件测试检查无参数展示和阶段切换，录制会话覆盖浏览器中的准备态与重载结果。
diff --git a/.agents/notes/implemented/architecture/2026-09-23-desktop-close-to-background-and-quit-confirmation.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-23-desktop-close-to-background-and-quit-confirmation.i18n.yaml
index 28b2efa813..11a37ac266 100644
--- a/.agents/notes/implemented/architecture/2026-09-23-desktop-close-to-background-and-quit-confirmation.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-23-desktop-close-to-background-and-quit-confirmation.i18n.yaml
@@ -3,8 +3,8 @@
# After editing either side, bring the other along and re-record with:
# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-23-desktop-close-to-background-and-quit-confirmation.md
/agent-note-hide-the-desktop-window-on-close-and-confirm-interruptible-quits:
- en: 9e029938c58bf143
- zh: f60f9cf2067a02ee
+ en: 92bb54cd9fe6b168
+ zh: b0952405c6066416
/agent-note-hide-the-desktop-window-on-close-and-confirm-interruptible-quits/problem:
en: 782e934449eae28c
zh: 0941465dff3a26d9
diff --git a/.agents/notes/implemented/architecture/2026-09-23-desktop-close-to-background-and-quit-confirmation.md b/.agents/notes/implemented/architecture/2026-09-23-desktop-close-to-background-and-quit-confirmation.md
index 67c7bf92e0..937cff4f32 100644
--- a/.agents/notes/implemented/architecture/2026-09-23-desktop-close-to-background-and-quit-confirmation.md
+++ b/.agents/notes/implemented/architecture/2026-09-23-desktop-close-to-background-and-quit-confirmation.md
@@ -4,7 +4,7 @@ Status: implemented
English | [中文](2026-09-23-desktop-close-to-background-and-quit-confirmation.zh.md)
-Window timing and shutdown ownership otherwise follow [showing the window before the Host starts](2026-09-09-desktop-immediate-window-and-direct-start.md); the task rule reuses the [update restart check](2026-08-25-electron-desktop-packaging-and-updates.md). This partially supersedes the [standard macOS window menus](../bug-fix/2026-09-16-desktop-window-menus.md) decision: ⌘W no longer destroys the window through Electron's role, and Dock activation reopens the hidden window when no window is visible instead of only when none exists. That note's menu declarations stay in force.
+Window timing and shutdown ownership otherwise follow [showing the window before the Host starts](../../../../apps/desktop/README.md); the task rule reuses the [update restart check](2026-08-25-electron-desktop-packaging-and-updates.md). ⌘W does not destroy the window through Electron's role, and Dock activation reopens the hidden window when no window is visible instead of only when none exists. The native menu declarations in the [Desktop reference](../../../../apps/desktop/README.md) stay in force.
## Problem
diff --git a/.agents/notes/implemented/architecture/2026-09-23-desktop-close-to-background-and-quit-confirmation.zh.md b/.agents/notes/implemented/architecture/2026-09-23-desktop-close-to-background-and-quit-confirmation.zh.md
index e5a59bcd0b..02633e6e04 100644
--- a/.agents/notes/implemented/architecture/2026-09-23-desktop-close-to-background-and-quit-confirmation.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-23-desktop-close-to-background-and-quit-confirmation.zh.md
@@ -4,7 +4,7 @@ Status: implemented
[English](2026-09-23-desktop-close-to-background-and-quit-confirmation.md) | 中文
-窗口时序和关闭归属仍遵循[在 Host 启动前显示窗口](2026-09-09-desktop-immediate-window-and-direct-start.zh.md)；任务判定复用[更新重启检查](2026-08-25-electron-desktop-packaging-and-updates.zh.md)。本记录部分取代[标准 macOS 窗口菜单](../bug-fix/2026-09-16-desktop-window-menus.zh.md)决策：⌘W 不再通过 Electron 的 role 销毁窗口，Dock 激活在没有可见窗口时重新打开隐藏窗口，而不再只在没有任何窗口时才创建。该记录中的菜单声明仍然有效。
+窗口时序和关闭归属仍遵循[在 Host 启动前显示窗口](../../../../apps/desktop/README.zh.md)；任务判定复用[更新重启检查](2026-08-25-electron-desktop-packaging-and-updates.zh.md)。⌘W 不通过 Electron 的 role 销毁窗口，Dock 激活在没有可见窗口时重新打开隐藏窗口，而不再只在没有任何窗口时才创建。[Desktop 参考](../../../../apps/desktop/README.zh.md)中的原生菜单声明仍然有效。
## 问题
diff --git a/.agents/notes/implemented/architecture/2026-09-23-schedule-local-menu.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-23-schedule-local-menu.i18n.yaml
deleted file mode 100644
index 5bd54753a0..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-23-schedule-local-menu.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-23-schedule-local-menu.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-23-schedule-local-menu.md
-/agent-note-own-the-schedule-detail-menus-inside-the-schedule-client:
- en: a9ed8f9cf0bdfd66
- zh: ff11822efe6b48b7
-/agent-note-own-the-schedule-detail-menus-inside-the-schedule-client/problem:
- en: 076e6ca799bf2045
- zh: d3f87030015cdf3c
-/agent-note-own-the-schedule-detail-menus-inside-the-schedule-client/decision:
- en: c35ab9fa2549866d
- zh: 01855f87b884dc93
-/agent-note-own-the-schedule-detail-menus-inside-the-schedule-client/alternatives-considered:
- en: 3648e55bb76a4381
- zh: 83c98e0789a6df9c
-/agent-note-own-the-schedule-detail-menus-inside-the-schedule-client/consequences:
- en: f6380c38e35bce37
- zh: 1379ff1763d0eb10
-/agent-note-own-the-schedule-detail-menus-inside-the-schedule-client/testing:
- en: f1de601175678a9a
- zh: 58fddec29a462b98
diff --git a/.agents/notes/implemented/architecture/2026-09-23-schedule-local-menu.md b/.agents/notes/implemented/architecture/2026-09-23-schedule-local-menu.md
deleted file mode 100644
index fd3266bbc4..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-23-schedule-local-menu.md
+++ /dev/null
@@ -1,43 +0,0 @@
-# Agent Note: Own the Schedule detail menus inside the Schedule client
-
-Status: implemented
-
-English | [中文](2026-09-23-schedule-local-menu.zh.md)
-
-## Problem
-
-The Automation tasks detail needs a menu whose list carries a pinned control: the Time zone row's search field must stay above the scrolling zone rows. The shared `Menu` in `@deepseek-ai/dsh-client-ui-primitives` renders rows, separators, labels, a selection mark, and a keyboard walk, but it has no header slot. The Delivery records tab shows a saved record's message id behind an info glyph, and the reader must be able to read and copy that id.
-
-Serving either need by extending `ui-primitives` puts one feature's behavior into the package every client plugin consumes. The same branch had already removed unrelated `ui-layout` and `ui-sidebar-right` edits after review asked why a Schedule change touched them, and a shared primitive extended for a single caller still costs every future reader of that primitive.
-
-## Decision
-
-`packages/client/ui-schedule` owns its menu. `src/client/TaskMenu.tsx` with `TaskMenu.module.css` holds a schedule-local copy that renders rows, separators, labels, disabled and destructive rows, a trailing `selectedId` mark, the pointer and keyboard walk, portaled placement, the pinned `header` slot, and the `data-menu-field` focus handover. It imports the shared `useAnchoredPosition` and `useDismissOnOutsidePointer` hooks, which are the placement and dismissal behavior any anchored panel needs, and it imports no runtime value from `ui-primitives`. The four detail menus use it.
-
-The Delivery records tab names and copies a record's message id through an info button. The button's accessible name states the action and the record (`Copy message ID: `), the shared `Tooltip` states the id on hover and on keyboard focus, and activation copies it through the shared `writeClipboard` helper and reports `Copied` in a status region beside the glyph. `Tooltip` therefore keeps its master shape: the mode that held one bubble open under the pointer is gone, and the Delivery records view does not use the `HoverCard` that opens on the pointer alone.
-
-`packages/client/ui-primitives` returns to master except the clock glyph's stroke. The client bundle purity gate in `packages/client/tsdown.client.ts` is the neighboring rule for the other direction of this boundary: a client plugin may import another plugin's package only as types or as a module-table request, so shared runtime vocabulary travels through an inline-safe layer or a cordis service rather than a package edge.
-
-## Alternatives considered
-
-**Add a `header` prop to the shared `Menu`.** This is what the branch first did: an optional slot plus the `data-menu-field` focus handover, with tests in the shared package. It gives the smallest diff and keeps one menu implementation, and it was rejected because the only caller is the Schedule detail: `ui-primitives` would carry API that exists for one feature, and every client plugin's bundle would read a header contract none of them use.
-
-**Add an `interactive` mode to the shared `Tooltip`.** Shipped first and then removed: a grace period between anchor and bubble, pointer hold, click toggling, and selectable text, with six tests. It lost because the shared tooltip already opens on focus and the shared clipboard helper already performs the copy, so the mode added a second way to hold one bubble open for a single caller.
-
-**Name and copy the message id through `HoverCard`.** Shipped second and then replaced: the card holds while the pointer rests on it, selects its text, and copies on activation. It lost because `HoverCard` opens on `onPointerEnter` alone, so the already-focusable glyph showed a keyboard reader nothing and offered no copy path.
-
-**Render the zone search field outside the menu list.** A search input above the trigger, or a separate row in the rule card, needs no primitive change. It was rejected because the field would scroll away from the list it filters or sit in a different surface than the rows it filters.
-
-**Build the zone picker on the schedule-local `PickerPopover`.** The Date and Time pickers already use that panel, so the zone list could reuse it. It was rejected because `PickerPopover` positions and dismisses a panel but renders no list semantics: the keyboard walk, the row roles, and the selected-row mark would have to be rebuilt inside the Schedule client anyway, which is the copy this note describes with more surface than the menu it replaces.
-
-## Consequences
-
-The Schedule client carries a second menu implementation: 346 lines of component, 189 lines of CSS, and 403 lines of tests, in exchange for `ui-primitives` returning to master except the clock glyph's stroke. The copy is trimmed to what the detail uses, and the absent capabilities stay absent: submenus, component-rendered rows, a pinned footer, multiple selection ids, the fill selection mode, dense and compact spacing, mount-time autofocus, a caller-supplied anchor rect, pointer-leave closing, and a side parameter. A later Schedule menu that needs one of them extends the copy or revisits this decision.
-
-Copying is an activation, not a text selection: the tooltip shows the id but does not accept the pointer, so the desktop gesture that copies the id is a click on the glyph. That is the capability the removed interactive mode had and this shape gives up. Shared behavior stays shared: placement, dismissal, focus handover, the duplication gate's exclusion markers naming both owners, and per-file coverage all apply to the copy. The copied region carries `jscpd:ignore-start` and `jscpd:ignore-end` with the two owners named, following the [cross-package value dependencies note](../../archived/process/2026-08-23-client-cross-package-value-dependencies.md); the schedule-specific header, handover, and Tab semantics sit outside that region.
-
-The copy places its list with `useAnchoredPosition`, which clamps every edge by the same 12px margin, while the shared menu's top edge used the frame-top clearance helper. A list that must clamp upward against the top of a macOS window can therefore sit about 12px lower than the shared menu did in the same situation; the stylesheet still reserves the clearance for the list's own maximum height, so the common case is unchanged.
-
-## Testing
-
-`packages/client/ui-schedule/tests/task-menu.client.spec.tsx` pins the pointer and keyboard walk, the `header` field's Home/End ownership, the `data-menu-field` handover after placement, the selected-row mark, disabled rows, portal placement, outside dismissal, and focus return; the three menu-header tests that lived in `ui-primitives` moved there with the capability. `delivery-history.client.spec.tsx` pins the tooltip that keyboard focus raises, the button's accessible name, the clipboard write, and the copy confirmation that clears. The coverage gate reports 100% per file for `packages/client/ui-schedule/src`, and the duplication gate reports no clones across `packages/client/ui-schedule` and `packages/client/ui-primitives`.
diff --git a/.agents/notes/implemented/architecture/2026-09-23-schedule-local-menu.zh.md b/.agents/notes/implemented/architecture/2026-09-23-schedule-local-menu.zh.md
deleted file mode 100644
index 924f14f5ad..0000000000
--- a/.agents/notes/implemented/architecture/2026-09-23-schedule-local-menu.zh.md
+++ /dev/null
@@ -1,43 +0,0 @@
-# Agent Note: Schedule 详情菜单由 Schedule 客户端自己拥有
-
-Status: implemented
-
-[English](2026-09-23-schedule-local-menu.md) | 中文
-
-## Problem
-
-Automation tasks 详情需要一个列表顶部钉住控件的菜单：Time zone 行的搜索框必须停在滚动时区行之上。`@deepseek-ai/dsh-client-ui-primitives` 里的共享 `Menu` 会渲染行、分隔线、标题行、选中标记和键盘走位，但没有 header 槽。Delivery records 页把一条已保存记录的 message id 放在 info 图标背后，读者要能读到并复制这个 id。
-
-用扩展 `ui-primitives` 来满足其中任一需求，都会把单个功能的行为放进每个 client 插件都消费的包里。同一条分支此前已经因为 review 质询“Schedule 的改动为什么碰它们”而撤掉了无关的 `ui-layout` 与 `ui-sidebar-right` 编辑；而一个只为单一调用方扩展的共享原语，对之后每一个读它的人都是成本。
-
-## Decision
-
-`packages/client/ui-schedule` 自己拥有菜单。`src/client/TaskMenu.tsx` 与 `TaskMenu.module.css` 保存一份 schedule 本地副本，渲染行、分隔线、标题行、disabled 与 dangerous 行、`selectedId` 尾随标记、指针与键盘走位、portal 定位、钉住的 `header` 槽，以及 `data-menu-field` 焦点交接。它导入共享的 `useAnchoredPosition` 与 `useDismissOnOutsidePointer` hook——任何锚定面板都需要的定位与关闭行为——不从 `ui-primitives` 导入任何运行时值。详情的四个菜单都改用它。
-
-Delivery records 页用一个 info 按钮给出并复制记录的消息 id。该按钮的可访问名称同时说明动作与记录（`Copy message ID: `），共享 `Tooltip` 在悬停与键盘聚焦时给出该 id，激活时通过共享的 `writeClipboard` 复制，并在图标旁用 status 区域报告 `Copied`。因此 `Tooltip` 保持 master 形态：那个让气泡在指针下保持展开的模式已不存在，Delivery records 页也不使用只在指针下打开的 `HoverCard`。
-
-`packages/client/ui-primitives` 除时钟图标描边外回到 master。`packages/client/tsdown.client.ts` 的 client bundle purity gate 是这条边界另一方向上的相邻规则：client 插件只能以类型或 module-table request 的形式导入另一个插件的包，因此共享运行时词汇要么走 inline-safe 层，要么走 cordis service，而不是包与包之间的边。
-
-## Alternatives considered
-
-**给共享 `Menu` 加 `header` prop。** 这是分支最初的做法：一个可选槽加 `data-menu-field` 焦点交接，并在共享包里带测试。它的 diff 最小、只保留一份菜单实现；被否决是因为唯一的调用方是 Schedule 详情：`ui-primitives` 会背上只为单个功能存在的 API，而每个 client 插件的 bundle 都要读一份没人使用的 header 契约。
-
-**给共享 `Tooltip` 加 `interactive` 模式。** 先落地后撤除：锚点与气泡之间的宽限期、指针停留、点击切换、可选中的文字，外加六个测试。被否决是因为共享 tooltip 本来就支持聚焦展开、共享剪贴板助手本来就负责复制，这个模式只是为单一调用方多出了一种保持气泡展开的方式。
-
-**用 `HoverCard` 给出并复制消息 id。** 第二个落地又被替换的版本：指针停在卡片上时保持展开、文字可选中、激活即复制。被否决是因为 `HoverCard` 只在 `onPointerEnter` 打开，于是那个本来就可聚焦的图标对键盘读者什么都不显示，也没有复制入口。
-
-**把时区搜索框渲染在菜单列表之外。** 放在触发器上方的输入框，或规则卡里的独立一行，都不需要改原语。被否决是因为该输入框会与它所过滤的列表分离滚动，或落在与它过滤的行不同的界面层上。
-
-**用 schedule 本地的 `PickerPopover` 实现时区选择器。** Date 与 Time picker 已经用它。被否决是因为 `PickerPopover` 只负责定位与关闭面板，不渲染列表语义：键盘走位、行 role、选中行标记都要在 Schedule 客户端里重建，那正是本 note 描述的副本，而且比它所替代的菜单要维护更多东西。
-
-## Consequences
-
-Schedule 客户端多出一份菜单实现：346 行组件、189 行 CSS、403 行测试，换来 `ui-primitives` 除时钟图标描边外回到 master。副本按详情实际使用裁剪，缺失的能力保持缺失：submenu、组件渲染行、钉住的 footer、多个 selectedId、fill 选中模式、dense 与 compact 间距、挂载时 autofocus、调用方提供锚点矩形、指针离开即关闭，以及 side 参数。日后某个 Schedule 菜单需要其中一项时，要么扩展副本，要么重新审视这个决定。
-
-复制是一次激活，而不是选中文本：tooltip 给出 id 但不接受指针，所以桌面端复制该 id 的手势是点击图标；这正是被撤掉的交互模式所具备、而当前形态放弃的能力。共享行为仍是共享的：定位、关闭、焦点交接、点名两个 owner 的 duplication gate 排除标记，以及 per-file 覆盖率都适用于这份副本。被拷贝的区域带 `jscpd:ignore-start` 与 `jscpd:ignore-end` 并点名两个 owner，遵循 [cross-package value dependencies note](../../archived/process/2026-08-23-client-cross-package-value-dependencies.md)；schedule 专有的 header、交接与 Tab 语义不在该区域内。
-
-副本用 `useAnchoredPosition` 定位列表，它对四条边都用同一个 12px margin，而共享菜单的顶边用的是 frame-top clearance helper。因此在 macOS 窗口顶部需要向上钳制的列表，可能比共享菜单原先的位置低约 12px；样式表仍为该列表自身的最大高度保留 clearance，常见情形不变。
-
-## Testing
-
-`packages/client/ui-schedule/tests/task-menu.client.spec.tsx` 钉住指针与键盘走位、`header` 输入框对 Home/End 的独占、落位后的 `data-menu-field` 交接、选中行标记、disabled 行、portal 定位、外部关闭与焦点回返；原先位于 `ui-primitives` 的三个菜单 header 测试随该能力一起迁入。`delivery-history.client.spec.tsx` 钉住键盘聚焦展开的工具提示、按钮的可访问名称、剪贴板写入，以及会自行清除的复制确认。覆盖率门禁对 `packages/client/ui-schedule/src` 报告 per-file 100%，duplication 门禁在 `packages/client/ui-schedule` 与 `packages/client/ui-primitives` 上报告 0 克隆。
diff --git a/.agents/notes/implemented/architecture/2026-09-24-preparing-tool-arguments.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-24-preparing-tool-arguments.i18n.yaml
new file mode 100644
index 0000000000..fcc4c5d557
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-24-preparing-tool-arguments.i18n.yaml
@@ -0,0 +1,31 @@
+# Bilingual-pair consistency record for 2026-09-24-preparing-tool-arguments.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-24-preparing-tool-arguments.md
+/agent-note-incremental-tool-argument-scanning-and-argument-order-during-preparation:
+ en: 07f6420c67ea2700
+ zh: b9b53250e050cf6e
+/agent-note-incremental-tool-argument-scanning-and-argument-order-during-preparation/problem:
+ en: c97b3edd4ef1d063
+ zh: 5c8b6065e662f326
+/agent-note-incremental-tool-argument-scanning-and-argument-order-during-preparation/decision:
+ en: a15c7c13f167e5ac
+ zh: 63bcc2ef60c2f344
+/agent-note-incremental-tool-argument-scanning-and-argument-order-during-preparation/decision/a-lazily-computed-argument-view-lives-in-dsh-util-values:
+ en: eb004194b0c08464
+ zh: d09c6353ed7138de
+/agent-note-incremental-tool-argument-scanning-and-argument-order-during-preparation/decision/parsing-happens-in-the-tool-definition-not-in-react:
+ en: 518206f94d82993d
+ zh: c6cab3b2f71dd18b
+/agent-note-incremental-tool-argument-scanning-and-argument-order-during-preparation/decision/argument-declaration-order:
+ en: 0fd7c9f0b8cf6a28
+ zh: 7d410403283b9996
+/agent-note-incremental-tool-argument-scanning-and-argument-order-during-preparation/alternatives-considered:
+ en: 7a033f81c557c58f
+ zh: 2ec66b0db6cf5d9e
+/agent-note-incremental-tool-argument-scanning-and-argument-order-during-preparation/verification:
+ en: c1e09085a137be1c
+ zh: ec79806f84f59dec
+/agent-note-incremental-tool-argument-scanning-and-argument-order-during-preparation/consequences:
+ en: f1c44f9d58d36920
+ zh: bb297337882ec407
diff --git a/.agents/notes/implemented/architecture/2026-09-24-preparing-tool-arguments.md b/.agents/notes/implemented/architecture/2026-09-24-preparing-tool-arguments.md
new file mode 100644
index 0000000000..60a9bc6a15
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-24-preparing-tool-arguments.md
@@ -0,0 +1,88 @@
+# Agent Note: Incremental tool-argument scanning and argument order during preparation
+
+Status: implemented
+
+English | [中文](2026-09-24-preparing-tool-arguments.zh.md)
+
+## Problem
+
+[Three-stage tool calls](2026-09-22-tool-call-three-phases.md) make tool identity visible before `tool/call`. A raw argument prefix alone cannot supply field-aware presentation: write/edit need a complete path and decoded content length, while bash/run_code need the description before the command or program finishes streaming.
+
+The order in which the model generates arguments also decides what can appear first. On 2026-09-24, 310 controlled requests against the real DeepSeek V4 API exercised bash/run_code/write/edit:
+
+| Variant | Change | bash first key is description | run_code first key is description |
+|---|---|---|---|
+| Baseline | — | 0/20 | 1/20 |
+| `properties` order only | description moved first | 0/20 | 0/20 |
+| `properties` + `required` together | Same plus reordered `required` | Forced tool_choice 10/10; free calling Pro 7/10, Flash 0/10 | Forced 10/10; free 20/20 |
+| Together + one ordering instruction in the description text | Appends "Provide `description` before `command` in the arguments." | Free calling Flash 19/20, Pro 20/20 | 20/20 |
+
+In these samples, reordering `required` changes argument order where reordering `properties` alone does not; V4 Flash's free bash calls also need the explicit instruction. The `dsh-tools` schema DSL generates `required` in property declaration order, so changing the declaration order in source reorders both. The probe uses a minimal system prompt, not the complete Harness prompt.
+
+## Decision
+
+### A lazily computed argument view lives in `dsh-util-values`
+
+`PartialArguments` is a tool-independent lazy reader. It retains separate argument fragments and a top-level key/value range index, or borrows an already parsed PTC payload. Reads index only newly received boundaries; unrequested values are neither decoded, counted, nor parsed. Requested fields materialize from their own ranges, without a per-tool field specification or registry.
+
+The boundary scanner tracks quotes, backslash parity, and matching nested brackets across fragments. Key names are decoded for lookup, while value contents are deferred. `complete()` reports a closing delimiter, not validated content; `invalid` reports errors already found by indexing or a content read. Content errors do not prevent indexing subsequent fields. Formal tool-input validation remains outside this presentation reader.
+
+Requested unescaped lengths derive directly from offsets. Escaped strings maintain content cursors only for requested length, text, or bounded-prefix reads; a limit query stops once its answer is known. Closed strings use native decoding when their full text is first requested. Arbitrary late reads require retaining the original fragments until authoritative complete text replaces them.
+
+The view judges change itself: `append(delta)` only retains the fragment, and `refresh()` compares remembered answers at publication time. With nothing read yet, it does not scan or report a change. Only refresh advances an existing answer's comparison baseline; an intervening read cannot suppress another consumer's update. The business states its granularity as it reads: `stringLength('content', { step: 1024 })` makes only a kilobyte crossing count, `text('description')` makes every character count, and `textPrefix()` limits decoded text to the requested UTF-16 prefix. An `offset` includes completed strings when edit progress combines old and new text.
+
+### Parsing happens in the Tool Definition, not in React
+
+The [Tool Definition](../../../../packages/client/ui-chat/src/client/conversation-nodes/tool.ts) matches every `tool-call-delta` carrying an id as a start candidate: the earliest opens the Context whether or not it is named, later ones fold as updates. The named delta creates the preparing root with a fresh streaming view; every delta only calls `args.append(delta)`. At the `animation-frame` publication point, `buildViewNode()` refreshes observed answers and replaces the root only when they change; otherwise it reuses the currently published root. The Context and its published Node own these identities without a separate preparation cache. A stream whose arguments precede the name is not scanned: a view opened late sees a non-object prefix, turns invalid, and reports no fields.
+
+Every stage's block exposes `name` and `args`; legacy `argsRaw` and result `call: { name, argsRaw } | null` remain available. `block-end` and `tool/call` reconcile argument fragments against their authoritative full text with length and exact per-fragment comparisons. Matching text seals the same reader and preserves its indexed fields; missing or conflicting deltas create a new `fromText()` view. No cumulative string or probabilistic hash is needed. PTC readers use `fromObject(payload)`, results reuse the started reader, and an unpaired result uses the shared empty view. Card models continue to read finalized `argsRaw`.
+
+Assistant blocks retain tool identity and first-token timing, not argument deltas. Complete argument text comes from `block-end` or the durable message. Parameter-only deltas preserve Assistant State, while the Tool Definition owns preparing reads and notifications.
+
+The Assembler shares one immutable Match per input and lifecycle role, including its Location, while each Definition retains independent State. Empty dependency sets require no replay work.
+
+Rows use the same readers across stages: read/write/edit show an openable path once `file_path` closes; write/edit show decoded content length in 1024-character units while content streams; bash/pwsh/run_code show the description prefix. Chat group detail reads the same view using its existing field priority. Without usable detail it stays empty while fields can still arrive, then falls back to the tool name once `closed()` is true, for every category.
+
+Group detail normalizes an initial 512-unit decoded prefix and expands it only when whitespace or multi-unit grapheme clusters prevent deciding the 160-cluster result. A filled prefix remains unchanged as its field grows, while a later higher-priority field still republishes the detail. String-length checks do not materialize the full text. Detail already within 160 UTF-16 units requires no grapheme traversal.
+
+Third-party tools receive the same view without registration or a separate subscription. Write/edit and Bash share their component across stages. The mutable argument reader is a narrow exception to JSON-compatible owner data: its Definition publishes a new block reference when an observed answer changes. Scan caches use private fields so read history does not affect structural comparison of equal sources.
+
+### Argument declaration order
+
+`tool-bash` and `tool-pwsh` declare `description` before `command` and include the ordering instruction. Both `parameters` declarations of `run_code` put `description` before `code` and share a parameter description requesting that generation order for TypeScript and Python. Write/edit declare `file_path` first and ask for it before `content` or `old_string`/`new_string` in the path parameter description. Read retains its leading `file_path`; other tools retain their argument order.
+
+## Alternatives considered
+
+**Parse inside a hook closure (a selector subscribing to the Step source).** Only the subscribing row sees the parsed result, so group titles need another subscription and each row owns parser lifetime. Definition-owned views share parsed fields across consumers.
+
+**Keeping a per-tool field specification in the Definition (built-in table plus a runtime registry).** The Definition is a pure function without ctx, so a runtime registry could only reach it through a factory closure, and a third-party tool would register in two places, the slot and the registry; the specification only ever said which fields keep text, information that on-demand decoding from the raw text no longer needs.
+
+**Third-party `partial-json`.** It reparses the cumulative input each frame and does not expose string completion separately from the decoded value.
+
+**Eagerly parse every field.** Large fields such as `content` usually need only a length; eagerly materializing their text adds decoding and memory costs before a consumer asks for it. Observing the entire key list also republishes a block when an unused argument appears; detail keeps field-specific observations.
+
+**Slice the normalized field for a truncated detail.** A V8 substring can retain the entire field. Joining the bounded selection of grapheme clusters keeps the displayed prefix independent of that source.
+
+**Reorder `properties` only.** Measured 0/40 effective; the model follows the `required` order.
+
+## Verification
+
+- Parser tests cover lazy scanning, observed-answer changes, empty and repeated keys, split escapes, non-string values, invalid input, sealed views, and read-independent structural equality.
+- Row and grouping tests cover streamed paths and descriptions, content length, shared row identity, name fallback only when arguments cannot grow, and at most 161 clusters per truncation pass without changing whitespace or Unicode handling.
+- Negative controls restore read-time acknowledgement, repeated Match allocation, and short-text segmentation; four focused tests fail at their corresponding assertions and pass after restoration. Definitions retain independent State; Turn and Step records remain Session-owned.
+- Additional controls eagerly parse unread containers, accept same-length conflicting text, or rebuild Assistant State for parameter-only deltas. Each fails its owning assertion; the boundary-index implementation passes after restoration.
+
+The required [conversation-fold benchmark](../../../../benchmarks/conversation-fold/conversation-fold.bench.client.ts) drives the real Tool Definition, Assembler, Chat groups, and published write-row reads with 16-character fragments, flushing every 64 fragments. Three fresh compiled Node workers report all samples and their median; setup and forced GC are outside timing, and retained heap is measured with the Assembler and argument view still reachable. Row reads validate decoded progress and the file path; the worker also reports process peak RSS.
+
+Local Chat-only measurements on 2026-09-29 compare the pre-feature baseline with the optimized implementation for 512 KiB write content and 32,769 body deltas. On Linux x64, AMD EPYC 7763, Node 24.18.0, median unprofiled processing time is 212.16 → 176.12 ms, cumulative allocation including collected objects is 132.06 → 76.65 MiB, and retained heap is 24.89 → 21.84 MiB. These measurements exclude model, network, browser rendering, and non-Chat targets; they do not establish whole-page or CI-runner latency.
+
+Match calls remain 393,228; update calls rise from 98,307 to 131,076 because the Tool Definition consumes every argument delta. The baseline displays raw-length write progress rather than decoded argument reads.
+
+The CI budgets remain 750/375 ms and 37.5/10 MiB: reference expectations of 300/150 ms use the shared 2× time scale and 1.25× headroom, while 30/8 MiB heap expectations use headroom only. Historical cumulative-indexing/full-segmentation controls take 3984.9–4035.5 ms for write and 1471.2–1494.9 ms for bash, exceeding those unchanged budgets.
+
+## Consequences
+
+- Observed argument changes replace preparing blocks; unread calls retain their block reference. Views retain source text, and group headers can request fields independently of tool rows. Started and settled views scan on first read without publishing updates.
+- Schema order and description instructions encourage label-first generation but do not guarantee it. Rows show usable fields as they arrive; a late path delays its display and the accompanying content progress.
+- Presentation remains Client-derived; argument scanning adds no Session event or persistence format.
+- A stream whose name arrives after its arguments gives up scanning; that call's preparing row falls back to the title alone.
diff --git a/.agents/notes/implemented/architecture/2026-09-24-preparing-tool-arguments.zh.md b/.agents/notes/implemented/architecture/2026-09-24-preparing-tool-arguments.zh.md
new file mode 100644
index 0000000000..653b517aed
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-24-preparing-tool-arguments.zh.md
@@ -0,0 +1,88 @@
+# Agent Note: 准备阶段的工具参数增量扫描与参数顺序
+
+Status: implemented
+
+[English](2026-09-24-preparing-tool-arguments.md) | 中文
+
+## 问题
+
+[三阶段工具调用](2026-09-22-tool-call-three-phases.zh.md)让工具身份在 `tool/call` 之前就可见。只有原始参数前缀不足以按字段展示：write/edit 需要完整路径和解码后的内容长度，bash/run_code 需要在命令或程序流入结束前显示描述。
+
+模型生成参数的顺序也决定了什么能先显示。2026-09-24 用真实 DeepSeek V4 API 对 bash/run_code/write/edit 做了 310 次受控请求：
+
+| 变体 | 改了什么 | bash 首键为 description | run_code 首键为 description |
+|---|---|---|---|
+| 现状 | — | 0/20 | 1/20 |
+| 只调 `properties` 顺序 | description 提前 | 0/20 | 0/20 |
+| `properties` + `required` 同调 | 同上并调 `required` | 强制 tool_choice 10/10；自由调用 pro 7/10、flash 0/10 | 强制 10/10；自由 20/20 |
+| 同调 + 描述文本加一句顺序指令 | 追加「Provide `description` before `command` in the arguments.」 | 自由调用 flash 19/20、pro 20/20 | 20/20 |
+
+在这些样本中，单调 `properties` 无效时，调整 `required` 能改变参数顺序；V4 Flash 自由调用 bash 还需要显式指令。`dsh-tools` 的 schema DSL 按属性声明顺序生成 `required`，所以改源码声明顺序会同时调整两者。探针使用极简系统提示词，不是完整 Harness 提示词。
+
+## 决策
+
+### 懒计算的参数视图住在 `dsh-util-values`
+
+`PartialArguments` 是一个与工具无关的懒读器。它分别保留参数分片和顶层键值范围索引，或借用已解析的 PTC 参数。读取只索引新收到的边界；未请求的值不解码、不计数、不解析。请求字段时仅从该字段范围生成值，不需要每工具字段规格或注册表。
+
+边界扫描器跨分片跟踪引号、反斜杠奇偶和嵌套括号配对。键名为查找而解码，值内容延后处理。`complete()` 表示结束分隔符已到达，不代表内容已校验；`invalid` 报告索引或内容读取已经发现的错误。内容错误不阻止后续字段建立索引。正式工具入参校验仍位于此展示读器之外。
+
+被请求的无转义字符串长度直接由偏移量计算。转义字符串仅为已请求的长度、文本或有界前缀维护内容游标；上限查询在答案确定后停止。完整字符串首次被请求全文时使用原生解码。支持任意晚到的读取，需要保留原分片，直到权威完整文本替换它们。
+
+变化由视图自己判定：`append(delta)` 只保留分片，`refresh()` 在发布时比较已观察的答案。没人读过时，不扫描也不报告变化。只有 refresh 推进已有答案的比较基线；中途读取不能吞掉其他消费方的更新。业务在读的时候说明粒度——`stringLength('content', { step: 1024 })` 让跨 KB 才算变化，`text('description')` 让每个字符都算变化，`textPrefix()` 将解码文本限制在请求的 UTF-16 前缀内。edit 进度合计新旧文本时，`offset` 计入已完成的字符串。
+
+### 解析在 Tool Definition 层，不在 React
+
+[Tool Definition](../../../../packages/client/ui-chat/src/client/conversation-nodes/tool.ts) 把每个带 id 的 `tool-call-delta` 都匹配为 start 候选：最早的一个打开 Context（无论是否带名），后续折叠为 update。带名 delta 创建 preparing 根并挂上一个新的流式视图；每个 delta 只做 `args.append(delta)`。在 `animation-frame` 发布点，`buildViewNode()` 刷新已观察答案，仅在变化时替换根块，否则复用当前已发布根块。Context 和已发布 Node 持有这些身份，不另建准备阶段缓存。参数在名字之前到达的流不扫描：迟开的视图看到非对象前缀即 invalid、零字段。
+
+三个阶段的块都提供 `name` 和 `args`，原有 `argsRaw` 和 result 的 `call: { name, argsRaw } | null` 仍可使用。`block-end` 和 `tool/call` 通过长度及逐分片精确比较，将流式参数与权威全文核对。文本一致时封存原读器并保留字段索引，分片缺失或冲突时创建新的 `fromText()` 视图。不需要累加字符串或概率性 hash。PTC 读器使用 `fromObject(payload)`，结果复用已派发读器，未配对结果使用共享空视图。卡片模型继续读取最终 `argsRaw`。
+
+Assistant 块保留工具身份和首 token 时间，不保留参数 delta。完整参数文本来自 `block-end` 或持久消息。纯参数 delta 保持 Assistant State 不变，preparing 读取与通知由 Tool Definition 负责。
+
+Assembler 为同一输入和生命周期角色共享一个不可变 Match 及其 Location，各 Definition 仍保留独立 State。空依赖集合无需执行回放。
+
+工具行在各阶段使用相同读器：read/write/edit 在 `file_path` 闭合后显示可打开的路径；write/edit 在内容流入时按 1024 字符单位显示解码后长度；bash/pwsh/run_code 显示描述前缀。Chat 分组详情按既有字段优先级读取同一视图。没有可用详情时，只要字段还可能到达就留空；`closed()` 为真后才回退工具名，所有类别一致。
+
+分组详情先规范化 512 单元的解码前缀，仅当空白或多单元字素簇使其无法判定 160 字素簇的结果时才扩大前缀。前缀填满后，字段继续增长不会改变它，但稍后出现的更高优先级字段仍会发布新详情。字符串长度检查不会物化全文。详情不超过 160 个 UTF-16 单元时，无需遍历字素。
+
+三方工具无需注册或独立订阅就能取得同一视图。write/edit 和 Bash 在各阶段共用组件。可变参数读器是 owner 数据要求 JSON 兼容的一项限定例外：已读取答案变化时，所属 Definition 发布新的块引用。扫描缓存使用私有字段，同源视图的结构比较不受读取历史影响。
+
+### 参数声明顺序
+
+`tool-bash`、`tool-pwsh` 在 `command` 前声明 `description`，并包含顺序指令。`run_code` 两处 `parameters` 将 `description` 放在 `code` 前，共用的参数描述要求 TypeScript 和 Python 都按此顺序生成。write/edit 首先声明 `file_path`，并在路径参数描述中要求先生成它，再生成 `content` 或 `old_string`/`new_string`。read 保留首位的 `file_path`；其他工具保留原有参数顺序。
+
+## 考虑过的替代方案
+
+**在 hook 闭包里解析（选择器订阅 Step source）。** 只有订阅行能看到解析结果，分组标题需要另一份订阅，每行还要负责解析器生命周期。Definition 持有的视图让消费方共享已解析字段。
+
+**在 Definition 里维护每工具字段规格（内建表 + 运行时注册表）。** Definition 是纯函数、拿不到 ctx，运行时注册表只能经工厂闭包注入，三方工具要在坑位与注册表两处登记；而规格表本质只是"哪些字段保留文本"，懒计算按需从原始文本切出原文后这条信息不再需要。
+
+**第三方 `partial-json`。** 每帧重解析累计输入，且不独立于解码值暴露字符串完成状态。
+
+**提前解析所有字段。** `content` 等大字段通常只需要长度；在消费方请求前构造全文，会增加解码和内存成本。观察整个键列表还会在无关参数出现时重新发布块，因此详情保持逐字段观察。
+
+**从规范化字段切出截断详情。** V8 的子字符串可能保留整个字段。拼接有界数量的字素簇，使展示前缀不再依赖该原文。
+
+**只调 `properties` 顺序。** 实测 0/40 生效；模型跟随 `required` 顺序。
+
+## 验证
+
+- 解析器测试覆盖懒扫描、已读取答案变化、空键与重复键、跨片转义、非字符串值、非法输入、封存视图，以及不受读取历史影响的结构相等。
+- 工具行和分组测试覆盖流式路径与描述、内容长度、共用行身份、参数不再增长后才回退工具名，以及不改变空白或 Unicode 处理语义的每次截断遍历最多 161 个字素簇。
+- 负控恢复读取时确认变化、重复分配 Match 和短文本字素遍历；四项聚焦测试在对应断言失败，恢复后通过。各 Definition 保留独立 State，Turn 与 Step 记录仍归各 Session 所有。
+- 另有负控提前解析未读容器、接受同长度的冲突文本，或为纯参数 delta 重建 Assistant State。每项都在所属断言失败，恢复边界索引实现后通过。
+
+必跑的 [conversation-fold benchmark](../../../../benchmarks/conversation-fold/conversation-fold.bench.client.ts) 使用真实 Tool Definition、Assembler、Chat 分组及发布后的 write 行读取，以 16 字符分片输入，每 64 片 flush。三个独立的已编译 Node worker 报告全部样本及中位数；准备工作和显式 GC 不计时，保留 Assembler 与参数视图后测量驻留堆。行读取校验解码进度与文件路径；worker 还报告进程峰值 RSS。
+
+2026-09-29 的本地 Chat 专项测量，以 512 KiB write 内容和 32,769 个正文 delta 对比功能改造前基线与优化实现。在 Linux x64、AMD EPYC 7763、Node 24.18.0 上，无探针处理耗时中位数为 212.16 → 176.12 ms，包含已回收对象的累计分配为 132.06 → 76.65 MiB，驻留堆为 24.89 → 21.84 MiB。测量不含模型、网络、浏览器渲染和非 Chat 目标，不代表整页或 CI runner 延迟。
+
+Match 调用保持 393,228 次；update 从 98,307 增至 131,076 次，因为 Tool Definition 消费每个参数 delta。基线按原文长度显示 write 进度，不读取解码后的参数。
+
+CI 预算保持 750/375 ms 和 37.5/10 MiB：300/150 ms 参考预期使用共享的 2× 时间倍率和 1.25× 余量，30/8 MiB 堆预期只使用余量。历史累计索引／全文分段负控中，write 耗时为 3984.9–4035.5 ms，bash 为 1471.2–1494.9 ms，均超过未调整的预算。
+
+## 影响
+
+- 已读取参数变化时替换准备态块，无人读取的调用保留块引用。视图保留源文本，分组标题可以独立于工具行请求字段。已派发和已结算视图在首次读取时扫描，不发布更新。
+- schema 顺序和描述指令引导模型先生成展示标签，但不保证生成顺序。工具行在字段可用时显示它；路径晚到会推迟路径及其后的内容进度展示。
+- 展示仍由 Client 派生；参数扫描不新增 Session 事件或持久化格式。
+- 名字晚于参数到达的流放弃扫描，该调用的准备行退回只显示标题。
diff --git a/.agents/notes/implemented/architecture/2026-09-25-session-log-otel-byte-limits.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-25-session-log-otel-byte-limits.i18n.yaml
index 15f69188be..c72fdec87f 100644
--- a/.agents/notes/implemented/architecture/2026-09-25-session-log-otel-byte-limits.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-25-session-log-otel-byte-limits.i18n.yaml
@@ -9,8 +9,8 @@
en: 20f659a15fb55352
zh: 49d39c95da1b8aa5
/agent-note-session-log-otlp-strings-and-bounded-requests/decision:
- en: 0f0866232326658b
- zh: aa608d17ba712d8a
+ en: 6e18311171c724bd
+ zh: 0214676ea3ee769c
/agent-note-session-log-otlp-strings-and-bounded-requests/alternatives-considered:
en: 0dc933b18a1a3573
zh: 77655740322c4e45
diff --git a/.agents/notes/implemented/architecture/2026-09-25-session-log-otel-byte-limits.md b/.agents/notes/implemented/architecture/2026-09-25-session-log-otel-byte-limits.md
index 57fbe72dc5..686df954fd 100644
--- a/.agents/notes/implemented/architecture/2026-09-25-session-log-otel-byte-limits.md
+++ b/.agents/notes/implemented/architecture/2026-09-25-session-log-otel-byte-limits.md
@@ -14,7 +14,7 @@ The shared `otel` Cordis plugin owns ordinary-event and Session-log transport im
Session logs use a separate provider and byte/count queue. Each record is measured once with the SDK serializer including a full envelope; the sum conservatively bounds a combined request. Greedy packing avoids full-candidate serialization and recursive re-encoding. Single oversized records receive one diagnostic and do not block later events. One HTTP request owns the transport slot until settlement, even after its watchdog fires; shutdown expiry stops the remaining queue. Scope name/version and explicit transport options remain owned by the backend.
-The [telemetry revival](../feature/2026-07-23-session-telemetry-otel-revival.md) remains authoritative for redaction, capture, and best-effort handoff. This decision replaces its SDK-only queue/batching rule: SDK batch deadlines cannot own an operation split into multiple HTTP requests. The shared Session-log channel schedules complete requests; the SDK still owns transport/retry. Feedback authorization and the separate DeepSeek model-request contribution remain unchanged.
+The [telemetry revival](../../../../packages/session/session-telemetry/README.md) remains authoritative for redaction, capture, and best-effort handoff. This decision replaces the earlier SDK-only queue/batching rule: SDK batch deadlines cannot own an operation split into multiple HTTP requests. The shared Session-log channel schedules complete requests; the SDK still owns transport/retry. Feedback authorization and the separate DeepSeek model-request contribution remain unchanged.
## Alternatives considered
diff --git a/.agents/notes/implemented/architecture/2026-09-25-session-log-otel-byte-limits.zh.md b/.agents/notes/implemented/architecture/2026-09-25-session-log-otel-byte-limits.zh.md
index f6e8306978..947f5cf129 100644
--- a/.agents/notes/implemented/architecture/2026-09-25-session-log-otel-byte-limits.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-25-session-log-otel-byte-limits.zh.md
@@ -14,7 +14,7 @@ Session 日志包含嵌套 JSON 和大型工具结果。产品采集端接收带
Session 日志使用独立 provider 和字节/条数队列。每条记录使用 SDK 序列化器计量一次，包含完整 envelope；其总和保守约束合并请求大小。顺序组包避免候选批次的完整序列化和递归重复编码。单条超限记录只产生一次诊断，不阻塞后续事件。每个 HTTP 请求在结束前始终占有传输槽位，即使其监测期限已经触发；关闭期限到期后停止剩余队列。scope 名称/版本和显式传输选项仍由后端拥有。
-[遥测恢复决策](../feature/2026-07-23-session-telemetry-otel-revival.zh.md) 继续约束脱敏、捕获和尽力交接。本决策替代其仅使用 SDK 队列/聚合的规则：SDK 批次期限无法拥有拆成多个 HTTP 请求的操作。共享 Session 日志通道调度完整请求，SDK 仍负责传输和重试。反馈授权和独立的 DeepSeek 模型请求附加路径不变。
+[遥测恢复参考](../../../../packages/session/session-telemetry/README.zh.md) 继续约束脱敏、捕获和尽力交接。本决策替代先前仅使用 SDK 队列/聚合的规则：SDK 批次期限无法拥有拆成多个 HTTP 请求的操作。共享 Session 日志通道调度完整请求，SDK 仍负责传输和重试。反馈授权和独立的 DeepSeek 模型请求附加路径不变。
## 考虑过的替代方案
diff --git a/.agents/notes/implemented/architecture/2026-09-30-profile-package-refresh-and-manifest-invalidation.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-30-profile-package-refresh-and-manifest-invalidation.i18n.yaml
new file mode 100644
index 0000000000..0187f43093
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-30-profile-package-refresh-and-manifest-invalidation.i18n.yaml
@@ -0,0 +1,37 @@
+# Bilingual-pair consistency record for 2026-09-30-profile-package-refresh-and-manifest-invalidation.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-30-profile-package-refresh-and-manifest-invalidation.md
+/agent-note-refresh-runtime-resolution-after-package-operations-and-expire-hmr-package-configuration:
+ en: ea66719b3dcdd21c
+ zh: 893364551594ddaf
+/agent-note-refresh-runtime-resolution-after-package-operations-and-expire-hmr-package-configuration/problem:
+ en: e59e3f5c61158701
+ zh: 2ced78e3c84f604e
+/agent-note-refresh-runtime-resolution-after-package-operations-and-expire-hmr-package-configuration/decision:
+ en: a15c7c13f167e5ac
+ zh: a15c7c13f167e5ac
+/agent-note-refresh-runtime-resolution-after-package-operations-and-expire-hmr-package-configuration/decision/responsibilities:
+ en: 3ffd0c78fa204b04
+ zh: f468bab00a7ff357
+/agent-note-refresh-runtime-resolution-after-package-operations-and-expire-hmr-package-configuration/decision/runtime-resolution:
+ en: ca45b973e1968533
+ zh: 002f23bb70e4fed7
+/agent-note-refresh-runtime-resolution-after-package-operations-and-expire-hmr-package-configuration/decision/plugin-manager:
+ en: 9b04926c175f22e8
+ zh: fbf05dd4065b0738
+/agent-note-refresh-runtime-resolution-after-package-operations-and-expire-hmr-package-configuration/decision/hmr-package-configuration-expiry:
+ en: c7de8dafe47a5587
+ zh: 6010a70d8451edd1
+/agent-note-refresh-runtime-resolution-after-package-operations-and-expire-hmr-package-configuration/decision/future-work:
+ en: 31818f8f7f80470b
+ zh: ecb7ac85bb49cf6d
+/agent-note-refresh-runtime-resolution-after-package-operations-and-expire-hmr-package-configuration/alternatives-considered:
+ en: 7c1c6d21570cda0d
+ zh: e6f8334c85f1b404
+/agent-note-refresh-runtime-resolution-after-package-operations-and-expire-hmr-package-configuration/verification:
+ en: 939cedceed200cb2
+ zh: c7bb02d0da400c8d
+/agent-note-refresh-runtime-resolution-after-package-operations-and-expire-hmr-package-configuration/consequences:
+ en: 1b9e31b4e773fac5
+ zh: c140ce07fc64bd55
diff --git a/.agents/notes/implemented/architecture/2026-09-30-profile-package-refresh-and-manifest-invalidation.md b/.agents/notes/implemented/architecture/2026-09-30-profile-package-refresh-and-manifest-invalidation.md
new file mode 100644
index 0000000000..b1b86be199
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-30-profile-package-refresh-and-manifest-invalidation.md
@@ -0,0 +1,119 @@
+# Agent Note: Refresh runtime resolution after package operations and expire HMR package configuration
+
+Status: implemented
+
+English | [中文](2026-09-30-profile-package-refresh-and-manifest-invalidation.zh.md)
+
+## Problem
+
+Two pieces of Host state did not follow changes while the process ran:
+
+- **Runtime resolution was built only at startup.** After a GUI install or enablement, nothing published the latest generation, so a bundle's private dependencies never reached the profile fallback and its bare plugins could not be found. After disablement or removal, a new generation could not remove profile-scoped entries or profile-local names, so stale records and package metadata remained. A newly installed package directory is new, and Node holds no stale cache for it; only the table was missing.
+- **Package configuration and module evaluation have separate caches.** Clearing a plugin's module cache does not refresh the package.json fields that Node uses for exports, main, imports, and format detection. A package.json can also be imported as a JSON module, in which case its consumers need ordinary module reloads.
+
+## Decision
+
+### Responsibilities
+
+| Owner | Does | Does not |
+|---|---|---|
+| resolver (`app-boot/src/profile-resolution/resolver.ts`) | `replace()` allows removing `scope: profile` entries and profile-local names | Touch any Node cache |
+| plugin-manager | Calls `pluginPackages.refresh()` at fixed points of package operations | Construct resolutions or manage module and package-configuration caches |
+| HMR (`packages/boot/hmr`) | Expires package configuration and preserves ordinary reloads for manifests loaded as JSON modules | Reload plugins for configuration-only manifests; handle `node_modules` package replacement |
+
+### Runtime resolution
+
+The [generation Note](2026-09-09-profile-resolution-generations.md) owns package identity and Worker inheritance rules.
+
+Validation of a new generation in `replace()`:
+
+- `scope: profile` entries may be removed.
+- Profile-local package names may be removed.
+- Retained profile entries keep their normalized directory, version, and scope, but may change declaring anchor when another selected bundle supplies the same package. Installation mappings and declaring anchors remain unchanged. The profile scope cannot change; a new local name cannot override an existing entry; a published link name cannot select another real directory.
+
+### Plugin Manager
+
+| Operation | Publication point |
+|---|---|
+| Install a new package | After pnpm succeeds and the bundle selection is saved, before reconciliation, whether or not the bundle is enabled |
+| Overwrite an installed package | No publication; the result is `restart-required` |
+| Enable a bundle | After the selection is saved, before reconciliation |
+| Disable a bundle | With HMR, after reconciliation stops its plugins; without HMR, no publication, and running plugins keep the current table |
+| Remove | After pnpm remove succeeds, inside the HMR transaction |
+| Failed or cancelled install, failed removal | No publication |
+
+`createRuntimeResolution()` returns a `ProfileRuntimeResolution`, which privately keeps the installation anchor, Harness home, and profile directory it was computed from. Its `computeLatestResolution()` rereads that profile with the same inputs and returns a new object for the latest generation, leaving the original unchanged; Workers receive only the table fields. `PluginPackages.refresh()` calls the current resolution's `computeLatestResolution()` and then `replace()`; a resolution constructed as plain data cannot be refreshed and makes the call throw.
+
+Without HMR, deselecting a startup bundle does not stop its plugins. While such a bundle remains deselected, later package operations keep the existing runtime table instead of publishing its removal. Other no-HMR installations and removals of non-running bundles still publish normally.
+
+A successful package operation is not rolled back when publication is rejected afterwards. The result reports the failed runtime application and retains the successful disk changes. Recomputing uses the captured profile directory on disk, not synthetic in-memory layers; a computed resolution without a profile recomputes installation packages only.
+
+### HMR package-configuration expiry
+
+In HMR's change dispatch, a changed file named `package.json` outside `node_modules` goes to `PackageManifests.invalidate()`. A manifest in the host dependency graph still requests a host reload; one loaded as a JSON module still reloads its consumers. A configuration-only manifest schedules no module reload. Configuration-owned paths stay with their dedicated watcher. Source changes in the same batch reload afterwards.
+
+`invalidate(manifest)` records the directory as expired. Afterwards:
+
+- package.json reads, scope lookups, type lookups, and nearest-manifest lookups below that directory read the current file. Ownership follows the real directory when a consumer reaches the package through a link.
+- ESM `ResolveCache` is cleared. Its entries do not record every consulted manifest, and a package entry may resolve outside the package directory.
+- CommonJS `_pathCache` is cleared for the same reason. Unrelated requests recompute their resolution without unloading their modules.
+- CommonJS loads using the default resolver pass the freshly resolved filename to the native loader. Its private request alias cannot select an older entry; cached module instances remain intact.
+
+Configuration invalidation alone leaves loaded modules unchanged. Loader entries retain their raw import results before export normalization. HMR matches imported Node module objects to cached ModuleJob namespaces and reloads the loaded URLs. All matching entry records, including disabled entries, update only after a successful reload and remain unchanged on failure. Stopping and restarting a Loader entry resolves its package name again and selects the new entry.
+
+Entry names are scoped by configuration-tree base URL and retain all distinct imported namespaces. An uninitialized entry contributes the name without erasing loaded namespaces; name-based resolution is used only when none is recorded, or for `cordis:` builtins. Dependency analysis considers every recorded module. Entries sharing a plugin runtime use one replacement operation, while each Loader entry selects its replacement by its original namespace. Module imports and export normalization finish before the old runtime is removed. Failed imports or activation restore the previous modules and plugin implementations and clean up partially activated replacements.
+
+An instance without a Loader entry has no recorded module identity. If a shared runtime's replacement modules have different plugin callbacks, HMR reports an ambiguity error and rolls back instead of assigning that instance to an arbitrary module.
+
+Package invalidation lives in `packages/boot/hmr/src/package-manifest.ts`, which encapsulates its Node internal interfaces. `index.ts` dispatches manifest changes and locates loaded entries by module identity. HMR's `node_modules` exclusion is unchanged.
+
+| Interface | Action |
+|---|---|
+| modules binding `readPackageJSON`, `getPackageScopeConfig`, `getPackageType` | Replaced: paths in an expired directory read the current file; other calls reach the native method |
+| `package_json_reader.getNearestParentPackageJSON` | Replaced: expired directories bypass its JS cache; a lookup without a manifest returns the native absent result |
+| The ESM Loader's `ResolveCache` instance | The prototype `get` is replaced for one lookup to obtain the instance and restored at once; the resolution cache is then cleared |
+| CommonJS `Module._pathCache` | The request-to-filename cache is cleared |
+| CommonJS `Module._load` | Default-resolver requests load by resolved filename; builtins and registered resolve hooks keep the original path |
+
+The binding's `getNearestParentPackageJSON` is called only by `package_json_reader` and is not replaced. Each HMR instance owns a separate configuration cache. Its replacements are installed at the first expiry and restored when the service is disposed, alongside watcher and reload-queue cleanup.
+
+### Future Work
+
+- Online replacement inside `node_modules`, same-path reinstall, changed link targets, and cross-package reload propagation remain unsupported. Package updates need process restart; this does not guarantee that every management result already reports that requirement correctly.
+- TSX versions using an asynchronous loader thread keep that thread's package configuration outside these hooks. Synchronizing it is deferred; this change does not provide general Worker cache synchronization.
+- CommonJS private-request-cache refresh with registered synchronous resolve hooks is deferred. Those requests retain their original loader behavior.
+- Disposing HMR restores the native readers, whose previous cached configuration can become visible again. Preserving invalidation state across HMR replacement is deferred.
+
+## Alternatives considered
+
+**Read current disk on every lookup (#4703).** Resolution follows the disk, but module caches stay and running plugins do not reload. Same-URL contents do not take effect, and different URLs load a second version beside the first in one process. It also maintains its own entry resolver, bypasses custom bare-name hooks, and does not refresh runtime resolution, so GUI-installed private dependencies still cannot be found.
+
+**Reread every observed manifest when runtime resolution publishes (#5496).** This places package-configuration expiry in table publication, decoupled from module caches: overwriting an installed package reports restart, yet the next unrelated publication makes new imports load the new version while the old plugin still runs. Package configuration is content and belongs with module caches, in HMR.
+
+**Let HMR reload packages inside `node_modules`.** It requires finding affected plugins over a module graph that includes `node_modules`, preventing duplicate evaluation of shared libraries and Cordis, and handling missing dynamic-import edges, module side effects, and Workers. It is not done here; those scenarios keep requiring restart.
+
+**Reload every plugin for a package.json change.** Configuration-only manifests do not require module evaluation. Manifests actually imported as JSON modules retain ordinary dependency-driven reloads.
+
+**Re-import reloaded plugins by package name.** It would let an entry rename follow a source reload, but changes `partialReload`'s rule that the loaded URL is the reload unit. Entry renames already take effect when the Loader entry restarts, so this is not changed.
+
+**Keep one namespace per entry name.** Entries with the same name and base URL can have loaded different modules before and after a manifest change. Keeping only the first or last namespace loses a live module; an uninitialized entry must not erase another entry's imported namespace.
+
+## Verification
+
+| Coverage | Location |
+|---|---|
+| A new generation removes profile entries and local names and still rejects retained-entry changes | `packages/boot/app-boot/tests/profile-resolution.spec.ts` |
+| GUI install, deferred enablement, disablement, removal, overwrite, failure, and cancellation, with and without HMR | `packages/boot/plugin-manager/tests/package-reload.spec.ts` |
+| Captured-directory recomputation, computed installation-only refresh, and plain-data rejection | `packages/boot/app-boot/tests/profile-resolution.spec.ts`, `packages/boot/app-boot/tests/profile-resolution-service.spec.ts` |
+| Sequential no-HMR operations, shared dependency declarers, and disk-success/publication-failure outcomes | `packages/boot/plugin-manager/tests/package-reload.spec.ts` |
+| Expired exports, main, imports, type, scope, and nearest manifests; native-reader parity; actual CommonJS loads and retained module instances; the `node_modules` boundary; restoration | `packages/boot/hmr/tests/package-manifest.spec.ts` |
+| Configuration-only manifests, JSON-module and host reloads, source reloads, same-name and shared-runtime entries, import and activation rollback, entry restarts, and the `node_modules` exclusion | `packages/boot/hmr/tests/package-manifest-dispatch.spec.ts` |
+
+Tests need no API key and make no model calls.
+
+## Consequences
+
+- With HMR, supported package operations publish the updated private dependencies and remove unused mappings after plugins stop. Without HMR, a pending startup-bundle disablement defers later publications until restart, preserving running plugins' mappings.
+- In the supported thread, package.json configuration reads use the changed fields; JSON modules retain their own reload behavior. The separate module, loader-thread, and Worker limitations above still apply.
+- Package configuration below expired directories is parsed in JavaScript and must keep the native reader's field and error semantics; tests compare it with the native reader on Node 22, 24, and 26.
+- The implementation depends on several Node internal interfaces, and these tests must run again for Node upgrades.
diff --git a/.agents/notes/implemented/architecture/2026-09-30-profile-package-refresh-and-manifest-invalidation.zh.md b/.agents/notes/implemented/architecture/2026-09-30-profile-package-refresh-and-manifest-invalidation.zh.md
new file mode 100644
index 0000000000..9ee201f27a
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-30-profile-package-refresh-and-manifest-invalidation.zh.md
@@ -0,0 +1,119 @@
+# Agent Note: 包操作刷新 runtime resolution 与 HMR 包配置失效
+
+Status: implemented
+
+[English](2026-09-30-profile-package-refresh-and-manifest-invalidation.md) | 中文
+
+## Problem
+
+Host 运行期间有两处状态没有随变化更新：
+
+- **runtime resolution 只在启动时构造。** GUI 安装或启用 bundle 后，没有人发布最新代，bundle 的私有依赖进不了 profile fallback，它的 bare 插件找不到。停用、卸载后，新一代又不允许移除 profile 范围的条目和本地包名，旧记录和包元数据一直留着。新安装的包目录本身是新的，Node 对它没有旧缓存，缺的只是这张表。
+- **包配置与模块求值使用独立缓存。** 清理插件的模块缓存不会刷新 Node 用于 exports、main、imports 和格式判断的 package.json 字段。package.json 也可以被作为 JSON 模块导入，此时其消费方需要普通的模块重载。
+
+## Decision
+
+### 职责
+
+| 负责方 | 做什么 | 不做什么 |
+|---|---|---|
+| resolver（`app-boot/src/profile-resolution/resolver.ts`） | `replace()` 允许移除 `scope: profile` 条目和 profile 本地包名 | 不碰 Node 的任何缓存 |
+| plugin-manager | 在包操作的确定时点调用 `pluginPackages.refresh()` | 不构造 resolution；不管模块缓存与包配置缓存 |
+| HMR（`packages/boot/hmr`） | 使包配置失效，并保留作为 JSON 模块加载的 manifest 的普通重载 | 不因仅作为配置的 manifest 重载插件；不处理 `node_modules` 包替换 |
+
+### runtime resolution
+
+包身份与 Worker 继承规则由[代际说明](2026-09-09-profile-resolution-generations.zh.md)定义。
+
+`replace()` 对新一代的校验：
+
+- `scope: profile` 的条目可以移除。
+- profile 本地包名可以移除。
+- 保留的 profile 条目保持规范化目录、版本与作用域不变；另一个已选 bundle 提供同一包时，可以更换声明锚点。安装范围的映射与声明锚点保持不变。profile 范围不能变；新本地包名不能覆盖已有条目；已发布的 link 名称不能换真实目录。
+
+### plugin-manager
+
+| 操作 | 发布时点 |
+|---|---|
+| 安装新包 | pnpm 成功、保存 bundle 选择之后，reconciliation 之前；无论是否立即启用都发布 |
+| 覆盖已安装的包 | 不发布，结果为 `restart-required` |
+| 启用 bundle | 保存选择后发布，再做 reconciliation |
+| 停用 bundle | 有 HMR 时，reconciliation 让插件退出后再发布；没有 HMR 时不发布，运行中的插件继续使用原表 |
+| 卸载 | pnpm remove 成功后，在 HMR 事务内发布 |
+| 安装失败、取消、卸载失败 | 不发布 |
+
+`createRuntimeResolution()` 返回 `ProfileRuntimeResolution`，它私有保存构造时的 installAnchor、home 和 profile 目录；`computeLatestResolution()` 用同一组输入重新读取 profile，返回表示最新代的新对象，原实例不变；Worker 只收到表数据。`PluginPackages.refresh()` 调用当前 resolution 的 `computeLatestResolution()` 再 `replace()`；以纯数据构造的 resolution 无法刷新，调用时抛错。
+
+没有 HMR 时，取消启动 bundle 的选择不会停止它的插件。只要该 bundle 仍未选中，后续包操作就保留当前 runtime 表，不发布其移除。其他无 HMR 的安装和未运行 bundle 卸载仍正常发布。
+
+包操作成功后若发布被拒绝，不回滚已完成的包操作。结果报告运行时应用失败，并保留成功的磁盘变更。重新计算使用捕获的磁盘 profile 目录，不继承内存合成 layers；没有 profile 的已计算 resolution 只重算安装范围的包。
+
+### HMR 包配置失效
+
+HMR 的文件变化分派中，文件名为 `package.json` 且不在 `node_modules` 内的变化，交给 `PackageManifests.invalidate()`。位于宿主依赖图中的 manifest 仍请求宿主重载；作为 JSON 模块加载的 manifest 仍重载消费方。仅作为配置的 manifest 不安排模块重载。配置专属路径仍由其独立 watcher 处理。同一批的源码变化随后重载。
+
+`invalidate(manifest)` 把该目录登记为已失效，之后：
+
+- 位于该目录下的 package.json 读取、scope 查询、type 查询、最近 package.json 查询，都按当前磁盘解析。消费方经由链接路径访问时，按真实目录判断归属。
+- 清空 ESM `ResolveCache`。其条目不记录查询过的全部 manifest，包入口也可能解析到包目录之外。
+- 基于相同原因清空 CommonJS `_pathCache`。无关请求重新计算解析结果，不卸载其模块。
+- 使用默认 resolver 的 CommonJS 加载把重新解析的文件名交给原生 loader。其私有请求别名不再选中旧入口，已缓存的模块实例保持不变。
+
+仅使配置失效不会改变已加载模块。Loader entry 保留导出规范化之前的原始导入结果。HMR 将已导入的 Node 模块对象与缓存中 ModuleJob 的模块命名空间按对象身份匹配，重载已加载 URL。所有匹配的 entry 记录，包括已停用的 entry，仅在重载成功后更新，失败时保持不变。停止并重新启动 Loader entry 时，会重新按包名解析并选择新入口。
+
+entry 名称以配置树 base URL 为作用域，并保留所有不同的已导入命名空间。尚未初始化的 entry 只登记名称，不抹去已加载的命名空间；仅在没有记录命名空间或入口为 `cordis:` 内置模块时按名称解析。依赖分析考虑每个已记录模块。共享插件运行时的 entry 使用同一次替换操作，但每个 Loader entry 按自身原命名空间选择替换实现。模块导入与导出规范化在移除旧运行时之前完成。导入或激活失败时，恢复原来的模块和插件实现，并清理已部分激活的替换实例。
+
+没有 Loader entry 的实例不具备已记录的模块身份。如果共享运行时的替换模块具有不同的插件回调，HMR 会报告歧义错误并回滚，而不是将该实例随意分配给某个模块。
+
+包配置失效实现在 `packages/boot/hmr/src/package-manifest.ts`，封装其使用的 Node internal 接口。`index.ts` 分派 manifest 变更，并按模块身份定位已加载 entry。HMR 的 `node_modules` 排除规则不变。
+
+| 接口 | 动作 |
+|---|---|
+| modules binding 的 `readPackageJSON`、`getPackageScopeConfig`、`getPackageType` | 替换：路径位于已失效目录时按当前磁盘解析，其余调用原生方法 |
+| `package_json_reader.getNearestParentPackageJSON` | 替换：已失效目录绕过它的 JS 缓存；没有 manifest 时返回原生的缺失结果 |
+| ESM Loader 的 `ResolveCache` 实例 | 临时替换原型的 `get`，取得实例后立即恢复，再清空解析缓存 |
+| CJS `Module._pathCache` | 清空请求到文件名的缓存 |
+| CJS `Module._load` | 默认 resolver 的请求按解析后的文件名加载；内置模块及注册的 resolve hooks 保留原路径 |
+
+binding 的 `getNearestParentPackageJSON` 只被 `package_json_reader` 自己调用，不替换。每个 HMR 实例拥有独立的配置缓存，在第一次失效时安装 hook，并在服务销毁时恢复，同时清理 watcher 和重载队列。
+
+### 后续工作
+
+- 不支持 `node_modules` 内在线替换、同路径重装、link 换目标及跨包重载传播。包更新需要重启进程；这不保证每个管理操作的结果都已正确报告这一要求。
+- 使用异步 loader 线程的 TSX 版本，其线程内包配置不受这些 hook 管理。线程同步留待后续；本次不提供通用 Worker 缓存同步。
+- 注册了同步 resolve hooks 时，CommonJS 私有请求缓存刷新留待后续；这些请求保留原有 loader 行为。
+- 销毁 HMR 会恢复原生 reader，其此前缓存的配置可能重新可见。跨 HMR 替换保留失效状态留待后续。
+
+## Alternatives considered
+
+**每次查找都读当前磁盘（#4703）。** 解析能跟上磁盘，但不清模块缓存，也不重载运行中的插件。同一 URL 时新内容不生效，不同 URL 时新旧版本在同一进程并存。它还要维护一份入口解析实现，并且绕过自定义 bare-name hook。它也没有刷新 runtime resolution，GUI 安装的私有依赖依然找不到。
+
+**在 runtime resolution 发布时全量重读已见过的 manifest（#5496）。** 它把包配置失效放进了绑定表发布，和模块缓存脱了钩：覆盖已安装的包时报需要重启，但下一次无关的发布会让新导入拿到新版本，旧插件仍在运行。包配置缓存属于内容，应该和模块缓存由同一方负责，也就是 HMR。
+
+**让 HMR 支持 `node_modules` 内的包重载。** 这需要沿包含 `node_modules` 的模块图确定受影响插件，防止共享库和 Cordis 被重复求值，还要处理动态 import 漏边、模块副作用和 Worker。本次不做，这些场景继续要求重启。
+
+**package.json 变化时重载所有插件。** 仅作为配置的 manifest 不要求模块求值。实际作为 JSON 模块导入的 manifest 保留普通的依赖驱动重载。
+
+**按插件名重新 import 被重载的插件。** 这能让入口改名随源码重载生效，但会改变 `partialReload` 以已加载 URL 为重载单位的规则。入口改名在 Loader entry 重启时已经生效，所以本次不改。
+
+**每个 entry 名称只保留一个命名空间。** 名称和 base URL 相同的 entry，可能在 manifest 变化前后加载了不同模块。只保留最早或最后一个命名空间会遗漏仍在使用的模块；尚未初始化的 entry 也不能抹去其他 entry 的已导入命名空间。
+
+## Verification
+
+| 覆盖面 | 位置 |
+|---|---|
+| 新一代可移除 profile 条目与本地包名、仍拒绝修改保留条目 | `packages/boot/app-boot/tests/profile-resolution.spec.ts` |
+| GUI 安装、延迟启用、停用、卸载、覆盖、失败、取消，有无 HMR | `packages/boot/plugin-manager/tests/package-reload.spec.ts` |
+| 捕获目录后的重新计算、无 profile 的已计算 resolution 刷新、纯数据拒绝 | `packages/boot/app-boot/tests/profile-resolution.spec.ts`、`packages/boot/app-boot/tests/profile-resolution-service.spec.ts` |
+| 无 HMR 连续操作、共享依赖声明来源、磁盘成功但发布失败 | `packages/boot/plugin-manager/tests/package-reload.spec.ts` |
+| 失效后的 exports、main、imports、type、scope、最近 package.json，原生 reader 对照，实际 CommonJS 加载及旧模块实例保留，node_modules 边界，恢复 | `packages/boot/hmr/tests/package-manifest.spec.ts` |
+| 配置专用 manifest、JSON 模块与宿主重载、源码重载、同名及共享运行时的 entry、导入与激活失败回滚、entry 重启和 node_modules 排除规则 | `packages/boot/hmr/tests/package-manifest-dispatch.spec.ts` |
+
+测试不需要 API key，不调用模型。
+
+## Consequences
+
+- 有 HMR 时，支持的包操作发布更新后的私有依赖，并在插件停止后移除不再需要的映射。没有 HMR 时，待生效的启动 bundle 停用会将后续发布延迟到重启，保留运行中插件的映射。
+- 在支持的线程内，package.json 配置读取使用更新后的字段；JSON 模块保留自己的重载行为。上述模块、loader 线程及 Worker 的独立限制仍然适用。
+- 包配置读取改由 JS 解析 package.json，需要与原生读取保持字段和错误语义一致；测试在 Node 22、24、26 上与原生读取逐项比较。
+- 依赖多个 Node internal 接口，Node 升级时需要重跑这些测试。
diff --git a/.agents/notes/implemented/architecture/2026-09-30-structured-draft-initialization.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-30-structured-draft-initialization.i18n.yaml
new file mode 100644
index 0000000000..16a39c6917
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-30-structured-draft-initialization.i18n.yaml
@@ -0,0 +1,34 @@
+# Bilingual-pair consistency record for 2026-09-30-structured-draft-initialization.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-30-structured-draft-initialization.md
+/agent-note-initial-draft-content-and-structured-reference-restoration:
+ en: 88202480bcf49e10
+ zh: 3f2aff8ad2be0faa
+/agent-note-initial-draft-content-and-structured-reference-restoration/problem:
+ en: 6aa396e12264ee48
+ zh: 56849a18acaf830a
+/agent-note-initial-draft-content-and-structured-reference-restoration/decision:
+ en: 9cf2afd9d5e663e9
+ zh: ad59b1bec6ec4666
+/agent-note-initial-draft-content-and-structured-reference-restoration/decision/data-model:
+ en: 7f33895364a9f5cc
+ zh: f1c79ea15f5c151e
+/agent-note-initial-draft-content-and-structured-reference-restoration/decision/classes-and-methods:
+ en: ca81423a57f898a0
+ zh: 98962cc1c6bce113
+/agent-note-initial-draft-content-and-structured-reference-restoration/decision/data-flow:
+ en: dd57e639e9328f1d
+ zh: 5e16cb2e3a73597c
+/agent-note-initial-draft-content-and-structured-reference-restoration/decision/asynchronous-skill-matching:
+ en: 3b6a99c417384470
+ zh: b62951995eda2fb0
+/agent-note-initial-draft-content-and-structured-reference-restoration/alternatives-considered:
+ en: eddaec471425fafc
+ zh: b206ecdb12e8c33d
+/agent-note-initial-draft-content-and-structured-reference-restoration/verification:
+ en: 341f4f36936f686a
+ zh: 479fbe04e810f640
+/agent-note-initial-draft-content-and-structured-reference-restoration/consequences:
+ en: ff4f9527db80f790
+ zh: f3e57093c058f643
diff --git a/.agents/notes/implemented/architecture/2026-09-30-structured-draft-initialization.md b/.agents/notes/implemented/architecture/2026-09-30-structured-draft-initialization.md
new file mode 100644
index 0000000000..678129340f
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-30-structured-draft-initialization.md
@@ -0,0 +1,88 @@
+# Agent Note: Initial draft content and structured reference restoration
+
+Status: implemented
+
+English | [中文](2026-09-30-structured-draft-initialization.zh.md)
+
+## Problem
+
+New-task entry points need to place unsent content in the composer. A draft contains not only text but also file, folder, and Session references the user has selected. Saving only their text projection loses the chips' source, target, and presentation fields when the input object is disposed. Filling the composer after mounting also cannot guarantee that the first input-model read contains the complete document.
+
+## Decision
+
+Keep the existing `SessionInputShell`, `DraftEditorRuntime`, Conversation store, and Session reference lifetime. Plain text and structured drafts enter through the input model. Initial import finishes before `InputHub.shellFor()` returns, without React effects restoring text. Existing input objects are not restored again. React mounts the same editor and binds the existing persistence callback.
+
+The second parameter of `startSession(workspaceId?, options?)` contains `prompt` and `clearPreviousDraft`. `prompt` accepts only a string; structured drafts remain internal to restoration and Workspace transfer. Omitting options preserves the existing flow. Without clearing, existing content is preserved and only an empty draft adopts the prompt. Explicit clearing replaces the target Session's text document, without deleting attachments or changing other Sessions. Prefilling does not send, execute commands, or change `blank`.
+
+### Data model
+
+`DraftSnapshot` contains `text` and `references`. Each reference retains `offset`, `length`, `source`, `ref`, `label`, `appearance`, `clipboardText`, and its existing invalid flag. Positions use JavaScript string coordinates. Reference spans must be ordered, non-overlapping, and equal the corresponding `clipboardText`. Snapshots exclude Lexical NodeKeys, DOM, runtime occurrenceIds, functions, and temporary highlights.
+
+A string represents input without structured references; an ambiguous `@` query never selects a file automatically. The public `SessionInput.setDraft` and `InputActions.setDraft` methods accept only text. Internal structured restoration reuses the editor's reference restoration without listing directories or reading files. Plain text and file, folder, and Session chips all pass through the registered editor transforms and projection.
+
+The existing `dsh.conversation.` key remains. Readers accept both legacy strings and structured `draft` values; new writes store structured values. The original Conversation store still writes the complete record, without a second writer for that key. Reference changes must reach persistence even when the visible text does not change.
+
+### Classes and methods
+
+| Location | Change and responsibility |
+| --- | --- |
+| `UiWorkspace` / `UiWorkspaceService.startSession` | The second parameter is `StartSessionOptions`; the existing `beforeOpen` preparation point passes initialization to the exact target binding. Creation, reuse, and navigation cancellation remain unchanged |
+| `SessionInputResolver` / `InputHub.requestDraftInitialization` | Accept the binding and options and delegate to that binding's input object, without looking up a global current Session |
+| `InputHub.shellFor` | After registering a new object and its cleanup, read the Session's saved draft, import it through the input model, and return. Reused objects are not restored again |
+| `readConversationDraft(sessionId)` in `stores.ts` / `parseStoredDraft` in `draft.ts` | Read the original storage key, accept legacy strings, and check structured reference fields and positions without creating a store or another writer |
+| `SessionInputShell.setDraft` | The concrete internal method accepts a string or `DraftSnapshot` and imports one document through the editor; public input methods accept only text. Neither path simulates keyboard events or submits |
+| `SessionInputShell.requestDraftInitialization` | Apply clear, preserve, and prefill rules to the restored model; refuse changes during submission without clearing first |
+| `SessionInputShell.draftSnapshot` / `persistCurrentDraft()` | Cache snapshots without runtime IDs by content revision; `InputActions.persistDraft()` delegates explicit saving, while `bindDraftPersistence(write)` only binds the callback |
+| `DraftEditorRuntime.restoreDraft` | Rebuild ReferenceChipNodes from semantic reference fields; existing failed-send restoration uses the same implementation |
+| `SessionInputShell.refreshLexiconSubscription()` / `DraftEditorRuntime.refreshLexiconSubscription()` | `InputHub` owns the Session-scope `inject` callback that connects the lexicon after caching the shell, reconnects when the service arrives or is replaced, and unsubscribes on disposal. Both connection and catalog updates rescan the current editor without writing old text back; `setDraft` does not establish the subscription |
+| `ConversationStoreState` / `createConversationStore` | Support structured input and legacy strings in draft storage, keeping View state and the original key |
+| `DefaultConversationViews` | Remove restoration and prefill effects, retaining persistence binding and unbinding. Initial saving reads the owner's current snapshot, never text captured during render |
+| The existing `selectWorkspace` callback in `apply.ts` | Keep the existing cross-Workspace draft-transfer rules, passing `draftSnapshot` instead of plain text so transfer retains references |
+
+There is no new draft service, storage key, general task framework, or Session creation entry point. SlotRenderer, Host Session logs, command execution, and file-discovery RPCs are unchanged. `InputActions` remains the shared input-action entry; components receive no separate content-initialization callback.
+
+The call parameters are `startSession(workspaceId?: WorkspaceId, options?: StartSessionOptions)`, `requestDraftInitialization(binding: SessionBinding, options: DraftInitializationOptions)`, `SessionInputShell.requestDraftInitialization(options)`, and the internal `SessionInputShell.setDraft(input: string | DraftSnapshot)`. `StartSessionOptions` aliases `DraftInitializationOptions`, whose fields are `prompt?: string` and `clearPreviousDraft?: boolean`. A shallow copy captures these values before asynchronous creation, and the result addresses only the retained target binding. Initialization distinguishes applied, preserved, and submission-blocked outcomes. Refusal does not clear first; superseded navigation does not write a draft.
+
+### Data flow
+
+```text
+stored draft / startSession options
+ → DraftInput
+ → SessionInputShell.setDraft
+ → DraftEditorRuntime → Lexical → InputState
+ → InputHub.shellFor returns
+ → React mounts the editor
+
+user edits / input actions
+ → editor → projection
+ → DraftSnapshot
+ → Conversation store
+```
+
+### Asynchronous skill matching
+
+Skills remain editable text, not file chips. A pending lexicon never locks the draft. Slash names remain ordinary text until a catalog supplies a matching name; an absent provider, unavailable catalog, or unmatched name produces no skill highlight. The existing subscription rescans the current document on arrival instead of saving and restoring the text present when the request began. This changes neither text nor structured references, does not take the caret, and adds no user Undo step. Commands retain their existing validation and execution path at submission.
+
+## Alternatives considered
+
+**Calling setDraft after mounting.** The first model read and render can still be empty, and later restoration can overwrite a clear. Initialization cannot depend on React-effect ordering.
+
+**Saving only clipboardText and searching references again.** Text does not identify a reference's source and presentation fields. Searching candidates does not restore the user's previous selection; existing structure should be restored directly.
+
+**Waiting for all remote lexicons before allowing input.** File references already have their data, and skill highlighting is not an editing prerequisite. Blocking the draft on those queries adds unnecessary waiting.
+
+**Splitting persistence keys or adding a draft-management service.** The existing input owner and store can perform the work by sharing the input representation and import path.
+
+## Verification
+
+The core model invariants are semantic equivalence after import, export, and JSON round trips without comparing runtime node IDs; a complete document on the first input-object read; and stable draft snapshots across selection or skill-highlight changes. [Document-model cases](../../../../packages/client/ui-conversation/tests/draft-document.client.spec.ts) cover strings, empty drafts, multiline Unicode text, file/folder/Session references, duplicates, invalid flags, placeholder sanitization, and invalid stored spans. [Input-lifecycle cases](../../../../packages/client/ui-conversation/tests/draft-hub.client.spec.ts) cover first reads, reuse, lexicon-service arrival, unloading, reconnection, and retired bindings. Initialization is refused during submission, and lexicon rescans add no Undo step.
+
+[Navigation cases](../../../../packages/client/ui-workspace/tests/workspaces-service.client.spec.ts) check exact retained targets, option copying before asynchronous creation, superseded requests without draft writes, and refusal without changing selection. [Assembly cases](../../../../packages/client/ui-conversation/tests/apply-inject.client.spec.tsx) check that existing Workspace transfer retains structured references. The related regression run passed 708 cases in 44 files; after the shared draft module moved to its owning location, the three affected model and assembly files passed another 66 cases.
+
+The [browser e2e](../../../../apps/web/tests/draft-initialization.e2e.ts) observes the shipped Workspace API through the existing module-loader test instrumentation and calls public `startSession` with text options, without an additional test plugin. Structured fixtures enter through the existing saved-draft restoration path. The cases cover absent, empty, and nonempty prompts; explicit and inherited Workspaces; preservation and clearing; creation and reuse; repeated real-UI Session switching and editing; reload; legacy strings; and Workspace-picker transfer. Both orders of delayed creation responses preserve the newer target and leave the other draft unchanged. A delayed real skill-catalog response rematches current text without replacing chips, selection, or Undo history. Assertions inspect chip fields, file previews, and persisted snapshots. Before sending, Host logs contain neither `user/message` nor `turn/start`.
+
+## Consequences
+
+Missing reference information in legacy strings cannot be reconstructed losslessly, so they restore as plain text without searching and guessing files. Attachment File objects, upload state, cross-browser synchronization, multiple independent editors, and persistent Undo history are outside this change.
+
+This decision shares input ownership with the [editor-isolation proposal](../../proposed/architecture/2026-09-14-composer-model-and-draft-editor.md) without implementing its multi-editor goal. [Reference previews](../../../../packages/client/ui-input-trigger/README.md) and [Session reference lifetimes](2026-09-15-client-session-references.md) continue to govern source routing and generation cleanup independently; neither is superseded.
diff --git a/.agents/notes/implemented/architecture/2026-09-30-structured-draft-initialization.zh.md b/.agents/notes/implemented/architecture/2026-09-30-structured-draft-initialization.zh.md
new file mode 100644
index 0000000000..07c185a969
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-30-structured-draft-initialization.zh.md
@@ -0,0 +1,88 @@
+# Agent Note: 草稿初始内容与结构化引用恢复
+
+Status: implemented
+
+[English](2026-09-30-structured-draft-initialization.md) | 中文
+
+## 问题
+
+新任务入口需要把一段尚未发送的内容放入输入框。草稿不仅包含文字，也包含用户已经选定的文件、目录和 Session 引用；只保存引用的文字投影，会在输入对象销毁后丢失胶囊的来源、目标和展示字段。页面挂载后的填字也不能保证第一次读取输入模型时已经得到完整内容。
+
+## 决策
+
+保留现有 `SessionInputShell`、`DraftEditorRuntime`、Conversation store 和 Session 引用生命周期。普通文字与结构化草稿统一经过输入模型导入；初始导入在 `InputHub.shellFor()` 返回对象前完成，不由 React effect 恢复文字。已存在的输入对象不重新恢复。React 只挂载同一编辑器，并绑定现有持久化回调。
+
+`startSession(workspaceId?, options?)` 的第二参数保留 `prompt` 与 `clearPreviousDraft`。`prompt` 仅接受字符串；结构化草稿只用于内部恢复和工作区携带。无选项时维持原流程。不清空时保留已有内容，空稿才采用 prompt；显式清空作用于目标 Session 的文字文档，不删除附件，也不修改其他 Session。预填不自动发送、执行命令或改变 `blank`。
+
+### 数据模型
+
+`DraftSnapshot` 由 `text` 和 `references` 组成。每个引用保留 `offset`、`length`、`source`、`ref`、`label`、`appearance`、`clipboardText` 及已有的无效标记；位置使用 JavaScript 字符串坐标。引用位置必须有序、不重叠，且对应的正文片段与 `clipboardText` 一致。不保存 Lexical NodeKey、DOM、运行时 occurrenceId、函数或临时高亮。
+
+字符串等价于不含引用结构的输入；不会据模糊的 `@` 查询擅自选中某个文件。公开的 `SessionInput.setDraft` 与 `InputActions.setDraft` 仅接受文本。内部结构化恢复直接复用编辑器已有的引用恢复能力，无需查询文件目录或读取文件内容。恢复普通文字、文件胶囊、目录胶囊和 Session 胶囊都经过已注册的编辑器变换和投影流程。
+
+现有 `dsh.conversation.` key 保留，`draft` 可读取旧字符串，也可读取新的结构化值；新写入保存结构化值。仍由原 Conversation store 写整个记录，不增加第二个同 key 写入者。引用变化即使没有改变显示文字，也必须进入持久化快照。
+
+### Class 与方法
+
+| 位置 | 改动与职责 |
+| --- | --- |
+| `UiWorkspace`／`UiWorkspaceService.startSession` | 第二参数类型为 `StartSessionOptions`；在原 `beforeOpen` 准备点向准确的目标 binding 传入初始化请求。创建、复用与导航取消路径不变 |
+| `SessionInputResolver`／`InputHub.requestDraftInitialization` | 接收 binding 和 options，交给该 binding 的输入对象，不重新查找全局当前 Session |
+| `InputHub.shellFor` | 新对象登记及清理接线后，读取该 Session 保存的草稿，通过输入模型导入，然后返回；复用对象不再恢复 |
+| `stores.ts` 的 `readConversationDraft(sessionId)`／`draft.ts` 的 `parseStoredDraft` | 只读原存储 key；兼容字符串并检查结构化引用的位置和字段，不创建 store 或增加写入者 |
+| `SessionInputShell.setDraft` | 具体类的内部方法接受字符串或 `DraftSnapshot`，向编辑器发送一次文档导入；公开输入方法仅接受文本。两条路径均不模拟键盘事件、不提交内容 |
+| `SessionInputShell.requestDraftInitialization` | 在已经恢复的模型上执行清空／保留／填入规则；提交中拒绝修改，失败前不先清稿 |
+| `SessionInputShell.draftSnapshot`／`persistCurrentDraft()` | 按内容修订号缓存不含运行时 ID 的快照；`InputActions.persistDraft()` 委托显式保存方法；`bindDraftPersistence(write)` 仍只绑定回调 |
+| `DraftEditorRuntime.restoreDraft` | 接受引用的语义字段，重建 ReferenceChipNode；既有发送失败恢复继续使用同一实现 |
+| `SessionInputShell.refreshLexiconSubscription()`／`DraftEditorRuntime.refreshLexiconSubscription()` | `InputHub` 拥有 Session scope 的 `inject` 回调，在缓存输入对象后连接词典，服务到达或替换时重接，销毁时退订。连接和词典更新都会重扫当前 editor，不覆盖旧文本；`setDraft` 不负责建立订阅 |
+| `ConversationStoreState`／`createConversationStore` | draft 支持兼容旧字符串的结构化输入，View 状态及原 key 保持 |
+| `DefaultConversationViews` | 删除恢复／预填 effect；保留持久化回调的绑定和解绑。初始保存只能读取 owner 的当前快照，不能把 render 时的旧文字写回 |
+| `apply.ts` 中现有 `selectWorkspace` 回调 | 沿用原有跨工作区携带规则，但传递 `draftSnapshot` 而不是纯文本，防止携带时再次丢失引用 |
+
+不新增草稿服务、存储 key、通用任务框架或另一套 Session 创建入口；不改 SlotRenderer、Host Session 日志、命令执行和文件发现 RPC。`InputActions` 保留统一输入操作入口，组件不单独注入另一条内容初始化回调。
+
+调用参数依次为 `startSession(workspaceId?: WorkspaceId, options?: StartSessionOptions)`、`requestDraftInitialization(binding: SessionBinding, options: DraftInitializationOptions)`、`SessionInputShell.requestDraftInitialization(options)`，以及内部的 `SessionInputShell.setDraft(input: string | DraftSnapshot)`。`StartSessionOptions` 直接引用 `DraftInitializationOptions`，字段为 `prompt?: string` 和 `clearPreviousDraft?: boolean`；进入异步创建前浅拷贝这些值，结果只作用于最终保留的 binding。初始化结果区分已应用、保留原稿和提交期间拒绝；拒绝不先清空，导航被后续操作取消时不写稿。
+
+### 数据流
+
+```text
+stored draft / startSession options
+ → DraftInput
+ → SessionInputShell.setDraft
+ → DraftEditorRuntime → Lexical → InputState
+ → InputHub.shellFor returns
+ → React mounts the editor
+
+user edits / input actions
+ → editor → projection
+ → DraftSnapshot
+ → Conversation store
+```
+
+### 异步 skill 匹配
+
+skill 是可编辑文字，不转为文件胶囊。词典尚未返回时不锁草稿；斜杠名称先保持普通文字，词典提供匹配名称后才高亮。提供方缺席、词典不可用或名称不匹配时不显示 skill 高亮。数据到达后通过现有订阅机制重匹配当前文档，而不是保存请求发出时的文字并回写。此过程不修改正文和结构化引用，不抢光标、不增加用户 Undo 步骤。命令仍只在用户提交时走既有校验和执行路径。
+
+## 考虑过的替代方案
+
+**挂载后调用 setDraft。** 首次模型读取与显示仍可能为空，清空还可能被稍后的旧稿恢复覆盖；初始化责任不能依赖 React effect 的先后顺序。
+
+**只保存 clipboardText，再重新搜索引用。** 文字不足以表达引用的来源和展示字段；搜索候选也不等于恢复用户已经作出的选择。已有结构应直接恢复。
+
+**等待所有远程词典再开放输入。** 文件引用已有数据，skill 高亮也不是编辑前提；让网络查询阻塞草稿会引入不必要的等待。
+
+**拆分持久化 key 或新增草稿管理服务。** 现有输入 owner 和 store 已能承担职责，只需统一输入数据与导入路径。
+
+## 验证
+
+数据模型的核心约束是：有效草稿经过导入、导出和 JSON 往返后语义相等，运行时节点 ID 不参与比较；初次获取输入对象即具有完整文档；选区和 skill 高亮变化不改变草稿快照。[文档模型用例](../../../../packages/client/ui-conversation/tests/draft-document.client.spec.ts)覆盖字符串、空稿、多行与 Unicode、文件／目录／Session 引用、重复引用、无效标记、占位字符净化和非法存储跨度；[输入生命周期用例](../../../../packages/client/ui-conversation/tests/draft-hub.client.spec.ts)验证首次读取、复用、词典服务到达／卸载／重连和旧 binding 失效。提交中拒绝初始化，词典重匹配不增加 Undo 步骤。
+
+[导航用例](../../../../packages/client/ui-workspace/tests/workspaces-service.client.spec.ts)验证初始化作用于准确的保留对象、参数在异步创建前复制、导航取消不写稿、拒绝时保持原选择。[组合用例](../../../../packages/client/ui-conversation/tests/apply-inject.client.spec.tsx)验证现有工作区携带路径不把引用变成纯文本。相关回归共 44 个文件、708 项通过；共享草稿模块归位后，受影响的三个模型与组合文件再验证 66 项通过。
+
+[浏览器 e2e](../../../../apps/web/tests/draft-initialization.e2e.ts)通过已有模块加载观测方式取得实际 Workspace API，调用公开 `startSession` 传入文本选项，不新增测试插件。结构化 fixture 经既有已存草稿路径恢复。用例覆盖缺省、空字符串和非空提示词，明确传入及沿用当前工作区，保留与清空、创建与复用、真实界面的 Session 多轮切换和编辑、刷新、旧字符串及工作区选择器携带。延迟创建响应的两种返回顺序都保持较新的目标选择，并且不改动另一份草稿。延迟返回的真实 skill 目录只重匹配当前文字，不替换胶囊、选区或 Undo 历史。断言检查胶囊字段、文件预览和持久化快照。未点击发送前，Host 日志没有 `user/message` 或 `turn/start`。
+
+## 后果与边界
+
+旧字符串草稿缺失的引用信息不能无损推断，按普通文字恢复；不为兼容旧数据自动查询并猜测文件。附件文件对象、上传状态、跨浏览器同步、多个独立编辑器和完整 Undo 持久化不在本次范围。
+
+本决策与[编辑器隔离方案](../../proposed/architecture/2026-09-14-composer-model-and-draft-editor.zh.md)共享输入 owner 的归属，但不实现其多编辑器目标；[引用预览](../../../../packages/client/ui-input-trigger/README.zh.md)和[Session 引用生命周期](2026-09-15-client-session-references.zh.md)继续各自约束来源路由和代次清理，不被本次决策取代。
diff --git a/.agents/notes/implemented/architecture/2026-10-05-anonymous-reasoning-translation.i18n.yaml b/.agents/notes/implemented/architecture/2026-10-05-anonymous-reasoning-translation.i18n.yaml
new file mode 100644
index 0000000000..ee7758db34
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-10-05-anonymous-reasoning-translation.i18n.yaml
@@ -0,0 +1,19 @@
+# Bilingual-pair consistency record for 2026-10-05-anonymous-reasoning-translation.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-10-05-anonymous-reasoning-translation.md
+/agent-note-anonymous-translation-remains-separate-from-model-history:
+ en: ab8fee99b1f6d828
+ zh: 0e324a42eebc1403
+/agent-note-anonymous-translation-remains-separate-from-model-history/problem:
+ en: 5e10347fa87f98b5
+ zh: cf3569631af8d66f
+/agent-note-anonymous-translation-remains-separate-from-model-history/decision:
+ en: f13c134f53ed63c9
+ zh: 868aacd453d26c82
+/agent-note-anonymous-translation-remains-separate-from-model-history/alternatives-considered:
+ en: 083d50f8564b0378
+ zh: 50af332e64ad06f3
+/agent-note-anonymous-translation-remains-separate-from-model-history/consequences:
+ en: 57c774c6fb14a1b4
+ zh: 5a05393e6f1d25b1
diff --git a/.agents/notes/implemented/architecture/2026-10-05-anonymous-reasoning-translation.md b/.agents/notes/implemented/architecture/2026-10-05-anonymous-reasoning-translation.md
new file mode 100644
index 0000000000..0fa78afa4e
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-10-05-anonymous-reasoning-translation.md
@@ -0,0 +1,31 @@
+# Agent Note: Anonymous translation remains separate from model history
+
+Status: implemented
+
+English | [中文](2026-10-05-anonymous-reasoning-translation.zh.md)
+
+## Problem
+
+Readers need reasoning in their chosen language without another model credential or replacement of the original assistant output. Translation needs an owner for external requests, cancellation, and failures independent of Agent execution.
+
+## Decision
+
+The experimental translator owns explicit Google or Bing routing, provider-language normalization, and bounded network requests. Its Service Definition and both providers share one package because their current consumers use the same operation and lifetime. The optional GUI consumer owns settings, paragraph scheduling, per-disclosure caches, and translated display. Its authenticated Remote calls the translator; the agent loop and Session event types remain independent.
+
+Bing is the configured default. Enabling the bundle permits transmission of expanded reasoning to the chosen service, disclosed in plugin metadata and settings. Failure never selects another provider. Original remains available; translated text neither replaces persisted assistant output nor enters model input. The [optional-bundle admission policy](2026-09-21-experimental-capabilities-as-optional-bundles.md) keeps the feature disabled until selected.
+
+The reasoning-body chain carries original text and streaming status. Native Chat owns its original Markdown fallback; consumers do not replace the assistant renderer or alter Session projection. Only expanded bodies start translation. Collapsing, changing selection, or unloading aborts outstanding work and excludes late results.
+
+## Alternatives considered
+
+**Translate through the conversation's LLM provider.** This adds model requests and depends on model credentials, pricing, and routing. Anonymous translation has separate availability and requires none of those credentials.
+
+**Rewrite reasoning in the Session or provider stream.** This changes the original trajectory and can affect model reasoning passback. Display translation preserves the original model history.
+
+**Silently try another endpoint after failure.** This sends potentially private text to another operator without an explicit selection. Retry uses the same provider; switching providers is a user action.
+
+## Consequences
+
+Anonymous translation adds no third-party translation library or model-token usage. Anonymous endpoints provide no developer availability guarantee. Both providers send source text in POST request bodies. Translations may alter Markdown or code formatting and do not translate collapsed summaries.
+
+The translator retains Session-bound results under the [shared machine-translation persistence decision](2026-10-05-persistent-machine-translation.md); its stateless calls do not record results.
diff --git a/.agents/notes/implemented/architecture/2026-10-05-anonymous-reasoning-translation.zh.md b/.agents/notes/implemented/architecture/2026-10-05-anonymous-reasoning-translation.zh.md
new file mode 100644
index 0000000000..293f74a5ee
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-10-05-anonymous-reasoning-translation.zh.md
@@ -0,0 +1,31 @@
+# Agent Note: 免登录翻译独立于模型历史
+
+Status: implemented
+
+[English](2026-10-05-anonymous-reasoning-translation.md) | 中文
+
+## 问题
+
+读者需要用指定语言阅读思考内容，同时无需额外模型凭据，也不替换原始 assistant 输出。翻译需要独立于 Agent 执行的所有者，负责外部请求、取消与失败。
+
+## 决策
+
+实验性 translator 负责显式 Google 或 Bing 路由、Provider 语言标签映射及有界网络请求。Service Definition 与两种 Provider 共用一个包，因为当前消费者使用相同操作与生命周期。可选 GUI 消费者负责设置、段落调度、展开组件内缓存及译文展示。其经过身份验证的 Remote 调用 translator；agent loop 与 Session 事件类型保持独立。
+
+配置的默认服务为 Bing。启用 Bundle 允许将展开的思考内容发送给所选服务，插件元数据与设置公开说明接收方。失败时不选择其他 Provider。原文始终可访问；译文不替换持久化 assistant 输出，也不进入模型输入。[可选 Bundle 准入规则](2026-09-21-experimental-capabilities-as-optional-bundles.zh.md) 保证功能在显式选择前保持关闭。
+
+reasoning-body chain 传递原始文本与流式状态。原生 Chat 负责原始 Markdown fallback；消费者不替换 assistant 渲染器，也不改变 Session projection。只有展开内容才开始翻译。折叠、切换设置或卸载都会中止未完成工作并忽略迟到结果。
+
+## 考虑过的替代方案
+
+**通过对话使用的 LLM Provider 翻译。** 这会增加模型请求，并依赖模型凭据、定价与路由。免登录翻译有独立的可用性，且无需这些凭据。
+
+**重写 Session 或 Provider 流中的思考内容。** 这会改变原始轨迹，并可能影响思考内容回传。展示翻译保留原始模型历史。
+
+**失败后静默尝试另一端点。** 这会在没有显式选择的情况下将潜在私有文本发送给另一个运营方。重试使用同一 Provider；切换 Provider 是用户操作。
+
+## 后果
+
+匿名翻译不增加第三方翻译库或模型 token 消耗。免登录端点不保证开发者可用性。两种服务均通过 POST 请求体发送原文。译文可能改变 Markdown 或代码格式，也不翻译折叠摘要。
+
+translator 按[统一的机器翻译持久化决策](2026-10-05-persistent-machine-translation.zh.md)保留绑定 Session 的结果；无状态调用不记录结果。
diff --git a/.agents/notes/implemented/architecture/2026-10-05-official-on-demand-bundles.i18n.yaml b/.agents/notes/implemented/architecture/2026-10-05-official-on-demand-bundles.i18n.yaml
new file mode 100644
index 0000000000..4af09bcaae
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-10-05-official-on-demand-bundles.i18n.yaml
@@ -0,0 +1,19 @@
+# Bilingual-pair consistency record for 2026-10-05-official-on-demand-bundles.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-10-05-official-on-demand-bundles.md
+/agent-note-discover-official-bundles-without-installing-their-runtimes:
+ en: 1f2387f10628638b
+ zh: c835a8ee615e9da6
+/agent-note-discover-official-bundles-without-installing-their-runtimes/problem:
+ en: a590bcef6c9760c0
+ zh: 19e6f61c2c7d8d3b
+/agent-note-discover-official-bundles-without-installing-their-runtimes/decision:
+ en: 31e3c52841f31a11
+ zh: ac2ad6e54ef9e150
+/agent-note-discover-official-bundles-without-installing-their-runtimes/alternatives-considered:
+ en: 42cb0f808a145871
+ zh: 225012615d1ecdf5
+/agent-note-discover-official-bundles-without-installing-their-runtimes/consequences:
+ en: 899b07d90024e019
+ zh: 01d22ac4b2444feb
diff --git a/.agents/notes/implemented/architecture/2026-10-05-official-on-demand-bundles.md b/.agents/notes/implemented/architecture/2026-10-05-official-on-demand-bundles.md
new file mode 100644
index 0000000000..0b0ad0cf55
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-10-05-official-on-demand-bundles.md
@@ -0,0 +1,37 @@
+# Agent Note: Discover Official bundles without installing their runtimes
+
+Status: implemented
+
+English | [中文](2026-10-05-official-on-demand-bundles.zh.md)
+
+## Problem
+
+Native subagent integrations bring their own runtimes. Shipping those dependencies with every DSH installation charges that cost to people who never delegate to them, while requiring a package name hides the integrations from the Plugins page.
+
+## Decision
+
+`ON_DEMAND_BUNDLES` admits the Claude Code and Codex bundles to an installation-owned catalog. The catalog embeds their package-owned localized metadata and icons, so discovery works offline without resolving or importing either package. Official identifies project maintenance; optional delivery and experimental maturity remain independent properties.
+
+Selection uses the ordinary third-party bundle installer, profile dependency, scoped patches, compatibility evaluation, progress, cancellation, registry fallback, and build-script approval. Native authentication and configuration remain provider-owned.
+
+The running installation owns the target. Published applications offer the exact DSH release version and save an exact registry dependency pin. Source Web and development Desktop offer ordinary `link:` dependencies into the same checkout as the running CLI, using its prepared workspace dependencies and peers. The source target follows the actual installation, never the current working directory or a prerelease suffix; an incomplete checkout does not fall back to the registry. A development checkout can share a version string with different published code, so replacing an installed registry copy or another checkout’s link compares the source as well as the version. Replacement is explicit, preserves selection, and reports required restarts; startup does not download providers. [Plugin Manager](../../../../packages/boot/plugin-manager/README.md#use-this-package) owns the operational details.
+
+Every Official package remains in the DSH release family. Packed DSH dependencies, optional dependencies, and peers use the exact family version. Publication prerequisites place catalog packages before the DSH package advertising them without adding their runtimes to DSH production dependencies. Catalog verification rejects missing metadata, unsupported membership, and stale generated content.
+
+The [shipped optional-bundle policy](../process/2026-09-15-shipped-optional-bundles.md) still owns lightweight installation-provided bundles. The [optional-composition decision](2026-09-21-experimental-capabilities-as-optional-bundles.md) owns shared patch and preset-generation behavior. Native bundles require the full Web preset targets; custom profiles mount their providers and tools explicitly. The [identity compatibility decision](2026-10-06-web-desktop-plugin-identity-compatibility.md) owns retained names, selectors, and deferred naming cleanup.
+
+## Alternatives considered
+
+**Ship the native runtimes with every installation.** This makes first activation offline, but increases the default download for unused integrations.
+
+**Query the registry to build the discovery list.** This avoids embedded metadata, but makes discovery depend on network availability and does not bind the offered package version to the running application.
+
+**Give Official packages a separate installer or activation registry.** A second path would duplicate package-operation and profile-composition behavior. Installation-owned discovery data can reuse the existing third-party mechanisms.
+
+**Always install the registry package with the running version.** Version equality identifies a published release, but cannot identify unreleased source changes. It can deliver an older provider API and a provider-only patch to a development Host that expects current tool contributions.
+
+**Build a separate development registry or artifact cache.** Ordinary local links already keep provider code and its dependencies in the running checkout. A second delivery system would add lifecycle and invalidation work without improving that development promise.
+
+## Consequences
+
+Registry delivery requires a reachable registry; development delivery requires a prepared, built checkout and normal rebuild/restart discipline. Equal source version strings do not certify identical build outputs. Off only deselects; Remove remains separate and respects retained preset modules. Activation failure can retain the saved dependency and selection; there is no rollback. Offline metadata, release pins, source-target selection, same-version source mismatches, clean installed artifacts, and release ordering have dedicated checks. Native-provider authentication is not part of catalog discovery.
diff --git a/.agents/notes/implemented/architecture/2026-10-05-official-on-demand-bundles.zh.md b/.agents/notes/implemented/architecture/2026-10-05-official-on-demand-bundles.zh.md
new file mode 100644
index 0000000000..6fbdaa6e8f
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-10-05-official-on-demand-bundles.zh.md
@@ -0,0 +1,37 @@
+# Agent Note: 发现 Official bundle 而不安装其运行时
+
+Status: implemented
+
+[English](2026-10-05-official-on-demand-bundles.md) | 中文
+
+## 问题
+
+原生子智能体集成携带自己的运行时。把这些依赖放进每次 DSH 安装，会让从不向它们委派任务的用户也承担成本；要求用户知道包名，又会让插件页无法展示这些集成。
+
+## 决策
+
+`ON_DEMAND_BUNDLES` 将 Claude Code 和 Codex bundle 纳入安装方维护的目录。目录内嵌包自身拥有的本地化元信息和图标，因此发现过程离线可用，无需解析或导入这两个包。Official 表示项目维护；可选交付与实验成熟度仍是独立属性。
+
+选择操作复用普通第三方 bundle 的安装器、profile 依赖、作用域 patch、兼容性判断、进度、取消、注册表回退和构建脚本审批。原生认证与配置仍由提供方拥有。
+
+当前运行的安装决定目标。已发布应用提供精确的 DSH 发布版本，并保存精确的注册表依赖版本。源码 Web 和开发 Desktop 提供指向当前 CLI 所在 checkout 的普通 `link:` 依赖，使用其中已准备好的工作区依赖和 peer。源码目标跟随实际安装位置，不由当前工作目录或预发布版本后缀决定；不完整的 checkout 不回退到注册表。开发 checkout 可以与内容不同的已发布代码共用版本字符串，因此替换已安装的注册表副本或其他 checkout 的链接时，同时比较来源和版本。替换需显式触发，保留选择状态，并报告是否需要重启；启动时不下载提供方。[插件管理器](../../../../packages/boot/plugin-manager/README.zh.md#use-this-package)拥有操作细节。
+
+所有 Official 包仍属于 DSH 发布家族。打包后的 DSH 依赖、可选依赖与 peer 均使用家族精确版本。发布前置关系要求先发布目录包，再发布宣传它们的 DSH 包，同时不把这些运行时加入 DSH 生产依赖。目录校验拒绝缺失的元信息、不受支持的成员和过期生成内容。
+
+[随附可选 bundle 策略](../process/2026-09-15-shipped-optional-bundles.zh.md)仍管理安装随附的轻量 bundle。[可选组合决策](2026-09-21-experimental-capabilities-as-optional-bundles.zh.md)管理共享 patch 与预设代际行为。原生 bundle 要求完整 Web 预设目标存在；自定义 profile 显式挂载提供方和工具。[身份兼容决策](2026-10-06-web-desktop-plugin-identity-compatibility.zh.md)管理保留名称、选择器和暂缓的命名清理。
+
+## 考虑过的替代方案
+
+**每次安装都附带原生运行时。** 首次激活可离线完成，但会为未使用的集成增加默认下载量。
+
+**查询注册表构建发现列表。** 可以避免内嵌元信息，但发现过程依赖网络可用性，且无法把提供的包版本绑定到运行中的应用。
+
+**为 Official 包增加独立安装器或激活注册表。** 第二条路径会重复包操作和 profile 组合行为。安装方维护的发现数据可以复用已有第三方机制。
+
+**始终安装与当前版本相同的注册表包。** 版本相同可以标识已发布版本，但不能标识尚未发布的源码修改。这可能向期待当前工具贡献的开发 Host 交付旧提供方 API 和仅含提供方的 patch。
+
+**建立独立的开发注册表或产物缓存。** 普通本地链接已能让提供方代码及其依赖来自当前 checkout。第二套交付系统会增加生命周期和失效处理，而不改善这一开发保证。
+
+## 后果
+
+注册表交付要求注册表可达；开发交付要求准备并构建 checkout，遵循正常的重新构建和重启流程。源码版本字符串相同不证明构建输出相同。关闭仅取消选择；移除保持独立，并尊重预设仍保留的模块。激活失败可以保留已保存的依赖和选择，不加入回滚。离线元信息、发布版本锁定、源码目标选择、同版本来源差异、干净安装产物和发布顺序有专门检查。原生提供方认证不属于目录发现过程。
diff --git a/.agents/notes/implemented/architecture/2026-10-05-paid-native-flash-reasoning-translation.i18n.yaml b/.agents/notes/implemented/architecture/2026-10-05-paid-native-flash-reasoning-translation.i18n.yaml
new file mode 100644
index 0000000000..33da8f55cb
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-10-05-paid-native-flash-reasoning-translation.i18n.yaml
@@ -0,0 +1,19 @@
+# Bilingual-pair consistency record for 2026-10-05-paid-native-flash-reasoning-translation.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-10-05-paid-native-flash-reasoning-translation.md
+/agent-note-paid-native-flash-translation-uses-independent-queries:
+ en: 37a2416d68e5a73d
+ zh: ae439aa6ec6a2feb
+/agent-note-paid-native-flash-translation-uses-independent-queries/problem:
+ en: 1029e393c5794564
+ zh: 6044cd7da7fc0947
+/agent-note-paid-native-flash-translation-uses-independent-queries/decision:
+ en: be443b5b9ed2d0a4
+ zh: 399c3c196a3a5858
+/agent-note-paid-native-flash-translation-uses-independent-queries/alternatives-considered:
+ en: e5ec698f302c8ae8
+ zh: b3a7d4f037ca6bdb
+/agent-note-paid-native-flash-translation-uses-independent-queries/consequences:
+ en: 74d2e9a7f22b6555
+ zh: 249e56f0c7071fe3
diff --git a/.agents/notes/implemented/architecture/2026-10-05-paid-native-flash-reasoning-translation.md b/.agents/notes/implemented/architecture/2026-10-05-paid-native-flash-reasoning-translation.md
new file mode 100644
index 0000000000..948ae90f1b
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-10-05-paid-native-flash-reasoning-translation.md
@@ -0,0 +1,27 @@
+# Agent Note: Paid native Flash translation uses independent queries
+
+Status: implemented
+
+English | [中文](2026-10-05-paid-native-flash-reasoning-translation.zh.md)
+
+## Problem
+
+Readers may choose model-based translation in exchange for additional charges. Reusing their conversation request would inherit its history and generation controls, while routing through an arbitrary configured model would conceal the translation's billing and receiver choices.
+
+## Decision
+
+Paid translation is an explicit alternative to the [default anonymous path](2026-10-05-anonymous-reasoning-translation.md). Only active built-in `deepseek-account` and `deepseek-official` owners with configured credentials and the exact `deepseek-flash` catalog ID qualify. Display names and versions do not participate, and pi-ai routes are excluded. Each fragment receives one fresh text-only query, a simple translation instruction and disabled thinking; no previous fragment or main history is supplied.
+
+The original Session keeps `plugin:translator/request`, the [shared translation request record](2026-10-05-persistent-machine-translation.md), with exact model-visible input in optional `metadata.modelRequest` before dispatch. The existing `appendPluginRecord` writer snapshots its JSON payload and marks it ignorable without replacing main history. Read-only cache lookup precedes native admission and needs no live Session. A cache miss uses the active Session writer and flushes before dispatch; the GUI joins normal Session activation when needed, with its ordinary startup and resume effects. Format migration retains these informational records on a best-effort basis. Translation does not supply the main Session identity to the native request extensions, so a fragment cannot authorize uploading its full conversation log. The configured paid choice is enforced by the Host before billing.
+
+## Alternatives considered
+
+**Reuse the conversation's model call.** Its history, model and thinking settings are unrelated to a translation fragment, and session-log delivery could transmit more than the selected text. A fresh native Flash call makes these choices explicit.
+
+**Offer every model or version label.** This requires additional receiver and billing decisions. The stable `deepseek-flash` ID supports future versions while preserving the requested built-in route restriction.
+
+**Replace the original assistant output.** Translated text is retained separately as a shared result record; original reasoning remains the source of main model history.
+
+## Consequences
+
+Paid queries consume additional input and output tokens. The GUI discloses billing for uncached fragments. Reopening reuses persisted successful results, including when native credentials or model configuration are unavailable. Failures never choose another route. Local audit retention is independent of provider log delivery, and anonymous translation remains the default.
diff --git a/.agents/notes/implemented/architecture/2026-10-05-paid-native-flash-reasoning-translation.zh.md b/.agents/notes/implemented/architecture/2026-10-05-paid-native-flash-reasoning-translation.zh.md
new file mode 100644
index 0000000000..9feb7e8dff
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-10-05-paid-native-flash-reasoning-translation.zh.md
@@ -0,0 +1,27 @@
+# Agent Note: 付费原生 Flash 翻译使用独立查询
+
+Status: implemented
+
+[English](2026-10-05-paid-native-flash-reasoning-translation.md) | 中文
+
+## 问题
+
+读者可选择模型翻译并承担额外费用。复用对话请求会继承其历史及生成控制，而路由到任意已配置模型会隐藏翻译的计费及接收方选择。
+
+## 决策
+
+付费翻译是[默认匿名路径](2026-10-05-anonymous-reasoning-translation.zh.md)的显式替代选项。只有内置 `deepseek-account` 与 `deepseek-official` 所有者处于活动状态、凭据已配置，且目录包含 ID 恰好为 `deepseek-flash` 的模型时才符合条件。显示名称和版本不参与匹配，pi-ai 路由被排除。每个片段执行一次新的纯文本查询，使用简单翻译指令并关闭思考，不携带此前片段或主历史。
+
+原始 Session 在派发前通过实验性记录 `plugin:translator/request` 在可选 `metadata.modelRequest` 中保留精确的模型可见请求，采用[统一的翻译请求记录](2026-10-05-persistent-machine-translation.zh.md)。现有 `appendPluginRecord` 写入器快照其 JSON 载荷并标为可忽略，不替换主历史。只读缓存查找先于原生准入，且不要求 Session 已激活。缓存未命中时使用已激活 Session 的写入器，在派发前刷新；GUI 按需等待正常 Session 激活，保留普通启动与恢复行为。格式迁移以尽力而为的方式保留这些信息性记录。翻译不向原生请求扩展提供主 Session 身份，因此单个片段不能授权上传完整对话日志。Host 在计费前强制要求已配置的付费选择。
+
+## 考虑过的替代方案
+
+**复用对话的模型调用。** 其历史、模型及思考设置与翻译片段无关，Session 日志派送还可能传输超出所选文本的内容。新的原生 Flash 调用使这些选择明确。
+
+**提供所有模型或版本标签。** 这需要额外的接收方及计费决策。稳定的 `deepseek-flash` ID 支持未来版本，同时保留所要求的内置路由限制。
+
+**替换原始 assistant 输出。** 译文通过统一的结果记录单独保留；原始思考仍是主模型历史的来源。
+
+## 后果
+
+付费查询消耗额外的输入和输出 token。GUI 说明未缓存片段的计费。重新展开复用已持久化的成功结果，即使原生凭据或模型配置不可用。失败时不选择其他路由。本地审计保留独立于提供方日志派送，匿名翻译仍为默认选项。
diff --git a/.agents/notes/implemented/architecture/2026-10-05-persistent-machine-translation.i18n.yaml b/.agents/notes/implemented/architecture/2026-10-05-persistent-machine-translation.i18n.yaml
new file mode 100644
index 0000000000..d54e1be33d
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-10-05-persistent-machine-translation.i18n.yaml
@@ -0,0 +1,19 @@
+# Bilingual-pair consistency record for 2026-10-05-persistent-machine-translation.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-10-05-persistent-machine-translation.md
+/agent-note-machine-translation-results-use-shared-session-records:
+ en: 0587db1f8b7b3c6d
+ zh: 63af01050024d4d1
+/agent-note-machine-translation-results-use-shared-session-records/problem:
+ en: 4194ba9786778876
+ zh: 6b99613a4d0dd5d2
+/agent-note-machine-translation-results-use-shared-session-records/decision:
+ en: fb8800dede33177b
+ zh: b3f5098e54d5d982
+/agent-note-machine-translation-results-use-shared-session-records/alternatives-considered:
+ en: 3f251877332d74cc
+ zh: 61991d5fd4704a99
+/agent-note-machine-translation-results-use-shared-session-records/consequences:
+ en: c51bbb4ec6b7f20b
+ zh: 856dbfdf47509d90
diff --git a/.agents/notes/implemented/architecture/2026-10-05-persistent-machine-translation.md b/.agents/notes/implemented/architecture/2026-10-05-persistent-machine-translation.md
new file mode 100644
index 0000000000..0826274392
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-10-05-persistent-machine-translation.md
@@ -0,0 +1,35 @@
+# Agent Note: Machine translation results use shared Session records
+
+Status: implemented
+
+English | [中文](2026-10-05-persistent-machine-translation.zh.md)
+
+## Problem
+
+Readers need a saved translation when they reopen reasoning or restart the application. A disclosure-only cache repeats external requests, can change an already displayed result and can incur repeated model charges. Storing only model inputs leaves successful translations unavailable after restart.
+
+## Decision
+
+The translator owns `plugin:translator/request` and `plugin:translator/result` for every provider. A request records its selected provider, exact source text, source and target languages, and recipe identity. Optional metadata carries provider-owned request details. A result references the request's Session sequence and retains the completed translated text. Requests are durable before dispatch, and results are durable before they return to the GUI.
+
+The browser binds displayed translations to the disclosure's Session, and the Host validates the configured provider and explicit target language. The authenticated Client supplies the original text and Session identity; the Host does not verify that the text belongs to that Session. Successful records are reusable across disclosure lifetimes and restarts. Identity includes the provider and recipe, so changing the receiver, language or translation settings cannot substitute another result. Identical concurrent translations wait for one result; distinct fragments can run in parallel.
+
+Read-only lookup precedes provider work. New records use the active Session's existing writer through `appendPluginRecord` and targeted flush. An uncached inactive Session rejects before provider work; the GUI consumer joins normal Session controller activation and retries once.
+
+These records accompany the [original reasoning](2026-10-05-anonymous-reasoning-translation.md) and never replace its events or model input. They use the existing experimental record writer and best-effort format-migration retention. Provider availability gates new requests; a saved result remains readable without another inference. Stateless translator calls remain available without a Session.
+
+## Alternatives considered
+
+**Keep only disclosure-local results.** Reopening loses the displayed value and sends the same text again, with possible repeat charges.
+
+**Give anonymous and model translations different result formats.** The reader needs the same source-to-translation relationship from every provider. Provider-owned audit details belong in optional metadata.
+
+**Replace original assistant reasoning.** A translation is derived data. Keeping it alongside the original preserves model history and access to the source.
+
+**Open a separate writer for historical translations.** This competes with normal Session activation and requires coordination between two writer owners. The GUI already activates opened conversations; using its existing controller keeps that ownership in one place.
+
+## Consequences
+
+The Session retains translated text and request identity in addition to original reasoning. Only completed persisted results supply cached text; failed or incomplete attempts do not. A completion that has already entered the append-only log may survive a late caller cancellation. Records do not introduce released Session schema history, and future format migrations may drop experimental state.
+
+Saved results remain readable without activation. A new translation may wait for normal Session activation, including preset startup hooks, resume markers, interrupted-turn repair, and any required generation migration. These ordinary lifecycle effects can append context; translation does not bypass them. Cache reads leave older generations unpublished. The translator owns no second writer and requires no core lifecycle changes.
diff --git a/.agents/notes/implemented/architecture/2026-10-05-persistent-machine-translation.zh.md b/.agents/notes/implemented/architecture/2026-10-05-persistent-machine-translation.zh.md
new file mode 100644
index 0000000000..bf9b9b2c56
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-10-05-persistent-machine-translation.zh.md
@@ -0,0 +1,35 @@
+# Agent Note: 机器翻译结果使用统一的 Session 记录
+
+Status: implemented
+
+[English](2026-10-05-persistent-machine-translation.md) | 中文
+
+## 问题
+
+读者在重新展开思考内容或重启应用后仍需要已保存的译文。只在展开区域缓存会重复外部请求、可能改变已显示结果，也可能重复产生模型费用。仅存储模型输入无法在重启后恢复成功译文。
+
+## 决策
+
+translator 对所有 Provider 统一使用 `plugin:translator/request` 和 `plugin:translator/result`。请求记录所选 Provider、精确原文、源语言和目标语言，以及翻译规则标识。可选 metadata 保存 Provider 自有请求细节。结果引用请求的 Session 序号并保留完成后的译文。请求在派发前持久化，结果在返回 GUI 前持久化。
+
+浏览器将展示翻译绑定到展开区域的 Session，Host 校验配置的提供方和显式目标语言。已认证的 Client 提供原文与 Session 身份；Host 不校验原文是否属于该 Session。成功记录可跨展开组件生命周期和重启复用。身份包含 Provider 和翻译规则，因此改变接收方、语言或翻译设置不会混用其他结果。相同的并发翻译等待同一结果，不同片段可并行执行。
+
+只读查找先于 Provider 调用。新记录通过已激活 Session 的现有写入器调用 `appendPluginRecord` 并定向刷新。未激活 Session 缓存未命中时，在 Provider 调用前拒绝；GUI 消费者等待 Session controller 的正常激活，再重试一次。
+
+这些记录与[原始思考内容](2026-10-05-anonymous-reasoning-translation.zh.md)一同保留，从不替换其事件或模型输入。它们使用现有的实验性记录写入器，格式迁移采用尽力保留语义。Provider 可用性限制新请求，已保存结果无需再次推理即可读取。不指定 Session 时，translator 仍支持无状态调用。
+
+## 考虑过的替代方案
+
+**只保留展开区域内的结果。** 重新展开会丢失已展示值并再次发送同样的文本，可能重复计费。
+
+**匿名翻译与模型翻译使用不同的结果格式。** 读者对所有 Provider 都需要相同的原文到译文关系。Provider 自有审计细节属于可选 metadata。
+
+**替换原始 assistant 思考内容。** 翻译属于派生数据。与原文并存可以保留模型历史和原文访问能力。
+
+**为历史翻译另开写入器。** 这会与正常 Session 激活竞争，并需要协调两个写入所有者。GUI 已经会激活打开的对话；使用其现有 controller 可将所有权集中在一处。
+
+## 后果
+
+Session 在原始思考内容之外保留译文和请求身份。只有完成并持久化的结果提供缓存译文，失败或未完成尝试不提供。已进入 append-only 日志的完成记录可能在调用者迟到取消后保留。记录不引入已发布的 Session schema 历史，未来格式迁移可能丢弃实验性状态。
+
+已保存结果无需激活即可读取。新翻译可能等待正常 Session 激活，包括 preset 启动钩子、恢复标记、中断轮次修复及所需的 generation 迁移。这些普通生命周期行为可能追加上下文；翻译不会绕过它们。缓存读取不会发布旧 generation。translator 不拥有第二个写入器，也不需要修改核心生命周期。
diff --git a/.agents/notes/implemented/architecture/2026-10-05-shared-agents-root-instructions.i18n.yaml b/.agents/notes/implemented/architecture/2026-10-05-shared-agents-root-instructions.i18n.yaml
new file mode 100644
index 0000000000..0d4737ef26
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-10-05-shared-agents-root-instructions.i18n.yaml
@@ -0,0 +1,19 @@
+# Bilingual-pair consistency record for 2026-10-05-shared-agents-root-instructions.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-10-05-shared-agents-root-instructions.md
+/agent-note-shared-agents-root-joins-the-user-global-instruction-chain:
+ en: d29282678b243512
+ zh: f81e134f59df5491
+/agent-note-shared-agents-root-joins-the-user-global-instruction-chain/problem:
+ en: 8fd7583122a2b082
+ zh: 032acf0c713780f7
+/agent-note-shared-agents-root-joins-the-user-global-instruction-chain/decision:
+ en: 69008d5fd1bb091b
+ zh: a7c4d0334834e6c7
+/agent-note-shared-agents-root-joins-the-user-global-instruction-chain/alternatives-considered:
+ en: 825c2470ba83573e
+ zh: d0ffd4fea4f8f0d0
+/agent-note-shared-agents-root-joins-the-user-global-instruction-chain/consequences:
+ en: cc30674b9b41d0f3
+ zh: 36ac52fb078dbec4
diff --git a/.agents/notes/implemented/architecture/2026-10-05-shared-agents-root-instructions.md b/.agents/notes/implemented/architecture/2026-10-05-shared-agents-root-instructions.md
new file mode 100644
index 0000000000..5687130961
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-10-05-shared-agents-root-instructions.md
@@ -0,0 +1,37 @@
+# Agent Note: Shared agents root joins the user-global instruction chain
+
+Status: implemented
+
+English | [中文](2026-10-05-shared-agents-root-instructions.zh.md)
+
+## Problem
+
+DSH loads one user-global instruction file, `$DSH_HOME/AGENTS.md`. People who run several agent tools keep the instructions they share across those tools in the shared agent configuration root (`~/.agents/AGENTS.md`, or `$DSH_AGENTS_HOME`) that `dsh-skill-filesystem` already scans for skills. Those instructions reached DSH only when the person copied or symlinked them into the harness home, which duplicates one source of truth into DSH-owned data and leaves no way to tell which copy a session loaded.
+
+## Decision
+
+The user-global instruction scope has two ordered roots: `$DSH_HOME/AGENTS.md` first, then `/AGENTS.md`. The instruction loader resolves the harness home from `$DSH_HOME` or `~/.dsh`, and `agentsHome` from `$DSH_AGENTS_HOME` or `~/.agents`. `resolveAgentsHome` and `agentsHomeDisplay` in `dsh-home-paths` own that resolution for both `dsh-agent-instructions` and `dsh-skill-filesystem`, so the shared root has one resolver whose tilde expansion and blank-environment handling match the harness home.
+
+The two files are candidates of one candidate group. They deduplicate by trimmed content, so identical copies render once from the harness home, and an unobservable candidate preserves the group's last-good state. A duplicate of budget-retained content keeps being reconciled, so deleting or changing the retained candidate promotes it; a byte-budget omission leaves that candidate and its content duplicates unprobed. The harness-home file keeps the `user-global` scope key that earlier sessions recorded; the shared file carries `agents-global`, and reconciliation probes both roots on resume, so an external edit, a removal, or a newly created file appears as a change notice instead of a new baseline.
+
+A user-global scope directory is an internal reconciliation key, so it stays out of model-visible prose: a global delta states `These user-global instructions apply to all work.` instead of naming a scope directory, and a project path whose first component would collide with one renders with a leading `.` so it keeps its own scope.
+
+`USER_GLOBAL_DIRECTORIES` fixes the root order, and discovery, baseline reconciliation, and deduplication all iterate it. The harness home therefore decides content duplicates and keeps its position in the baseline, while distinct content from the shared root follows it.
+
+## Alternatives considered
+
+**Replace the harness-home file with the shared root.** The harness home owns DSH-specific configuration, and its `AGENTS.md` is the user-global file the package documents, tests, and renders today. Removing it would drop a DSH-only layer for anyone who shares instructions across tools, and sessions that recorded `user-global` state would lose their referent.
+
+**Load the shared root only when the harness-home file is absent.** The two files then alternate as the session-visible user-global file, which makes a DSH-specific file silently suppress the shared one instead of composing with it.
+
+**Load the shared file as a second candidate name in the harness home.** `instructionFileCandidates` names files within one directory; the two roots are different directories, so the option cannot express this chain without redefining candidate semantics.
+
+**Rely on path identity instead of content for the duplicate case.** The common layout is `$DSH_HOME/AGENTS.md` symlinked to `~/.agents/AGENTS.md`, which is two paths for one file. Path identity drops neither, so the same text would render twice under two display labels.
+
+## Consequences
+
+- Shared instructions load without a copy or symlink, and the symlinked layout still renders once, from the harness home.
+- A session that started before this change receives one transition when the shared file exists with content that differs from the harness-home file.
+- `dsh-agent-instructions` exposes no `dshHome` or `agentsHome` config field; its two roots are process policy. `dsh-skill-filesystem` retains its explicit home fields, which select that provider's own skill roots.
+- The two user-global files share one fate on probe failure: the group preserves its last-good state together, because one digest decides which member renders.
+- `packages/context/agent-instructions/tests/agent-instructions.spec.ts` pins the two-root order, content deduplication, duplicate promotion after the retained candidate changes or disappears, the global delta wording, the `replace` and `remove` transitions, `$DSH_AGENTS_HOME` resolution, the `~/.agents` display label, and the escaped project directory name.
diff --git a/.agents/notes/implemented/architecture/2026-10-05-shared-agents-root-instructions.zh.md b/.agents/notes/implemented/architecture/2026-10-05-shared-agents-root-instructions.zh.md
new file mode 100644
index 0000000000..bea805d075
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-10-05-shared-agents-root-instructions.zh.md
@@ -0,0 +1,37 @@
+# Agent Note: 共享 agents 根目录加入用户全局指令链
+
+Status: implemented
+
+[English](2026-10-05-shared-agents-root-instructions.md) | 中文
+
+## 问题
+
+DSH 只加载一个用户全局指令文件：`$DSH_HOME/AGENTS.md`。同时使用多个 agent 工具的人，会把跨工具共享的指令放在共享 agent 配置根目录（`~/.agents/AGENTS.md`，或 `$DSH_AGENTS_HOME`）——`dsh-skill-filesystem` 已经在该根目录下扫描 skill。这些指令只有被复制或 symlink 到 harness home 之后才能进入 DSH，这会把唯一真源复制进 DSH 自有数据，也让人无法判断会话加载的是哪一份。
+
+## 决策
+
+用户全局指令 scope 有两个有序根目录：先是 `$DSH_HOME/AGENTS.md`，然后是 `/AGENTS.md`。指令加载器从 `$DSH_HOME` 或 `~/.dsh` 解析 harness home，从 `$DSH_AGENTS_HOME` 或 `~/.agents` 解析 `agentsHome`。`dsh-home-paths` 中的 `resolveAgentsHome` 与 `agentsHomeDisplay` 为 `dsh-agent-instructions` 和 `dsh-skill-filesystem` 共同负责该解析，因此共享根目录只有一个解析器，其波浪号展开与空白环境变量处理都与 harness home 一致。
+
+这两个文件是同一个候选组中的候选：按去除首尾空白后的内容去重，完全相同的副本只从 harness home 渲染一次，候选不可观测时保留该组最后一次成功状态。预算保留内容的重复候选仍参与对账，因此保留的候选被删除或改变时它会被提升为可见；字节预算省略会让该候选及其内容重复项不再被探测。harness home 文件保留更早会话记录过的 `user-global` scope key；共享文件使用 `agents-global`。对账在恢复会话时会探测两个根目录，因此外部编辑、移除或新建文件都会表现为变更通知，而不会重新生成基线。
+
+用户全局 scope 目录是对账用的内部 key，因此不会进入模型可见文本：全局增量声明 `These user-global instructions apply to all work.`，而不指名 scope 目录；首段路径与 scope 目录同名的项目路径会带前导 `.` 渲染，从而保留自己的 scope。
+
+根目录顺序由 `USER_GLOBAL_DIRECTORIES` 固定，发现、基线对账与去重都按它迭代。因此由 harness home 决定内容重复项，并在基线中保持自己的位置；共享根目录中内容不同的文件排在其后。
+
+## 备选方案
+
+**用共享根目录替换 harness home 文件。** harness home 存放 DSH 专有配置，其 `AGENTS.md` 是该包当前记录、测试并渲染的用户全局文件。移除它会剥夺跨工具共享指令者的 DSH 专有层，也会让记录了 `user-global` 状态的会话失去指涉对象。
+
+**仅当 harness home 文件不存在时才加载共享根目录。** 这样两个文件会轮流充当会话可见的用户全局文件，使 DSH 专有文件静默压制共享文件，而不是与之组合。
+
+**把共享文件作为 harness home 中的第二个候选名加载。** `instructionFileCandidates` 命名的是同一个目录内的文件；这两个根目录是不同目录，因此该选项无法表达这条指令链，除非重新定义候选语义。
+
+**重复项改用路径标识而非内容判断。** 常见布局是把 `$DSH_HOME/AGENTS.md` symlink 到 `~/.agents/AGENTS.md`，这是同一个文件的两个路径。路径标识无法丢弃其中任何一个，同一段文本会以两个显示标签渲染两次。
+
+## 影响
+
+- 共享指令无需复制或 symlink 即可加载；symlink 布局仍然只从 harness home 渲染一次。
+- 在此变更之前启动的会话，若共享文件存在且内容与 harness home 文件不同，会收到一次变更通知。
+- `dsh-agent-instructions` 不暴露 `dshHome` 或 `agentsHome` 配置字段；它的两个根目录属于进程策略。`dsh-skill-filesystem` 保留显式 home 字段，用于选择该提供方自身的 skill 根目录。
+- 探测失败时两个用户全局文件共享同一命运：整个组一起保留最后一次成功状态，因为决定哪个成员渲染的是同一个 digest。
+- `packages/context/agent-instructions/tests/agent-instructions.spec.ts` 固定了两个根目录的顺序、内容去重、保留候选改变或消失后的重复项提升、全局增量措辞、`replace` 与 `remove` 变更、`$DSH_AGENTS_HOME` 解析、`~/.agents` 显示标签，以及转义后的项目目录名。
diff --git a/.agents/notes/implemented/architecture/2026-10-06-web-desktop-plugin-identity-compatibility.i18n.yaml b/.agents/notes/implemented/architecture/2026-10-06-web-desktop-plugin-identity-compatibility.i18n.yaml
new file mode 100644
index 0000000000..bab272d8e1
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-10-06-web-desktop-plugin-identity-compatibility.i18n.yaml
@@ -0,0 +1,22 @@
+# Bilingual-pair consistency record for 2026-10-06-web-desktop-plugin-identity-compatibility.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-10-06-web-desktop-plugin-identity-compatibility.md
+/agent-note-preserve-web-and-desktop-plugin-identities-across-experimental-consolidation:
+ en: 45d8ead4ca3db272
+ zh: 4ef8e729d5d7e8c1
+/agent-note-preserve-web-and-desktop-plugin-identities-across-experimental-consolidation/problem:
+ en: 8112c1c059d1cf10
+ zh: 852d23c56a93a555
+/agent-note-preserve-web-and-desktop-plugin-identities-across-experimental-consolidation/decision:
+ en: ac725c281d7dfb41
+ zh: 5adcaa6ca6eab384
+/agent-note-preserve-web-and-desktop-plugin-identities-across-experimental-consolidation/deferred-naming-cleanup:
+ en: 4c428f65ef611d07
+ zh: 1fdc5467b0203d08
+/agent-note-preserve-web-and-desktop-plugin-identities-across-experimental-consolidation/alternatives-considered:
+ en: 1bf03723fea6c9a4
+ zh: 2d0d2fc997f7c022
+/agent-note-preserve-web-and-desktop-plugin-identities-across-experimental-consolidation/consequences:
+ en: 60f7c823b5d2ed6f
+ zh: 75f375487cab3c56
diff --git a/.agents/notes/implemented/architecture/2026-10-06-web-desktop-plugin-identity-compatibility.md b/.agents/notes/implemented/architecture/2026-10-06-web-desktop-plugin-identity-compatibility.md
new file mode 100644
index 0000000000..def042e26a
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-10-06-web-desktop-plugin-identity-compatibility.md
@@ -0,0 +1,40 @@
+# Agent Note: Preserve Web and Desktop plugin identities across experimental consolidation
+
+Status: implemented
+
+English | [中文](2026-10-06-web-desktop-plugin-identity-compatibility.zh.md)
+
+## Problem
+
+Moving a capability into the experimental directory changes its ownership and support classification. Renaming its published package or an existing configuration row additionally changes how installed profiles refer to that capability. Those identity changes can make a working Web or Desktop customization require edits unrelated to the capability's behavior.
+
+## Decision
+
+The moved packages retain the published names declared by the [experimental naming policy](../../../../scripts/experimental-package-policy.ts). That typed directory-to-name map is the sole maintained inventory of naming exceptions. Package manifests, consumers, installation checks, and bundler checks agree with it; a missing, moved, or duplicated exception is rejected. [Experimental status](../../../../packages/experimental/README.md#status) remains independent of spelling, Official discovery, and explicit selection.
+
+Existing badge, Ralph, and native delegation row IDs remain valid selectors inside their applicable Host or preset scope. New isolation groups and newly introduced capabilities retain their new IDs. Later user layers still replace configuration or disable rows, and a complete preset replacement remains authoritative. Selecting an optional bundle is still explicit: a patch targeting an absent row does not select its bundle.
+
+Compatibility protection covers Web and Desktop profiles, including existing native provider package identities, selections, configuration, and authentication. Headless, SDK, and ACP compositions may require changes. Native bundles use the ordinary shared patch operation and require the full preset targets; separate provider-only compatibility wrappers are unnecessary for the protected profiles. Public APIs remain pre-stable, and new output metadata stays required unless an actual consumer needs an accommodation.
+
+## Deferred naming cleanup
+
+| Retained identity | Unconstrained cleanup | Why it is deferred |
+|---|---|---|
+| Published names in the naming-exception map | Give every experimental package the `@deepseek-ai/dsh-experimental-` prefix | Existing dependencies, imports, module declarations, and profile files use the established names |
+| Existing badge, Ralph, and native-tool row IDs | Give optional contributions consistently distinct `optional-*` selectors | Existing user overrides use those IDs; the ownership move does not require a new selector |
+
+These naming changes are deferred, not prerequisites for experimental classification. A later cleanup requires an explicit release and migration decision, an inventory of affected Web/Desktop configurations, and installed-profile upgrade evidence. Directory moves or pre-stable API status alone do not retire these exceptions. The package list stays in the typed policy rather than being copied into this note or package READMEs.
+
+## Alternatives considered
+
+**Rename every package and row during consolidation.** Uniform spelling makes the new ownership visible, but adds dependency and configuration migration to a change that can preserve those references.
+
+**Publish aliases or keep duplicate compatibility rows.** Parallel identities need continuing resolution and removal rules and can register the same capability twice. Retaining the established identity avoids that additional mechanism.
+
+**Keep provider-only bundles through additional wrapper packages.** Web and Desktop already provide the required presets. Extra delivery packages would preserve compositions outside the selected compatibility scope and increase catalog and release maintenance.
+
+## Consequences
+
+The repository carries a bounded naming-exception map and tests that classify retained names through direct imports, aliases, transitive dependencies, and packed or bundled artifacts. An unprefixed name does not grant admission to the default product. Existing row identities have Web/Desktop composition coverage for user overrides, disabled state, and preset replacement. No general alias or automatic profile migration mechanism is introduced.
+
+The [classification decision](../process/2026-10-05-product-package-classification.md), [optional-composition decision](2026-09-21-experimental-capabilities-as-optional-bundles.md), and [on-demand discovery decision](2026-10-05-official-on-demand-bundles.md) retain their separate responsibilities. Released Session generations and persisted hook event names remain protected independently of this profile compatibility scope.
diff --git a/.agents/notes/implemented/architecture/2026-10-06-web-desktop-plugin-identity-compatibility.zh.md b/.agents/notes/implemented/architecture/2026-10-06-web-desktop-plugin-identity-compatibility.zh.md
new file mode 100644
index 0000000000..1f513060ea
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-10-06-web-desktop-plugin-identity-compatibility.zh.md
@@ -0,0 +1,40 @@
+# Agent Note: 在实验能力整合中保留 Web 和 Desktop 插件身份
+
+Status: implemented
+
+[English](2026-10-06-web-desktop-plugin-identity-compatibility.md) | 中文
+
+## 问题
+
+把能力迁入 experimental 目录会改变其归属和支持分类。重命名已发布的包或既有配置行，还会改变已安装 profile 引用该能力的方式。这些身份变化可能要求正常工作的 Web 或 Desktop 自定义配置进行与能力行为无关的修改。
+
+## 决策
+
+迁移的包保留[实验包命名策略](../../../../scripts/experimental-package-policy.ts)声明的已发布名称。这个带类型的目录到包名映射是命名例外唯一手工维护的清单。包清单、消费者、安装检查和打包检查与其保持一致；缺失、迁移到其他位置或重复归属的例外会被拒绝。[实验状态](../../../../packages/experimental/README.zh.md#status)仍独立于名称拼写、Official 发现和显式选择。
+
+既有徽章、Ralph 和原生委派行 ID 在对应的 Host 或预设作用域中保持有效。新增隔离组和新引入的能力保留各自的新 ID。后续用户层仍可替换配置或禁用行，完整预设替换仍具有决定权。可选 bundle 仍须显式选择：指向缺失行的 patch 不会自动选择其 bundle。
+
+兼容性保护覆盖 Web 和 Desktop profile，包括既有原生提供方的包身份、选择状态、配置和认证。Headless、SDK 和 ACP 组合可以要求修改。原生 bundle 使用普通的共享 patch 操作并要求完整预设目标存在；受保护的 profile 不需要单独的仅提供方兼容包装包。公共 API 仍处于稳定前阶段，新增输出元信息保持必填，除非实际消费者需要适配。
+
+## 暂缓的命名清理
+
+| 保留的身份 | 不受兼容性约束时的清理 | 暂缓原因 |
+|---|---|---|
+| 命名例外映射中的已发布名称 | 为每个实验包使用 `@deepseek-ai/dsh-experimental-` 前缀 | 既有依赖、导入、模块声明和 profile 文件使用原有名称 |
+| 既有徽章、Ralph 和原生工具行 ID | 为可选贡献统一使用独立的 `optional-*` 选择器 | 既有用户覆盖使用这些 ID；归属迁移不要求新的选择器 |
+
+这些命名变更被暂缓，不是实验分类的前提。后续清理需要明确的发布与迁移决策、受影响 Web/Desktop 配置清单，以及已安装 profile 的升级验证。仅目录迁移或公共 API 处于稳定前阶段，不足以删除这些例外。包清单保留在带类型的策略中，不复制到本记录或各包 README。
+
+## 考虑过的替代方案
+
+**在整合时重命名所有包和配置行。** 统一拼写可以体现新归属，但会为本可保留引用的变更加上依赖和配置迁移。
+
+**发布别名或保留重复兼容行。** 并行身份需要持续维护解析和移除规则，还可能重复注册同一能力。保留既有身份可以避免增加这种机制。
+
+**通过额外包装包保留仅提供方 bundle。** Web 和 Desktop 已提供所需预设。额外交付包会保留选定兼容范围之外的组合，并增加目录和发布维护成本。
+
+## 后果
+
+仓库维护范围明确的命名例外映射，并测试通过直接导入、别名、传递依赖及打包产物识别这些保留名称。没有实验前缀的名称不因此获准进入默认产品。既有行身份具有覆盖用户配置、禁用状态和预设替换的 Web/Desktop 组合测试。不引入通用别名或自动 profile 迁移机制。
+
+[分类决策](../process/2026-10-05-product-package-classification.zh.md)、[可选组合决策](2026-09-21-experimental-capabilities-as-optional-bundles.zh.md)和[按需发现决策](2026-10-05-official-on-demand-bundles.zh.md)继续承担各自独立的职责。已发布 Session 代际和持久化 hook 事件名的保护独立于此 profile 兼容范围。
diff --git a/.agents/notes/implemented/bug-fix/2026-07-20-jsonl-storage-identity.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-07-20-jsonl-storage-identity.i18n.yaml
deleted file mode 100644
index 5247ed21c3..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-07-20-jsonl-storage-identity.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-20-jsonl-storage-identity.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-07-20-jsonl-storage-identity.md
-/agent-note-bind-jsonl-session-identity-before-mutation:
- en: 1d52db2391f1433e
- zh: 3bcb9dca6b77bfdd
-/agent-note-bind-jsonl-session-identity-before-mutation/problem:
- en: 960d783083269ddd
- zh: ef52b53d99b520d1
-/agent-note-bind-jsonl-session-identity-before-mutation/decision:
- en: 3fc8ab92d1f0f98b
- zh: 855b863c7d90cdd9
-/agent-note-bind-jsonl-session-identity-before-mutation/alternatives-considered:
- en: 5269f154c37cb8de
- zh: 983f18775457361a
-/agent-note-bind-jsonl-session-identity-before-mutation/consequences:
- en: 2c88ff974542760f
- zh: 489996a16ba6907b
diff --git a/.agents/notes/implemented/bug-fix/2026-07-31-fail-loud-releases-the-terminal.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-07-31-fail-loud-releases-the-terminal.i18n.yaml
deleted file mode 100644
index dbd450eb86..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-07-31-fail-loud-releases-the-terminal.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-31-fail-loud-releases-the-terminal.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-07-31-fail-loud-releases-the-terminal.md
-/agent-note-fail-loud-releases-the-terminal-before-exiting:
- en: c070ae81b744a18b
- zh: 8379e89b11e263c4
-/agent-note-fail-loud-releases-the-terminal-before-exiting/problem:
- en: 705893ebb3a11d92
- zh: 7d19929c62213a3c
-/agent-note-fail-loud-releases-the-terminal-before-exiting/decision:
- en: a28315c307acdf90
- zh: fb7b2df986ffdffc
-/agent-note-fail-loud-releases-the-terminal-before-exiting/alternatives-considered:
- en: 5ee239978e8f1ece
- zh: 55267740c7726c25
-/agent-note-fail-loud-releases-the-terminal-before-exiting/consequences:
- en: 19241cdfdb6c4e56
- zh: 24534e8660ae2f96
-/agent-note-fail-loud-releases-the-terminal-before-exiting/testing:
- en: 8a7b0c74ec32d5a0
- zh: 5bbb564ecc8a9870
diff --git a/.agents/notes/implemented/bug-fix/2026-08-03-cli-signal-shutdown-escalation.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-08-03-cli-signal-shutdown-escalation.i18n.yaml
deleted file mode 100644
index 23c1697c7e..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-08-03-cli-signal-shutdown-escalation.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-03-cli-signal-shutdown-escalation.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-08-03-cli-signal-shutdown-escalation.md
-/agent-note-bounded-escalating-signal-shutdown-for-web-and-headless:
- en: d8f8ef8811dfe378
- zh: ca728da97cb35920
-/agent-note-bounded-escalating-signal-shutdown-for-web-and-headless/problem:
- en: 1042d3e1c2cb1e45
- zh: d32f05dd83eee04b
-/agent-note-bounded-escalating-signal-shutdown-for-web-and-headless/decision:
- en: 5738aa92d9185c4f
- zh: 1999e41d43063c12
-/agent-note-bounded-escalating-signal-shutdown-for-web-and-headless/alternatives-considered:
- en: 53239a7e43d70aa1
- zh: d5ab1cc4c52513e6
-/agent-note-bounded-escalating-signal-shutdown-for-web-and-headless/consequences:
- en: 888679c978b87125
- zh: c68d962f516f675e
-/agent-note-bounded-escalating-signal-shutdown-for-web-and-headless/testing:
- en: e2dd8e925ff94a13
- zh: b9430f38c27982ff
diff --git a/.agents/notes/implemented/bug-fix/2026-08-06-bwrap-private-pid-namespace.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-08-06-bwrap-private-pid-namespace.i18n.yaml
deleted file mode 100644
index a261460c22..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-08-06-bwrap-private-pid-namespace.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-06-bwrap-private-pid-namespace.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-08-06-bwrap-private-pid-namespace.md
-/agent-note-isolate-bwrap-from-the-host-pid-namespace:
- en: 56e719d5aa015e57
- zh: 2568d89bb33ab663
-/agent-note-isolate-bwrap-from-the-host-pid-namespace/problem:
- en: 2da6f0dd324f054d
- zh: 4a414f04e638aa47
-/agent-note-isolate-bwrap-from-the-host-pid-namespace/decision:
- en: d1000f28dd8cd2c6
- zh: 9b35f7085ae68b99
-/agent-note-isolate-bwrap-from-the-host-pid-namespace/alternatives-considered:
- en: e794f6d8578bffef
- zh: 61feee3ed99c615d
-/agent-note-isolate-bwrap-from-the-host-pid-namespace/verification:
- en: 7f9a12f088ce869f
- zh: 8d1ea7519de1605d
-/agent-note-isolate-bwrap-from-the-host-pid-namespace/consequences:
- en: 4543b72f4d669fdf
- zh: 7576f60bac467013
diff --git a/.agents/notes/implemented/bug-fix/2026-08-06-host-backed-web-preferences.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-08-06-host-backed-web-preferences.i18n.yaml
deleted file mode 100644
index 82875f587c..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-08-06-host-backed-web-preferences.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-06-host-backed-web-preferences.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-08-06-host-backed-web-preferences.md
-/agent-note-persist-web-user-preferences-through-host-settings:
- en: da28d8677a4d9f9c
- zh: a5311ab734f576d3
-/agent-note-persist-web-user-preferences-through-host-settings/problem:
- en: 18b583ecb58b9e06
- zh: 55570d758b75852a
-/agent-note-persist-web-user-preferences-through-host-settings/decision:
- en: 2846c0d0f8615da7
- zh: 511d61ea4ea6efa6
-/agent-note-persist-web-user-preferences-through-host-settings/alternatives-considered:
- en: a91ebb47ec1ee356
- zh: d5ce0b7f48195093
-/agent-note-persist-web-user-preferences-through-host-settings/consequences:
- en: 7defab72acfd5e78
- zh: 566cbbd3eb3cd9e3
diff --git a/.agents/notes/implemented/bug-fix/2026-08-07-cancel-convergence-wake-latch.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-08-07-cancel-convergence-wake-latch.i18n.yaml
deleted file mode 100644
index 8f8930a2f0..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-08-07-cancel-convergence-wake-latch.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-07-cancel-convergence-wake-latch.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-08-07-cancel-convergence-wake-latch.md
-/agent-note-latch-wake-ups-that-land-in-the-cancel-convergence-window:
- en: 0b877f8208b50162
- zh: dd6b6af7d96a5f86
-/agent-note-latch-wake-ups-that-land-in-the-cancel-convergence-window/problem:
- en: 4539f5fa2c7dc7e4
- zh: f7b6cbe04ca0ffc2
-/agent-note-latch-wake-ups-that-land-in-the-cancel-convergence-window/decision:
- en: 23d5dbc6b75ca908
- zh: 116ae93f6a48e6ed
-/agent-note-latch-wake-ups-that-land-in-the-cancel-convergence-window/alternatives-considered:
- en: 6df22ff84b2dc081
- zh: 38d1559935b66fb9
-/agent-note-latch-wake-ups-that-land-in-the-cancel-convergence-window/consequences:
- en: 7d72c68239cd7e31
- zh: 19045871dcceb4bf
diff --git a/.agents/notes/implemented/bug-fix/2026-08-07-ptc-executor-collapse.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-08-07-ptc-executor-collapse.i18n.yaml
deleted file mode 100644
index a3575ac176..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-08-07-ptc-executor-collapse.i18n.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-07-ptc-executor-collapse.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-08-07-ptc-executor-collapse.md
-/agent-note-ptc-mode-collapses-the-executor-not-just-the-wire:
- en: 7958ca7ba1201af2
- zh: bc7f74c91444eed6
-/agent-note-ptc-mode-collapses-the-executor-not-just-the-wire/problem:
- en: a6fcd5114ffde259
- zh: 05940375a30756d0
-/agent-note-ptc-mode-collapses-the-executor-not-just-the-wire/decision:
- en: 66f55639766a6d02
- zh: a8819b045463a927
-/agent-note-ptc-mode-collapses-the-executor-not-just-the-wire/alternatives-considered:
- en: 6119e2aff3b6be5a
- zh: e01a6c669a9ec6aa
-/agent-note-ptc-mode-collapses-the-executor-not-just-the-wire/alternatives-considered/filter-get-the-registry-view-by-mode:
- en: 31b6fed689eea5db
- zh: ace070ad616bca62
-/agent-note-ptc-mode-collapses-the-executor-not-just-the-wire/alternatives-considered/filter-at-the-agent-loop-entry:
- en: 9dbdb9939baccd49
- zh: 11437030cd211000
-/agent-note-ptc-mode-collapses-the-executor-not-just-the-wire/alternatives-considered/reject-via-a-shipped-guard:
- en: 9011947651f58129
- zh: 1d4a0c622680f13f
-/agent-note-ptc-mode-collapses-the-executor-not-just-the-wire/alternatives-considered/keep-schema-omission-only-status-quo:
- en: 0d4759646b19917a
- zh: 1a1bef7617c52f9c
-/agent-note-ptc-mode-collapses-the-executor-not-just-the-wire/consequences:
- en: 9120e68ba25bd30a
- zh: 6ec4bea5df8668a1
diff --git a/.agents/notes/implemented/bug-fix/2026-08-10-child-agents-join-their-parent-preset.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-08-10-child-agents-join-their-parent-preset.i18n.yaml
deleted file mode 100644
index e86b334e45..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-08-10-child-agents-join-their-parent-preset.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-10-child-agents-join-their-parent-preset.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-08-10-child-agents-join-their-parent-preset.md
-/agent-note-child-agents-join-their-parent-s-preset-composition:
- en: ad623e2fef93c033
- zh: a37abf059f39aefa
-/agent-note-child-agents-join-their-parent-s-preset-composition/problem:
- en: 0b8d70c073523bc1
- zh: 6bba76a467508149
-/agent-note-child-agents-join-their-parent-s-preset-composition/decision:
- en: 13a3452527f35bc6
- zh: 6c319f554184e578
-/agent-note-child-agents-join-their-parent-s-preset-composition/alternatives-considered:
- en: 88a48e6bba3d30e2
- zh: 842d835a7a9db434
-/agent-note-child-agents-join-their-parent-s-preset-composition/testing:
- en: 458a2aa1ae046253
- zh: 59fad52e881989ed
-/agent-note-child-agents-join-their-parent-s-preset-composition/consequences:
- en: 09fd94b5ceaa95e6
- zh: bf8e4e22f5b70b45
diff --git a/.agents/notes/implemented/bug-fix/2026-08-17-durable-web-queue-recovery.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-08-17-durable-web-queue-recovery.i18n.yaml
deleted file mode 100644
index 63f61fbc54..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-08-17-durable-web-queue-recovery.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-17-durable-web-queue-recovery.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-08-17-durable-web-queue-recovery.md
-/agent-note-recover-the-web-queue-from-durable-inbox-state:
- en: df261933e13adb0a
- zh: 369772acd6fe0e48
-/agent-note-recover-the-web-queue-from-durable-inbox-state/problem:
- en: 79fe907a6201ed27
- zh: 55d0de6b6518f946
-/agent-note-recover-the-web-queue-from-durable-inbox-state/decision:
- en: 2e64d021a2009eec
- zh: b3f7d5ba2a6f6322
-/agent-note-recover-the-web-queue-from-durable-inbox-state/verification:
- en: bab880ec7de69673
- zh: 769f2641856fde60
-/agent-note-recover-the-web-queue-from-durable-inbox-state/alternatives-considered:
- en: df29962ab5d779ee
- zh: 2593f0973b725d54
-/agent-note-recover-the-web-queue-from-durable-inbox-state/consequences:
- en: ffa16214aa1f0efd
- zh: 7915524221acac0c
diff --git a/.agents/notes/implemented/bug-fix/2026-08-17-subagent-message-settlement-ordering.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-08-17-subagent-message-settlement-ordering.i18n.yaml
deleted file mode 100644
index fcd7dd96b2..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-08-17-subagent-message-settlement-ordering.i18n.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-17-subagent-message-settlement-ordering.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-08-17-subagent-message-settlement-ordering.md
-/agent-note-child-agent-messages-precede-their-settlement-notices:
- en: b46c628c107fbdfe
- zh: 829b71dae5e73e0f
-/agent-note-child-agent-messages-precede-their-settlement-notices/problem:
- en: 82e6c4d5db64a818
- zh: 3610573f1521409e
-/agent-note-child-agent-messages-precede-their-settlement-notices/decision:
- en: 94a44265545ff53e
- zh: 06db7c1bacb6b120
-/agent-note-child-agent-messages-precede-their-settlement-notices/decision/ordering-across-parent-states:
- en: 2bceedd85283e6ed
- zh: 6c11a3519fe9b941
-/agent-note-child-agent-messages-precede-their-settlement-notices/decision/verification:
- en: b2d6b562739ea61c
- zh: 33f56b3220b00953
-/agent-note-child-agent-messages-precede-their-settlement-notices/alternatives-considered:
- en: a81f4efd6c32125e
- zh: d38898c6b3352ad8
-/agent-note-child-agent-messages-precede-their-settlement-notices/consequences:
- en: 3b8532d48efb656a
- zh: 971bced6f6bed59d
diff --git a/.agents/notes/implemented/bug-fix/2026-08-24-alpha-routed-image-quality-ladders.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-08-24-alpha-routed-image-quality-ladders.i18n.yaml
deleted file mode 100644
index d82479170d..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-08-24-alpha-routed-image-quality-ladders.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-24-alpha-routed-image-quality-ladders.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-08-24-alpha-routed-image-quality-ladders.md
-/agent-note-alpha-routed-image-quality-ladders-replace-colour-count-codec-routing:
- en: b2c958d45911a787
- zh: b826c61174b3640f
-/agent-note-alpha-routed-image-quality-ladders-replace-colour-count-codec-routing/problem:
- en: bcb73f4711d40348
- zh: 6e26853ea4728e4d
-/agent-note-alpha-routed-image-quality-ladders-replace-colour-count-codec-routing/decision:
- en: aabf20046a7a15e9
- zh: dba0c5261a3af1e5
-/agent-note-alpha-routed-image-quality-ladders-replace-colour-count-codec-routing/alternatives-considered:
- en: 95a42e3e2313790b
- zh: 116043c295d7aa12
-/agent-note-alpha-routed-image-quality-ladders-replace-colour-count-codec-routing/consequences:
- en: 3ce6acd960671b52
- zh: 1ec81d76130d338d
diff --git a/.agents/notes/implemented/bug-fix/2026-08-31-win32-picker-path-string-read.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-08-31-win32-picker-path-string-read.i18n.yaml
deleted file mode 100644
index 3ffc1ac876..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-08-31-win32-picker-path-string-read.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-31-win32-picker-path-string-read.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-08-31-win32-picker-path-string-read.md
-/agent-note-read-the-win32-picker-path-without-a-fixed-size-unmanaged-view:
- en: abd03a3bff03600e
- zh: 8a4a21ecc7cae78b
-/agent-note-read-the-win32-picker-path-without-a-fixed-size-unmanaged-view/problem:
- en: 1835aa6f42229a1f
- zh: 928cb408e879fc41
-/agent-note-read-the-win32-picker-path-without-a-fixed-size-unmanaged-view/decision:
- en: 831ea941c84193ef
- zh: b7a1842d9843bf0d
-/agent-note-read-the-win32-picker-path-without-a-fixed-size-unmanaged-view/alternatives-considered:
- en: 8c0a9a1620504f50
- zh: 7f439ecb6ca5a618
-/agent-note-read-the-win32-picker-path-without-a-fixed-size-unmanaged-view/consequences:
- en: 616bc4293a0b1856
- zh: ed8cf574d7a126cc
diff --git a/.agents/notes/implemented/bug-fix/2026-09-03-normalized-unread-fs-tool-diagnostic.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-03-normalized-unread-fs-tool-diagnostic.i18n.yaml
deleted file mode 100644
index 40c0a993a5..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-03-normalized-unread-fs-tool-diagnostic.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-03-normalized-unread-fs-tool-diagnostic.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-03-normalized-unread-fs-tool-diagnostic.md
-/agent-note-normalized-unread-filesystem-tool-diagnostic:
- en: 103e786a598d2ee3
- zh: 13d637140685f63a
-/agent-note-normalized-unread-filesystem-tool-diagnostic/problem:
- en: 89cfcff2f9895623
- zh: dd1cd21d431e5161
-/agent-note-normalized-unread-filesystem-tool-diagnostic/decision:
- en: 0c59c5193131ca44
- zh: da48f204aef62c99
-/agent-note-normalized-unread-filesystem-tool-diagnostic/alternatives-considered:
- en: dbb9cbdafd0f2764
- zh: ed8bef943f12b21d
-/agent-note-normalized-unread-filesystem-tool-diagnostic/consequences:
- en: 20abbdbfa3aa4edc
- zh: d0555aac68cb7a1f
diff --git a/.agents/notes/implemented/bug-fix/2026-09-03-root-marker-metadata-failures.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-03-root-marker-metadata-failures.i18n.yaml
deleted file mode 100644
index 9789836b6d..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-03-root-marker-metadata-failures.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-03-root-marker-metadata-failures.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-03-root-marker-metadata-failures.md
-/agent-note-root-marker-metadata-failures:
- en: c351be96177b2ea5
- zh: a094d77aaffd1fbe
-/agent-note-root-marker-metadata-failures/problem:
- en: 3d88594600ede55b
- zh: fd9e36f5b72d8aee
-/agent-note-root-marker-metadata-failures/decision:
- en: 8131fbf06980774f
- zh: 21a3c48edbe9ab99
-/agent-note-root-marker-metadata-failures/alternatives-considered:
- en: 2070e244fd8ffc91
- zh: 31324cd0d5ace0a9
-/agent-note-root-marker-metadata-failures/consequences:
- en: a459fc1a7a8353a3
- zh: 144b373b0988b633
-/agent-note-root-marker-metadata-failures/verification:
- en: 4c912e5effdaedb7
- zh: 1b28ba3dea9170dd
diff --git a/.agents/notes/implemented/bug-fix/2026-09-03-user-owned-goal-pause-activation.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-03-user-owned-goal-pause-activation.i18n.yaml
deleted file mode 100644
index c75a62877c..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-03-user-owned-goal-pause-activation.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-03-user-owned-goal-pause-activation.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-03-user-owned-goal-pause-activation.md
-/agent-note-user-owned-goal-pause-exposes-live-activation:
- en: 07749eb6ac180964
- zh: b9c1165739fc45bf
-/agent-note-user-owned-goal-pause-exposes-live-activation/problem:
- en: 9f044f22e6782773
- zh: 6c17c53aa75280fd
-/agent-note-user-owned-goal-pause-exposes-live-activation/decision:
- en: 2cc4ab097350a88f
- zh: db10825a6285f3c5
-/agent-note-user-owned-goal-pause-exposes-live-activation/alternatives-considered:
- en: 640afdb17164b06b
- zh: 92d33c139c40b2a1
-/agent-note-user-owned-goal-pause-exposes-live-activation/consequences:
- en: d73e412f853612ee
- zh: 96630d28e3c431e1
-/agent-note-user-owned-goal-pause-exposes-live-activation/testing:
- en: 9d103a90036f5d06
- zh: df5440c8a4640e93
diff --git a/.agents/notes/implemented/bug-fix/2026-09-04-busy-send-button-follows-enter-setting.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-04-busy-send-button-follows-enter-setting.i18n.yaml
deleted file mode 100644
index 4248c352c7..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-04-busy-send-button-follows-enter-setting.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-04-busy-send-button-follows-enter-setting.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-04-busy-send-button-follows-enter-setting.md
-/agent-note-the-busy-send-button-follows-the-enter-setting:
- en: d0e9f804958ee8ce
- zh: e5cd102fbdd12ff1
-/agent-note-the-busy-send-button-follows-the-enter-setting/problem:
- en: c378dfa9efcc0758
- zh: 785c3b9ee99c66a4
-/agent-note-the-busy-send-button-follows-the-enter-setting/decision:
- en: 101e21100f8afd7d
- zh: 76979af8aee15976
-/agent-note-the-busy-send-button-follows-the-enter-setting/verification:
- en: eb886930b09445bd
- zh: 1e671f8f81868490
-/agent-note-the-busy-send-button-follows-the-enter-setting/alternatives-considered:
- en: d47aa278a2103890
- zh: 313f75c7fb8ccd5c
-/agent-note-the-busy-send-button-follows-the-enter-setting/consequences:
- en: a067e427615a682a
- zh: d72074056e1def4a
diff --git a/.agents/notes/implemented/bug-fix/2026-09-04-busy-send-button-follows-enter-setting.md b/.agents/notes/implemented/bug-fix/2026-09-04-busy-send-button-follows-enter-setting.md
deleted file mode 100644
index 2db0848e3c..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-04-busy-send-button-follows-enter-setting.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# Agent Note: The busy Send button follows the Enter setting
-
-Status: implemented
-
-English | [中文](2026-09-04-busy-send-button-follows-enter-setting.zh.md)
-
-## Problem
-
-The Web composer offers one user-facing choice for submitting while the agent is running: the `ui-conversation.busyEnter` setting selects Queue or Steer. [Running drafts take the primary Send action](../../archived/bug-fix/2026-08-20-running-draft-primary-send.md) (archived) gave a running draft a pointer Send button, deliberately kept it off the preference to avoid an invisible mode on a button labeled only Send, and routed every click through the public `InputActions.submit()` face, which `SessionInputShell.actions` fixes to `'queue'`. A user who chose Steer in Settings got Steer from Enter and Queue from the button beside the same draft, with the button labeled only "Send message". Nothing in the composer explained the divergence, and the Settings row's title and description named only the Enter key, so the setting looked broken rather than deliberately partial.
-
-## Decision
-
-The running Send button delivers through the same mode as plain Enter. `InputBar` computes `resolveSubmitMode(busyEnter, running, 'enter', steeringAvailable)` once per render, where `steeringAvailable` is the same ordinary-Session-or-continuable-child predicate the keyboard path uses, applies it to the primary click through `ComposerKeyboard.submit(mode)`, and applies it to the primary label exactly when the click would deliver a plain message: the composer is running and steer-capable, the button is enabled (no file upload still pending), and the draft is non-empty, unclaimed, and not a `/` line headed for command adjudication. That state shows `input.send.queue` ("Queue message" / "排队发送") or `input.send.steer` ("Steer message" / "插话发送") as both the tooltip and the accessible name; every other state in which the seat is a Send button — idle sessions, one-shot children, locked composers, a continuable child's empty draft, drafts with a pending upload, and command drafts whose click executes the command rather than delivering a message — keeps `input.send` ("Send message"); an ordinary running session with an empty or owner-blocked draft shows Stop in that seat instead. Cmd/Ctrl+Enter still resolves to the opposite mode, and the empty-draft accelerated gesture still steers the whole queue. The [continuable subagent interrupt note](../feature/2026-08-06-continuable-subagent-interrupt.md) describes the child's Send with this delivery.
-
-The composer bar's inject face carries the live preference instead of a resolver closure. `ComposerBarInjected.hooks.busyEnter` publishes `ComposerSubmissionPolicy.busyEnter`, so the bar receives a `useBusyEnter` selector hook and re-renders the label when the Settings row or a Host settings update changes the value. `resolveSubmitMode` is a pure exported function in `submission-policy.ts` taking the preference explicitly; the policy class keeps only the store and its Host adoption and write-through.
-
-The Settings row is retitled to cover both inputs: "Send behavior while busy" / "繁忙时的发送行为", described as what Enter and the Send button do while the agent is running, with the Cmd/Ctrl+Enter opposite-mode note retained. The `busyEnter` field name, its `queue` default, and the Host schema are unchanged, so existing `settings.yaml` documents keep their meaning.
-
-## Verification
-
-`input-bar.client.spec.tsx` asserts that a running draft's button is labeled by mode and submits with that mode under both preferences, that flipping the preference store re-labels the mounted button before the next click, that idle Send keeps the plain label and Queue delivery regardless of the preference, that a continuable subagent's Send follows the same mode and label as an ordinary Session while its empty-draft disabled button and a one-shot child keep plain Send, and that a `/` line, a claimed command, and a draft with a still-uploading file keep plain Send while running. `submission-policy.client.spec.ts` pins `resolveSubmitMode` for every preference, running, gesture, and steering-availability combination. `enter-behavior-row.client.spec.tsx` and the `settings-chrome` ARIA goldens carry the new Settings copy. The keyless `live-interactions` Web scenario waits for "Queue message" on the parked running draft and asserts that no "Send message" button exists at that moment, and its `running-draft.expected.md` golden records the new name.
-
-## Alternatives considered
-
-**Keep the button on Queue and only reword the Settings row.** This preserves the earlier decision but leaves the composer with two submission paths for one draft under one setting. A user who prefers Steer still cannot get it by pointer, and the reworded row would have to document a keyboard-only scope that no other composer control shares.
-
-**Add a second running button, one per mode.** Both delivery modes become reachable by pointer without a hidden state, but the ordinary session has one primary seat that already alternates between Stop and Send; a permanent second control spends space and introduces a hierarchy the draft itself does not need. The single setting already expresses the user's default, and Cmd/Ctrl+Enter remains the per-message override.
-
-**Thread the mode through `InputActions.submit(mode)`.** Widening the public provide-channel face would let any session-scope slot pick a delivery mode, which no other consumer needs, and would move a composer presentation decision into the machine's public contract. The package-private `ComposerKeyboard.submit(mode)` already exists for exactly this purpose, so the button uses it.
-
-**Keep `resolveSubmitMode` as a closure on the inject face and add a separate `busyEnter` hook only for the label.** Two sources for one fact invite drift between what the label says and what the click does. Publishing the preference once and resolving it in the bar keeps label and delivery derived from the same value in the same render.
-
-## Consequences
-
-The setting governs every busy-state submission a user can trigger with a message, and the button announces which delivery it performs, so choosing Steer no longer produces a Queue row from the button beside the draft. Users who relied on the button as an always-Queue escape while their setting selected Steer now use Cmd/Ctrl+Enter for that. The running Send label changes for every user, including under the default Queue preference, which the Web e2e scenarios that click Send during a running turn account for; idle-session flows and one-shot subagent composers see no change. The archived running-draft note's clause that the pointer action ignores the preference is reversed here; its primary-seat, owner-block, and subagent-control decisions stand as shipped and are described by the `ui-conversation` README.
diff --git a/.agents/notes/implemented/bug-fix/2026-09-04-busy-send-button-follows-enter-setting.zh.md b/.agents/notes/implemented/bug-fix/2026-09-04-busy-send-button-follows-enter-setting.zh.md
deleted file mode 100644
index 7062f60320..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-04-busy-send-button-follows-enter-setting.zh.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# Agent Note: 繁忙态 Send 按钮跟随 Enter 设置
-
-Status: implemented
-
-[English](2026-09-04-busy-send-button-follows-enter-setting.md) | 中文
-
-## 问题
-
-Web composer 为 agent（智能体）运行期间的提交只提供一个面向用户的选择：`ui-conversation.busyEnter` 设置在 Queue 与 Steer 之间选择。[运行中草稿取得主 Send 操作](../../archived/bug-fix/2026-08-20-running-draft-primary-send.md)（已归档）为运行中的草稿提供了指针 Send 按钮，有意让它不跟随该偏好，以避免一个只标注为 Send 的按钮携带不可见模式，并把每次点击都路由到公共的 `InputActions.submit()` 接口，而 `SessionInputShell.actions` 把该接口固定为 `'queue'`。用户在设置中选择 Steer 后，Enter 得到 Steer，同一草稿旁的按钮却得到 Queue，且按钮只标注为"发送消息"。composer 中没有任何内容解释这一分歧，设置行的标题和描述也只提到 Enter 键，因此该设置看起来像是失效，而不是有意只覆盖一部分。
-
-## 决策
-
-运行中的 Send 按钮按与 plain Enter 相同的模式投递。`InputBar` 每次渲染计算一次 `resolveSubmitMode(busyEnter, running, 'enter', steeringAvailable)`，其中 `steeringAvailable` 与键盘路径使用同一个"普通 Session 或可继续 child"判定；用它通过 `ComposerKeyboard.submit(mode)` 执行主按钮点击，并且仅在点击会投递一条普通消息时用它决定主按钮标签：composer 运行中且可 steering、按钮可用（没有仍在上传的文件）、草稿非空、未被认领且不是将进入命令 adjudication 的 `/` 行。该状态把 `input.send.queue`（"Queue message" / "排队发送"）或 `input.send.steer`（"Steer message" / "插话发送"）同时用作 tooltip 与可访问名称；该位置仍为 Send 按钮的其余所有状态——空闲会话、one-shot child、锁定的 composer、可继续 child 的空草稿、带待上传附件的草稿，以及点击会执行命令而非投递消息的命令草稿——保留 `input.send`（"Send message"）；普通运行中会话在空草稿或 owner block 时该位置显示的是 Stop。Cmd/Ctrl+Enter 仍解析为相反模式，空草稿下的加速手势仍对整个队列执行 steering（中途引导）。[可继续 subagent 中断 Agent Note](../feature/2026-08-06-continuable-subagent-interrupt.zh.md)以此投递方式描述 child 的 Send。
-
-composer bar 的 inject 接口携带实时偏好，而不是解析闭包。`ComposerBarInjected.hooks.busyEnter` 发布 `ComposerSubmissionPolicy.busyEnter`，因此 bar 获得 `useBusyEnter` 选择器 hook，并在设置行或 Host 设置更新改变该值时重新渲染标签。`resolveSubmitMode` 是 `submission-policy.ts` 中导出的纯函数，显式接收偏好值；policy 类只保留 store 及其 Host 采纳与写回。
-
-设置行重新命名以覆盖两种输入："Send behavior while busy" / "繁忙时的发送行为"，描述为 agent 运行时 Enter 与 Send 按钮的行为，并保留 Cmd/Ctrl+Enter 使用相反模式的说明。`busyEnter` 字段名、其 `queue` 默认值和 Host schema 均未改变，因此现有 `settings.yaml` 文档保持原有含义。
-
-## 验证
-
-`input-bar.client.spec.tsx` 断言运行中草稿的按钮在两种偏好下都按模式标注并以该模式提交，切换偏好 store 会在下一次点击前重新标注已挂载的按钮，空闲 Send 无论偏好如何都保留普通标签与 Queue 投递，可继续 subagent 的 Send 与普通 Session 遵循同一模式与标签，而其空草稿下的禁用按钮与 one-shot child 保留普通 Send，运行中的 `/` 行、已认领命令与带仍在上传文件的草稿也保留普通 Send。`submission-policy.client.spec.ts` 钉住 `resolveSubmitMode` 在偏好、运行状态、手势与 steering 可用性所有组合下的结果。`enter-behavior-row.client.spec.tsx` 与 `settings-chrome` ARIA golden 携带新的设置文案。无密钥的 `live-interactions` Web 场景在停住的运行中草稿上等待"Queue message"，并断言此刻不存在"Send message"按钮，其 `running-draft.expected.md` golden 记录了新名称。
-
-## 备选方案
-
-**保持按钮使用 Queue，只改写设置行文案。** 这保留了先前决策，但让同一设置下的同一草稿拥有两条提交路径。偏好 Steer 的用户仍无法通过指针得到它，而改写后的设置行必须记录一种其他 composer 控件都不具备的仅键盘生效范围。
-
-**增加第二个运行中按钮，每种模式一个。** 两种投递模式都可以通过指针到达且没有隐藏状态，但普通会话只有一个主操作位置，且已在 Stop 与 Send 之间交替；永久增加第二个控件会占用空间，并引入草稿本身不需要的层级。单一设置已经表达了用户默认值，Cmd/Ctrl+Enter 仍是逐条消息的覆盖手段。
-
-**通过 `InputActions.submit(mode)` 传递模式。** 拓宽公共 provide 通道接口会让任何 session 作用域的 slot 都能选择投递模式，而没有其他消费者需要它，并且会把 composer 的呈现决策推入机器的公共契约。包内私有的 `ComposerKeyboard.submit(mode)` 正是为此存在，因此按钮直接使用它。
-
-**在 inject 接口上保留 `resolveSubmitMode` 闭包，仅为标签另加一个 `busyEnter` hook。** 同一事实有两个来源，会让标签所说与点击所做之间产生偏差。只发布一次偏好并在 bar 中解析，可以让标签与投递在同一次渲染中源自同一个值。
-
-## 影响
-
-该设置约束用户能以消息触发的每一种繁忙态提交，且按钮会声明它执行哪种投递，因此选择 Steer 后不再会从草稿旁的按钮产生 Queue 行。此前在设置为 Steer 时依赖按钮作为始终 Queue 逃生口的用户，现在改用 Cmd/Ctrl+Enter。运行中的 Send 标签对每位用户都会变化，包括默认的 Queue 偏好下，运行中点击 Send 的 Web e2e 场景已相应处理；空闲会话流程和 one-shot subagent composer 没有变化。已归档的运行中草稿 Agent Note 中"指针操作忽略偏好"的条款在此被反转；其主操作位置、owner block 与 subagent 控件决策按已交付状态继续有效，并由 `ui-conversation` README 描述。
diff --git a/.agents/notes/implemented/bug-fix/2026-09-05-continuous-client-recovery.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-05-continuous-client-recovery.i18n.yaml
deleted file mode 100644
index f08907aa62..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-05-continuous-client-recovery.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-05-continuous-client-recovery.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-05-continuous-client-recovery.md
-/agent-note-continuous-client-connection-recovery:
- en: f0fee6b344250d4c
- zh: 713ea72ca8d6565a
-/agent-note-continuous-client-connection-recovery/problem:
- en: 70259bdedbf6b449
- zh: b0a3014c27483a09
-/agent-note-continuous-client-connection-recovery/decision:
- en: db9ac3c08a3eaf0b
- zh: 68c9ce30d8d5c7e2
-/agent-note-continuous-client-connection-recovery/alternatives-considered:
- en: 2e94feca66d912af
- zh: 8fc4e81b797d4553
-/agent-note-continuous-client-connection-recovery/consequences:
- en: cd99c771043a23d5
- zh: 8559757fa8098fbe
-/agent-note-continuous-client-connection-recovery/testing:
- en: 39fdcfb5c6b52a96
- zh: 276de310ed1bbc39
diff --git a/.agents/notes/implemented/bug-fix/2026-09-05-nested-terminal-cards.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-05-nested-terminal-cards.i18n.yaml
deleted file mode 100644
index e0fdd0b674..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-05-nested-terminal-cards.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-05-nested-terminal-cards.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-05-nested-terminal-cards.md
-/agent-note-nested-terminal-cards:
- en: acc1dadeee5e1aeb
- zh: a589c28cf1aff307
-/agent-note-nested-terminal-cards/problem:
- en: 1bd9adbd90b66871
- zh: 0a87672dffc07bae
-/agent-note-nested-terminal-cards/decision:
- en: 075b10a41974411e
- zh: cc3341afff14f61b
-/agent-note-nested-terminal-cards/alternatives-considered:
- en: c585eb14efb10514
- zh: c5a1cc87fc4edacc
-/agent-note-nested-terminal-cards/consequences:
- en: a7abcb5b95a020cc
- zh: 27fe3216944de8c3
-/agent-note-nested-terminal-cards/verification:
- en: 0133972e958fccce
- zh: 52d4d3e29b7346e0
diff --git a/.agents/notes/implemented/bug-fix/2026-09-05-patch-plugin-file-urls.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-05-patch-plugin-file-urls.i18n.yaml
deleted file mode 100644
index 3bcf021adf..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-05-patch-plugin-file-urls.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-05-patch-plugin-file-urls.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-05-patch-plugin-file-urls.md
-/agent-note-file-urls-for-inserted-patch-plugins:
- en: 0da1360de4441566
- zh: aa617df23150096d
-/agent-note-file-urls-for-inserted-patch-plugins/problem:
- en: 68de71db96c5e4b5
- zh: c88db125cddb54a4
-/agent-note-file-urls-for-inserted-patch-plugins/decision:
- en: 09bb824857b8fb60
- zh: 859da30ff296688c
-/agent-note-file-urls-for-inserted-patch-plugins/alternatives-considered:
- en: e53a86bc1c71a6ff
- zh: 514b48c8734fca17
-/agent-note-file-urls-for-inserted-patch-plugins/consequences:
- en: 9b9628919e52c617
- zh: 195935e5d905d81d
diff --git a/.agents/notes/implemented/bug-fix/2026-09-05-pi-ai-upgrade-compatibility.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-05-pi-ai-upgrade-compatibility.i18n.yaml
deleted file mode 100644
index 88960b1f51..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-05-pi-ai-upgrade-compatibility.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-05-pi-ai-upgrade-compatibility.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-05-pi-ai-upgrade-compatibility.md
-/agent-note-pi-ai-upgrade-compatibility:
- en: faa0207498bd36c7
- zh: 2c6c209849dcce32
-/agent-note-pi-ai-upgrade-compatibility/problem:
- en: 0a106a9d74115ce5
- zh: a65945e32455944e
-/agent-note-pi-ai-upgrade-compatibility/decision:
- en: 978b93bba58cfaf9
- zh: 847360ba75d67abc
-/agent-note-pi-ai-upgrade-compatibility/alternatives-considered:
- en: bcfd595bb17c3cd6
- zh: b7d4346e9c50f95d
-/agent-note-pi-ai-upgrade-compatibility/consequences:
- en: 0b634c9d7567aa57
- zh: c8ae82694e5fae12
diff --git a/.agents/notes/implemented/bug-fix/2026-09-05-session-reference-model-budget.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-05-session-reference-model-budget.i18n.yaml
deleted file mode 100644
index 57f613df55..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-05-session-reference-model-budget.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-05-session-reference-model-budget.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-05-session-reference-model-budget.md
-/agent-note-model-relative-session-reference-budgets:
- en: 6d4d5e9c678c93cb
- zh: 7023bca0480a27df
-/agent-note-model-relative-session-reference-budgets/problem:
- en: 2bc7bc4083a96c5d
- zh: d0d290871def4abf
-/agent-note-model-relative-session-reference-budgets/decision:
- en: e686c4ed659fc44c
- zh: 41484c0431a53177
-/agent-note-model-relative-session-reference-budgets/alternatives-considered:
- en: 77148c41d109895a
- zh: dba534347f0e0877
-/agent-note-model-relative-session-reference-budgets/consequences:
- en: 6ee6a4b3229ff378
- zh: 9e30e71ac15da8c4
diff --git a/.agents/notes/implemented/bug-fix/2026-09-05-session-reference-spill-reuse.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-05-session-reference-spill-reuse.i18n.yaml
deleted file mode 100644
index 05f653cf57..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-05-session-reference-spill-reuse.i18n.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-05-session-reference-spill-reuse.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-05-session-reference-spill-reuse.md
-/agent-note-reuse-spill-storage-for-truncated-session-references:
- en: 9691f4ba51c41f8b
- zh: 5c1719f1ef901639
-/agent-note-reuse-spill-storage-for-truncated-session-references/problem:
- en: 50a1ef10604acb5f
- zh: 128abfd3e43740dc
-/agent-note-reuse-spill-storage-for-truncated-session-references/decision:
- en: 058598a9e6c65fcf
- zh: 7760170bbc53396d
-/agent-note-reuse-spill-storage-for-truncated-session-references/alternatives-considered:
- en: fccf1c25876b92a0
- zh: 7d5c7c3d240132c3
-/agent-note-reuse-spill-storage-for-truncated-session-references/consequences:
- en: 2bff957549afe59b
- zh: 30c6be54168fe183
-/agent-note-reuse-spill-storage-for-truncated-session-references/verification:
- en: e015a599fc71a65f
- zh: 0812b5b9a64a8673
-/agent-note-reuse-spill-storage-for-truncated-session-references/related-decisions:
- en: 7a53914026e82df7
- zh: 3c802bbf63117485
diff --git a/.agents/notes/implemented/bug-fix/2026-09-06-environment-prompt-suffix.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-06-environment-prompt-suffix.i18n.yaml
deleted file mode 100644
index 1e5d9065c2..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-06-environment-prompt-suffix.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-06-environment-prompt-suffix.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-06-environment-prompt-suffix.md
-/agent-note-environment-facts-follow-reusable-prompt-instructions:
- en: 8677e5d20233627f
- zh: 684772490164fbdf
-/agent-note-environment-facts-follow-reusable-prompt-instructions/problem:
- en: 7b20207cd4dc1583
- zh: ca5014aa437a5239
-/agent-note-environment-facts-follow-reusable-prompt-instructions/decision:
- en: 0f28a61d659c0f4d
- zh: d2ef431d15a54d57
-/agent-note-environment-facts-follow-reusable-prompt-instructions/alternatives-considered:
- en: 9fb4ff8a8786ce2d
- zh: 25820720365b489f
-/agent-note-environment-facts-follow-reusable-prompt-instructions/consequences:
- en: 212b29160c254854
- zh: e6a1ea253e8f7780
-/agent-note-environment-facts-follow-reusable-prompt-instructions/testing:
- en: d5132186efc6afcd
- zh: e5cc036c7c8ed68e
diff --git a/.agents/notes/implemented/bug-fix/2026-09-06-packed-install-private-npm-cache.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-06-packed-install-private-npm-cache.i18n.yaml
new file mode 100644
index 0000000000..0b35f92fb4
--- /dev/null
+++ b/.agents/notes/implemented/bug-fix/2026-09-06-packed-install-private-npm-cache.i18n.yaml
@@ -0,0 +1,22 @@
+# Bilingual-pair consistency record for 2026-09-06-packed-install-private-npm-cache.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-06-packed-install-private-npm-cache.md
+/agent-note-packed-install-verification-owns-its-npm-cache:
+ en: 54d54ee850476cb9
+ zh: 8d666e40eb2372f0
+/agent-note-packed-install-verification-owns-its-npm-cache/problem:
+ en: 5cd500387242a7cc
+ zh: 75de2c0049631634
+/agent-note-packed-install-verification-owns-its-npm-cache/decision:
+ en: 8a9ead906e1148d6
+ zh: 6a5b911fc5849be2
+/agent-note-packed-install-verification-owns-its-npm-cache/alternatives-considered:
+ en: b2637475da22cec0
+ zh: 5c0e3979caf44461
+/agent-note-packed-install-verification-owns-its-npm-cache/consequences:
+ en: a123744738fac02f
+ zh: 54bda8e161cb6e85
+/agent-note-packed-install-verification-owns-its-npm-cache/verification:
+ en: e37107020148c23e
+ zh: 94227a591fad9f17
diff --git a/.agents/notes/implemented/bug-fix/2026-09-06-packed-install-private-npm-cache.md b/.agents/notes/implemented/bug-fix/2026-09-06-packed-install-private-npm-cache.md
new file mode 100644
index 0000000000..ce25230c8f
--- /dev/null
+++ b/.agents/notes/implemented/bug-fix/2026-09-06-packed-install-private-npm-cache.md
@@ -0,0 +1,29 @@
+# Agent Note: Packed-install verification owns its npm cache
+
+Status: implemented
+
+English | [中文](2026-09-06-packed-install-private-npm-cache.zh.md)
+
+## Problem
+
+The [packed-install verifier](../../../../scripts/release/verify-packed-install.ts) removes its temporary consumer but an npm install using the ambient cache leaves tarball content and logs outside that cleanup. Repeated release rehearsals can therefore grow the shared runner user cache even when every consumer is removed. A full root filesystem can fail unrelated CI jobs.
+
+## Decision
+
+The verifier passes `--cache /.npm-cache` only to its npm install invocation. The explicit argument overrides npm environment and user-configuration cache settings without changing the environment of the installed executable. The existing `finally` removes this cache together with the consumer after success, an install failure, or an executable failure.
+
+The [release sequence decision](../process/2026-08-10-npm-release-sequences.md) still owns artifact selection and publication. This decision only adds cache ownership to the verifier; it does not change other npm consumers.
+
+## Alternatives considered
+
+- **Delete the shared user cache:** unrelated jobs also own its contents. The verifier must not delete shared host state.
+- **Change global `TMPDIR` or npm configuration:** that affects processes outside this invocation and is unnecessary when the consumer already has an owned temporary directory.
+- **Keep a persistent verifier cache:** that retains cross-run downloads but requires a separate retention policy. Invocation ownership accepts repeated downloads instead.
+
+## Consequences
+
+This prevents this verifier from adding content to the ambient npm cache; it neither reclaims existing host cache contents nor guarantees that disk exhaustion from other producers stops. External dependencies can require fresh downloads on each invocation. A forced termination that prevents `finally` from running can leave the consumer and its cache behind; this change adds no crash-recovery cleanup.
+
+## Verification
+
+[The focused regression](../../../../scripts/release/verify-packed-install.spec.ts) runs the real verifier and npm offline against a tiny local tarball. A lifecycle script records actual private `_cacache` files before cleanup. The tests verify consumer removal after success, npm install failure, and installed-entry failure, while inherited environment and user-config cache canaries remain unchanged. Removing the cache argument makes the private-cache assertion fail. The executable test follows the POSIX release runner path; it does not exercise Windows command-shim resolution.
diff --git a/.agents/notes/implemented/bug-fix/2026-09-06-packed-install-private-npm-cache.zh.md b/.agents/notes/implemented/bug-fix/2026-09-06-packed-install-private-npm-cache.zh.md
new file mode 100644
index 0000000000..7e495439e4
--- /dev/null
+++ b/.agents/notes/implemented/bug-fix/2026-09-06-packed-install-private-npm-cache.zh.md
@@ -0,0 +1,29 @@
+# Agent Note: 打包安装验证拥有独立 npm 缓存
+
+Status: implemented
+
+[English](2026-09-06-packed-install-private-npm-cache.md) | 中文
+
+## 问题
+
+[打包安装验证器](../../../../scripts/release/verify-packed-install.ts) 会删除临时消费目录，但使用环境配置缓存的 npm install 会把 tarball 内容和日志留在清理范围之外。因此，即使每个消费目录均被删除，重复的发布演练仍可能扩大共享 runner 用户缓存。根文件系统满载会使无关 CI 作业失败。
+
+## 决策
+
+验证器仅向自己的 npm install 调用传入 `--cache /.npm-cache`。显式参数覆盖 npm 环境变量和用户配置中的缓存设置，不改变已安装可执行文件的环境。现有 `finally` 在成功、安装失败或可执行文件失败后将此缓存与消费目录一起删除。
+
+[发布序列决策](../process/2026-08-10-npm-release-sequences.zh.md) 仍负责产物选择与发布。本决策仅为验证器增加缓存所有权，不改变其他 npm 消费方。
+
+## 曾考虑的替代方案
+
+- **删除共享用户缓存：**其他作业也拥有其中的内容。验证器不得删除共享宿主状态。
+- **修改全局 `TMPDIR` 或 npm 配置：**这会影响本次调用之外的进程，而消费目录已有独立临时目录，因此没有必要。
+- **保留持久化验证缓存：**这能跨运行复用下载，但需要独立保留策略。调用级所有权选择接受重复下载。
+
+## 后果
+
+这会阻止该验证器向环境配置的 npm 缓存添加内容；既不会回收现有宿主缓存，也不保证其他来源导致的磁盘耗尽停止。外部依赖可能需要在每次调用时重新下载。若强制终止使 `finally` 无法运行，消费目录及其缓存仍可能残留；本改动不增加崩溃恢复清理。
+
+## 验证
+
+[定向回归测试](../../../../scripts/release/verify-packed-install.spec.ts) 使用微型本地 tarball 离线运行真实验证器和 npm。生命周期脚本在清理前记录私有 `_cacache` 中的实际文件。测试验证成功、npm 安装失败和已安装入口失败后消费目录均被删除，同时继承环境和用户配置指定缓存中的探针文件保持不变。移除缓存参数会使私有缓存断言失败。可执行测试沿用 POSIX 发布 runner 路径，不覆盖 Windows 命令垫片解析。
diff --git a/.agents/notes/implemented/bug-fix/2026-09-06-windows-python-console-spawn-wait.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-06-windows-python-console-spawn-wait.i18n.yaml
deleted file mode 100644
index be90b83299..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-06-windows-python-console-spawn-wait.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-06-windows-python-console-spawn-wait.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-06-windows-python-console-spawn-wait.md
-/agent-note-wait-for-the-windows-python-console-runtime:
- en: 97ffbd17152279cc
- zh: 9a223670f273471b
-/agent-note-wait-for-the-windows-python-console-runtime/problem:
- en: 26ea75714d6fbbea
- zh: 49441436e362a868
-/agent-note-wait-for-the-windows-python-console-runtime/decision:
- en: 6ef15038eb5e0786
- zh: 92e319fbb8133d52
-/agent-note-wait-for-the-windows-python-console-runtime/alternatives-considered:
- en: 2cc100a4b8724d40
- zh: 6ba47c76f304a460
-/agent-note-wait-for-the-windows-python-console-runtime/consequences:
- en: ec5c2a7082012ed5
- zh: 32027ea20bd32acf
diff --git a/.agents/notes/implemented/bug-fix/2026-09-07-pi-ai-settings-catalog-recovery.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-07-pi-ai-settings-catalog-recovery.i18n.yaml
deleted file mode 100644
index 130a3812c0..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-07-pi-ai-settings-catalog-recovery.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-07-pi-ai-settings-catalog-recovery.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-07-pi-ai-settings-catalog-recovery.md
-/agent-note-repairable-pi-ai-settings-after-catalog-changes:
- en: 69bf6edd0515636c
- zh: cb5039a98dc8b736
-/agent-note-repairable-pi-ai-settings-after-catalog-changes/problem:
- en: acc6a5afd829fde0
- zh: a2173b59b670efe2
-/agent-note-repairable-pi-ai-settings-after-catalog-changes/decision:
- en: 37034d76d7542f46
- zh: a6423ba488fe272c
-/agent-note-repairable-pi-ai-settings-after-catalog-changes/alternatives-considered:
- en: 1dcabe193953fa1b
- zh: 02263349cdbdc843
-/agent-note-repairable-pi-ai-settings-after-catalog-changes/consequences:
- en: d2f89ce8cec55c6e
- zh: 20fab7854366ae05
-/agent-note-repairable-pi-ai-settings-after-catalog-changes/testing:
- en: 30c8172b88231251
- zh: 54aee9d1dffa8566
diff --git a/.agents/notes/implemented/bug-fix/2026-09-07-typert-package-local-forwarding-imports.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-07-typert-package-local-forwarding-imports.i18n.yaml
deleted file mode 100644
index 53a10eeede..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-07-typert-package-local-forwarding-imports.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-07-typert-package-local-forwarding-imports.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-07-typert-package-local-forwarding-imports.md
-/agent-note-follow-package-local-forwarding-modules-in-typert-references:
- en: ebacf2fc1c764589
- zh: c14b1752a01b2775
-/agent-note-follow-package-local-forwarding-modules-in-typert-references/problem:
- en: 0ed0703cdd876132
- zh: ab759d1a2137bdd8
-/agent-note-follow-package-local-forwarding-modules-in-typert-references/decision:
- en: e828847b069ef3f8
- zh: 95e9425c02dd8215
-/agent-note-follow-package-local-forwarding-modules-in-typert-references/alternatives-considered:
- en: 49a0984c31c2b993
- zh: fb6d093474130a75
-/agent-note-follow-package-local-forwarding-modules-in-typert-references/consequences:
- en: 7e196e1cffcb31e1
- zh: 7d096507578c1731
diff --git a/.agents/notes/implemented/bug-fix/2026-09-07-win32-picker-foreground-alt-key.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-07-win32-picker-foreground-alt-key.i18n.yaml
deleted file mode 100644
index 6088c5898e..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-07-win32-picker-foreground-alt-key.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-07-win32-picker-foreground-alt-key.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-07-win32-picker-foreground-alt-key.md
-/agent-note-foreground-activation-for-the-win32-picker-via-a-synthesized-alt-press:
- en: bbd08341a635d6a8
- zh: 94d4ea2412237630
-/agent-note-foreground-activation-for-the-win32-picker-via-a-synthesized-alt-press/problem:
- en: b21a34182868057e
- zh: 54cb143a2a11479b
-/agent-note-foreground-activation-for-the-win32-picker-via-a-synthesized-alt-press/decision:
- en: d4cff7cc9b5c9379
- zh: a8f3e238799a18ce
-/agent-note-foreground-activation-for-the-win32-picker-via-a-synthesized-alt-press/alternatives-considered:
- en: dd3491b3b760f330
- zh: 81ca7b6603379713
-/agent-note-foreground-activation-for-the-win32-picker-via-a-synthesized-alt-press/consequences:
- en: 6e7c7c46cc48a95d
- zh: bbed46fb61e53700
diff --git a/.agents/notes/implemented/bug-fix/2026-09-10-built-bundle-css-exemption.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-10-built-bundle-css-exemption.i18n.yaml
deleted file mode 100644
index 7fc8e02b71..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-10-built-bundle-css-exemption.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-10-built-bundle-css-exemption.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-10-built-bundle-css-exemption.md
-/agent-note-built-bundle-exemption-for-a-failing-stylesheet:
- en: 7eea80c07cea261d
- zh: 936523023c0b527d
-/agent-note-built-bundle-exemption-for-a-failing-stylesheet/problem:
- en: ca5c97dd0ad51b66
- zh: 8491ee495b0c625e
-/agent-note-built-bundle-exemption-for-a-failing-stylesheet/decision:
- en: cd272aa1bfd34a14
- zh: d184be63053f73b8
-/agent-note-built-bundle-exemption-for-a-failing-stylesheet/alternatives-considered:
- en: 7f0eb995b7f00d73
- zh: aaf7b18f7bb2c20d
-/agent-note-built-bundle-exemption-for-a-failing-stylesheet/consequences:
- en: 767857f0bbd93ca8
- zh: f49bf34e304a7dee
diff --git a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.i18n.yaml
deleted file mode 100644
index f98968b567..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-10-deepseek-image-token-calculator-v41.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.md
-/agent-note-deepseek-image-token-estimator-on-the-v41-calculator:
- en: 3e0b96f522d5e2c9
- zh: a05009e8f9cbe5d4
-/agent-note-deepseek-image-token-estimator-on-the-v41-calculator/problem:
- en: c47a183a3192d1ae
- zh: bbc157ff44423dd3
-/agent-note-deepseek-image-token-estimator-on-the-v41-calculator/decision:
- en: 17f8c045d3222266
- zh: aead3e0de01980d9
-/agent-note-deepseek-image-token-estimator-on-the-v41-calculator/alternatives-considered:
- en: 8f5bb52220ead193
- zh: f267fda075b19963
-/agent-note-deepseek-image-token-estimator-on-the-v41-calculator/consequences:
- en: 0a41bb795e221c3f
- zh: b4840b79c78691cf
diff --git a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.i18n.yaml
deleted file mode 100644
index eb27fa1ee7..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-10-deepseek-v41-request-image-projection.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.md
-/agent-note-deepseek-request-images-on-the-published-token-grid:
- en: 67401dae42c79c06
- zh: 19ab8d82fec9ec25
-/agent-note-deepseek-request-images-on-the-published-token-grid/problem:
- en: 3c86cfcbd6895dc5
- zh: 68cb8bd4c1ef2d24
-/agent-note-deepseek-request-images-on-the-published-token-grid/decision:
- en: 0c1257b4fd77d7ad
- zh: b1134f24c8f58ded
-/agent-note-deepseek-request-images-on-the-published-token-grid/alternatives-considered:
- en: c5d3470b62129fde
- zh: 26c9abf1e4a4f49f
-/agent-note-deepseek-request-images-on-the-published-token-grid/consequences:
- en: 95bc8d0d09928dee
- zh: 090292fa154e854f
diff --git a/.agents/notes/implemented/bug-fix/2026-09-11-incremental-terminal-retention.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-11-incremental-terminal-retention.i18n.yaml
deleted file mode 100644
index aa5f93f3c7..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-11-incremental-terminal-retention.i18n.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-11-incremental-terminal-retention.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-11-incremental-terminal-retention.md
-/agent-note-incremental-terminal-retention:
- en: b00300b3ace789da
- zh: c267be719b3c8814
-/agent-note-incremental-terminal-retention/problem:
- en: 0c3232a4a2429315
- zh: c6b3c6224bc9031d
-/agent-note-incremental-terminal-retention/decision:
- en: 43bb3c2d0d561231
- zh: 8dacb0720f28d490
-/agent-note-incremental-terminal-retention/measurement-design:
- en: 925815f8ae326179
- zh: 188ee3f695ece8de
-/agent-note-incremental-terminal-retention/measurement-design/local-reference-measurements:
- en: a049c0a118648de7
- zh: 2c31044ff11b9029
-/agent-note-incremental-terminal-retention/alternatives-considered:
- en: 0af1fcbc28320b5b
- zh: 8e1cfc843821dd77
-/agent-note-incremental-terminal-retention/consequences:
- en: c60008ba652dffd2
- zh: 3210329182096f39
diff --git a/.agents/notes/implemented/bug-fix/2026-09-12-linux-scope-direct-kill-settlement.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-12-linux-scope-direct-kill-settlement.i18n.yaml
deleted file mode 100644
index 192ea7ceec..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-12-linux-scope-direct-kill-settlement.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-12-linux-scope-direct-kill-settlement.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-12-linux-scope-direct-kill-settlement.md
-/agent-note-join-direct-termination-before-rejecting-linux-scope-cleanup:
- en: 6a72b66b6d0cf21b
- zh: be432bfebb8e9919
-/agent-note-join-direct-termination-before-rejecting-linux-scope-cleanup/problem:
- en: be042a28c1154171
- zh: 7b8356c9dcb159be
-/agent-note-join-direct-termination-before-rejecting-linux-scope-cleanup/decision:
- en: 75b071e48715ff29
- zh: 3f1d710f54ed3b1b
-/agent-note-join-direct-termination-before-rejecting-linux-scope-cleanup/alternatives-considered:
- en: ea3f33dd6c9bab88
- zh: 6f274fcd86b231a7
-/agent-note-join-direct-termination-before-rejecting-linux-scope-cleanup/consequences:
- en: 4f7e7535b49b22fe
- zh: 10447b3c42a341a2
diff --git a/.agents/notes/implemented/bug-fix/2026-09-13-partitioned-coverage-location-canonicalization.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-13-partitioned-coverage-location-canonicalization.i18n.yaml
deleted file mode 100644
index baae5ed39f..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-13-partitioned-coverage-location-canonicalization.i18n.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-13-partitioned-coverage-location-canonicalization.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-13-partitioned-coverage-location-canonicalization.md
-/agent-note-canonicalize-partition-coverage-locations-before-the-blob-merge:
- en: 9346bcf9fc59bea8
- zh: 170ebd969ac038bd
-/agent-note-canonicalize-partition-coverage-locations-before-the-blob-merge/problem:
- en: c2f8792fb6ec46d1
- zh: cc01e2e2ff14f367
-/agent-note-canonicalize-partition-coverage-locations-before-the-blob-merge/decision:
- en: 07f37eb8430ef8ee
- zh: bc2910040b90291c
-/agent-note-canonicalize-partition-coverage-locations-before-the-blob-merge/divergent-statement-maps-across-vite-environments:
- en: 4f6d088fd7e272fc
- zh: d44463ee8485b060
-/agent-note-canonicalize-partition-coverage-locations-before-the-blob-merge/testing:
- en: 59a8515f97eb4c63
- zh: 86d655d454da2c63
-/agent-note-canonicalize-partition-coverage-locations-before-the-blob-merge/alternatives-considered:
- en: 8c7efd287cf0e56b
- zh: 2ed0477918e10f4e
-/agent-note-canonicalize-partition-coverage-locations-before-the-blob-merge/consequences:
- en: c7a2e99922697cb6
- zh: 0c98a57b00263bf8
diff --git a/.agents/notes/implemented/bug-fix/2026-09-14-chat-presentation-defaults.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-14-chat-presentation-defaults.i18n.yaml
deleted file mode 100644
index e671a8aa27..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-14-chat-presentation-defaults.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-14-chat-presentation-defaults.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-14-chat-presentation-defaults.md
-/agent-note-keep-chat-presentation-independent-of-trajectory-inspection:
- en: 72d5bc0911e0bc3f
- zh: 1fc58f89bdc53b56
-/agent-note-keep-chat-presentation-independent-of-trajectory-inspection/problem:
- en: 2102a58c1baafe54
- zh: 939872d86e013f94
-/agent-note-keep-chat-presentation-independent-of-trajectory-inspection/decision:
- en: f77e394352fe8d8e
- zh: 7c4c9b066874dc9b
-/agent-note-keep-chat-presentation-independent-of-trajectory-inspection/alternatives-considered:
- en: f4c1b9c9998e3355
- zh: f684e39ffabce5e6
-/agent-note-keep-chat-presentation-independent-of-trajectory-inspection/consequences:
- en: bb15d68e46b10b8e
- zh: 8506ab5775d04fe8
diff --git a/.agents/notes/implemented/bug-fix/2026-09-14-chat-presentation-defaults.md b/.agents/notes/implemented/bug-fix/2026-09-14-chat-presentation-defaults.md
deleted file mode 100644
index 6703a14e2a..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-14-chat-presentation-defaults.md
+++ /dev/null
@@ -1,25 +0,0 @@
-# Agent Note: Keep Chat presentation independent of Trajectory inspection
-
-Status: implemented
-
-English | [中文](2026-09-14-chat-presentation-defaults.zh.md)
-
-## Problem
-
-Trajectory inspection benefits from exposing complete recorded reasoning. Applying that default to Chat expands the live transcript during reasoning and changes its height when an answer or Tool call arrives. The Trajectory inspection change also added historical first-token recovery to Chat without a separate Chat behavior decision.
-
-## Decision
-
-[Chat](../../../../packages/client/ui-chat/README.md#turn-process-folding) starts each reasoning row collapsed and retains the reader's manual disclosure choice through subsequent output and settlement. Settlement retires the observed live chunks and rebuilds Chat reply nodes from durable events without recovering first-token time from embedded streams. Consequently, completed-turn TTFT and decoding speed are absent after live settlement as well as after reopening history. Turn-level process folding remains independently owned.
-
-[Trajectory inspection](../feature/2026-09-09-ptc-trajectory-code-inspection.md) keeps its expanded reasoning default, recorded timing, JSON controls, and PTC code inspector. The [compact stream readers](../architecture/2026-09-06-embedded-stream-record-readers.md) remain available to Trajectory and other consumers. These decisions partially supersede the Chat presentation additions while preserving both notes' independent rationale.
-
-## Alternatives considered
-
-**Keep Chat's automatic expansion and historical timing recovery.** These change Chat behavior beyond the requested Trajectory inspection work. Reintroducing either requires a separate Chat product decision and its own verification.
-
-**Revert the entire inspection change.** That would remove the requested Trajectory behavior along with the unintended Chat changes.
-
-## Consequences
-
-Chat reasoning requires a click to inspect in full. Elapsed turn time and the independently projected Session Stats remain available. Assembler tests distinguish transient retirement at live settlement from reopening durable history; browser replay verifies the completed-turn timing dialog before and after reload. Component tests cover collapsed streaming and reasoning-only replies and manual disclosure across answer and Tool-call arrival. Trajectory tests retain its separate defaults and timing.
diff --git a/.agents/notes/implemented/bug-fix/2026-09-14-chat-presentation-defaults.zh.md b/.agents/notes/implemented/bug-fix/2026-09-14-chat-presentation-defaults.zh.md
deleted file mode 100644
index 67ca433339..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-14-chat-presentation-defaults.zh.md
+++ /dev/null
@@ -1,25 +0,0 @@
-# Agent Note: 保持 Chat 展示与 Trajectory 查看独立
-
-Status: implemented
-
-[English](2026-09-14-chat-presentation-defaults.md) | 中文
-
-## 问题
-
-Trajectory 查看适合直接展示完整的已记录思考。将该默认行为应用到 Chat 会在思考期间展开实时对话，并在回答或工具调用到来时改变其高度。Trajectory 查看改动还为 Chat 增加了历史首 token 计时恢复，却没有独立的 Chat 行为决策。
-
-## 决策
-
-[Chat](../../../../packages/client/ui-chat/README.zh.md#turn-process-folding) 的每个思考行初始都折叠，后续输出和结算保留用户手动选择的展开状态。结算会移除观测到的实时 chunk，并从持久事件重建 Chat 回复节点，不从内嵌流恢复首 token 时间。因此，实时结算后和重新打开历史后，已完成轮次都不显示 TTFT 和解码速度。轮次级过程折叠仍独立维护。
-
-[Trajectory 查看](../feature/2026-09-09-ptc-trajectory-code-inspection.zh.md) 保留思考默认展开、已记录计时、JSON 控件和 PTC 代码查看器。[紧凑流读取器](../architecture/2026-09-06-embedded-stream-record-readers.zh.md) 仍供 Trajectory 和其他消费方使用。这些决策部分取代了 Chat 展示增量，同时保留两份记录各自独立的理由。
-
-## 考虑过的替代方案
-
-**保留 Chat 自动展开和历史计时恢复。** 这些改变了所请求的 Trajectory 查看工作之外的 Chat 行为。重新引入任一行为都需要独立的 Chat 产品决策及相应验证。
-
-**撤回整个查看改动。** 这会在撤回意外 Chat 改动的同时移除所请求的 Trajectory 行为。
-
-## 影响
-
-Chat 思考需要点击才能查看全文。轮次总耗时和独立投影的 Session Stats 仍可用。组装器测试区分实时结算时移除临时数据与重新打开持久历史；浏览器回放验证重载前后的已完成轮次计时对话框。组件测试覆盖流式与仅思考回复的默认折叠，以及回答和工具调用到来时的手动展开状态。Trajectory 测试保留其独立默认值和计时。
diff --git a/.agents/notes/implemented/bug-fix/2026-09-14-web-diff-context.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-14-web-diff-context.i18n.yaml
deleted file mode 100644
index 8a44818fd8..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-14-web-diff-context.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-14-web-diff-context.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-14-web-diff-context.md
-/agent-note-web-diff-cards-compare-contextual-content:
- en: 2dc5ae1577ba6173
- zh: 0b580f4e70eddc72
-/agent-note-web-diff-cards-compare-contextual-content/problem:
- en: 73aa63782984835f
- zh: 41982214968dcca8
-/agent-note-web-diff-cards-compare-contextual-content/decision:
- en: d8c9e2af5843c87d
- zh: 5487925fa1a66da8
-/agent-note-web-diff-cards-compare-contextual-content/alternatives-considered:
- en: b5d00cc913db27c9
- zh: ef72c91cff5ebcce
-/agent-note-web-diff-cards-compare-contextual-content/measurement:
- en: 839be054edf51392
- zh: 3d2a51e634b39eb2
-/agent-note-web-diff-cards-compare-contextual-content/consequences:
- en: 1900b6984a59765c
- zh: 8f3755fcdf8f2562
diff --git a/.agents/notes/implemented/bug-fix/2026-09-14-windows-lock-release-probe.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-14-windows-lock-release-probe.i18n.yaml
deleted file mode 100644
index 4816998bc8..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-14-windows-lock-release-probe.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-14-windows-lock-release-probe.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-14-windows-lock-release-probe.md
-/agent-note-windows-lock-release-before-contention-probing:
- en: ec7e0474bd96df26
- zh: 20a70a6284cb0269
-/agent-note-windows-lock-release-before-contention-probing/problem:
- en: cc9630ce8e232e8a
- zh: 16f3541a58eac0ef
-/agent-note-windows-lock-release-before-contention-probing/decision:
- en: 9230417f2af237d4
- zh: 6fbef7a6d6e1e4d0
-/agent-note-windows-lock-release-before-contention-probing/alternatives-considered:
- en: ba6d9e4c01c8f25b
- zh: 8899bcf11d45b258
-/agent-note-windows-lock-release-before-contention-probing/consequences:
- en: fc268a94ceeb3a96
- zh: b14be62df4a4bfad
diff --git a/.agents/notes/implemented/bug-fix/2026-09-15-client-session-blank-reconciliation.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-15-client-session-blank-reconciliation.i18n.yaml
index 196679568b..d21312201c 100644
--- a/.agents/notes/implemented/bug-fix/2026-09-15-client-session-blank-reconciliation.i18n.yaml
+++ b/.agents/notes/implemented/bug-fix/2026-09-15-client-session-blank-reconciliation.i18n.yaml
@@ -21,5 +21,5 @@
en: 4c16904319ae2745
zh: 06bf9126b7f504ec
/agent-note-keep-accepted-session-presentation-across-list-refreshes/related-decisions:
- en: 99d6b7e450a8dc09
- zh: 46a6df4730514668
+ en: ac8ca7380845aa3f
+ zh: 12980beee33ad336
diff --git a/.agents/notes/implemented/bug-fix/2026-09-15-client-session-blank-reconciliation.md b/.agents/notes/implemented/bug-fix/2026-09-15-client-session-blank-reconciliation.md
index 7213636e32..d38ba4aedc 100644
--- a/.agents/notes/implemented/bug-fix/2026-09-15-client-session-blank-reconciliation.md
+++ b/.agents/notes/implemented/bug-fix/2026-09-15-client-session-blank-reconciliation.md
@@ -40,4 +40,4 @@ Manager tests cover refresh without a turn, running-to-idle updates, object repl
## Related decisions
-The [scope and provisioning decision](../architecture/2026-07-25-web-client-session-scope-and-provide-channel.md) owns Session scope, creation/reuse, and the visible blank row. The [Session/Conversation ownership decision](../architecture/2026-08-20-client-session-conversation-ownership.md) owns transport, assembly, and snapshot contents.
+The [scope and provisioning reference](../architecture/2026-09-15-client-session-references.md) owns Session scope, creation/reuse, and the visible blank row. The [Session/Conversation ownership decision](../architecture/2026-08-20-client-session-conversation-ownership.md) owns transport, assembly, and snapshot contents.
diff --git a/.agents/notes/implemented/bug-fix/2026-09-15-client-session-blank-reconciliation.zh.md b/.agents/notes/implemented/bug-fix/2026-09-15-client-session-blank-reconciliation.zh.md
index 4b50340fea..51272673a3 100644
--- a/.agents/notes/implemented/bug-fix/2026-09-15-client-session-blank-reconciliation.zh.md
+++ b/.agents/notes/implemented/bug-fix/2026-09-15-client-session-blank-reconciliation.zh.md
@@ -40,4 +40,4 @@ Manager 测试覆盖无轮次刷新、运行转空闲、对象替换、迟到受
## 相关决策
-[作用域与供给决策](../architecture/2026-07-25-web-client-session-scope-and-provide-channel.zh.md) 拥有 Session 作用域、创建/复用及可见 blank 行。[Session/Conversation 归属决策](../architecture/2026-08-20-client-session-conversation-ownership.zh.md) 拥有传输、装配及快照内容。
+[作用域与供给参考](../architecture/2026-09-15-client-session-references.zh.md) 拥有 Session 作用域、创建/复用及可见 blank 行。[Session/Conversation 归属决策](../architecture/2026-08-20-client-session-conversation-ownership.zh.md) 拥有传输、装配及快照内容。
diff --git a/.agents/notes/implemented/bug-fix/2026-09-15-linear-session-list-cache.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-15-linear-session-list-cache.i18n.yaml
deleted file mode 100644
index a4a8a32d4e..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-15-linear-session-list-cache.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-15-linear-session-list-cache.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-15-linear-session-list-cache.md
-/agent-note-linear-session-list-cache-reconciliation:
- en: 7b6289de90982e71
- zh: 0c020de607402bbd
-/agent-note-linear-session-list-cache-reconciliation/problem:
- en: b94ff168ba0310a8
- zh: 8d9fe4af8b047c86
-/agent-note-linear-session-list-cache-reconciliation/decision:
- en: 1d85980590014837
- zh: 2e03befc8ac84f0e
-/agent-note-linear-session-list-cache-reconciliation/alternatives-considered:
- en: 2085e3ccec11084a
- zh: 55f5f5156d03e20c
-/agent-note-linear-session-list-cache-reconciliation/consequences:
- en: 54f1788954da5704
- zh: dad3478c7f3b46f6
diff --git a/.agents/notes/implemented/bug-fix/2026-09-15-messages-v1-base-url.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-15-messages-v1-base-url.i18n.yaml
deleted file mode 100644
index 312f8cf353..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-15-messages-v1-base-url.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-15-messages-v1-base-url.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-15-messages-v1-base-url.md
-/agent-note-exact-v1-recognition-for-messages-base-urls:
- en: 8e65836ea970f866
- zh: 54ef0765d2c39be8
-/agent-note-exact-v1-recognition-for-messages-base-urls/problem:
- en: d6d0baca328ce1cd
- zh: 152d5c7793674ed2
-/agent-note-exact-v1-recognition-for-messages-base-urls/decision:
- en: 037fe11400e2e666
- zh: 5941d8f7364e45b8
-/agent-note-exact-v1-recognition-for-messages-base-urls/alternatives-considered:
- en: 5615cd72ec115068
- zh: 772d9a557d46c43d
-/agent-note-exact-v1-recognition-for-messages-base-urls/consequences:
- en: 90a3b42b98cf99e0
- zh: 50e45634f1bd5ecb
diff --git a/.agents/notes/implemented/bug-fix/2026-09-15-trajectory-attachment-presentation.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-15-trajectory-attachment-presentation.i18n.yaml
deleted file mode 100644
index da4262d0ea..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-15-trajectory-attachment-presentation.i18n.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-15-trajectory-attachment-presentation.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-15-trajectory-attachment-presentation.md
-/agent-note-consistent-trajectory-attachment-presentation:
- en: 44651b6372b8e74e
- zh: 8e1df22f6c969427
-/agent-note-consistent-trajectory-attachment-presentation/problem:
- en: 3a02d475408db611
- zh: 49ef7f0e91917e13
-/agent-note-consistent-trajectory-attachment-presentation/decision:
- en: 9a37a61d84813db3
- zh: 546cf3d1734289ee
-/agent-note-consistent-trajectory-attachment-presentation/decision/ownership:
- en: d453afd765988e76
- zh: eeb4c7d40fe578dc
-/agent-note-consistent-trajectory-attachment-presentation/alternatives-considered:
- en: f32a7ff301caf058
- zh: fbea3a171a300aef
-/agent-note-consistent-trajectory-attachment-presentation/consequences:
- en: da70caa5b98ac85d
- zh: 52a5379c3adaa62f
-/agent-note-consistent-trajectory-attachment-presentation/verification:
- en: 145819ab133854c3
- zh: f9a440d57c12a257
diff --git a/.agents/notes/implemented/bug-fix/2026-09-15-trajectory-attachment-presentation.md b/.agents/notes/implemented/bug-fix/2026-09-15-trajectory-attachment-presentation.md
deleted file mode 100644
index 03d737d67e..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-15-trajectory-attachment-presentation.md
+++ /dev/null
@@ -1,55 +0,0 @@
-# Agent Note: Consistent Trajectory attachment presentation
-
-Status: implemented
-
-English | [中文](2026-09-15-trajectory-attachment-presentation.zh.md)
-
-## Problem
-
-A user message can contain text, images, and ordinary files. Trajectory omitted image counts beside text, left ordinary files out of Preview, and mixed file JSON with rendered images in Raw. Readers could not identify the complete attachment set consistently across the ledger and inspector (Issue #4356).
-
-## Decision
-
-Trajectory presents every attachment occurrence while keeping visual inspection separate from inspection of recorded fields.
-
-| Location | Behavior |
-|---|---|
-| Ledger | Separate nonzero image and ordinary-file counts accompany the text excerpt, including messages without text. Each record stays on one compact line. |
-| Summary and Preview | Message text precedes one ordered attachment list. Both tabs use the same renderer; Summary retains its compact spacing and scroll container. |
-| Attachment list | Equal-width compact rows share spacing and corners. A file-type icon or contained image thumbnail accompanies the recorded name and available metadata. Repeated references retain their occurrence order. |
-| Image interaction | The complete image fits inside a 48px square thumbnail without cropping. Activation opens the existing image viewer, with keyboard access. Loading and retry icons fit the thumbnail and expose localized tooltips and accessible names. |
-| Raw | Image and file blocks use initially collapsed metadata disclosures with complete recorded fields. Original content-block order and unrendered text remain intact; generated display labels do not enter raw fields. |
-
-Recorded filenames take precedence over localized numbered image labels. Metadata comes from recorded fields or the filename extension; zero-byte sizes remain visible. Visually truncated names retain their complete accessible text and tooltip. Messages without text still expose all attachments inside the inspector's scroll area.
-
-### Ownership
-
-[ui-trajectory](../../../../packages/client/ui-trajectory/README.md) owns counts, ordered attachment projection, and inspector composition. Its view data carries typed image and file references separately from the serialized content used by Raw, so display code does not recover file metadata by parsing JSON.
-
-[ui-attachment](../../../../packages/client/ui-attachment/README.md) owns image loading and the viewer through the existing image slot. [ui-conversation](../../../../packages/client/ui-conversation/README.md) owns the per-session image cache: Chat and Trajectory share one authorized read and browser URL per attachment. Thumbnail sizing and optional display labels affect presentation only; loading still receives the original reference. Chat and tool-result gallery sizing retain their existing behavior.
-
-This decision uses existing durable attachment references without changing upload, storage, model requests, or the Session format. Ordinary files expose metadata without a content viewer or download action. Product labels use typed locale dictionaries, and styles use the existing semantic tokens.
-
-The [generic file upload decision](../feature/2026-08-26-generic-file-upload.md) owns upload, storage, admission, and ordered message attachments; this record owns Trajectory presentation. The [unreadable attachment quarantine proposal](../../proposed/bug-fix/2026-08-20-attachment-read-quarantine.md) concerns model-request recovery independently of thumbnail loading feedback.
-
-## Alternatives considered
-
-**Keep large inline images as the default inspector presentation.** This makes one image immediately readable, but a tall image displaces attachment names and message text in the narrow inspector. Compact rows with explicit image activation provide a consistent overview of mixed attachments.
-
-**Use two-column attachment cards.** A grid can make thumbnails more prominent on wide panels, but it leaves less room for long filenames and requires a different narrow-panel arrangement. A single equal-width list accommodates both panel widths.
-
-**Keep file JSON and image previews together in Raw.** This assigns different meanings to the same tab for two attachment kinds. Metadata disclosures let readers inspect recorded fields while Preview owns visual image presentation.
-
-## Consequences
-
-The shared attachment renderer keeps names, order, metadata, and image actions consistent between Summary and Preview. Grouping attachments after message text makes the complete set easy to scan; Raw preserves interleaving when readers need the original block sequence. Repeated references remain separate rows even when image loading shares a cache entry.
-
-Compact thumbnails require opening the viewer to read detailed diagrams. Missing metadata stays absent, and image-read failures retain a retry control without hiding ordinary files. Changes to the shared image slot also affect Chat and tool results, so their gallery behavior and cache reuse remain regression requirements.
-
-## Verification
-
-[Projection tests](../../../../packages/client/ui-trajectory/tests/layout.client.spec.tsx) cover mixed, attachment-only, empty-text, and repeated occurrences. [Inspector tests](../../../../packages/client/ui-trajectory/tests/table.client.spec.tsx) cover both locales, unnamed images, long filenames, zero-byte files, ordered lists, and complete Raw fields. [Image tests](../../../../packages/client/ui-attachment/tests/message-image.client.spec.tsx) cover thumbnail labels, loading, retry, and the existing viewer.
-
-The recorded [mixed-upload browser scenario](../../../../apps/web/tests/file-upload-round.e2e.ts) compares Summary and Preview, verifies keyboard activation and focus restoration, checks collapsed and expanded Raw content, and repeats inspection after reload. Its [Trajectory expectation](../../../../snapshots/web/file-upload-round/trajectory.expected.md) accompanies the unchanged Session fixture. The [assembled image-cache test](../../../../apps/web/tests/trajectory-image-display.expected.e2e.ts) also checks reuse between Chat and Trajectory.
-
-Layout acceptance covers narrow and wide panels, both themes and locales, complete thumbnail containment, and reachable final attachments. The [GIF workflow](../../../skills/record-browser-gif/SKILL.md) requires review evidence from a clean committed tree and one real-server, real-model session showing mixed submission, ledger counts, Summary, Preview image activation, and expanded Raw metadata. Issue #4356 and its linked PR track executed checks and demonstration evidence.
diff --git a/.agents/notes/implemented/bug-fix/2026-09-15-trajectory-attachment-presentation.zh.md b/.agents/notes/implemented/bug-fix/2026-09-15-trajectory-attachment-presentation.zh.md
deleted file mode 100644
index 55c63bf3d9..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-15-trajectory-attachment-presentation.zh.md
+++ /dev/null
@@ -1,55 +0,0 @@
-# Agent Note: 统一 Trajectory 附件展示
-
-Status: implemented
-
-[English](2026-09-15-trajectory-attachment-presentation.md) | 中文
-
-## 问题
-
-用户消息可以包含文本、图片和普通文件。Trajectory 曾在文本旁省略图片数量，在预览中遗漏普通文件，并在原始内容中混排文件 JSON 与渲染后的图片。读者无法在列表和详情面板中一致地确认完整附件集合（Issue #4356）。
-
-## 决定
-
-Trajectory 展示每次附件出现的记录，并分别提供视觉预览与已记录字段检查。
-
-| 位置 | 行为 |
-|---|---|
-| 列表 | 文本摘要旁分别显示非零的图片数量与普通文件数量，无正文的消息也显示计数。每条记录保持为紧凑单行。 |
-| 概述与预览 | 消息正文之后展示一个有序附件列表。两个标签页使用相同的渲染器；概述保留紧凑间距和滚动容器。 |
-| 附件列表 | 等宽的紧凑行使用一致的间距和圆角。文件类型图标或完整缩放的图片缩略图旁展示已记录的名称与可用元数据。重复引用保留各次出现的顺序。 |
-| 图片交互 | 图片完整缩放到 48px 方形缩略图内，不裁剪。激活时打开现有图片查看器，保留键盘访问。加载与重试图标适配缩略图尺寸，并提供本地化的工具提示和可访问名称。 |
-| 原始内容 | 图片块和文件块使用默认收起的元数据折叠区，包含完整记录字段。原始内容块顺序与未渲染文本保持完整；生成的显示标签不进入原始字段。 |
-
-已记录文件名优先于本地化的编号图片标签。元数据来自记录字段或文件扩展名，零字节大小仍然可见。视觉上截断的名称保留完整的无障碍文本和工具提示。无正文的消息仍在详情面板滚动区域内展示全部附件。
-
-### 职责
-
-[ui-trajectory](../../../../packages/client/ui-trajectory/README.zh.md)负责计数、有序附件投影和详情面板组合。其视图数据将带类型的图片与文件引用和原始内容使用的序列化文本分别保存，展示代码因此无需解析 JSON 来恢复文件元数据。
-
-[ui-attachment](../../../../packages/client/ui-attachment/README.zh.md)通过现有图片 slot 负责图片加载与查看器。[ui-conversation](../../../../packages/client/ui-conversation/README.zh.md)拥有会话级图片缓存：Chat 与 Trajectory 对每个附件共享一次授权读取和一个浏览器 URL。缩略图尺寸和可选显示标签只影响展示，加载仍接收原始引用。Chat 和工具结果图库保留现有的尺寸行为。
-
-本决定使用现有持久附件引用，不改变上传、存储、模型请求或会话格式。普通文件展示元数据，不提供内容查看器或下载操作。产品标签使用带类型的本地化字典，样式使用现有语义 token。
-
-[通用文件上传决定](../feature/2026-08-26-generic-file-upload.zh.md)负责上传、存储、准入和有序消息附件；本记录负责 Trajectory 展示。[不可读附件隔离提案](../../proposed/bug-fix/2026-08-20-attachment-read-quarantine.zh.md)处理模型请求恢复，与缩略图加载反馈相互独立。
-
-## 考虑过的替代方案
-
-**默认在详情面板中内联展示大图。** 这样可以立即阅读单张图片，但高图片会在窄面板中挤走附件名称和消息正文。紧凑行加显式图片激活入口能一致地概览混合附件。
-
-**使用双列附件卡片。** 网格能在宽面板上突出缩略图，但会压缩长文件名空间，并要求窄面板采用不同排布。单列等宽列表适用于两种面板宽度。
-
-**在原始内容中混排文件 JSON 和图片预览。** 这让同一个标签页对两种附件具有不同含义。元数据折叠区用于检查已记录字段，预览负责图片的视觉展示。
-
-## 影响
-
-共享附件渲染器使概述与预览中的名称、顺序、元数据和图片操作保持一致。将附件集中在消息正文之后便于浏览完整集合；需要原始块顺序时，原始内容保留交错关系。即使图片加载共享缓存项，重复引用仍各占一行。
-
-紧凑缩略图需要打开查看器才能阅读详细图表。缺失的元数据保持缺失，图片读取失败保留重试控件，并且不隐藏普通文件。共享图片 slot 的修改也会影响 Chat 和工具结果，因此其图库行为和缓存复用仍需回归验证。
-
-## 验证
-
-[投影测试](../../../../packages/client/ui-trajectory/tests/layout.client.spec.tsx)覆盖混合附件、纯附件、空文本和重复引用。[详情面板测试](../../../../packages/client/ui-trajectory/tests/table.client.spec.tsx)覆盖两种语言、无名称图片、长文件名、零字节文件、有序列表和完整的原始字段。[图片测试](../../../../packages/client/ui-attachment/tests/message-image.client.spec.tsx)覆盖缩略图标签、加载、重试和现有查看器。
-
-已录制的[混合上传浏览器场景](../../../../apps/web/tests/file-upload-round.e2e.ts)比较概述与预览，验证键盘激活和焦点恢复，检查原始内容收起与展开状态，并在刷新后重复检查。其 [Trajectory 预期输出](../../../../snapshots/web/file-upload-round/trajectory.expected.md)配合未改动的会话 fixture（测试前置数据）使用。[组装应用图片缓存测试](../../../../apps/web/tests/trajectory-image-display.expected.e2e.ts)也检查 Chat 与 Trajectory 之间的复用。
-
-布局验收覆盖窄版与宽版面板、两种主题和语言、缩略图完整缩放及末尾附件可达性。[GIF 工作流](../../../skills/record-browser-gif/SKILL.md)要求评审证据基于干净的已提交代码树，在同一个真实服务、真实模型会话中展示混合提交、列表计数、概述、预览中的图片激活和展开的原始元数据。Issue #4356 及其关联 PR（Pull Request）记录已执行的检查和演示证据。
diff --git a/.agents/notes/implemented/bug-fix/2026-09-16-desktop-window-menus.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-16-desktop-window-menus.i18n.yaml
deleted file mode 100644
index fdf261af26..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-16-desktop-window-menus.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-16-desktop-window-menus.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-16-desktop-window-menus.md
-/agent-note-desktop-standard-macos-window-menus:
- en: 7a3fc575043bc839
- zh: 5ab70cfa35509b3e
-/agent-note-desktop-standard-macos-window-menus/problem:
- en: 75c201a0a687b59d
- zh: 34593038f673d06f
-/agent-note-desktop-standard-macos-window-menus/decision:
- en: 0ce30c3a1e6202d7
- zh: badac0021fae4a6f
-/agent-note-desktop-standard-macos-window-menus/alternatives-considered:
- en: 957382dbfb6cac48
- zh: 2db98b7dbf3e01c0
-/agent-note-desktop-standard-macos-window-menus/consequences:
- en: 1fa44c82ca450bcd
- zh: b618f5ec0a90ed13
-/agent-note-desktop-standard-macos-window-menus/testing:
- en: 0c05c0044532f891
- zh: cff254b44b3c7a2d
diff --git a/.agents/notes/implemented/bug-fix/2026-09-16-desktop-window-menus.md b/.agents/notes/implemented/bug-fix/2026-09-16-desktop-window-menus.md
deleted file mode 100644
index d8f8bdb9cc..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-16-desktop-window-menus.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# Agent Note: Desktop standard macOS window menus
-
-Status: implemented
-
-English | [中文](2026-09-16-desktop-window-menus.zh.md)
-
-## Problem
-
-The Desktop shell replaces Electron's default application menu with a custom template that listed only the application and Edit menus. Electron builds only the roles a template declares, so macOS lost the File and Window menus and the application hide commands the default template supplies, including Close Window (⌘W), Minimize (⌘M), and Hide (⌘H). None of those shortcuts did anything in the Desktop application while every comparable macOS application responds to them (issue #4374).
-
-## Decision
-
-On macOS the template declares `{ role: 'windowMenu' }` after the Edit menu, and a separator-delimited run of `hide`, `hideOthers`, and `unhide` before Quit in the application submenu. Those roles contribute only the standard items; no Services submenu, window list, or other macOS default is declared. Windows and Linux keep the application and Edit menus. The [page-close decision](../architecture/2026-09-21-desktop-page-close-shortcuts.md) owns the custom File menu and close behavior.
-
-Electron supplies English defaults for the Window and Edit roles. Explicit labels override role defaults while retaining native actions and shortcuts; the localized application commands are documented in the [Desktop README](../../../../apps/desktop/README.md). Minimize and hide execute through Electron's roles without custom handlers. Close and activation behavior is partly superseded by [close-to-background](../architecture/2026-09-23-desktop-close-to-background-and-quit-confirmation.md); the menu declarations here remain in effect.
-
-## Alternatives considered
-
-**Bind ⌘W to minimizing or hiding the window.** macOS reserves Minimize for ⌘M and Hide for ⌘H, and comparable applications close the front window with ⌘W. Binding another command to the reported shortcut would contradict the platform convention the change follows.
-
-**Declare only the Window menu.** That menu supplies Minimize and Zoom but no Close, leaving ⌘W unbound.
-
-**Add a bare `{ role: 'close' }` item to the application submenu.** It avoids a File menu containing a single command, but places a window command among the app-wide Plugins, Updates, Hide, and Quit items where no macOS application puts it.
-
-**Declare the File and Window menus on every platform.** The same template declares Ctrl+W there; with one window, closing it invokes `window-all-closed` and quits the application. The menu-restoration task did not request this quit path; the page-close decision explicitly specifies the Desktop fallback.
-
-**Recreate the main window on Dock activation regardless of other windows.** The plugin window can outlive the main window, so gating `activate` on `mainWindow` instead of `BrowserWindow.getAllWindows()` would let a Dock click always restore the main window. That changes window lifecycle beyond restoring the suppressed platform commands, so the existing `activate` condition stays.
-
-## Consequences
-
-macOS retains native Window and application hide commands through four menu roles. Window and Edit retain Electron’s default English labels; application commands use the Desktop locale.
-
-## Testing
-
-`apps/desktop/tests/main-startup.spec.ts` verifies the declared menu roles per platform and records English and Chinese application-label snapshots. Role-based menu items execute natively, so a programmatic `click()` and the Vitest Electron mock cannot exercise the shortcuts. The isolated Electron 44 demo confirms that explicit application labels appear in native menus; the template snapshots do not qualify native shortcut execution.
diff --git a/.agents/notes/implemented/bug-fix/2026-09-16-desktop-window-menus.zh.md b/.agents/notes/implemented/bug-fix/2026-09-16-desktop-window-menus.zh.md
deleted file mode 100644
index c85ab23df1..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-16-desktop-window-menus.zh.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# Agent Note: Desktop standard macOS window menus
-
-Status: implemented
-
-[English](2026-09-16-desktop-window-menus.md) | 中文
-
-## 问题
-
-Desktop shell 用自定义模板替换了 Electron 的默认应用菜单，该模板此前只列出应用菜单和 Edit 菜单。Electron 只构建模板中声明的 role，因此 macOS 失去了默认模板提供的 File、Window 菜单和应用隐藏命令，包括 Close Window（⌘W）、Minimize（⌘M）和 Hide（⌘H）。这些快捷键在 Desktop 应用中都没有任何效果，而同类的 macOS 应用都会响应它们（#4374）。
-
-## 决策
-
-macOS 上的模板在 Edit 菜单之后声明 `{ role: 'windowMenu' }`，并在应用子菜单的 Quit 之前声明由分隔符隔开的 `hide`、`hideOthers` 和 `unhide`。这些 role 只提供标准菜单项；不声明 Services 子菜单、窗口列表或其他 macOS 默认项。Windows 和 Linux 保留应用菜单和 Edit 菜单。[页面关闭决策](../architecture/2026-09-21-desktop-page-close-shortcuts.zh.md)负责自定义 File 菜单和关闭行为。
-
-Electron 为 Window 和 Edit role 提供英文默认标签。显式标签会覆盖 role 的默认标签，同时保留原生命令和快捷键；本地化的应用命令见 [Desktop README](../../../../apps/desktop/README.zh.md)。最小化和隐藏通过 Electron 的 role 执行，没有自定义处理器。 关闭与激活行为已被[关闭时隐藏窗口](../architecture/2026-09-23-desktop-close-to-background-and-quit-confirmation.zh.md)部分取代；这里的菜单声明仍然有效。
-
-## 考虑过的替代方案
-
-**把 ⌘W 绑定为最小化或隐藏窗口。** macOS 把最小化留给 ⌘M、把隐藏留给 ⌘H，同类应用都用 ⌘W 关闭最前窗口。给这个快捷键绑定其他命令会违背本改动所遵循的平台惯例。
-
-**只声明 Window 菜单。** 该菜单提供 Minimize 和 Zoom，但不提供关闭，⌘W 仍然没有绑定。
-
-**在应用子菜单里直接加一个 `{ role: 'close' }` 项。** 这样可以避免只有一个命令的 File 菜单，但会把窗口命令放到 Plugins、Updates、Hide、Quit 这些应用级命令中间，没有 macOS 应用这样排布。
-
-**在所有平台都声明 File 和 Window 菜单。** 同一份模板在那些平台会把 Ctrl+W 声明为关闭；应用只有一个窗口，关闭它会触发 `window-all-closed` 并退出应用。恢复菜单的任务没有要求这条退出路径；页面关闭决策明确规定了 Desktop 回退。
-
-**让 Dock 激活时无论其他窗口是否存在都重建主窗口。** 插件窗口可以比主窗口存活更久，因此把 `activate` 的判断从 `BrowserWindow.getAllWindows()` 改为 `mainWindow` 能让点击 Dock 总可以恢复主窗口。但这超出了恢复被压掉的平台命令，属于窗口生命周期的行为变更，因此保留现有的 `activate` 判断。
-
-## 影响
-
-macOS 通过四个菜单 role 保留原生 Window 和应用隐藏命令。Window 和 Edit 保留 Electron 的默认英文标签；应用命令使用 Desktop 的语言。
-
-## 测试
-
-`apps/desktop/tests/main-startup.spec.ts` 验证各平台声明的菜单 role，并记录中英文应用标签快照。基于 role 的菜单项由本机执行，因此程序化的 `click()` 和 Vitest 的 Electron mock 都无法触达这些快捷键。独立 Electron 44 demo 确认显式应用标签会显示在原生菜单中；模板快照不能验证原生快捷键的执行。
diff --git a/.agents/notes/implemented/bug-fix/2026-09-16-messages-historical-tool-input.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-16-messages-historical-tool-input.i18n.yaml
deleted file mode 100644
index d0f3da21b3..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-16-messages-historical-tool-input.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-16-messages-historical-tool-input.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-16-messages-historical-tool-input.md
-/agent-note-replay-malformed-historical-tool-input-through-messages:
- en: 88cdfca30918b47f
- zh: 1203d380805f81e4
-/agent-note-replay-malformed-historical-tool-input-through-messages/problem:
- en: b9f848905bb31969
- zh: 7c56aab1a15cfc85
-/agent-note-replay-malformed-historical-tool-input-through-messages/decision:
- en: ee7c586820c28e54
- zh: fced4d6c50c7d227
-/agent-note-replay-malformed-historical-tool-input-through-messages/alternatives-considered:
- en: c7d7275282a83780
- zh: c0c570f156ac546f
-/agent-note-replay-malformed-historical-tool-input-through-messages/consequences:
- en: 4d1447eb8ea0f7f4
- zh: cf232f6bb1d60d4e
diff --git a/.agents/notes/implemented/bug-fix/2026-09-16-present-delayed-windows-installer.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-16-present-delayed-windows-installer.i18n.yaml
deleted file mode 100644
index e64fb33fd5..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-16-present-delayed-windows-installer.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-16-present-delayed-windows-installer.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-16-present-delayed-windows-installer.md
-/agent-note-present-delayed-windows-installer:
- en: 4451eeb66010bc3d
- zh: 7b5e60d779a9eb41
-/agent-note-present-delayed-windows-installer/problem:
- en: 7835e64ac8ea1825
- zh: aac3b323204b08b9
-/agent-note-present-delayed-windows-installer/decision:
- en: adea34850b8df240
- zh: da68a90a4144092f
-/agent-note-present-delayed-windows-installer/alternatives-considered:
- en: 66f936fe39452162
- zh: 4d0e192fb37afffe
-/agent-note-present-delayed-windows-installer/consequences:
- en: 6431f3c88199ecaf
- zh: 9f30f647fdab4e64
diff --git a/.agents/notes/implemented/bug-fix/2026-09-16-present-delayed-windows-installer.md b/.agents/notes/implemented/bug-fix/2026-09-16-present-delayed-windows-installer.md
deleted file mode 100644
index d4ffcfdc11..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-16-present-delayed-windows-installer.md
+++ /dev/null
@@ -1,23 +0,0 @@
-# Agent Note: Present delayed Windows installer
-
-Status: implemented
-
-English | [中文](2026-09-16-present-delayed-windows-installer.zh.md)
-
-## Problem
-
-The native installer hides its window while preparing resources. If the user activates another application during that interval, the welcome page can appear behind that application and seem absent.
-
-## Decision
-
-The first welcome-page display moves the installer above ordinary windows without activating it. When another window owns the foreground, the installer also flashes its taskbar button until foreground interaction. Later page changes do not repeat the move. The window never becomes permanently topmost.
-
-## Alternatives considered
-
-**Force foreground focus.** Windows may reject a background process's foreground request, and taking focus after the user switches applications interrupts their current action.
-
-**Keep the installer topmost.** A persistent topmost window obscures applications the user intentionally opens during installation.
-
-## Consequences
-
-The welcome page becomes visible when preparation completes, while the user retains control of focus and can cover the installer again. A native window-order test and the signed installer smoke test exercise the first display.
diff --git a/.agents/notes/implemented/bug-fix/2026-09-16-present-delayed-windows-installer.zh.md b/.agents/notes/implemented/bug-fix/2026-09-16-present-delayed-windows-installer.zh.md
deleted file mode 100644
index bf97ed8a4f..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-16-present-delayed-windows-installer.zh.md
+++ /dev/null
@@ -1,23 +0,0 @@
-# Agent Note: 延迟显示的 Windows 安装窗口
-
-Status: implemented
-
-[English](2026-09-16-present-delayed-windows-installer.md) | 中文
-
-## Problem
-
-原生安装程序准备资源时会隐藏窗口。如果用户在此期间激活其他应用，欢迎页可能出现在该应用后面，看起来像没有启动。
-
-## Decision
-
-欢迎页首次显示时，安装窗口会移到普通窗口前方，但不抢占焦点。如果其他窗口位于前台，安装程序还会闪烁任务栏按钮，直至用户进行前台交互。后续页面切换不会重复置前。安装窗口不会永久置顶。
-
-## Alternatives considered
-
-**强制获取前台焦点。** Windows 可能拒绝后台进程的前台请求，而且用户切换应用后再抢回焦点会打断当前操作。
-
-**让安装窗口始终置顶。** 持续置顶会遮挡用户在安装期间主动打开的其他应用。
-
-## Consequences
-
-准备完成时欢迎页可见，用户仍能控制焦点，也可以再次用其他窗口覆盖安装程序。原生窗口顺序测试和签名安装程序冒烟测试覆盖首次显示。
diff --git a/.agents/notes/implemented/bug-fix/2026-09-16-session-writer-held-feedback.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-16-session-writer-held-feedback.i18n.yaml
deleted file mode 100644
index 3d896f268f..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-16-session-writer-held-feedback.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-16-session-writer-held-feedback.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-16-session-writer-held-feedback.md
-/agent-note-session-writer-contention-feedback:
- en: 31fc83d11f79fbac
- zh: ec2e62f56a83ff3c
-/agent-note-session-writer-contention-feedback/problem:
- en: ce6f2ed854986c2a
- zh: 74b28d3282f610e8
-/agent-note-session-writer-contention-feedback/decision:
- en: a2c50e7614d183fd
- zh: c4057682bc25cb23
-/agent-note-session-writer-contention-feedback/alternatives-considered:
- en: 43f74d015db77ab1
- zh: 38c7ffda0a33ecac
-/agent-note-session-writer-contention-feedback/consequences:
- en: 230c23cceae0ad46
- zh: 8ec04813b825b509
diff --git a/.agents/notes/implemented/bug-fix/2026-09-16-windows-subprocess-console-visibility.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-16-windows-subprocess-console-visibility.i18n.yaml
deleted file mode 100644
index 879cde4ff0..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-16-windows-subprocess-console-visibility.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-16-windows-subprocess-console-visibility.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-16-windows-subprocess-console-visibility.md
-/agent-note-hide-windows-subprocess-console-windows-at-creation:
- en: be47c56d2dd977d1
- zh: 3ab8a9a18e7f545d
-/agent-note-hide-windows-subprocess-console-windows-at-creation/problem:
- en: b76c3b25b8616076
- zh: d14facfdf3948bc4
-/agent-note-hide-windows-subprocess-console-windows-at-creation/decision:
- en: 56b951a948c6d007
- zh: 301031638a642517
-/agent-note-hide-windows-subprocess-console-windows-at-creation/alternatives-considered:
- en: 9dcf5702a5032d69
- zh: 493c2709d441d52c
-/agent-note-hide-windows-subprocess-console-windows-at-creation/consequences:
- en: 0bfe83068c6fe3ee
- zh: 2bdc9eb64c6f7b66
diff --git a/.agents/notes/implemented/bug-fix/2026-09-17-thinking-markdown.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-17-thinking-markdown.i18n.yaml
deleted file mode 100644
index 9290c75e26..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-17-thinking-markdown.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-17-thinking-markdown.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-17-thinking-markdown.md
-/agent-note-compact-markdown-for-thinking:
- en: 2b71ec7a5294e982
- zh: 0c33248c5d07ec74
-/agent-note-compact-markdown-for-thinking/problem:
- en: c14bd1618741736a
- zh: dc1fff84736cb4f7
-/agent-note-compact-markdown-for-thinking/decision:
- en: adb4f711ecf2011a
- zh: 791f7bf3b8d23458
-/agent-note-compact-markdown-for-thinking/alternatives-considered:
- en: d5bf82e0de012900
- zh: a639fd02e00b5d09
-/agent-note-compact-markdown-for-thinking/consequences:
- en: d69b13246a34047c
- zh: 4c1a6520053261ef
diff --git a/.agents/notes/implemented/bug-fix/2026-09-17-thinking-markdown.md b/.agents/notes/implemented/bug-fix/2026-09-17-thinking-markdown.md
deleted file mode 100644
index 6990fc6277..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-17-thinking-markdown.md
+++ /dev/null
@@ -1,31 +0,0 @@
-# Agent Note: Compact Markdown for Thinking
-
-Status: implemented
-
-English | [中文](2026-09-17-thinking-markdown.zh.md)
-
-## Problem
-
-Chat Thinking contains model-authored Markdown, but literal rendering exposes headings, emphasis markers, and code fences. The shared answer typography makes headings larger and more prominent than the secondary reasoning text. Trajectory applies that answer typography to the same reasoning.
-
-## Decision
-
-[MarkdownText](../../../../packages/client/ui-primitives/src/markdown/MarkdownText.tsx) owns a compact presentation variant used by Chat Thinking and Trajectory thinking details. It keeps the secondary content font size, line height, and tertiary color throughout. Heading levels retain semantic elements but share the same 600 weight and size; paragraphs, lists, quotes, and code use compact spacing. Links keep a resting dotted underline with tertiary color as a secondary-content exception to the [shared link styling](../../../../docs/web-styling.md); code retains its monospace font and background.
-
-Tables and formulas remain enabled through the existing parser. Their containers constrain horizontal overflow, and formula text inherits the secondary font size. Inline formulas retain native KaTeX baselines; enclosing text blocks own overflow so short formulas do not create scrollbars. Compact code banners stay in normal flow, keeping the [Thinking disclosure header](../../../../packages/client/ui-chat/src/client/chat/ReasoningRow.module.css) above the scrolling content without a second sticky band.
-
-Chat passes its running state to the existing incremental Markdown renderer. The collapsed summary remains a separate single-line text projection. The parser, frozen-block cache, stored reasoning, and Session format do not change. Trajectory pins Thinking to its inspector’s fixed 13px/20px tier, independent of Chat’s content-size setting. Its answer output retains its existing typography and its [Thinking disclosure behavior](../feature/2026-09-09-ptc-trajectory-code-inspection.md).
-
-## Alternatives considered
-
-**Use answer typography unchanged.** Large headings and generous block spacing give reasoning more visual weight than the answer.
-
-**Style Markdown separately in each consumer.** Chat and Trajectory would need to track the same renderer elements independently; the primitive owns those elements and their compact presentation.
-
-**Disable tables and formulas.** The existing renderer already supports them. Bounded overflow and inherited font sizing preserve useful content without another parsing mode.
-
-## Consequences
-
-Thinking supports structured reading while retaining its secondary emphasis. Semantic headings remain available to assistive technology even though their visible hierarchy is flattened. The shared variant applies to both views; future Markdown element changes must preserve its typography as well as the default answer typography.
-
-Markdown soft line breaks collapse like answer prose; hard breaks and separate paragraphs require Markdown syntax. Streaming freezing operates on completed blocks, so an unfinished long paragraph remains in the mutable tail and is parsed again as it grows.
diff --git a/.agents/notes/implemented/bug-fix/2026-09-17-thinking-markdown.zh.md b/.agents/notes/implemented/bug-fix/2026-09-17-thinking-markdown.zh.md
deleted file mode 100644
index 963626088e..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-17-thinking-markdown.zh.md
+++ /dev/null
@@ -1,31 +0,0 @@
-# Agent Note: Thinking 的紧凑 Markdown
-
-Status: implemented
-
-[English](2026-09-17-thinking-markdown.md) | 中文
-
-## 问题
-
-Chat Thinking 包含模型编写的 Markdown，但纯文本渲染直接显示标题、强调标记和代码围栏。共享回答排版会让标题比次级推理文本更大、更醒目。Trajectory 对同一推理内容使用了回答排版。
-
-## 决策
-
-[MarkdownText](../../../../packages/client/ui-primitives/src/markdown/MarkdownText.tsx) 拥有紧凑展示变体，供 Chat Thinking 和 Trajectory 思考详情使用。内容沿用次级字号、行高和 tertiary 颜色。各级标题保留语义元素，但统一使用 600 字重和相同字号；段落、列表、引用和代码采用紧凑间距。链接保留默认点状下划线与 tertiary 颜色，作为[共享链接样式](../../../../docs/web-styling.zh.md)的次级内容例外；代码保留等宽字体和底色。
-
-表格和公式继续通过既有解析器启用。其容器限制横向溢出，公式文本继承次级字号。行内公式保留 KaTeX 原生基线，由外层文本块承担溢出处理，短公式不会产生滚动条。紧凑代码栏保持正常文档流，让 [Thinking 折叠标题](../../../../packages/client/ui-chat/src/client/chat/ReasoningRow.module.css) 位于滚动内容上方，无需第二条 sticky 栏。
-
-Chat 将运行状态传给既有增量 Markdown 渲染器。折叠摘要仍是独立的单行文本投影。解析器、冻结块缓存、存储的推理内容和 Session 格式均保持不变。Trajectory 将 Thinking 固定在检查器的 13px/20px 层级，与 Chat 的内容字号设置无关。其回答输出保留既有排版及其 [Thinking 折叠行为](../feature/2026-09-09-ptc-trajectory-code-inspection.zh.md)。
-
-## 曾考虑的替代方案
-
-**直接使用回答排版。** 大标题和宽松块间距让推理比回答更醒目。
-
-**由每个使用方单独设置 Markdown 样式。** Chat 和 Trajectory 将需要分别跟踪相同的渲染元素；基元拥有这些元素及其紧凑展示。
-
-**禁用表格和公式。** 既有渲染器已支持二者。限制溢出和继承字号可以保留有用内容，无需增加另一种解析模式。
-
-## 后果
-
-Thinking 支持结构化阅读，同时保持次级强调。虽然视觉层级被统一，辅助技术仍可使用语义标题。共享变体同时用于两个视图；后续 Markdown 元素变更必须同时保留紧凑排版与默认回答排版。
-
-Markdown 软换行与回答正文一样折叠；硬换行和独立段落需要相应 Markdown 语法。流式冻结以完整块为单位，因此尚未结束的长段落仍处于可变尾部，并随增长重新解析。
diff --git a/.agents/notes/implemented/bug-fix/2026-09-18-messages-input-history-compatibility.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-18-messages-input-history-compatibility.i18n.yaml
deleted file mode 100644
index 4d97265632..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-18-messages-input-history-compatibility.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-18-messages-input-history-compatibility.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-18-messages-input-history-compatibility.md
-/agent-note-replay-assistant-blocks-in-messages-user-input:
- en: 2928aedee63465ba
- zh: 0492dcc6604e2292
-/agent-note-replay-assistant-blocks-in-messages-user-input/problem:
- en: d42b7147df73f498
- zh: f77ef429363c2da8
-/agent-note-replay-assistant-blocks-in-messages-user-input/decision:
- en: 0b5629b321be7181
- zh: 3449958cde376d59
-/agent-note-replay-assistant-blocks-in-messages-user-input/alternatives-considered:
- en: 3801041c0f9c4d8a
- zh: 71d80b08183e8b30
-/agent-note-replay-assistant-blocks-in-messages-user-input/consequences:
- en: c1770c7aa4097c42
- zh: 80ab7f2b66408ad7
diff --git a/.agents/notes/implemented/bug-fix/2026-09-18-schedule-task-tab-restore.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-18-schedule-task-tab-restore.i18n.yaml
deleted file mode 100644
index dc30220e34..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-18-schedule-task-tab-restore.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-18-schedule-task-tab-restore.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-18-schedule-task-tab-restore.md
-/agent-note-task-tab-recovery-after-a-reload:
- en: d7edcc16307d350a
- zh: 63301b138b2a203b
-/agent-note-task-tab-recovery-after-a-reload/problem:
- en: 244f309423fff24e
- zh: ddd2ab66a3f4fd5b
-/agent-note-task-tab-recovery-after-a-reload/decision:
- en: 16e1bcb4a0860e91
- zh: 587715df43d5c96f
-/agent-note-task-tab-recovery-after-a-reload/alternatives-considered:
- en: 2fb8e2e0688d22ac
- zh: a584b183723aace7
-/agent-note-task-tab-recovery-after-a-reload/consequences:
- en: 20b7e4c551df0bc0
- zh: c17426fb981f0b06
-/agent-note-task-tab-recovery-after-a-reload/testing:
- en: 3581ad83c52ee3b0
- zh: fbffd886a46b76c6
diff --git a/.agents/notes/implemented/bug-fix/2026-09-18-windows-directory-junction-listing.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-18-windows-directory-junction-listing.i18n.yaml
deleted file mode 100644
index 9a2f10699e..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-18-windows-directory-junction-listing.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-18-windows-directory-junction-listing.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-18-windows-directory-junction-listing.md
-/agent-note-list-directory-links-in-the-workspace-file-tree:
- en: 70fbeeae3fa4a6e6
- zh: 6ed08f09c9d1d02e
-/agent-note-list-directory-links-in-the-workspace-file-tree/problem:
- en: eec5c2e8edd0e0ff
- zh: 03c0f3490bb891c0
-/agent-note-list-directory-links-in-the-workspace-file-tree/decision:
- en: ad36ceb185d15d69
- zh: 71847eaa4641a9d7
-/agent-note-list-directory-links-in-the-workspace-file-tree/alternatives-considered:
- en: 8a9daf7bd2d78b65
- zh: 69f46ee1108c2747
-/agent-note-list-directory-links-in-the-workspace-file-tree/consequences:
- en: 3cbc15d04a639292
- zh: 4a9c94a1a1e8aeca
diff --git a/.agents/notes/implemented/bug-fix/2026-09-19-declared-session-attachment-carriers.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-19-declared-session-attachment-carriers.i18n.yaml
deleted file mode 100644
index a1c2b57fdb..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-19-declared-session-attachment-carriers.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-19-declared-session-attachment-carriers.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-19-declared-session-attachment-carriers.md
-/agent-note-declared-session-attachment-carriers:
- en: ec696589b6d29694
- zh: fca0e8292a840d47
-/agent-note-declared-session-attachment-carriers/problem:
- en: 2c3544ea223fd86c
- zh: fee865c0ce374115
-/agent-note-declared-session-attachment-carriers/decision:
- en: 7538fa848fbbeff8
- zh: 6fd10f3683cadef0
-/agent-note-declared-session-attachment-carriers/alternatives-considered:
- en: 3307cfd109d19377
- zh: a0051b257807e6d0
-/agent-note-declared-session-attachment-carriers/consequences:
- en: 9d028f075b96f121
- zh: c5da5f89f7b75efc
-/agent-note-declared-session-attachment-carriers/verification:
- en: f297ee8e56e7e69e
- zh: e6bc44cb7711b778
diff --git a/.agents/notes/implemented/bug-fix/2026-09-19-failed-step-tool-results.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-19-failed-step-tool-results.i18n.yaml
deleted file mode 100644
index 727bb883f4..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-19-failed-step-tool-results.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-19-failed-step-tool-results.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-19-failed-step-tool-results.md
-/agent-note-record-unanswered-tool-results-before-closing-a-failed-step:
- en: 8fd2a50a041b1b18
- zh: 01aed07a6425a322
-/agent-note-record-unanswered-tool-results-before-closing-a-failed-step/problem:
- en: 1fa7525f83af9035
- zh: 401ce968e3dd5434
-/agent-note-record-unanswered-tool-results-before-closing-a-failed-step/decision:
- en: 3d58367a05183b4a
- zh: f9ccc3a7011a6240
-/agent-note-record-unanswered-tool-results-before-closing-a-failed-step/alternatives-considered:
- en: 37da4d9c8533b736
- zh: e52a59763ae2b62e
-/agent-note-record-unanswered-tool-results-before-closing-a-failed-step/consequences:
- en: 1ea72421a98551d8
- zh: c01e02ddac8a3454
diff --git a/.agents/notes/implemented/bug-fix/2026-09-19-session-local-subagent-migration.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-19-session-local-subagent-migration.i18n.yaml
deleted file mode 100644
index 5618368313..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-19-session-local-subagent-migration.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-19-session-local-subagent-migration.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-19-session-local-subagent-migration.md
-/agent-note-complete-parent-catalogs-without-migrating-child-catalogs:
- en: 352c234841bc0905
- zh: 89be7b695aec5931
-/agent-note-complete-parent-catalogs-without-migrating-child-catalogs/problem:
- en: 5ca0c3232895a9dd
- zh: cb89e5464d4a5f99
-/agent-note-complete-parent-catalogs-without-migrating-child-catalogs/decision:
- en: 7a368a5ad8dc3e0c
- zh: 11ca2af33de30d8f
-/agent-note-complete-parent-catalogs-without-migrating-child-catalogs/alternatives-considered:
- en: 7272107ab68ceefd
- zh: 8b8bba44c9e0c402
-/agent-note-complete-parent-catalogs-without-migrating-child-catalogs/consequences:
- en: 7caecc8516419375
- zh: cc966c325896737d
diff --git a/.agents/notes/implemented/bug-fix/2026-09-19-v3-incomplete-child-catalog-evidence.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-19-v3-incomplete-child-catalog-evidence.i18n.yaml
deleted file mode 100644
index 3b1c733004..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-19-v3-incomplete-child-catalog-evidence.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-19-v3-incomplete-child-catalog-evidence.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-19-v3-incomplete-child-catalog-evidence.md
-/agent-note-preserve-v3-sessions-with-incomplete-child-catalog-evidence:
- en: ff7fbd846f8edf2f
- zh: 8f4703ea0b0d7cc9
-/agent-note-preserve-v3-sessions-with-incomplete-child-catalog-evidence/problem:
- en: a5d524599f02e77f
- zh: b79687f999f4024c
-/agent-note-preserve-v3-sessions-with-incomplete-child-catalog-evidence/decision:
- en: cfd781300b663010
- zh: 6f7865d5619a1e52
-/agent-note-preserve-v3-sessions-with-incomplete-child-catalog-evidence/alternatives-considered:
- en: b7ce0d1b6b280d7f
- zh: 3deeaef73a3a7856
-/agent-note-preserve-v3-sessions-with-incomplete-child-catalog-evidence/consequences:
- en: 9f8b6446f6cdea60
- zh: d0a07674bf8434c4
diff --git a/.agents/notes/implemented/bug-fix/2026-09-20-session-open-read-coordination.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-20-session-open-read-coordination.i18n.yaml
index 270547a0cb..6b9b8fad84 100644
--- a/.agents/notes/implemented/bug-fix/2026-09-20-session-open-read-coordination.i18n.yaml
+++ b/.agents/notes/implemented/bug-fix/2026-09-20-session-open-read-coordination.i18n.yaml
@@ -33,5 +33,5 @@
en: 13437882143e2025
zh: 586bcd68eaa03969
/agent-note-session-opening-cache-identity-and-read-ordering/relationship-to-existing-records:
- en: 8b479aee5c808180
- zh: aa0220e664f9e9a6
+ en: 1621a7c781ebb432
+ zh: 92dbac3c96da2403
diff --git a/.agents/notes/implemented/bug-fix/2026-09-20-session-open-read-coordination.md b/.agents/notes/implemented/bug-fix/2026-09-20-session-open-read-coordination.md
index c00f8fa7a3..814d53651a 100644
--- a/.agents/notes/implemented/bug-fix/2026-09-20-session-open-read-coordination.md
+++ b/.agents/notes/implemented/bug-fix/2026-09-20-session-open-read-coordination.md
@@ -84,5 +84,5 @@ Focused TypeScript builds and bundles were run for affected packages during deve
- [Session observations and projection-owned Client state](../architecture/2026-08-25-session-observations-and-projection-owned-client-state.md) retains ownership of read cuts and shared values. This record adds cache-producer identity and opening-snapshot consumption order; the older claim of sharing unfinished cold loads does not match the current reader and is not evidence that this change implements singleflight.
- [Client Session references, reference sources, and UI state](../architecture/2026-09-15-client-session-references.md) retains ownership of `retain`, `ready`, `using`, and explicit-address semantics. This record limits temporary references to four classes of auxiliary reads as independent asynchronous operations, rather than adding references to every UI action.
-- [Web subagent catalogs consume shared projections](../simplification/2026-09-08-web-subagent-catalog-projections.md) retains ownership of the generic projection store, explicit catalog reads, and control updates. This implementation applies its rule that opening a conversation uses the follow baseline, without replacing the catalog mechanism.
-- [Web subagent catalogs and human continuation](../feature/2026-07-27-web-subagent-conversations.md) retains ownership of presentation and continuation authorization. This record changes only prerequisite navigation reads and root-menu refresh timing, not the child's own Host validation; the older description of interactive loading for missing root catalogs must be reconciled with the coverage gap recorded here.
+- [Web subagent catalogs consume shared projections](../../../../packages/client/ui-subagent/README.md) retains ownership of the generic projection store, explicit catalog reads, and control updates. This implementation applies its rule that opening a conversation uses the follow baseline, without replacing the catalog mechanism.
+- [Web subagent catalogs and human continuation](../../../../packages/client/ui-subagent/README.md) retains ownership of presentation and continuation authorization. This record changes only prerequisite navigation reads and root-menu refresh timing, not the child's own Host validation; the older description of interactive loading for missing root catalogs must be reconciled with the coverage gap recorded here.
diff --git a/.agents/notes/implemented/bug-fix/2026-09-20-session-open-read-coordination.zh.md b/.agents/notes/implemented/bug-fix/2026-09-20-session-open-read-coordination.zh.md
index ce9eac01db..4d20f7be40 100644
--- a/.agents/notes/implemented/bug-fix/2026-09-20-session-open-read-coordination.zh.md
+++ b/.agents/notes/implemented/bug-fix/2026-09-20-session-open-read-coordination.zh.md
@@ -84,5 +84,5 @@ Header 根目录缺失仍是明确的覆盖缺口：若它属于未打开的 par
- [Session observation 与 projection 所有的客户端状态](../architecture/2026-08-25-session-observations-and-projection-owned-client-state.zh.md)继续拥有读取切面和共享值的职责划分。本记录补充缓存生产者身份与首帧消费顺序；旧记录中“包括未完成冷加载的共享”描述与当前 reader 实现不一致，不能作为本次 singleflight 已实现的依据。
- [Client Session 引用、引用来源与 UI 状态](../architecture/2026-09-15-client-session-references.zh.md)继续拥有 `retain`、`ready`、`using` 与显式地址语义。本记录限定四类辅助读取作为独立异步操作持有临时引用，不把额外引用扩展到所有 UI 动作。
-- [Web 子代理目录消费共享 projection](../simplification/2026-09-08-web-subagent-catalog-projections.zh.md)继续拥有通用 projection store、显式目录读取和 control 更新。本次实现落实“打开会话使用 follow baseline”的规则，不替换整个目录机制。
-- [Web subagent 目录与用户继续交互](../feature/2026-07-27-web-subagent-conversations.zh.md)继续拥有展示和 continuation 授权。本记录只调整导航前置读取及根菜单刷新时机，不取消子会话自身的 Host 校验；旧记录对缺失根目录交互加载的描述需与这里的覆盖缺口一起核对。
+- [Web 子代理目录消费共享 projection](../../../../packages/client/ui-subagent/README.zh.md)继续拥有通用 projection store、显式目录读取和 control 更新。本次实现落实“打开会话使用 follow baseline”的规则，不替换整个目录机制。
+- [Web subagent 目录与用户继续交互](../../../../packages/client/ui-subagent/README.zh.md)继续拥有展示和 continuation 授权。本记录只调整导航前置读取及根菜单刷新时机，不取消子会话自身的 Host 校验；旧记录对缺失根目录交互加载的描述需与这里的覆盖缺口一起核对。
diff --git a/.agents/notes/implemented/bug-fix/2026-09-20-windows-embedded-mandatory-update.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-20-windows-embedded-mandatory-update.i18n.yaml
deleted file mode 100644
index 48e79b967c..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-20-windows-embedded-mandatory-update.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-20-windows-embedded-mandatory-update.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-20-windows-embedded-mandatory-update.md
-/agent-note-windows-embedded-mandatory-update:
- en: fb52005dc1f55b5d
- zh: dda7e46555da6d03
-/agent-note-windows-embedded-mandatory-update/problem:
- en: df8f2127905913d7
- zh: 64d27253ce39e031
-/agent-note-windows-embedded-mandatory-update/decision:
- en: f238482836ae80da
- zh: df856cba1b715056
-/agent-note-windows-embedded-mandatory-update/alternatives-considered:
- en: 9564f979909f0743
- zh: 6730e42a123b707a
-/agent-note-windows-embedded-mandatory-update/consequences:
- en: 64cd6585a98f01cd
- zh: 8bca9eb88aa55d8e
diff --git a/.agents/notes/implemented/bug-fix/2026-09-21-multimodal-tool-result-retention.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-21-multimodal-tool-result-retention.i18n.yaml
deleted file mode 100644
index 82aabefd0d..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-21-multimodal-tool-result-retention.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-21-multimodal-tool-result-retention.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-21-multimodal-tool-result-retention.md
-/agent-note-multimodal-tool-result-retention:
- en: aa04c4148785f8ca
- zh: b08c44c8484ea5d2
-/agent-note-multimodal-tool-result-retention/problem:
- en: 9e8765ea40441f36
- zh: 3ca2616499d3c9fc
-/agent-note-multimodal-tool-result-retention/decision:
- en: a65eeedad585fc4b
- zh: 82aae7ef0148282b
-/agent-note-multimodal-tool-result-retention/alternatives-considered:
- en: c670e96a46c93540
- zh: efccc4d3423e5ac0
-/agent-note-multimodal-tool-result-retention/consequences:
- en: 7fdf51600bb0ffd7
- zh: 0ad7f06887b1c859
diff --git a/.agents/notes/implemented/bug-fix/2026-09-21-persistent-pwsh-keeps-controlled-prompt.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-21-persistent-pwsh-keeps-controlled-prompt.i18n.yaml
deleted file mode 100644
index 48e34b2079..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-21-persistent-pwsh-keeps-controlled-prompt.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-21-persistent-pwsh-keeps-controlled-prompt.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-21-persistent-pwsh-keeps-controlled-prompt.md
-/agent-note-persistent-pwsh-keeps-the-backend-s-controlled-prompt:
- en: 78c6e7e3340581dc
- zh: 64e16ab608caa610
-/agent-note-persistent-pwsh-keeps-the-backend-s-controlled-prompt/problem:
- en: 0cd51c293e96d9eb
- zh: 6eb89ee3f1b7a851
-/agent-note-persistent-pwsh-keeps-the-backend-s-controlled-prompt/decision:
- en: edd5cbb51ddad62f
- zh: d7c41f09a9453992
-/agent-note-persistent-pwsh-keeps-the-backend-s-controlled-prompt/alternatives-considered:
- en: a3920fa51dd5ac79
- zh: 29c3f8364f64115e
-/agent-note-persistent-pwsh-keeps-the-backend-s-controlled-prompt/consequences:
- en: d43b72fb5aa0c6da
- zh: c4c9a27d5c7c6338
diff --git a/.agents/notes/implemented/bug-fix/2026-09-22-chat-scroll-follow-and-footer-geometry.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-22-chat-scroll-follow-and-footer-geometry.i18n.yaml
deleted file mode 100644
index e10cbc61b1..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-22-chat-scroll-follow-and-footer-geometry.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-22-chat-scroll-follow-and-footer-geometry.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-22-chat-scroll-follow-and-footer-geometry.md
-/agent-note-separate-chat-clipping-and-independent-follow-intent:
- en: a95aae5eecac228c
- zh: 01b7df574c3d010f
-/agent-note-separate-chat-clipping-and-independent-follow-intent/problem:
- en: 8e4310ee05cf535c
- zh: bd57ba36ebe8c201
-/agent-note-separate-chat-clipping-and-independent-follow-intent/decision:
- en: afe3cf3bb5a92039
- zh: bb11f9f4bcd8f329
-/agent-note-separate-chat-clipping-and-independent-follow-intent/alternatives-considered:
- en: 014e7974ce1cadae
- zh: 63c1743c598413e4
-/agent-note-separate-chat-clipping-and-independent-follow-intent/verification:
- en: 235dc4e251fa8124
- zh: 2c08ab5e14213b54
-/agent-note-separate-chat-clipping-and-independent-follow-intent/consequences:
- en: aa1367b399806ab7
- zh: f98a8b416d9a70c8
diff --git a/.agents/notes/implemented/bug-fix/2026-09-22-input-echo-admission-ownership.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-22-input-echo-admission-ownership.i18n.yaml
deleted file mode 100644
index 6f58c8d30c..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-22-input-echo-admission-ownership.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-22-input-echo-admission-ownership.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-22-input-echo-admission-ownership.md
-/agent-note-input-echoes-retain-display-ownership-through-admission:
- en: 987905631fdf4244
- zh: 2b2a1db249903717
-/agent-note-input-echoes-retain-display-ownership-through-admission/problem:
- en: a56f673056a7d913
- zh: a06acdb9f3e1afd3
-/agent-note-input-echoes-retain-display-ownership-through-admission/decision:
- en: b570ae20a428f554
- zh: b3cf1ebc56fbe78c
-/agent-note-input-echoes-retain-display-ownership-through-admission/alternatives-considered:
- en: 9ee59841301a61f4
- zh: 7ad35e485294dce1
-/agent-note-input-echoes-retain-display-ownership-through-admission/verification:
- en: a1373e299a536929
- zh: 13405143c3bb9331
-/agent-note-input-echoes-retain-display-ownership-through-admission/consequences:
- en: 027d6bae744c47e0
- zh: c9f397bc631298b9
diff --git a/.agents/notes/implemented/bug-fix/2026-09-22-windows-open-through-shell-resolution.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-22-windows-open-through-shell-resolution.i18n.yaml
deleted file mode 100644
index 3a1ef4f137..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-22-windows-open-through-shell-resolution.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-22-windows-open-through-shell-resolution.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-22-windows-open-through-shell-resolution.md
-/agent-note-windows-opens-go-through-explorer-exe:
- en: 315c5e87180365ba
- zh: 4bc29f09bb3900d3
-/agent-note-windows-opens-go-through-explorer-exe/problem:
- en: bc2c92e4247ea71e
- zh: ca20fdeccc58e883
-/agent-note-windows-opens-go-through-explorer-exe/decision:
- en: 4cf76bcb52a7beef
- zh: a55a5bd9a4b85063
-/agent-note-windows-opens-go-through-explorer-exe/alternatives-considered:
- en: 64712f720fca44a1
- zh: aad98e46f0c7a6bb
-/agent-note-windows-opens-go-through-explorer-exe/consequences:
- en: d06af93b608037c9
- zh: 38b1a4c840b0ce51
-/agent-note-windows-opens-go-through-explorer-exe/verification:
- en: c7ff7cb42072737c
- zh: 9bbf5ff6596938a0
diff --git a/.agents/notes/implemented/bug-fix/2026-09-23-bounded-pnpm-runs.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-23-bounded-pnpm-runs.i18n.yaml
deleted file mode 100644
index 1978750d50..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-23-bounded-pnpm-runs.i18n.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-23-bounded-pnpm-runs.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-23-bounded-pnpm-runs.md
-/agent-note-bounding-a-pnpm-run-that-stops-progressing:
- en: c2bd52dec2a41d84
- zh: 80dae83761a09a60
-/agent-note-bounding-a-pnpm-run-that-stops-progressing/problem:
- en: 227a287fe7127eae
- zh: 5d7eae54a4a75f8c
-/agent-note-bounding-a-pnpm-run-that-stops-progressing/decision:
- en: 6a574e5b6d536b5b
- zh: 92a9bb15d983e7db
-/agent-note-bounding-a-pnpm-run-that-stops-progressing/why-a-silence-bound-rather-than-a-duration-bound:
- en: 31287e4e71e7f10f
- zh: ff57c96539d51972
-/agent-note-bounding-a-pnpm-run-that-stops-progressing/alternatives-considered:
- en: 125710ae84911ed4
- zh: 5f35dbcda4447bea
-/agent-note-bounding-a-pnpm-run-that-stops-progressing/testing:
- en: eb3c4907aec48db3
- zh: 56b7168b732c782a
-/agent-note-bounding-a-pnpm-run-that-stops-progressing/related:
- en: a9c6d0a071ea9834
- zh: 0702183c645d03b9
-/agent-note-bounding-a-pnpm-run-that-stops-progressing/consequences:
- en: c13a64cd3dd381e9
- zh: 83d2db47153e3d8c
diff --git a/.agents/notes/implemented/bug-fix/2026-09-24-exited-holder-lock-takeover.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-24-exited-holder-lock-takeover.i18n.yaml
deleted file mode 100644
index ad4ccdf4ab..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-24-exited-holder-lock-takeover.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-24-exited-holder-lock-takeover.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-24-exited-holder-lock-takeover.md
-/agent-note-taking-over-a-writer-lock-whose-holder-exited:
- en: ecf6fb35c9eed3ca
- zh: 59c29b64e23608e4
-/agent-note-taking-over-a-writer-lock-whose-holder-exited/problem:
- en: cf143bc56530fe17
- zh: a4e3ee8fa3b8c465
-/agent-note-taking-over-a-writer-lock-whose-holder-exited/decision:
- en: af22bae72ff97ef8
- zh: 428c09871bba95d1
-/agent-note-taking-over-a-writer-lock-whose-holder-exited/alternatives-considered:
- en: ee800ed269cfc4a2
- zh: df983b552ef25273
-/agent-note-taking-over-a-writer-lock-whose-holder-exited/testing:
- en: 7eb7c5818049415a
- zh: f84c39c55bb3bc5a
-/agent-note-taking-over-a-writer-lock-whose-holder-exited/consequences:
- en: 03f4cda9290188e5
- zh: 07f800776c061218
diff --git a/.agents/notes/implemented/bug-fix/2026-09-27-pwsh-prompt-tail-grace.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-27-pwsh-prompt-tail-grace.i18n.yaml
index d0742687e2..b4f5f12a7b 100644
--- a/.agents/notes/implemented/bug-fix/2026-09-27-pwsh-prompt-tail-grace.i18n.yaml
+++ b/.agents/notes/implemented/bug-fix/2026-09-27-pwsh-prompt-tail-grace.i18n.yaml
@@ -6,8 +6,8 @@
en: 5e8c5673a0669d9c
zh: c8442a6186288a2a
/agent-note-a-seen-prompt-marker-keeps-its-own-tail-grace/problem:
- en: 906f8707987ff36c
- zh: 40430ec1e03ee340
+ en: 2f5e9297c5fd4853
+ zh: 8168c90bc6fa13b5
/agent-note-a-seen-prompt-marker-keeps-its-own-tail-grace/decision:
en: a998f5c6abdd68eb
zh: a7cdd13e1e4de6c6
diff --git a/.agents/notes/implemented/bug-fix/2026-09-27-pwsh-prompt-tail-grace.md b/.agents/notes/implemented/bug-fix/2026-09-27-pwsh-prompt-tail-grace.md
index 375ba521d5..68d22a753a 100644
--- a/.agents/notes/implemented/bug-fix/2026-09-27-pwsh-prompt-tail-grace.md
+++ b/.agents/notes/implemented/bug-fix/2026-09-27-pwsh-prompt-tail-grace.md
@@ -6,7 +6,7 @@ English | [中文](2026-09-27-pwsh-prompt-tail-grace.zh.md)
## Problem
-Windows sessions on the self-hosted lane settled one or two of seven sends on the controlled prompt and charged the silence tier for the rest (2026-09-25/26, issue #2487). The exact readiness evidence is the controlled prompt's printable tail after the OSC `133;D` marker, and the bound on waiting for it was `idleSilenceMs + handoffGraceMs`. A native Windows probe shows the render arrives as two pty chunks: the marker alone, then the five-byte `dsh> ` 2-28 ms later (56 renders under Windows PowerShell 5.1, the same two-chunk render under pwsh 7.6.6), with nothing printable after any prompt and no terminal queries in the output. The marker is written by the shell's own prompt function and the tail by the same render, so a tail that arrives past the bound means the host stalled that delivery, not that the prompt is absent. The session settled `inferred_idle` anyway, and each such send cost the tool call roughly three seconds. The lane's own failures are not that state: the first master run carrying this field (run 36326153388, 2026-09-27 14:30Z) took the same 20.8 s as the run before it (36309006133), so its degraded sends settled at the plain bound with the tolerance inert; the [Windows-lane observation note](../testing/2026-09-27-observation-waits-on-observed-state.md) records the open investigation.
+Windows sessions on the self-hosted lane settled one or two of seven sends on the controlled prompt and charged the silence tier for the rest (2026-09-25/26, issue #2487). The exact readiness evidence is the controlled prompt's printable tail after the OSC `133;D` marker, and the bound on waiting for it was `idleSilenceMs + handoffGraceMs`. A native Windows probe shows the render arrives as two pty chunks: the marker alone, then the five-byte `dsh> ` 2-28 ms later (56 renders under Windows PowerShell 5.1, the same two-chunk render under pwsh 7.6.6), with nothing printable after any prompt and no terminal queries in the output. The marker is written by the shell's own prompt function and the tail by the same render, so a tail that arrives past the bound means the host stalled that delivery, not that the prompt is absent. The session settled `inferred_idle` anyway, and each such send cost the tool call roughly three seconds. The lane's own failures are not that state: the first master run carrying this field (run 36326153388, 2026-09-27 14:30Z) took the same 20.8 s as the run before it (36309006133), so its degraded sends settled at the plain bound with the tolerance inert; the [Windows-lane observation note](../testing/2026-09-27-observation-waits-on-observed-state.md) records that investigation, and the [bundled console host note](2026-09-28-pty-bundled-console-host.md) measures that pool's tail arriving already malformed (`\ndsh>\x1b[1C`), which no bound on a well-formed tail can cover. This field still owns genuinely delayed tails.
## Decision
diff --git a/.agents/notes/implemented/bug-fix/2026-09-27-pwsh-prompt-tail-grace.zh.md b/.agents/notes/implemented/bug-fix/2026-09-27-pwsh-prompt-tail-grace.zh.md
index 511cedf728..5efebc7137 100644
--- a/.agents/notes/implemented/bug-fix/2026-09-27-pwsh-prompt-tail-grace.zh.md
+++ b/.agents/notes/implemented/bug-fix/2026-09-27-pwsh-prompt-tail-grace.zh.md
@@ -6,7 +6,7 @@ Status: implemented
## Problem
-自托管 lane 上的 Windows 会话在七次 send 中只有一到两次按受控提示符结算，其余都要支付静默层（2026-09-25/26，issue #2487）。精确的就绪证据是 OSC `133;D` 标记之后受控提示符的可打印尾部，而等待它的上界是 `idleSilenceMs + handoffGraceMs`。原生 Windows 探测表明该渲染以两个 pty 分块到达：先是标记本身，2–28 毫秒后是 5 字节的 `dsh> `（Windows PowerShell 5.1 下 56 次渲染，pwsh 7.6.6 下同样是两分块渲染），任何提示符之后都没有可打印文本，输出中也没有终端查询。标记由 shell 自己的 prompt 函数写出、尾部由同一次渲染写出，因此尾部晚于上界到达意味着宿主机拖慢了这次投递，而不是提示符缺失。会话此前仍会按 `inferred_idle` 结算，每次这样的 send 让工具调用多付约三秒。该 lane 自身的失败不是这种状态：首个带着该字段的 master run（run 36326153388，2026-09-27 14:30Z）与其前一个 run（36309006133）同样耗时 20.8 秒，因此其退化的 send 是在宽限不起作用的情况下按普通上界结算的；[Windows lane 观测笔记](../testing/2026-09-27-observation-waits-on-observed-state.zh.md)记录了这项仍未关闭的调查。
+自托管 lane 上的 Windows 会话在七次 send 中只有一到两次按受控提示符结算，其余都要支付静默层（2026-09-25/26，issue #2487）。精确的就绪证据是 OSC `133;D` 标记之后受控提示符的可打印尾部，而等待它的上界是 `idleSilenceMs + handoffGraceMs`。原生 Windows 探测表明该渲染以两个 pty 分块到达：先是标记本身，2–28 毫秒后是 5 字节的 `dsh> `（Windows PowerShell 5.1 下 56 次渲染，pwsh 7.6.6 下同样是两分块渲染），任何提示符之后都没有可打印文本，输出中也没有终端查询。标记由 shell 自己的 prompt 函数写出、尾部由同一次渲染写出，因此尾部晚于上界到达意味着宿主机拖慢了这次投递，而不是提示符缺失。会话此前仍会按 `inferred_idle` 结算，每次这样的 send 让工具调用多付约三秒。该 lane 自身的失败不是这种状态：首个带着该字段的 master run（run 36326153388，2026-09-27 14:30Z）与其前一个 run（36309006133）同样耗时 20.8 秒，因此其退化的 send 是在宽限不起作用的情况下按普通上界结算的；[Windows lane 观测笔记](../testing/2026-09-27-observation-waits-on-observed-state.zh.md)记录了该调查，而[自带控制台宿主说明](2026-09-28-pty-bundled-console-host.zh.md)实测该池的尾部以已经畸形的形态到达（`\ndsh>\x1b[1C`），任何针对良构尾部的上界都覆盖不了。本字段仍然负责真正迟到的尾部。
## Decision
diff --git a/.agents/notes/implemented/bug-fix/2026-09-28-pty-bundled-console-host.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-28-pty-bundled-console-host.i18n.yaml
new file mode 100644
index 0000000000..817b227486
--- /dev/null
+++ b/.agents/notes/implemented/bug-fix/2026-09-28-pty-bundled-console-host.i18n.yaml
@@ -0,0 +1,22 @@
+# Bilingual-pair consistency record for 2026-09-28-pty-bundled-console-host.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-28-pty-bundled-console-host.md
+/agent-note-windows-persistent-ptys-use-the-console-host-node-pty-ships:
+ en: 5d0101a130154663
+ zh: 9fe1948abd4b6576
+/agent-note-windows-persistent-ptys-use-the-console-host-node-pty-ships/problem:
+ en: d5e9c94b6a210a8e
+ zh: e2e15aac77dd34ee
+/agent-note-windows-persistent-ptys-use-the-console-host-node-pty-ships/decision:
+ en: 1b4f56354db760c5
+ zh: f467d13f84872e66
+/agent-note-windows-persistent-ptys-use-the-console-host-node-pty-ships/alternatives-considered:
+ en: c65cbf2fa36636a3
+ zh: fdf846dd4c8a39cb
+/agent-note-windows-persistent-ptys-use-the-console-host-node-pty-ships/consequences:
+ en: 5af486852c78125e
+ zh: 68215646a34b4412
+/agent-note-windows-persistent-ptys-use-the-console-host-node-pty-ships/testing:
+ en: eebdb2d7c7e61d9e
+ zh: da8dd1df06180dee
diff --git a/.agents/notes/implemented/bug-fix/2026-09-28-pty-bundled-console-host.md b/.agents/notes/implemented/bug-fix/2026-09-28-pty-bundled-console-host.md
new file mode 100644
index 0000000000..6caee6d9a3
--- /dev/null
+++ b/.agents/notes/implemented/bug-fix/2026-09-28-pty-bundled-console-host.md
@@ -0,0 +1,39 @@
+# Agent Note: Windows persistent PTYs use the console host node-pty ships
+
+Status: implemented
+
+English | [中文](2026-09-28-pty-bundled-console-host.zh.md)
+
+## Problem
+
+The master `serial / windows (self-hosted standby)` drill has been red since 2026-09-15: its `test:coverage` gate fails on `packages/shell/tool-pwsh-persistent/tests/loader-composition.spec.ts`, either with `settleReasons` reporting one `stdin_read` among six `inferred_idle` settlements or with the case exhausting its 120 s budget. The same case passes in 5.3 s on the Blacksmith Windows image.
+
+Windows has no exact stdin-wait tier: `WindowsProcessInspector.isStdinWaiting()` always returns false and `foregroundPgid()` returns the shell pid, so `inspectForeground()` can only report `inputWaiting: false`. The persistent-pwsh readiness path therefore settles `stdin_read` only after it has seen both the OSC `133;D;` marker and the printable `dsh> ` tail written by the same prompt render (`terminal-bash/src/session.ts`).
+
+Probing the pool machine directly (node-pty 1.2.0-beta.15, `pwsh -NoLogo -NoProfile`, 160x40, `TERM=dumb`) shows why that tail never matches there: once a command's output scrolls the viewport, the console host Windows itself provides replays the prompt line as `\ndsh>\x1b[1C` — a leading newline, the prompt text without its trailing space, and a cursor-forward escape in place of that space. `TerminalSanitizer` accumulates the printable text after the marker, so the tail becomes `\ndsh>`, which neither equals `dsh> ` nor prefixes it, and every later send waits out the silence tier. Five of seven prompts took that form on the pool machine; the same command sequence on Windows 11 25H2 (conhost 10.0.26100.1) renders `dsh> ` verbatim. The [seen-marker tail grace](2026-09-27-pwsh-prompt-tail-grace.md) recorded the same red signal as a late tail and shipped `promptTailGraceMs`; this measurement replaces that attribution for these hosts, because a tail that has already arrived in a non-prefixing form never satisfies the condition the grace extends.
+
+## Decision
+
+`subprocess-local` allocates Windows terminals with node-pty's `useConptyDll: true`, so the PTY is backed by the OpenConsole the node-pty package ships instead of the console host the operating system provides. The option is set only when the runtime platform is `win32`; POSIX allocation is unchanged.
+
+The same command sequence on the pool machine through the bundled console host rendered `dsh> ` for all seven prompts.
+
+## Alternatives considered
+
+**Rely on `promptTailGraceMs`, the grace shipped for late tails.** Rejected: the extended bound applies only while the arrived tail still prefixes `dsh> ` (`tailPending` in `terminal-bash/src/session.ts`). A pool prompt renders `\ndsh>`, which prefixes nothing in that comparison, so the grace is never reached and the sends keep settling on the plain silence bound.
+
+**Teach `TerminalSanitizer` to tolerate the operating system console host's rendering.** Rejected: normalizing the leading newline and `CSI nC` into the tail keeps the readiness path working, but it writes one console host's quirk into the sanitizer and leaves any other repaint form to reintroduce the same divergence. The console host is a replaceable component, and the package already ships a current one.
+
+**Keep the operating system console host and accept the red drill.** Rejected: the drill is the only continuous evidence that the in-house Windows pool can take over the required lanes, and it has been red for two weeks.
+
+**Upgrade the pool machines' Windows.** Rejected as this repository's fix: it requires rebuilding production CI hosts (Server 2022, Windows 10 22H2), and the rendering difference returns on any host that is not current.
+
+## Consequences
+
+Windows PTY allocation now depends on node-pty's bundled OpenConsole binaries. The desktop runtime file policy already retains `node-pty/prebuilds/win32-x64/conpty/conpty.dll` and `OpenConsole.exe`, and the package resolves them relative to its own addon, so the packaged desktop runtime keeps working; that policy is now load-bearing for terminal allocation rather than only for keeping the source distribution intact.
+
+Console signals keep their documented behavior: SIGINT is still delivered as a `\x03` input write that the console host turns into a console-wide CTRL_C event, and the Windows inspector is unchanged. The allocated process id still names the shell: on the pool machine `pty.pid` resolves to `pwsh.exe` and equals the shell's own `$PID` under both console hosts. node-pty marks `useConptyDll` experimental, so a node-pty upgrade can change it; a unit test pins the option as present for `win32` and absent elsewhere. Both teardown paths still publish node-pty's exit event on the pool machine under the bundled host (about 1.1 s for a `taskkill` tree kill and for a bare `kill()`), and an unresolvable `conpty/conpty.dll` fails loud: node-pty throws instead of falling back to the operating system host.
+
+## Testing
+
+`packages/subprocess/subprocess-local/tests/local.spec.ts` pins the option per platform: present for `win32`, absent for a POSIX platform. The end-to-end signal for the pool is the next master push's `serial / windows (self-hosted standby)` run, whose sends settle on the prompt path instead of the silence bound. No e2e, snapshot, or sandbox case applies: this change selects a PTY backend and produces no model- or product-user-visible output of its own. The packaged runtime keeps the assets this option resolves, pinned by the retained-file assertions in `apps/desktop/tests/runtime-file-policy.spec.ts`, and the Electron payload smoke passes the option when it allocates a PTY from that tree on Windows, so the packaged path and the separately pinned retained-file list are both exercised.
diff --git a/.agents/notes/implemented/bug-fix/2026-09-28-pty-bundled-console-host.zh.md b/.agents/notes/implemented/bug-fix/2026-09-28-pty-bundled-console-host.zh.md
new file mode 100644
index 0000000000..c8d2907b6f
--- /dev/null
+++ b/.agents/notes/implemented/bug-fix/2026-09-28-pty-bundled-console-host.zh.md
@@ -0,0 +1,39 @@
+# Agent Note: Windows 持久 PTY 使用 node-pty 自带的控制台宿主
+
+Status: implemented
+
+[English](2026-09-28-pty-bundled-console-host.md) | 中文
+
+## 问题
+
+master 的 `serial / windows (self-hosted standby)` 演练自 2026-09-15 起一直红：`test:coverage` gate 在 `packages/shell/tool-pwsh-persistent/tests/loader-composition.spec.ts` 上失败，形态要么是 `settleReasons` 报出六次 `inferred_idle` 结算里只有一次 `stdin_read`，要么是用例耗尽 120 s 预算。同一个用例在 Blacksmith 的 Windows 镜像上 5.3 s 通过。
+
+Windows 没有精确的 stdin-wait 档：`WindowsProcessInspector.isStdinWaiting()` 恒为 false、`foregroundPgid()` 返回 shell pid，因此 `inspectForeground()` 只能报 `inputWaiting: false`。持久 pwsh 的就绪路径只有在同时看到 OSC `133;D;` 标记与同一次 prompt 渲染写出的可打印 `dsh> ` 尾部之后，才结算 `stdin_read`（`terminal-bash/src/session.ts`）。
+
+直接在池机器上探测（node-pty 1.2.0-beta.15、`pwsh -NoLogo -NoProfile`、160x40、`TERM=dumb`）说明了那个尾部为何在池上匹配不上：命令输出把视口滚动一次之后，Windows 自带的控制台宿主把提示符行重绘成 `\ndsh>\x1b[1C`——一个前导换行、去掉尾随空格的提示符文本，以及代替那个空格的 cursor-forward 转义。`TerminalSanitizer` 累积标记之后的非转义文本，于是尾部成了 `\ndsh>`，既不等于 `dsh> ` 也不构成它的前缀，此后每次 send 都要等满静默档。池机器上七个提示符里有五个是这个形态；同一串命令在 Windows 11 25H2（conhost 10.0.26100.1）上原样渲染出 `dsh> `。[已见标记的尾部宽限](2026-09-27-pwsh-prompt-tail-grace.zh.md)把同一个红信号记为尾部迟到，并为此交付了 `promptTailGraceMs`；本次测量取代了该归因在这类宿主上的适用范围——已经以非前缀形态到达的尾部永远不满足宽限所延长的那个条件。
+
+## 决策
+
+`subprocess-local` 分配 Windows 终端时传 node-pty 的 `useConptyDll: true`，PTY 因此由 node-pty 包自带的 OpenConsole 承载，而不是操作系统提供的控制台宿主。该选项仅在运行时平台为 `win32` 时设置；POSIX 分配不变。
+
+同一串命令在池机器上经由自带控制台宿主时，七个提示符全部渲染出 `dsh> `。
+
+## 备选方案
+
+**依赖为迟到尾部交付的 `promptTailGraceMs`。** 否决：延长的上界只在已到达的尾部仍构成 `dsh> ` 前缀时生效（`terminal-bash/src/session.ts` 的 `tailPending`）。池上的提示符渲染成 `\ndsh>`，在这个比较里不构成任何前缀，因此宽限永远到不了，send 继续按普通静默上界结算。
+
+**让 `TerminalSanitizer` 容忍操作系统控制台宿主的渲染形态。** 否决：把前导换行与 `CSI nC` 归一进尾部能让就绪路径继续工作，但它把一个控制台宿主的怪癖写进 sanitizer，之后任何别的重绘形态都会重新引入同一类偏离。控制台宿主是可替换组件，而包里已经带了当前版本。
+
+**保留操作系统控制台宿主并接受演练长期红。** 否决：这条演练是「自有 Windows 池能接管必需 lane」的唯一持续证据，它已经红了两周。
+
+**升级池机器的 Windows。** 作为本仓库的修法否决：它需要重建生产 CI 主机（Server 2022、Windows 10 22H2），而且任何非最新宿主上这个渲染差异都会回来。
+
+## 后果
+
+Windows PTY 分配现在依赖 node-pty 自带的 OpenConsole 二进制。桌面端运行时文件策略已经保留 `node-pty/prebuilds/win32-x64/conpty/conpty.dll` 与 `OpenConsole.exe`，且包按自身 addon 位置解析它们，因此打包后的桌面运行时仍然可用；该策略现在对终端分配是承重的，不只是为了保留源码分发内容。
+
+控制台信号保持文档化的行为：SIGINT 仍以 `\x03` 输入写入投递、由控制台宿主转成控制台级 CTRL_C 事件，Windows inspector 未变。分配到的进程 id 仍然指向 shell：在池机器上 `pty.pid` 解析为 `pwsh.exe`，且与 shell 自己的 `$PID` 在两种控制台宿主下都相等。node-pty 把 `useConptyDll` 标为实验性，因此 node-pty 升级可能改变它；一条单测钉住该选项：`win32` 上存在、其它平台不存在。两种拆卸路径在池机器上、自带控制台宿主下都会发出 node-pty 的退出事件（`taskkill` 树杀与裸 `kill()` 各约 1.1 s）；解析不到 `conpty/conpty.dll` 时是硬失败——node-pty 直接抛错，不会回退到操作系统控制台宿主。
+
+## 测试
+
+`packages/subprocess/subprocess-local/tests/local.spec.ts` 按平台钉住该选项：`win32` 上存在、POSIX 平台上不存在。池侧的端到端信号是下一次 master push 的 `serial / windows (self-hosted standby)` run——它的 send 将按提示符路径结算，而不是等满静默上界。e2e、snapshot、sandbox 三类不适用：本改动只选择 PTY 后端，本身不产生模型可见或产品用户可见的输出。打包运行时保留了该选项要解析的资产，由 `apps/desktop/tests/runtime-file-policy.spec.ts` 的保留清单断言钉住；Electron payload smoke 在 Windows 上从该树分配 PTY 时也传该选项，因此打包路径与单独钉住的保留清单都会被覆盖。
diff --git a/.agents/notes/implemented/bug-fix/2026-09-30-job-session-lifecycle.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-30-job-session-lifecycle.i18n.yaml
index 9808841e3a..c0741def43 100644
--- a/.agents/notes/implemented/bug-fix/2026-09-30-job-session-lifecycle.i18n.yaml
+++ b/.agents/notes/implemented/bug-fix/2026-09-30-job-session-lifecycle.i18n.yaml
@@ -9,8 +9,8 @@
en: b3d0591cc559e466
zh: aa4c385e84f7eaa1
/agent-note-persist-owned-job-lifecycle-facts/decision:
- en: 7748eabcc29afd20
- zh: 08e5cd283bc2bcba
+ en: 42bc368642abf66d
+ zh: df21d7f36c6946a7
/agent-note-persist-owned-job-lifecycle-facts/alternatives-considered:
en: e95b3dd9a87d0805
zh: 39edb0eb03c26f9c
diff --git a/.agents/notes/implemented/bug-fix/2026-09-30-job-session-lifecycle.md b/.agents/notes/implemented/bug-fix/2026-09-30-job-session-lifecycle.md
index 740eb52663..83453c9981 100644
--- a/.agents/notes/implemented/bug-fix/2026-09-30-job-session-lifecycle.md
+++ b/.agents/notes/implemented/bug-fix/2026-09-30-job-session-lifecycle.md
@@ -16,7 +16,7 @@ The terminal record distinguishes producer acknowledgement from forced bookkeepi
Facts are captured at the registry commit and published in microtask order before completion waiters resume. This avoids reentering Session append when a Session observer starts a job. Recording errors warn independently: already-started work still has its control id, and a failed journal append cannot prevent cleanup or release of waiters. The Session's ordinary persistence and SDK notification paths own delivery after append.
-The live registry and resource ownership decisions remain in the [generic runtime note](../architecture/2026-06-20-generic-long-running-tool-runtime.md) and [seam consolidation note](../architecture/2026-09-03-jobs-seam-consolidation.md). Those notes remain active; this journal adds durable observations without replacing their execution or event-routing responsibilities.
+The [registry contract](../../../../packages/jobs/jobs/README.md) and [seam consolidation note](../architecture/2026-09-03-jobs-seam-consolidation.md) own live execution, resource ownership, and event routing. This journal adds durable observations without replacing those responsibilities.
## Alternatives considered
diff --git a/.agents/notes/implemented/bug-fix/2026-09-30-job-session-lifecycle.zh.md b/.agents/notes/implemented/bug-fix/2026-09-30-job-session-lifecycle.zh.md
index 00b597bc3f..e611b02566 100644
--- a/.agents/notes/implemented/bug-fix/2026-09-30-job-session-lifecycle.zh.md
+++ b/.agents/notes/implemented/bug-fix/2026-09-30-job-session-lifecycle.zh.md
@@ -16,7 +16,7 @@ SDK 消费方接收 Session 事件，而 job 注册和结算此前只存在于
事实在注册表提交时捕获，并在完成等待方恢复前按微任务顺序发布。这避免 Session 观察者启动 job 时重入 Session append。记录错误单独发出警告：已启动的工作仍有可控制的 id，日志追加失败不能阻止清理或释放等待方。追加后的投递由 Session 既有的持久化和 SDK 通知路径负责。
-运行期注册表与资源归属决策仍由[通用运行时说明](../architecture/2026-06-20-generic-long-running-tool-runtime.zh.md)和[seam 收敛说明](../architecture/2026-09-03-jobs-seam-consolidation.zh.md)负责。这些记录保持有效；本日志增加持久化观测，不替代其执行或事件路由职责。
+[注册表约定](../../../../packages/jobs/jobs/README.zh.md)和[seam 收敛说明](../architecture/2026-09-03-jobs-seam-consolidation.zh.md)负责运行期执行、资源归属和事件路由。本日志增加持久化观测，不替代这些职责。
## Alternatives considered
diff --git a/.agents/notes/implemented/bug-fix/2026-09-30-session-list-host-fairness.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-30-session-list-host-fairness.i18n.yaml
new file mode 100644
index 0000000000..817413b901
--- /dev/null
+++ b/.agents/notes/implemented/bug-fix/2026-09-30-session-list-host-fairness.i18n.yaml
@@ -0,0 +1,22 @@
+# Bilingual-pair consistency record for 2026-09-30-session-list-host-fairness.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-30-session-list-host-fairness.md
+/agent-note-time-sliced-session-list-work:
+ en: 0e8f0cce65f887bc
+ zh: 1f3b669c1eef811f
+/agent-note-time-sliced-session-list-work/problem:
+ en: 5ee132d1d44f463b
+ zh: 45589b49771d49e1
+/agent-note-time-sliced-session-list-work/decision:
+ en: 95b04ae405a5299f
+ zh: 53f1d8bf5e29e3ca
+/agent-note-time-sliced-session-list-work/measurement-and-calibration:
+ en: e12fe17a32ede555
+ zh: 6b16a72863073e47
+/agent-note-time-sliced-session-list-work/alternatives-considered:
+ en: a2f441a550c0ed7e
+ zh: 05e8bfd584217103
+/agent-note-time-sliced-session-list-work/consequences:
+ en: 5fd10d559a120ae6
+ zh: a56f45b77ce1f4e6
diff --git a/.agents/notes/implemented/bug-fix/2026-09-30-session-list-host-fairness.md b/.agents/notes/implemented/bug-fix/2026-09-30-session-list-host-fairness.md
new file mode 100644
index 0000000000..d0b6520de1
--- /dev/null
+++ b/.agents/notes/implemented/bug-fix/2026-09-30-session-list-host-fairness.md
@@ -0,0 +1,69 @@
+# Agent Note: Time-sliced Session-list work
+
+Status: implemented
+
+English | [中文](2026-09-30-session-list-host-fairness.zh.md)
+
+## Problem
+
+Large cached projection states can monopolize the Host while a Session list is assembled. Yielding after every row avoids that batch stall but adds thousands of event-loop round trips when a list contains many cheap rows. Row count alone is not a useful scheduling budget.
+
+## Decision
+
+[ApiSessionList](../../../../packages/api/session-controller/src/list.ts) uses one monotonic deadline for classification and summary generation. It yields only after elapsed work exhausts the configured `listWorkSliceMs`, then starts a new deadline after the wait. The optional deployment setting defaults to 16 positive integral milliseconds. Small lists have no forced final yield or no-op asynchronous helper. Cancellation is checked per row, after each yield, and before returning; no partial list is returned.
+
+Every row remains synchronous. Live rows precede queued cold rows before the stable activity sort; the list promises no cross-Session atomic cut. A cold row already queued before an attachment remains cached, and Client mutation replay plus [cached/sequenced precedence](../architecture/2026-09-19-projection-cache-listing-identity-and-cached-rows.md) reconcile the newer live state. No projection data or validation is omitted.
+
+## Measurement and calibration
+
+The [production-entry benchmark](../../../../benchmarks/session-corpus/projection-list.bench.ts) measures the real Session Controller, query engine, persistence, projection registry/cache and storage domain. Persisted fixtures use `generationLogPath`, `toHeaderLine` and `compressZstdFrame` from the persistence owner. All content is deterministic generated data. Setup and explicit GC are outside timing; complete results and JSON remain reachable during memory sampling.
+
+| Workload | Sessions | State observations | Request records | State JSON |
+|---|---:|---:|---:|---:|
+| Cheap live | 3,000 | 0 | 0 | 277,890 bytes |
+| Modest persisted | 50 | 4,925 | 641 | 1,813,852 bytes |
+| Heavy persisted | 300 | 300,000 | 37,575 | 111,255,440 bytes |
+
+The cheap live case avoids disk enumeration masking scheduling cost. Persisted row counts use 50/75/100/175% strata of 100 or 1,000 generated observations. Each fresh child measures one first call and three repeats with a single fixed-cost immediate probe per call. A separate fifth call re-arms at most one pending probe to measure the worst queue delay over the complete list. Full-probe timings are not throughput evidence: per-row yielding would otherwise execute proportionally more diagnostic callbacks. Yield counts exclude post-measurement GC helpers. Peak RSS includes setup and the entire process lifetime.
+
+Local Node 26.5.0/macOS arm64 comparisons alternate implementations and use three fresh children per workload. Repeat metrics first take each child's median, then the median across children. Queue delay takes the maximum in each separate diagnostic call, then the median across children.
+
+| Repeated metric | Synchronous | Per-row yield | 16 ms slices |
+|---|---:|---:|---:|
+| Cheap live: list + JSON | 61.60 ms | 111.65 ms | 65.68 ms |
+| Cheap live: yield calls | 0 | 3,000 | 3 |
+| Cheap live: maximum queue delay | 54.35 ms | 0.54 ms | 16.54 ms |
+| Modest persisted: list + JSON | 19.76 ms | 18.23 ms | 18.26 ms |
+| Modest persisted: yield calls | 0 | 50 | 0 |
+| Heavy persisted: list + JSON | 253.22 ms | 291.36 ms | 232.18 ms |
+| Heavy persisted: yield calls | 0 | 300 | 10 |
+| Heavy persisted: maximum queue delay | 172.39 ms | 0.80 ms | 16.67 ms |
+
+For cheap lists, slicing removes 99.9% of per-row yields and reduces measured repeat time by 41.2%; the synchronous reference remains slightly faster. Heavy-list wall time varies substantially on the shared host, so no universal throughput speedup is asserted. Retained heap stays about 35 MB for cheap lists and 186–188 MB for heavy lists, without a decoded-state cache.
+
+| Raw child aggregates | Synchronous | Per-row yield | 16 ms slices |
+|---|---|---|---|
+| Cheap repeat ms | [63.10, 61.60, 59.08] | [108.19, 115.61, 111.65] | [65.68, 71.75, 65.17] |
+| Cheap maximum queue ms | [112.69, 54.35, 49.67] | [0.54, 0.76, 0.41] | [16.41, 16.54, 41.15] |
+| Heavy repeat ms | [277.06, 253.22, 236.22] | [291.36, 302.76, 282.01] | [212.35, 232.18, 304.38] |
+| Heavy maximum queue ms | [297.76, 172.39, 164.17] | [0.56, 1.34, 0.80] | [16.39, 16.67, 16.76] |
+
+Separate 4/8/16 ms experiments measured cheap-list repeat medians of 58.39/58.57/52.34 ms and heavy-list medians of 279.81/253.85/216.67 ms. Their heavy-list maximum queued-work delay medians were 5.19/8.45/16.70 ms. The 16 ms default chooses fewer round trips while retaining a short work target; deployments can select a smaller budget.
+
+CI uses elapsed queue-delay and coarse throughput limits, not an exact batch size. The shared scale 2 and headroom 1.25 turn a 30 ms queue reference allowance into 75 ms, leaving room for one-row overshoot and scheduling variance while rejecting an unyielded heavy batch. Throughput reference allowances are 50/500/150 ms for modest/heavy/cheap, producing 125/1,250/375 ms bounds. These are safety ceilings, not claims of fine-grained non-regression. The earlier Linux Node 24.21 EPYC run measured 102.16/779.57 ms first calls for modest/heavy cases; the larger heavy allowance accounts for the observed hosted/reference ratio exceeding 2. Heap uses 240 MiB and only variance headroom, giving 300 MiB.
+
+The existing [3,000-Session corpus lane](../testing/2026-09-28-session-corpus-performance.md) remains the stored-corpus throughput authority. Its earlier per-row CI run measured first-call samples 3,205.3/3,166.2/3,165.1 ms and repeat samples 2,643.5/2,577.8/2,589.6 ms, within its existing calibrated limits. The projection benchmark adds a distinct cheap-live and large-state dimension rather than replacing that corpus. On the same local machine, the stored-corpus per-row/sliced first medians are 885.5/859.4 ms and repeat medians are 700.3/692.1 ms; that small difference is within ordinary run variation, with no observed throughput regression. The new three-workload file takes 23.98 s locally, including fixture setup and all nine children; its previously measured two-workload CI version took 36.80 s on EPYC Node 24.21.0.
+
+## Alternatives considered
+
+**Unconditional per-row yielding.** It minimizes individual queue waits but charges an event-loop round trip for every cheap row. The many-live-Session comparison exposes that cost; a fixed number of rows would still ignore variable row cost.
+
+**Larger or smaller time slices.** Smaller slices offer shorter queue waits at more scheduling cost. Larger slices reduce switching but extend the period other Host work waits. Configuration exposes this tradeoff without changing row semantics.
+
+**Caching decoded state or wire views.** Decoded-state reuse retains another graph per stored row and changes schema-evaluation ownership. Wire views can depend on current runtime state. Scheduling needs neither cache and preserves all schema checks and dynamic views.
+
+## Consequences
+
+[Controlled-clock tests](../../../../packages/api/session-controller/tests/list-scheduling.host.spec.ts) require cheap rows to remain in one synchronous slice, budget exhaustion and post-wait reset to govern yields, and cancellation to stop work even when no yield is due. They also preserve stable ties and attachment/removal/status interleavings. The time-based benchmark guard rejects unyielded or first-only-yield heavy work without forbidding efficient batches.
+
+A single row, provider enumeration, GC, final sorting and serialization can exceed the target. Concurrent lists and operating-system scheduling also affect latency. The budget is not a hard global bound, and these measurements do not claim browser paint or model/network latency improvements.
diff --git a/.agents/notes/implemented/bug-fix/2026-09-30-session-list-host-fairness.zh.md b/.agents/notes/implemented/bug-fix/2026-09-30-session-list-host-fairness.zh.md
new file mode 100644
index 0000000000..3e52f5503c
--- /dev/null
+++ b/.agents/notes/implemented/bug-fix/2026-09-30-session-list-host-fairness.zh.md
@@ -0,0 +1,69 @@
+# Agent Note: 按时间片执行 Session 列表工作
+
+Status: implemented
+
+[English](2026-09-30-session-list-host-fairness.md) | 中文
+
+## 问题
+
+较大的缓存投影状态会在组装 Session 列表时独占 Host。每行都让出可以避免整批停顿，却会在包含大量低开销行的列表上增加数千次事件循环往返。行数本身不是合适的调度预算。
+
+## 决策
+
+[ApiSessionList](../../../../packages/api/session-controller/src/list.ts) 对分类和摘要生成共享一个单调时钟截止时间。仅当经过的工作时间耗尽配置的 `listWorkSliceMs` 时才让出，并在等待结束后建立新的截止时间。这个可选部署设置默认为 16 毫秒，要求正整数。小列表没有强制的最后一次让出，也不经过空操作异步 helper。每行、每次让出之后以及返回前检查取消；不会返回部分列表。
+
+每行仍同步计算。live 行先于已进入队列的 cold 行，随后按活动时间稳定排序；列表不承诺跨 Session 的原子 cut。接入前已经排入队列的冷行仍是缓存行，Client 变更重放与 [cached/sequenced 优先级](../architecture/2026-09-19-projection-cache-listing-identity-and-cached-rows.zh.md)协调较新的 live 状态。不省略任何投影数据或校验。
+
+## 测量与校准
+
+[生产入口基准](../../../../benchmarks/session-corpus/projection-list.bench.ts)测量真实 Session Controller、查询引擎、持久化、投影注册表与缓存，以及 storage domain。持久化夹具使用持久化拥有方的 `generationLogPath`、`toHeaderLine` 和 `compressZstdFrame`。全部内容都是确定性生成数据。准备和显式 GC 不计入耗时；内存采样时完整结果与 JSON 仍可达。
+
+| 负载 | Session 数 | 状态观测数 | 请求记录数 | 状态 JSON |
+|---|---:|---:|---:|---:|
+| 低开销驻留 | 3,000 | 0 | 0 | 277,890 bytes |
+| 适中持久化 | 50 | 4,925 | 641 | 1,813,852 bytes |
+| 大状态持久化 | 300 | 300,000 | 37,575 | 111,255,440 bytes |
+
+低开销驻留场景避免磁盘枚举掩盖调度成本。持久化行按 100 或 1,000 条生成观测的 50/75/100/175% 分层。每个全新子进程测量一次首次调用和三次重复调用，每次只使用一个固定成本的 immediate 探针。独立的第五次调用以最多一个待处理探针反复采样，测量完整列表中的最差排队延迟。完整探针模式的耗时不作为吞吐量证据，否则逐行让出会按比例执行更多诊断回调。yield 次数不包含测量后 GC helper 的调用。峰值 RSS 包含准备阶段及整个进程生命周期。
+
+本地比较使用 Node 26.5.0/macOS arm64，交替运行实现，每种负载使用三个全新子进程。重复指标先取每个子进程的中位数，再取子进程间的中位数。排队延迟先取独立诊断调用的最大值，再取子进程间的中位数。
+
+| 重复读取指标 | 同步 | 逐行让出 | 16 ms 时间片 |
+|---|---:|---:|---:|
+| 低开销驻留：列表与 JSON | 61.60 ms | 111.65 ms | 65.68 ms |
+| 低开销驻留：yield 次数 | 0 | 3,000 | 3 |
+| 低开销驻留：最大排队延迟 | 54.35 ms | 0.54 ms | 16.54 ms |
+| 适中持久化：列表与 JSON | 19.76 ms | 18.23 ms | 18.26 ms |
+| 适中持久化：yield 次数 | 0 | 50 | 0 |
+| 大状态持久化：列表与 JSON | 253.22 ms | 291.36 ms | 232.18 ms |
+| 大状态持久化：yield 次数 | 0 | 300 | 10 |
+| 大状态持久化：最大排队延迟 | 172.39 ms | 0.80 ms | 16.67 ms |
+
+在低开销列表中，时间片去掉了 99.9% 的逐行 yield，并使测得的重复耗时下降 41.2%；同步参考仍略快。共享 Host 上大状态列表的墙钟耗时波动明显，因此不宣称普遍提高吞吐量。常驻堆在低开销场景约为 35 MB，在大状态场景约为 186–188 MB，没有解码状态缓存。
+
+| 原始子进程聚合值 | 同步 | 逐行让出 | 16 ms 时间片 |
+|---|---|---|---|
+| 低开销重复 ms | [63.10, 61.60, 59.08] | [108.19, 115.61, 111.65] | [65.68, 71.75, 65.17] |
+| 低开销最大排队 ms | [112.69, 54.35, 49.67] | [0.54, 0.76, 0.41] | [16.41, 16.54, 41.15] |
+| 大状态重复 ms | [277.06, 253.22, 236.22] | [291.36, 302.76, 282.01] | [212.35, 232.18, 304.38] |
+| 大状态最大排队 ms | [297.76, 172.39, 164.17] | [0.56, 1.34, 0.80] | [16.39, 16.67, 16.76] |
+
+独立的 4/8/16 ms 实验测得，低开销列表重复耗时中位数分别为 58.39/58.57/52.34 ms，大状态列表为 279.81/253.85/216.67 ms。大状态列表最大排队延迟的中位数分别为 5.19/8.45/16.70 ms。16 ms 默认值在保持较短工作目标的同时减少往返；部署可以选择更小的预算。
+
+CI 使用经过时间的排队延迟与粗粒度吞吐量上限，而不是精确批大小。共享的 2 倍时间系数和 1.25 倍余量将 30 ms 排队参考余量转换为 75 ms，为单行超时和调度波动留出空间，同时拒绝没有让出的大状态批次。适中、大状态、低开销三种负载的吞吐量参考余量分别为 50/500/150 ms，得到 125/1,250/375 ms 上限。这些是安全上限，不证明细粒度不回退。先前 Linux Node 24.21 EPYC 运行测得适中和大状态场景首次调用为 102.16/779.57 ms；较大的大状态余量考虑了实际 hosted/reference 比值超过 2。堆使用 240 MiB，并只乘波动余量，得到 300 MiB。
+
+已有的 [3,000 Session 会话集合测试](../testing/2026-09-28-session-corpus-performance.zh.md)仍是持久化集合吞吐量的依据。先前逐行版本的 CI 首次调用样本为 3,205.3/3,166.2/3,165.1 ms，重复调用为 2,643.5/2,577.8/2,589.6 ms，均在既有校准上限内。投影基准补充低开销驻留和大状态维度，不替代该集合。在同一本地机器上，持久化集合的逐行/时间片首次中位数为 885.5/859.4 ms，重复中位数为 700.3/692.1 ms；这点差异处于普通运行波动内，未观察到吞吐量回退。新的三负载文件在本地耗时 23.98 s，包含夹具准备和全部九个子进程；先前测得的双负载 CI 版本在 EPYC Node 24.21.0 上耗时 36.80 s。
+
+## 考虑过的替代方案
+
+**无条件逐行让出。** 它尽量缩短单次排队等待，却对每个低开销行都收取一次事件循环往返成本。大量驻留 Session 的比较暴露了这项成本；固定行数同样忽略了行成本差异。
+
+**更大或更小的时间片。** 更小的时间片缩短排队等待，但增加调度成本。更大的时间片减少切换，却延长其他 Host 工作的等待。配置显式提供这一取舍，不改变行语义。
+
+**缓存解码状态或 wire view。** 解码状态复用会为每份存储行保留另一份对象图，并改变 schema 执行的所有权。wire view 可能依赖当前运行状态。调度不需要这两类缓存，且保留全部 schema 校验和动态视图。
+
+## 后果
+
+[受控时钟测试](../../../../packages/api/session-controller/tests/list-scheduling.host.spec.ts)要求低开销行保持在同一同步时间片内，由预算耗尽和等待后重置决定让出，并在无需让出时也能响应取消。测试还保留了稳定并列排序和接入、移除、状态变更的交错行为。按时间判断的基准保护会拒绝不让出或仅首次让出的大状态工作，同时允许高效批处理。
+
+单行、提供方枚举、GC、最终排序和序列化都可能超出目标。并发列表和操作系统调度也会影响延迟。预算不是全局硬上限，这些测量也不宣称改善浏览器绘制或模型、网络延迟。
diff --git a/.agents/notes/implemented/feature/2026-06-15-ptc.i18n.yaml b/.agents/notes/implemented/feature/2026-06-15-ptc.i18n.yaml
index 4a99a03276..38cc4a8bf5 100644
--- a/.agents/notes/implemented/feature/2026-06-15-ptc.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-06-15-ptc.i18n.yaml
@@ -9,17 +9,17 @@
en: 4b312be894531bee
zh: d655648ea5843ef5
/agent-note-ptc-mode-the-model-writes-typescript-against-the-tool-registry/decision:
- en: 371abc68ce278a5c
- zh: 3fa8d28213794932
+ en: a1732e2b1b46cb39
+ zh: ddfc2bdcffa099a5
/agent-note-ptc-mode-the-model-writes-typescript-against-the-tool-registry/decision/per-program-execution-controls:
en: da694641e1d009de
zh: 9d7492d39039af66
/agent-note-ptc-mode-the-model-writes-typescript-against-the-tool-registry/decision/the-registry-owns-the-mode:
- en: 55287fedeaaee6d8
- zh: d2afe242e84acc43
+ en: 091b7bc49b027353
+ zh: 42dc77a810202694
/agent-note-ptc-mode-the-model-writes-typescript-against-the-tool-registry/decision/the-run-code-tool-and-the-dispatch-bridge:
- en: 8811a9c5e28488fd
- zh: 6937645281b79fb9
+ en: 6a0e2698b082978e
+ zh: fbb03503520b30e9
/agent-note-ptc-mode-the-model-writes-typescript-against-the-tool-registry/decision/observability-tool-ptc-dispatch:
en: b8e4cf9433c7ee18
zh: e5f4e8d7d03d3a7b
@@ -33,8 +33,8 @@
en: d62b41a6a5c58e5f
zh: ef72c5a9b32b370e
/agent-note-ptc-mode-the-model-writes-typescript-against-the-tool-registry/decision/what-the-model-sees:
- en: 43653fd91ab9165b
- zh: 6ddfa853e69b2d80
+ en: 81c12f19f7a967c1
+ zh: 29734ca964acdec2
/agent-note-ptc-mode-the-model-writes-typescript-against-the-tool-registry/consequences:
en: 761eb6c1aeb7af18
zh: 5434456a3d0a1b65
@@ -42,8 +42,8 @@
en: f5d287f610962a48
zh: 88368e1df517b087
/agent-note-ptc-mode-the-model-writes-typescript-against-the-tool-registry/alternatives-considered:
- en: 90110f91f6f6130f
- zh: 25d28433840f91a4
+ en: e78530994a88d14f
+ zh: 49f64c7f1421f507
/agent-note-ptc-mode-the-model-writes-typescript-against-the-tool-registry/risks:
- en: 7743b1b621b8e6c7
- zh: 70c33a5b306ca71c
+ en: d58925bdb912de23
+ zh: d3a70237d656e5a4
diff --git a/.agents/notes/implemented/feature/2026-06-15-ptc.md b/.agents/notes/implemented/feature/2026-06-15-ptc.md
index d5ed3fc79d..c49b21ecee 100644
--- a/.agents/notes/implemented/feature/2026-06-15-ptc.md
+++ b/.agents/notes/implemented/feature/2026-06-15-ptc.md
@@ -18,7 +18,7 @@ Tool presentation belongs to the registry that owns tool visibility: implementin
Three decisions, each elaborated in its own section below:
-1. **PTC mode is a first-class presentation mode of `ToolRuntime`** (`dsh-tools`), selected by a validated `mode` config: `'native'` (the default, contributing the visible capability schemas), `'ptc'` (the registry contributes only its reserved `run_code` transport plus a generated SDK `.d.ts` in the system prompt), or `'both'` (native schemas and the transport + SDK). The registry constructs its canonical contribution at the source; the cooperative prompt-assembly result remains authoritative, and the logged request header records exactly that returned presentation.
+1. **PTC mode is a first-class presentation mode of `ToolRuntime`** (`dsh-tools`), selected by a validated `mode` config: `'native'` (the default, contributing the visible capability schemas) or `'ptc'` (the registry contributes only its reserved `run_code` transport plus a generated SDK `.d.ts` in the system prompt). The registry constructs its canonical contribution at the source; the cooperative prompt-assembly result remains authoritative, and the logged request header records exactly that returned presentation.
2. **Code execution is a capability seam** — `packages/ptc-runtime/` contains the Service Definition package `@deepseek-ai/dsh-ptc-runtime`, which owns `ctx.ptcRuntime` ([capability seams](../architecture/2026-06-13-capability-seams.md); Consumer = `dsh-tools`, with core-consumes-a-seam precedent in `agent-loop` → `dsh-llm`). The runtime knows nothing about tools: it is handed a program and named async bindings, runs the program, and reports `{ value, logs, error? }`. Language and substrate are backend properties, so a future Python or container backend is another Service Provider package, not a redesign.
3. **The shipped implementation is `@deepseek-ai/dsh-ptc-runtime-node`**: each program runs in a fresh managed Node process under the calling Session's resolved sandbox policy. Direct Node APIs remain available within that policy; named host bindings cross a separately validated control channel.
@@ -32,13 +32,13 @@ The [Node execution decision](../architecture/2026-09-11-sandboxed-node-ptc-runt
### The registry owns the mode
-`ToolRuntime` gains a schemastery-validated config (`static Config`), its first: `mode: 'native' | 'ptc' | 'both'`, default `'native'`. A deployment flips it from `cordis.yml` (`tools: { mode: ptc }`) — no code edit, per the no-hardcoded-tunables convention.
+`ToolRuntime` gains a schemastery-validated config (`static Config`), its first: `mode: 'native' | 'ptc'`, default `'native'`. A deployment flips it from `cordis.yml` (`tools: { mode: ptc }`) — no code edit, per the no-hardcoded-tunables convention.
-**Wire tool list.** The registry contributes visible capabilities in `'native'`, only `run_code` in `'ptc'`, and both in `'both'`. The final `PromptAssembly.tools` list is logged in the request header. `run_code` is a reserved presentation transport outside registration and restriction layers; direct prompt providers and the assembly waterfall remain responsible for their own contributions.
+**Wire tool list.** The registry contributes visible capabilities in `'native'` and only `run_code` in `'ptc'`. The [presentation simplification](../simplification/2026-10-05-native-or-ptc-presentation.md) owns the removal of mixed presentation. The final `PromptAssembly.tools` list is logged in the request header. `run_code` is a reserved presentation transport outside registration and restriction layers; direct prompt providers and the assembly waterfall remain responsible for their own contributions.
**Interaction with `toolOrder`:** a configured `systemPrompt.toolOrder` naming native capabilities rejects every assembly under `mode: 'ptc'`, because those names are outside that mode's wire-validation universe. This is correct behavior, not a bug: a deployment using PTC mode updates its order config or drops it.
-**SDK prompt section.** In `'ptc'` and `'both'`, the lazy `tools:sdk` section in the tool-guidance order band renders the loaded runtime's language declarations plus fixed usage instructions for the scope's visible capabilities (TypeScript by default; the [language-dispatch note](../../archived/feature/2026-07-31-ptc-language-dispatch.md) added Python and the `ctx.ptcRuntime.language` renderer table). It shares lookup and execution visibility, excludes `run_code`, and sorts tools lexicographically for byte-stable output.
+**SDK prompt section.** In `'ptc'`, the lazy `tools:sdk` section in the tool-guidance order band renders the loaded runtime's language declarations plus fixed usage instructions for the scope's visible capabilities (TypeScript by default; the [language-dispatch note](../../archived/feature/2026-07-31-ptc-language-dispatch.md) added Python and the `ctx.ptcRuntime.language` renderer table). It shares lookup and execution visibility, excludes `run_code`, and sorts tools lexicographically for byte-stable output.
**Assembly ownership.** `run_code` and `tools:sdk` enter the trusted `system-prompt/assemble` waterfall as normal assembly inputs. A scoped `tools:sdk` section may shadow the global default before dispatch, and a listener may remove or replace either contribution. The waterfall's returned assembly is final, so whoever changes these inputs owns preserving a viable PTC mode protocol when the deployment expects PTC mode to remain usable; no restoration pass overrides deliberate composition.
@@ -46,15 +46,15 @@ The [Node execution decision](../architecture/2026-09-11-sandboxed-node-ptc-runt
### The run_code tool and the dispatch bridge
-Under `'ptc'` and `'both'` the registry owns `run_code` as a reserved presentation transport with two required parameters, `{ code: string; description: string }` (the description labels the call in UIs, the bash precedent). It is represented by a normal `ToolDefinition` for dispatch but stays outside the filterable capability layers, so restrictions cannot accidentally remove PTC mode's only entry point. Calls traverse the complete tool pipeline — `tools/pre-execute` → monotonic guards → `tools/execute` around dispatch → `tools/post-execute` → optional definition-owned `finalizeContent` → immutable `tools/result` notification — exactly like native calls; a permission plugin can inspect the program text before it runs, and final-result observers see the normalized outer outcome. Its `execute(args, exec)`:
+Under `'ptc'` the registry owns `run_code` as a reserved presentation transport with two required parameters, `{ code: string; description: string }` (the description labels the call in UIs, the bash precedent). It is represented by a normal `ToolDefinition` for dispatch but stays outside the filterable capability layers, so restrictions cannot accidentally remove PTC mode's only entry point. Calls traverse the complete tool pipeline — `tools/pre-execute` → monotonic guards → `tools/execute` around dispatch → `tools/post-execute` → optional definition-owned `finalizeContent` → immutable `tools/result` notification — exactly like native calls; a permission plugin can inspect the program text before it runs, and final-result observers see the normalized outer outcome. Its `execute(args, exec)`:
-1. **Build bindings.** One run-scoped signal follows outer cancellation and is aborted whenever the run settles. Each visible tool binding snapshots lossless-JSON arguments, enters the native-contract dispatch pool (the [live-parallel note](2026-07-26-ptc-live-parallel-dispatch.md) owns the scheduling design), executes with a deterministic call id and the outer token as `parent`, defers returned contexts through the outer execution, and logs the `tool/ptc-dispatch-start`/`tool/ptc-dispatch` pair, the settle side carrying the full rendered result content. Success returns the tool's final canonical JSON value; failure becomes the program-visible `ToolCallError`. Every sub-call retains its own immutable execution identity and traverses the full tool pipeline.
+1. **Build bindings.** One run-scoped signal follows outer cancellation and is aborted whenever the run settles. Each visible tool binding snapshots lossless-JSON arguments, enters the native-contract dispatch pool (the [live-parallel reference](../../../../packages/core/tools/README.md) owns the scheduling design), executes with a deterministic call id and the outer token as `parent`, defers returned contexts through the outer execution, and logs the `tool/ptc-dispatch-start`/`tool/ptc-dispatch` pair, the settle side carrying the full rendered result content. Success returns the tool's final canonical JSON value; failure becomes the program-visible `ToolCallError`. Every sub-call retains its own immutable execution identity and traverses the full tool pipeline.
2. **Runs resolved inputs:** `ctx.ptcRuntime.run(ctx.ptcRuntime.resolve(request))`. The request carries the program, bindings, run-scoped signal, calling Session cwd and applicable resolved file policy. The run-scoped signal connects outer settlement to execution cancellation.
3. **Settle after quiescence.** When the runtime settles, the bridge aborts outstanding work and drains the dispatch queue before returning. Success returns captured logs and the completion value as canonical output; the registry renders that value into durable `tool/result.content`, which the result card reads directly. A runtime failure becomes `CodeRunFailedError`; backend rejection uses the registry's normal error boundary. Both produce structured error results, and no sub-call can append after `run_code` settles.
**Sub-call contexts are deferred through the parent.** Injecting inside `run_code` would break parent call/result adjacency, so `ToolRunContext.deferContext()` collects every sub-result `additionalContexts` entry in dispatch order. The registry carries that array even when the program later throws, and the loop appends each entry only after the outer result and every sibling result in the step. An outer post-execute block discards tool-deferred entries and exposes only contexts explicitly attached by the blocking decision.
-**Concurrency is bounded, not serialized.** Each run owns a dispatch queue that starts calls strictly in submission order and classifies each one through `registry.executionMode`, the same fail-closed `isConcurrencySafe` contract the native loop uses. Consecutive parallel-classified calls overlap up to `maxParallelSubCalls` (default 10; `1` restores serial dispatch); an exclusive call drains the pool and runs alone. Settlement abandons queued calls that have not started. This note shipped the serialized placeholder; the [live-parallel Agent Note](2026-07-26-ptc-live-parallel-dispatch.md) owns the scheduler that replaced it.
+**Concurrency is bounded, not serialized.** Each run owns a dispatch queue that starts calls strictly in submission order and classifies each one through `registry.executionMode`, the same fail-closed `isConcurrencySafe` contract the native loop uses. Consecutive parallel-classified calls overlap up to `maxParallelSubCalls` (default 10; `1` restores serial dispatch); an exclusive call drains the pool and runs alone. Settlement abandons queued calls that have not started. This note shipped the serialized placeholder; the [live-parallel reference](../../../../packages/core/tools/README.md) owns the scheduler that replaced it.
**Presentation.** `run_code`'s render intent is decided here per the [render-intent Agent Note](../architecture/2026-07-02-tool-render-intent-union.md): `presentCall` creates a `generic` card with `kind: 'execute'`, the program text as its title, and the same program text as `rawInput`; `run_code` intentionally declares no `presentResult`, so the TUI and host/client runtime (Web) complete that card through their generic raw-content fallback using the final durable `tool/result.content`, including captured logs plus the returned value, failure, or post-policy spill preview. This is not a `terminal` card: that card's semantics are "a shell command in a working directory", which a program is not. See the [result-card completeness note](../../archived/bug-fix/2026-07-20-code-mode-result-card-completeness.md).
@@ -86,7 +86,7 @@ The selected OS backend constrains direct Node effects under the same policy use
### What the model sees
-The SDK instructs the model to write an async body in the loaded runtime's language (an erasable-TypeScript body by default; a Python `async` body under a Python runtime — see the [language-dispatch note](../../archived/feature/2026-07-31-ptc-language-dispatch.md)), call tools through `await tools.name(args)`, catch rejected tool calls when needed, and return or log only the output that should re-enter context. Both flavors state the same contract in their own primitive: independent read-only calls MAY overlap under `Promise.all` (TypeScript) or `asyncio.gather` (Python), mutating calls run alone in submission order, and dependent work sequences with `await`. The declaration prefix can be as large as native schemas, especially in `'both'`, but remains stable for provider caching.
+The SDK instructs the model to write an async body in the loaded runtime's language (an erasable-TypeScript body by default; a Python `async` body under a Python runtime — see the [language-dispatch note](../../archived/feature/2026-07-31-ptc-language-dispatch.md)), call tools through `await tools.name(args)`, catch rejected tool calls when needed, and return or log only the output that should re-enter context. Both flavors state the same contract in their own primitive: independent read-only calls MAY overlap under `Promise.all` (TypeScript) or `asyncio.gather` (Python), mutating calls run alone in submission order, and dependent work sequences with `await`. The declaration prefix can be as large as native schemas, but remains stable for provider caching.
The transport's own `description` and both SDK instruction flavors open by naming `code` and `description` as the call's two required arguments. Prose that describes the call as passing a program leaves the second argument discoverable only through the parameter schema, and a model that emits `{code}` alone loses the whole written program to an `INVALID_ARGS` rejection.
@@ -113,7 +113,7 @@ Deployments switching to `'ptc'` must update any native-only `toolOrder`. Assemb
**Always-exclusive (Cloudflare-faithful, no mode).** Rejected for this SDK's primary consumer: a coding agent's bread-and-butter single calls (`bash`, `read`, `edit`) are already ideal as native calls, and forcing every edit through a program taxes the common case. The mode config keeps the faithful form (`'ptc'`) one line away without imposing it.
-**Per-tool visibility tiers (this tool native, that tool ptc-only).** Deferred: it needs per-tool metadata and a presentation split that `'native' | 'ptc' | 'both'` does not, and its design depends on evidence about how models split usage under `'both'`.
+**Per-tool visibility tiers (this tool native, that tool ptc-only).** Deferred: it needs per-tool metadata and separate admission rules for native and program-only operations. Whole-agent native or PTC presentation keeps one calling convention per agent.
**Sanitized identifier aliases in the SDK** (`my-tool` → `my_tool`, Cloudflare's approach). Rejected: quoted keys on a `declare const` make every name reachable with zero alias-collision logic; models handle `tools["my-tool"](…)` fine.
@@ -125,12 +125,12 @@ Deployments switching to `'ptc'` must update any native-only `toolOrder`. Assemb
**`stripTypeScriptTypes` is marked experimental.** It is the same engine (amaro/swc) behind Node's own native `.ts` execution, exposed as an API across this repo's whole engines range. Mitigations: the runtime's unit suite checks position preservation and the required parts of the erasable-only rejection message, the call sits behind one private function, and `amaro`/`sucrase` are direct replacements if the API shifts. The erasable-only subset is a model-facing input restriction, and the error tells the model how to correct the program.
-**Prompt cost of the SDK, especially under `'both'`.** The `.d.ts` can rival the native schemas it complements; `'both'` carries two representations. Prefix stability + provider caching amortize per-session cost; the mode is per-deployment; the Agent Note makes no unconditional-savings claim. Measured guidance (when to prefer which mode) is explicitly post-ship learning.
+**Prompt cost of the SDK.** The `.d.ts` can rival the native schemas it replaces. Prefix stability + provider caching amortize per-session cost; the mode is per-deployment; the Agent Note makes no unconditional-savings claim. Measured guidance (when to prefer which mode) is explicitly post-ship learning.
**Registry scope growth.** `dsh-tools` absorbs codegen, a tool, a bridge, and an event. Package modules separate these responsibilities (`ts-types.ts` and `ptc.ts` beside `schema.ts`, `json-schema.ts`, and `presentation.ts`), while `ctx.ptcRuntime` owns all ptc-runtime-specific implementation.
**Large binding values can still exhaust memory.** The Node provider bounds control frames, outstanding arguments and queued writes, while a host binding can allocate its result before those checks. Lossless JSON transfer and the outer output ledger do not create a process-wide allocation quota.
-**Sub-dispatch overlap is bounded by tool safety claims, not by the caller.** A program's `Promise.all` or `asyncio.gather` buys wall-clock parallelism only across calls the tool itself classifies concurrency-safe; a run of exclusive calls still costs its round-trips in sequence, and models may over-expect. Both flavors' SDK instructions state the real contract. This note shipped the serialized placeholder that made the risk absolute; the [live-parallel Agent Note](2026-07-26-ptc-live-parallel-dispatch.md) owns the scheduler and its overlap cap.
+**Sub-dispatch overlap is bounded by tool safety claims, not by the caller.** A program's `Promise.all` or `asyncio.gather` buys wall-clock parallelism only across calls the tool itself classifies concurrency-safe; a run of exclusive calls still costs its round-trips in sequence, and models may over-expect. Both flavors' SDK instructions state the real contract. This note shipped the serialized placeholder that made the risk absolute; the [live-parallel reference](../../../../packages/core/tools/README.md) owns the scheduler and its overlap cap.
**Elapsed deadlines include awaited work.** Nested tools and approval waits consume the program's elapsed budget. The host stops execution on expiry and awaits managed cleanup; it does not meter process-tree CPU consumption. The sandboxed Node decision records current defaults and deferred timeout questions.
diff --git a/.agents/notes/implemented/feature/2026-06-15-ptc.zh.md b/.agents/notes/implemented/feature/2026-06-15-ptc.zh.md
index 1434db5c35..669a63e991 100644
--- a/.agents/notes/implemented/feature/2026-06-15-ptc.zh.md
+++ b/.agents/notes/implemented/feature/2026-06-15-ptc.zh.md
@@ -18,7 +18,7 @@ Cloudflare 的 [Code Mode](https://blog.cloudflare.com/code-mode/) 提出了一
三项决策，各自在下方独立小节中展开：
-1. **PTC mode 是 `ToolRuntime`（`dsh-tools`）的一等呈现模式**，通过经校验的 `mode` 配置选择：`'native'`（默认，贡献可见能力 schema）、`'ptc'`（注册表仅贡献其保留的 `run_code` 传输通道加一份生成的 SDK `.d.ts` 到系统提示词中）或 `'both'`（原生 schema 加传输通道 + SDK）。注册表在源头构建其规范贡献；协作式提示词组装的结果仍具权威性，记录在日志中的请求头精确反映该返回的呈现。
+1. **PTC mode 是 `ToolRuntime`（`dsh-tools`）的一等呈现模式**，通过经校验的 `mode` 配置选择：`'native'`（默认，贡献可见能力 schema）或 `'ptc'`（注册表仅贡献其保留的 `run_code` 传输通道加一份生成的 SDK `.d.ts` 到系统提示词中）。注册表在源头构建其规范贡献；协作式提示词组装的结果仍具权威性，记录在日志中的请求头精确反映该返回的呈现。
2. **代码执行是一个能力 seam**——`packages/ptc-runtime/` 包含 Service Definition 包 `@deepseek-ai/dsh-ptc-runtime`，拥有 `ctx.ptcRuntime`（[能力 seam](../architecture/2026-06-13-capability-seams.zh.md)；消费方 = `dsh-tools`，core 消费 seam 的先例见 `agent-loop` → `dsh-llm`）。运行时对工具一无所知：它接收一段程序和命名的异步绑定，执行程序，报告 `{ value, logs, error? }`。语言和基底是后端属性，因此未来的 Python 或容器后端只是另一个 Service Provider 包，而非重新设计。
3. **交付的实现是 `@deepseek-ai/dsh-ptc-runtime-node`**：每个程序在全新的受管 Node 进程中，按调用 Session 的已解析沙箱策略运行。直接 Node API 在该策略内仍可使用；具名 Host 绑定通过单独验证的控制通道调用。
@@ -32,13 +32,13 @@ Cloudflare 的 [Code Mode](https://blog.cloudflare.com/code-mode/) 提出了一
### 注册表拥有模式
-`ToolRuntime` 获得一个经 schemastery 校验的配置（`static Config`），这是它的第一个配置：`mode: 'native' | 'ptc' | 'both'`，默认 `'native'`。部署通过 `cordis.yml` 翻转模式（`tools: { mode: ptc }`），无需改代码，遵循 no-hardcoded-tunables 约定。
+`ToolRuntime` 获得一个经 schemastery 校验的配置（`static Config`），这是它的第一个配置：`mode: 'native' | 'ptc'`，默认 `'native'`。部署通过 `cordis.yml` 翻转模式（`tools: { mode: ptc }`），无需改代码，遵循 no-hardcoded-tunables 约定。
-**协议工具列表。** 注册表在 `'native'` 下贡献可见能力，在 `'ptc'` 下仅贡献 `run_code`，在 `'both'` 下两者都贡献。最终的 `PromptAssembly.tools` 列表记录在请求头中。`run_code` 是一个保留的呈现传输通道，位于注册和限制层之外；直接提示词提供方和组装 waterfall 仍各自负责自己的贡献。
+**协议工具列表。** 注册表在 `'native'` 下贡献可见能力，在 `'ptc'` 下仅贡献 `run_code`。[呈现方式简化决策](../simplification/2026-10-05-native-or-ptc-presentation.zh.md) 记录混合呈现的移除。最终的 `PromptAssembly.tools` 列表记录在请求头中。`run_code` 是一个保留的呈现传输通道，位于注册和限制层之外；直接提示词提供方和组装 waterfall 仍各自负责自己的贡献。
**与 `toolOrder` 的交互：** 如果配置的 `systemPrompt.toolOrder` 引用了原生能力名称，在 `mode: 'ptc'` 下会拒绝所有组装，因为那些名称不在该模式的协议校验范围内。这是正确行为而非 bug：使用 PTC mode 的部署需要更新其 order 配置或移除它。
-**SDK 提示词段。** 在 `'ptc'` 和 `'both'` 下，tool-guidance order band 中的惰性 `tools:sdk` 段为当前 scope 的可见能力渲染所加载运行时语言的声明加固定的使用说明（默认 TypeScript；[语言分发 note](../../archived/feature/2026-07-31-ptc-language-dispatch.md) 加入了 Python 与按 `ctx.ptcRuntime.language` 选择的渲染器表）。它共享查找和执行可见性，排除 `run_code`，并按字典序排列工具以获得字节稳定的输出。
+**SDK 提示词段。** 在 `'ptc'` 下，tool-guidance order band 中的惰性 `tools:sdk` 段为当前 scope 的可见能力渲染所加载运行时语言的声明加固定的使用说明（默认 TypeScript；[语言分发 note](../../archived/feature/2026-07-31-ptc-language-dispatch.md) 加入了 Python 与按 `ctx.ptcRuntime.language` 选择的渲染器表）。它共享查找和执行可见性，排除 `run_code`，并按字典序排列工具以获得字节稳定的输出。
**组装所有权。** `run_code` 和 `tools:sdk` 作为正常的组装输入进入受信任的 `system-prompt/assemble` waterfall。一个 scoped 的 `tools:sdk` 段可以在分发前遮蔽全局默认值，监听器也可以移除或替换任一贡献。waterfall 返回的组装结果是最终的，因此修改这些输入的人有责任在部署期望 PTC mode 可用时保持协议面的完整性；没有恢复 pass 会覆盖有意的组合。
@@ -46,15 +46,15 @@ Cloudflare 的 [Code Mode](https://blog.cloudflare.com/code-mode/) 提出了一
### run_code 工具与分发桥
-在 `'ptc'` 和 `'both'` 下，注册表拥有 `run_code` 作为保留的呈现传输通道，带两个必需参数 `{ code: string; description: string }`（description 为 UI 标注该调用，沿用 bash 的先例）。它由一个正常的 `ToolDefinition` 表示以供分发，但位于可过滤的能力层之外，因此限制规则不会意外移除 PTC mode 的唯一入口。调用遍历完整的工具流水线——`tools/pre-execute` → 单调性守卫 → `tools/execute` 包裹分发 → `tools/post-execute` → 由定义拥有的可选 `finalizeContent` → 不可变的 `tools/result` 通知——与原生调用完全一致；权限插件可以在程序运行前检查程序文本，最终结果观察者看到的是规范化的外层结果。其 `execute(args, exec)`：
+在 `'ptc'` 下，注册表拥有 `run_code` 作为保留的呈现传输通道，带两个必需参数 `{ code: string; description: string }`（description 为 UI 标注该调用，沿用 bash 的先例）。它由一个正常的 `ToolDefinition` 表示以供分发，但位于可过滤的能力层之外，因此限制规则不会意外移除 PTC mode 的唯一入口。调用遍历完整的工具流水线——`tools/pre-execute` → 单调性守卫 → `tools/execute` 包裹分发 → `tools/post-execute` → 由定义拥有的可选 `finalizeContent` → 不可变的 `tools/result` 通知——与原生调用完全一致；权限插件可以在程序运行前检查程序文本，最终结果观察者看到的是规范化的外层结果。其 `execute(args, exec)`：
-1. **构建绑定。** 一个 run 级别的 signal 跟随外层取消，并在 run 结算时被 abort。每个可见工具绑定都会对无损 JSON 参数创建快照，进入原生约定的分发池（调度设计由[实时并行 Agent Note](2026-07-26-ptc-live-parallel-dispatch.zh.md) 负责），以确定性的 call id 和外层 token 作为 `parent` 执行，通过外层 execution 延后返回的上下文，并记录 `tool/ptc-dispatch-start`/`tool/ptc-dispatch` 事件对，其中结算侧携带完整渲染后的结果内容。成功时返回工具最终的规范 JSON 值；失败则变为程序可见的 `ToolCallError`。每个子调用保留自己不可变的执行标识，并遍历完整的工具流水线。
+1. **构建绑定。** 一个 run 级别的 signal 跟随外层取消，并在 run 结算时被 abort。每个可见工具绑定都会对无损 JSON 参数创建快照，进入原生约定的分发池（调度设计由[实时并行 参考](../../../../packages/core/tools/README.zh.md) 负责），以确定性的 call id 和外层 token 作为 `parent` 执行，通过外层 execution 延后返回的上下文，并记录 `tool/ptc-dispatch-start`/`tool/ptc-dispatch` 事件对，其中结算侧携带完整渲染后的结果内容。成功时返回工具最终的规范 JSON 值；失败则变为程序可见的 `ToolCallError`。每个子调用保留自己不可变的执行标识，并遍历完整的工具流水线。
2. **运行已解析输入：** `ctx.ptcRuntime.run(ctx.ptcRuntime.resolve(request))`。请求携带程序、绑定、运行级信号、调用 Session 的 cwd 与适用的已解析文件策略。运行级信号将外层结算与执行取消关联。
3. **完全停稳后结算。** 运行时结算后，桥 abort 未完成的工作并排空分发队列后再返回。成功时返回捕获的日志和完成值，将其作为规范输出；注册表再把该值渲染为持久化的 `tool/result.content`，供结果卡片直接读取。运行时失败变为 `CodeRunFailedError`；后端拒绝使用注册表的正常错误边界。两者都产生结构化的错误结果，且 `run_code` 结算后不允许子调用追加。
**子调用上下文通过父调用延后。** 在 `run_code` 内部注入会破坏父调用/结果的相邻性，因此 `ToolRunContext.deferContext()` 按分发顺序收集每个子结果的 `additionalContexts` 条目。即使程序后来抛出异常，注册表仍携带该数组；循环只在外层结果与步骤中所有兄弟结果之后追加每个条目。外层 post-execute 阻止会丢弃工具延后的条目，只暴露阻止 decision 显式附加的上下文。
-**并发是有界的，而非被序列化。** 每次 run 拥有一个分发队列，严格按提交顺序启动调用，并通过 `registry.executionMode` 对每个调用分类——与原生循环所用的 fail-closed `isConcurrencySafe` 约定相同。连续的 parallel 类调用最多重叠 `maxParallelSubCalls` 个（默认 10；设为 `1` 恢复串行分发）；exclusive 类调用会排空池并单独运行。结算时放弃尚未开始的排队调用。本 note 交付的是被序列化的占位实现；取代它的调度器由[实时并行 Agent Note](2026-07-26-ptc-live-parallel-dispatch.zh.md) 负责。
+**并发是有界的，而非被序列化。** 每次 run 拥有一个分发队列，严格按提交顺序启动调用，并通过 `registry.executionMode` 对每个调用分类——与原生循环所用的 fail-closed `isConcurrencySafe` 约定相同。连续的 parallel 类调用最多重叠 `maxParallelSubCalls` 个（默认 10；设为 `1` 恢复串行分发）；exclusive 类调用会排空池并单独运行。结算时放弃尚未开始的排队调用。本 note 交付的是被序列化的占位实现；取代它的调度器由[实时并行 参考](../../../../packages/core/tools/README.zh.md) 负责。
**呈现。** `run_code` 的 render intent 按[呈现意图 Agent Note](../architecture/2026-07-02-tool-render-intent-union.zh.md)在此决定：`presentCall` 创建一个 `generic` 卡片，`kind: 'execute'`，以程序文本作为标题，并将同一程序文本作为 `rawInput`；`run_code` 有意不声明 `presentResult`，因此 TUI 和宿主/客户端运行时（Web）会通过通用原始内容回退机制，使用最终持久化的 `tool/result.content` 补全该卡片，其中包括捕获的日志，以及返回值、失败信息或 post-policy spill 预览。这不是 `terminal` 卡片：该卡片的语义是「工作目录中的 shell 命令」，程序不是。参见[结果卡片完整性说明](../../archived/bug-fix/2026-07-20-code-mode-result-card-completeness.md)。
@@ -86,7 +86,7 @@ Node 提供方擦除可擦除 TypeScript，在配置的文件系统／子进程
### 模型看到的内容
-SDK 指示模型编写一个所加载运行时语言的异步函数体（默认可擦除 TypeScript；Python 运行时下为 Python `async` 函数体——见[语言分发 note](../../archived/feature/2026-07-31-ptc-language-dispatch.md)），通过 `await tools.name(args)` 调用工具，在需要时捕获被拒绝的工具调用，并仅 return 或 log 应重新进入上下文的输出。两种 flavor 用各自的原语陈述同一约定：相互独立的只读调用可以（MAY）在 `Promise.all`（TypeScript）或 `asyncio.gather`（Python）下重叠，有副作用的调用按提交顺序单独运行，有依赖的工作用 `await` 排序。声明前缀可能与原生 schema 一样大，尤其在 `'both'` 下，但对提供方缓存保持稳定。
+SDK 指示模型编写一个所加载运行时语言的异步函数体（默认可擦除 TypeScript；Python 运行时下为 Python `async` 函数体——见[语言分发 note](../../archived/feature/2026-07-31-ptc-language-dispatch.md)），通过 `await tools.name(args)` 调用工具，在需要时捕获被拒绝的工具调用，并仅 return 或 log 应重新进入上下文的输出。两种 flavor 用各自的原语陈述同一约定：相互独立的只读调用可以（MAY）在 `Promise.all`（TypeScript）或 `asyncio.gather`（Python）下重叠，有副作用的调用按提交顺序单独运行，有依赖的工作用 `await` 排序。声明前缀可能与原生 schema 一样大，但对提供方缓存保持稳定。
传输自身的 `description` 与两种 flavor 的 SDK 说明都以点名 `code` 和 `description` 这两个必填参数开头。把该调用描述成「传入一个程序」的散文会让第二个参数只能从参数 schema 中发现，而只发出 `{code}` 的模型会因 `INVALID_ARGS` 被拒，连同已写好的整个程序一起丢失。
@@ -113,7 +113,7 @@ SDK 指示模型编写一个所加载运行时语言的异步函数体（默认
**始终排他（忠于 Cloudflare，无模式）。** 否决，因为本 SDK 的主要消费方是编码 agent：其日常的单次调用（`bash`、`read`、`edit`）作为原生调用已经是最优的，强制每次编辑都通过程序会给常见场景增加负担。mode 配置让忠实形式（`'ptc'`）只需一行配置即可启用，而不强加于人。
-**每工具可见性分层（此工具 native，彼工具 ptc-only）。** 推迟：它需要每工具元数据和 `'native' | 'ptc' | 'both'` 不提供的呈现拆分，且其设计取决于模型在 `'both'` 下如何分配使用的证据。
+**每工具可见性分层（此工具 native，彼工具 ptc-only）。** 推迟：它需要每工具元数据，以及针对原生操作和仅限程序操作的独立准入规则。整个 agent 采用原生或 PTC 呈现，可让每个 agent 保持一种调用约定。
**SDK 中的清洁化标识符别名**（`my-tool` → `my_tool`，Cloudflare 的做法）。否决：`declare const` 上的带引号键使每个名称可达，零别名碰撞逻辑；模型能正常处理 `tools["my-tool"](…)`。
@@ -125,12 +125,12 @@ SDK 指示模型编写一个所加载运行时语言的异步函数体（默认
**`stripTypeScriptTypes` 标记为 experimental。** 它与 Node 自身原生 `.ts` 执行背后的引擎（amaro/swc）相同，在本仓库的整个引擎范围内作为 API 暴露。缓解措施：运行时的单元测试套件会检查位置保持和可擦除限制拒绝消息中的必需部分；调用位于一个私有函数之后，且 `amaro`/`sucrase` 可在 API 变化时直接替换它。仅可擦除子集是面向模型的输入限制，错误消息会告诉模型如何修正程序。
-**SDK 的提示词成本，尤其在 `'both'` 下。** `.d.ts` 可能与它补充的原生 schema 体量相当；`'both'` 携带两种表示。前缀稳定性 + 提供方缓存摊销了每会话成本；mode 按部署配置；本 Agent Note 不做无条件节省的声明。何时优先使用哪种模式的量化指导明确属于上线后学习。
+**SDK 的提示词成本。** `.d.ts` 可能与它替代的原生 schema 体量相当。前缀稳定性 + 提供方缓存摊销了每会话成本；mode 按部署配置；本 Agent Note 不做无条件节省的声明。何时优先使用哪种模式的量化指导明确属于上线后学习。
**注册表 scope 增长。** `dsh-tools` 吸收了代码生成、一个工具、一个桥和一个事件。包内模块把这些职责分开（`ts-types.ts`、`ptc.ts` 与 `schema.ts`、`json-schema.ts`、`presentation.ts` 并列），所有 ptc-runtime 专用实现都由 `ctx.ptcRuntime` 提供。
**大型绑定值仍可能耗尽内存。** Node 提供方限制控制帧、未完成参数和排队写入，而 Host 绑定可以在这些检查前分配其结果。无损 JSON 传输与外层输出账本不构成进程级分配配额。
-**子分发的重叠由工具自身的安全声明限定，而非由调用方决定。** 程序里的 `Promise.all` 或 `asyncio.gather` 只在工具自己分类为并发安全的调用之间换来挂钟并行性；一串 exclusive 调用仍要按顺序付出各自的往返开销，模型可能过度期望。两种 flavor 的 SDK 说明都陈述了真实约定。本 note 交付的是使该风险绝对化的序列化占位实现；调度器及其重叠上限由[实时并行 Agent Note](2026-07-26-ptc-live-parallel-dispatch.zh.md) 负责。
+**子分发的重叠由工具自身的安全声明限定，而非由调用方决定。** 程序里的 `Promise.all` 或 `asyncio.gather` 只在工具自己分类为并发安全的调用之间换来挂钟并行性；一串 exclusive 调用仍要按顺序付出各自的往返开销，模型可能过度期望。两种 flavor 的 SDK 说明都陈述了真实约定。本 note 交付的是使该风险绝对化的序列化占位实现；调度器及其重叠上限由[实时并行 参考](../../../../packages/core/tools/README.zh.md) 负责。
**经过时间截止包括被等待的工作。** 嵌套工具和审批等待消耗程序的经过时间预算。Host 在截止到期时停止执行并等待受管清理；它不计量进程树 CPU 消耗。沙箱 Node 决策记录当前默认值与延后评估的 timeout 问题。
diff --git a/.agents/notes/implemented/feature/2026-06-18-compaction-capability-seam.i18n.yaml b/.agents/notes/implemented/feature/2026-06-18-compaction-capability-seam.i18n.yaml
deleted file mode 100644
index 4b48c194fe..0000000000
--- a/.agents/notes/implemented/feature/2026-06-18-compaction-capability-seam.i18n.yaml
+++ /dev/null
@@ -1,52 +0,0 @@
-# Bilingual-pair consistency record for 2026-06-18-compaction-capability-seam.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-06-18-compaction-capability-seam.md
-/agent-note-compaction-as-a-capability-seam-abstract-contract-basic-backend:
- en: 6808ccbe73762daa
- zh: 11f3669e6ae4512c
-/agent-note-compaction-as-a-capability-seam-abstract-contract-basic-backend/problem:
- en: ed3fddc1dce0f229
- zh: fab2663b344cd851
-/agent-note-compaction-as-a-capability-seam-abstract-contract-basic-backend/decision:
- en: a15c7c13f167e5ac
- zh: 63bcc2ef60c2f344
-/agent-note-compaction-as-a-capability-seam-abstract-contract-basic-backend/decision/compaction-is-a-capability-seam-with-separate-service-definition-and-service-provider-roles:
- en: 785c69730accbb4d
- zh: ee9bd2a8a7dc3b72
-/agent-note-compaction-as-a-capability-seam-abstract-contract-basic-backend/decision/the-contract-depends-on-dsh-session-and-dsh-llm-a-deliberate-deviation:
- en: 5c07a5a6429f6752
- zh: 8bf83da6e0563a66
-/agent-note-compaction-as-a-capability-seam-abstract-contract-basic-backend/decision/three-abstract-operations-algorithm-in-the-backend:
- en: 62191e0e65c79673
- zh: cbaa5bece0f5b45a
-/agent-note-compaction-as-a-capability-seam-abstract-contract-basic-backend/decision/automatic-pressure-runs-after-successful-durable-step-work:
- en: b246f9837c9c9a6b
- zh: c19c51456c8fd8b7
-/agent-note-compaction-as-a-capability-seam-abstract-contract-basic-backend/decision/retention-is-turn-agnostic-tool-pairing-balance-is-the-only-structural-guard:
- en: 3126c249c48e90b9
- zh: dc82bc9a37d90474
-/agent-note-compaction-as-a-capability-seam-abstract-contract-basic-backend/decision/head-anchoring-one-auto-checkpoint-always-at-the-head:
- en: 26f187b321217e4c
- zh: b324dcdb6da4bf02
-/agent-note-compaction-as-a-capability-seam-abstract-contract-basic-backend/decision/approximate-convergence-invariant:
- en: 4870032f23833fc4
- zh: b30180c31ba84a5a
-/agent-note-compaction-as-a-capability-seam-abstract-contract-basic-backend/decision/surface-replacement-compaction-events-are-log-only-one-user-message-carries-the-summary:
- en: 6d50dfe66a35f6fb
- zh: 6ff9e66553f10ac6
-/agent-note-compaction-as-a-capability-seam-abstract-contract-basic-backend/decision/checkpoint-framing-incremental-merge-backend-private:
- en: 1c71cf67450e78d5
- zh: fb44b3cf5cee070a
-/agent-note-compaction-as-a-capability-seam-abstract-contract-basic-backend/decision/blocking-via-a-log-recorded-lock-plus-a-crash-recoverable-failure-taxonomy:
- en: 5aed57a49e031b1e
- zh: 1424f332197ef541
-/agent-note-compaction-as-a-capability-seam-abstract-contract-basic-backend/alternatives-considered:
- en: 24a7bb1949445136
- zh: 7914ea99f498ed67
-/agent-note-compaction-as-a-capability-seam-abstract-contract-basic-backend/consequences:
- en: 400bf1cadb974d04
- zh: 7612a4634ae98b32
-/agent-note-compaction-as-a-capability-seam-abstract-contract-basic-backend/testing:
- en: 843476bd607fe832
- zh: 50be0b06553a54d0
diff --git a/.agents/notes/implemented/feature/2026-06-21-subagent-capability-seam.i18n.yaml b/.agents/notes/implemented/feature/2026-06-21-subagent-capability-seam.i18n.yaml
deleted file mode 100644
index 2362f9cac7..0000000000
--- a/.agents/notes/implemented/feature/2026-06-21-subagent-capability-seam.i18n.yaml
+++ /dev/null
@@ -1,46 +0,0 @@
-# Bilingual-pair consistency record for 2026-06-21-subagent-capability-seam.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-06-21-subagent-capability-seam.md
-/agent-note-subagent-capability-seam:
- en: 3c051f92759dd9c4
- zh: fceee1b8289f2779
-/agent-note-subagent-capability-seam/problem:
- en: 5c81597e6dc16c39
- zh: c30c6b5dce12bfae
-/agent-note-subagent-capability-seam/alternatives-considered:
- en: 6119e2aff3b6be5a
- zh: 76136ef5249c23eb
-/agent-note-subagent-capability-seam/alternatives-considered/why-not-the-bash-seam-shape:
- en: 3a01c98c45de8585
- zh: 7f87d8bd6d348dae
-/agent-note-subagent-capability-seam/decision:
- en: a15c7c13f167e5ac
- zh: 63bcc2ef60c2f344
-/agent-note-subagent-capability-seam/decision/the-three-package-boundary:
- en: c470cd9518cebc8b
- zh: 228b559f73c58f2b
-/agent-note-subagent-capability-seam/decision/the-primitive-async-start-subagentrun:
- en: 08250dc4d5faf918
- zh: 1b413cb438af6796
-/agent-note-subagent-capability-seam/decision/two-kinds-of-optional-capability-discovered-two-ways:
- en: d2a27fcacc46ca76
- zh: 4e8cca931fcaec2c
-/agent-note-subagent-capability-seam/decision/fork-vs-fresh-are-separate-backends-not-a-flag:
- en: a8e071639738ea79
- zh: 3fd7cc7427843efe
-/agent-note-subagent-capability-seam/decision/child-isolation-and-the-parent-log:
- en: e970f97f27d11f4a
- zh: 34ece0dfe5ec6185
-/agent-note-subagent-capability-seam/decision/synchronous-collect-first-cut:
- en: a14200a7abfa532f
- zh: ee4f8c08deb0ee99
-/agent-note-subagent-capability-seam/decision/transport-provider-selection-is-config-not-model-facing:
- en: 3dab95ec93f918df
- zh: 4c3c7d4e8357bf63
-/agent-note-subagent-capability-seam/testing:
- en: 324951447c43d01a
- zh: b04388c4665302d2
-/agent-note-subagent-capability-seam/consequences:
- en: c60d3fb1012f52b4
- zh: f46ab4b214941622
diff --git a/.agents/notes/implemented/feature/2026-06-30-interception-extension-points.i18n.yaml b/.agents/notes/implemented/feature/2026-06-30-interception-extension-points.i18n.yaml
deleted file mode 100644
index b5de0ccbcd..0000000000
--- a/.agents/notes/implemented/feature/2026-06-30-interception-extension-points.i18n.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-# Bilingual-pair consistency record for 2026-06-30-interception-extension-points.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-06-30-interception-extension-points.md
-/agent-note-interception-extension-points-the-typed-decision-surface-a-hook-programs-against:
- en: 623ca9ecb3ed4c8e
- zh: 5d5639dea9a6a541
-/agent-note-interception-extension-points-the-typed-decision-surface-a-hook-programs-against/problem:
- en: 7ce5525628f7fc7d
- zh: 53f27e5423da86f8
-/agent-note-interception-extension-points-the-typed-decision-surface-a-hook-programs-against/decision:
- en: dc7daa9100978a8b
- zh: c87aa08a4e085b7b
-/agent-note-interception-extension-points-the-typed-decision-surface-a-hook-programs-against/decision/the-tool-pipeline-gives-each-phase-one-kind-of-authority:
- en: 65553dedec611132
- zh: 5b002349db90b83f
-/agent-note-interception-extension-points-the-typed-decision-surface-a-hook-programs-against/decision/three-load-bearing-loop-decisions:
- en: d91bda956aa8bad9
- zh: 12bc8f819bf62ed2
-/agent-note-interception-extension-points-the-typed-decision-surface-a-hook-programs-against/decision/pre-tool-input-rewrite-is-a-separate-consistency-decision:
- en: bea1cab63d0470f1
- zh: b3a1dba46e346109
-/agent-note-interception-extension-points-the-typed-decision-surface-a-hook-programs-against/decision/boundaries:
- en: 30c23a1087faca81
- zh: 03d58723ee6b1a37
-/agent-note-interception-extension-points-the-typed-decision-surface-a-hook-programs-against/alternatives-considered:
- en: d05468299caa114d
- zh: d0b0eecf36456130
-/agent-note-interception-extension-points-the-typed-decision-surface-a-hook-programs-against/consequences:
- en: 830c7bab979652be
- zh: 7266e2d0780e9d67
diff --git a/.agents/notes/implemented/feature/2026-07-05-dynamic-workflows.i18n.yaml b/.agents/notes/implemented/feature/2026-07-05-dynamic-workflows.i18n.yaml
deleted file mode 100644
index b70097f9c9..0000000000
--- a/.agents/notes/implemented/feature/2026-07-05-dynamic-workflows.i18n.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-05-dynamic-workflows.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-05-dynamic-workflows.md
-/agent-note-dynamic-workflows-a-script-driven-multi-agent-orchestration-seam:
- en: 472dec484bf937c1
- zh: 1d6c38c699d43828
-/agent-note-dynamic-workflows-a-script-driven-multi-agent-orchestration-seam/problem:
- en: e890f8ac24054d94
- zh: 45ec14140f62e1c9
-/agent-note-dynamic-workflows-a-script-driven-multi-agent-orchestration-seam/decision:
- en: 16af14c0c9fc54ee
- zh: 463dd56b53d05ea7
-/agent-note-dynamic-workflows-a-script-driven-multi-agent-orchestration-seam/decision/the-script-contract-claude-code-compatible:
- en: 889beb90c3650f25
- zh: b1ba5dac3c77f8d2
-/agent-note-dynamic-workflows-a-script-driven-multi-agent-orchestration-seam/decision/the-seam-dsh-workflow:
- en: d37f01afb4d9cd6a
- zh: 5648b981b61e6624
-/agent-note-dynamic-workflows-a-script-driven-multi-agent-orchestration-seam/decision/the-engine-dsh-workflow-ptc-shared-node-process-execution:
- en: 7567d5fcf218e4b5
- zh: 2ba33b1237df9e4a
-/agent-note-dynamic-workflows-a-script-driven-multi-agent-orchestration-seam/decision/the-consumer-dsh-tool-workflow:
- en: 00b015ee9db948fb
- zh: 6dac8d8aaf0b32d2
-/agent-note-dynamic-workflows-a-script-driven-multi-agent-orchestration-seam/decision/the-foundation-structured-output-on-the-subagent-seam:
- en: 40ad0d1f23ffa7db
- zh: 23a81a277fb24cd9
-/agent-note-dynamic-workflows-a-script-driven-multi-agent-orchestration-seam/testing:
- en: a1607694b584dcbc
- zh: 29c9c7560f0fcf56
-/agent-note-dynamic-workflows-a-script-driven-multi-agent-orchestration-seam/deferred-documented-non-goals:
- en: 2bff807d808bfa13
- zh: add602509c0a826c
-/agent-note-dynamic-workflows-a-script-driven-multi-agent-orchestration-seam/alternatives-considered:
- en: 44a36cb0a91546cc
- zh: f4ed8c49f3764d7a
-/agent-note-dynamic-workflows-a-script-driven-multi-agent-orchestration-seam/consequences:
- en: bfd2d827ffb20587
- zh: 310c4fe77f48aa4e
diff --git a/.agents/notes/implemented/feature/2026-07-06-approval-seam.i18n.yaml b/.agents/notes/implemented/feature/2026-07-06-approval-seam.i18n.yaml
index 07e39db02d..c8979a44f7 100644
--- a/.agents/notes/implemented/feature/2026-07-06-approval-seam.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-07-06-approval-seam.i18n.yaml
@@ -6,8 +6,8 @@
en: 5a500ddf8910f3b2
zh: 0461f97e3c905d72
/agent-note-the-approval-seam-one-shot-permission-decisions-over-a-waterfall-of-answerers/problem:
- en: 0903931cf3fd2d9b
- zh: ae39e774ffa66c36
+ en: bbf79ea651c64540
+ zh: 31c18cc9a96d4e86
/agent-note-the-approval-seam-one-shot-permission-decisions-over-a-waterfall-of-answerers/decision:
en: 058d4bd95d3c55d3
zh: a861c6a59340b121
@@ -24,8 +24,8 @@
en: 1d4478059f608fd2
zh: 4a1d12e4ccb766b5
/agent-note-the-approval-seam-one-shot-permission-decisions-over-a-waterfall-of-answerers/decision/design-detail/the-per-session-policy-tier:
- en: 4eaf3ae10290dc6a
- zh: 0cb65c79a5e9effc
+ en: efb68e085f784862
+ zh: ad73ca74d9174cd5
/agent-note-the-approval-seam-one-shot-permission-decisions-over-a-waterfall-of-answerers/decision/design-detail/the-acp-answerer:
en: bbfb8c3f1cb34b12
zh: 4f8f51a027a09a03
@@ -39,8 +39,8 @@
en: 01356985c175fcda
zh: b1bb3b68f619e698
/agent-note-the-approval-seam-one-shot-permission-decisions-over-a-waterfall-of-answerers/deferred:
- en: 3a9a1ddf86364f14
- zh: ec8413e23f171bd2
+ en: c6246315353b3e19
+ zh: 3931b829e2288ac1
/agent-note-the-approval-seam-one-shot-permission-decisions-over-a-waterfall-of-answerers/alternatives-considered:
en: ae974b0f43a29b4e
zh: bbc4662c0c63b6c1
@@ -48,8 +48,8 @@
en: 9d2097d7b796dd63
zh: 4f1a0493dc109b12
/agent-note-the-approval-seam-one-shot-permission-decisions-over-a-waterfall-of-answerers/faq:
- en: 85f3a8270d96497d
- zh: b97bedebc08f23f0
+ en: 680b33c124d10384
+ zh: 57ac659ffda68dad
/agent-note-the-approval-seam-one-shot-permission-decisions-over-a-waterfall-of-answerers/prior-art:
- en: 964a5c6afd4724d6
- zh: 1a386e1376860105
+ en: 3672a3e2f52bf220
+ zh: adc15c33f9d1884a
diff --git a/.agents/notes/implemented/feature/2026-07-06-approval-seam.md b/.agents/notes/implemented/feature/2026-07-06-approval-seam.md
index bb44957b6d..dede6ae6b7 100644
--- a/.agents/notes/implemented/feature/2026-07-06-approval-seam.md
+++ b/.agents/notes/implemented/feature/2026-07-06-approval-seam.md
@@ -6,7 +6,7 @@ English | [中文](2026-07-06-approval-seam.zh.md)
## Problem
-Two callers need one closed decision — "may this specific action proceed?": `tools/pre-execute`'s `ask` decision (including the Claude-Code hook bridge's `permissionDecision: ask`) and the [sandbox Agent Note](2026-07-06-sandbox.md)'s post-denial one-shot escalation retry. A shared seam keeps them from inventing separate outcome vocabularies, channel routing, cancellation, and audit trails, while guaranteeing that a deployment with no answerer can never grant an unanswerable request. The answerer may be an interactive host or an automated controller.
+Two callers need one closed decision — "may this specific action proceed?": `tools/pre-execute`'s `ask` decision (including the Claude-Code hook bridge's `permissionDecision: ask`) and the [sandbox reference](../../../../packages/shell/tool-bash/README.md)'s post-denial one-shot escalation retry. A shared seam keeps them from inventing separate outcome vocabularies, channel routing, cancellation, and audit trails, while guaranteeing that a deployment with no answerer can never grant an unanswerable request. The answerer may be an interactive host or an automated controller.
The routing problem is ownership: a permission request must reach the channel that owns the asking agent, fail closed for agents nobody owns, and stay out of deployments that compose no answerer.
@@ -63,7 +63,7 @@ Answerers are `approval/request` waterfall listeners. Zero listeners fall throug
#### The per-session policy tier
-The seam also owns the session-scoped `'ask' | 'never'` policy described by [the sandbox Agent Note](2026-07-06-sandbox.md). Effective policy is folded from logged switches over the deployment default. `'never'` resolves to `rejected` inside `request()` before any answerer can run; `'ask'` dispatches and otherwise falls through to `unavailable`. Both current values join the atomic runtime-context snapshot before each model request, so a policy switch needs no separate narration; every approval request still records the audit pair.
+The seam also owns the session-scoped `'ask' | 'never'` policy described by [the approval reference](../../../../packages/interaction/user-approval/README.md). Effective policy is folded from logged switches over the deployment default. `'never'` resolves to `rejected` inside `request()` before any answerer can run; `'ask'` dispatches and otherwise falls through to `unavailable`. Both current values join the atomic runtime-context snapshot before each model request, so a policy switch needs no separate narration; every approval request still records the audit pair.
#### The ACP answerer
@@ -87,7 +87,7 @@ Snapshots record allowed and rejected sandbox escalation through `session/reques
## Deferred
-- **`allow_always` grant storage** — honoring a persistent grant means designing storage, scope identity (call? path? prefix? session? time window?), and revocation; until designed, only the one-shot options are advertised ([the sandbox Agent Note](2026-07-06-sandbox.md) § Escalation records the open scope question).
+- **`allow_always` grant storage** — honoring a persistent grant means designing storage, scope identity (call? path? prefix? session? time window?), and revocation; until designed, only the one-shot options are advertised.
- **A recorded hook-driven `ask` through a composed answerer** — the permission wire is recorded through the sandbox example's escalation branches. The hook matrix's `hook-cc-pretool-ask` pins the no-ApprovalService fallback denial, while the hook-producer-plus-answerer composition remains on the unit tier.
- **Routing a child agent's approvals to the parent session** — `subagent-acp`'s child auto-answers its own permission requests; delegating them to the parent controller is its own design.
@@ -123,7 +123,7 @@ Costs and accepted limits:
- **Who decides whether a call asks in the first place?** Policy producers: a hook returning `permissionDecision: ask`, any `tools/pre-execute` listener, or the sandbox escalation gate. The seam and the bridge only route and answer; neither injects its own judgment about what deserves a prompt.
- **What happens when the user dismisses the prompt, or the turn aborts mid-ask?** Dismissal maps to `cancelled` with its own deny text. An already-aborted signal settles `cancelled` without dispatching; an abort during the ask discards the late answer. When both audit appends commit, either path records one pair, never two.
- **What if the client answers with an option the harness never offered?** Any selection other than the offered `allow_once` maps to `rejected` — an unknown optionId from a non-conforming client can never grant.
-- **How do subagents' approvals route?** They do not: delegation pins every in-process child to `'never'` ([approvals-pinned decision](2026-08-10-subagent-approval-pinned-never.md)), so each child ask resolves `rejected` before any answerer and the child is told up front through its runtime context. `subagent-acp`'s child-side auto-answer is separate; routing a child's asks to the parent controller is deferred (§ Deferred).
+- **How do subagents' approvals route?** They do not: delegation pins every in-process child to `'never'` ([approvals-pinned reference](../../../../packages/subagent/subagent/README.md)), so each child ask resolves `rejected` before any answerer and the child is told up front through its runtime context. `subagent-acp`'s child-side auto-answer is separate; routing a child's asks to the parent controller is deferred (§ Deferred).
- **What does `policy: 'never'` actually change at runtime?** The service resolves every ask for that session to `rejected` before dispatching any answerer (in-service, so no registration order can bypass it); the next atomic runtime-context snapshot states the policy; each successful auto-rejection records the audit pair.
- **What happens across a hot reload, or when an answerer unloads mid-session?** Answerers dispose with their owning fiber, so the next ask degrades to `unavailable` instead of hanging on a dead channel; remounting re-registers the answerer with no catch-up state.
- **Where does a client get approval context?** The request carries the exact `callId` and the asker's human-readable `reason`; channel adapters may correlate richer tool-call state without duplicating arguments in the approval seam.
@@ -134,6 +134,6 @@ In-repo precedents this design copies or contrasts with:
- The `fs/write-intent` gate (`packages/fs/fs/`) — the documented single-occupancy decision-slot waterfall semantics (first answer wins, delegate via `next()`) the answerer contract reuses.
- `hook/invoked`/`hook/result` — the log-only audit-pair precedent `approval/asked`/`approval/decided` follows; [the hook-bridges Agent Note](../../archived/feature/2026-06-30-hook-bridges.md) ships `permissionDecision: ask`, the first producer.
-- [The interception extension-points Agent Note](2026-06-30-interception-extension-points.md) — the `tools/pre-execute` `allow`/`deny`/`ask` vocabulary whose `ask` this seam services.
+- [The interception extension-points reference](../../../../docs/tool-execution-pipeline.md) — the `tools/pre-execute` `allow`/`deny`/`ask` vocabulary whose `ask` this seam services.
- [The automation-only ACP Agent Note](../simplification/2026-07-23-acp-automation-only-protocol.md) — the exact-agent ownership check against the session map that the answerer routes through; [the multi-session Agent Note](../../archived/feature/2026-06-14-acp-multi-session.md) — the per-session permission-ownership blocker this implements.
- The opportunistic `ctx.get()` consumption pattern (`tool-bash`'s owner-token lookup, the loop's persistence probe) — how `dsh-tools` consumes the seam without gating its fiber on it.
diff --git a/.agents/notes/implemented/feature/2026-07-06-approval-seam.zh.md b/.agents/notes/implemented/feature/2026-07-06-approval-seam.zh.md
index b7e07a376c..61632594a1 100644
--- a/.agents/notes/implemented/feature/2026-07-06-approval-seam.zh.md
+++ b/.agents/notes/implemented/feature/2026-07-06-approval-seam.zh.md
@@ -6,7 +6,7 @@ Status: implemented
## 问题
-两个调用方需要同一个封闭决策——「这个具体操作可以继续吗？」：`tools/pre-execute` 的 `ask` 决策（包括 Claude-Code 钩子桥的 `permissionDecision: ask`）以及[沙箱 Agent Note](2026-07-06-sandbox.zh.md) 中拒绝后的一次性升级重试。一个共享的 seam 使它们无需各自发明独立的结果词汇、通道路由、取消机制和审计轨迹，同时保证没有应答者的部署永远不会批准一个无法应答的请求。应答者可以是交互式宿主，也可以是自动化控制器。
+两个调用方需要同一个封闭决策——「这个具体操作可以继续吗？」：`tools/pre-execute` 的 `ask` 决策（包括 Claude-Code 钩子桥的 `permissionDecision: ask`）以及[沙箱 参考](../../../../packages/shell/tool-bash/README.zh.md) 中拒绝后的一次性升级重试。一个共享的 seam 使它们无需各自发明独立的结果词汇、通道路由、取消机制和审计轨迹，同时保证没有应答者的部署永远不会批准一个无法应答的请求。应答者可以是交互式宿主，也可以是自动化控制器。
路由问题的核心是归属：权限请求必须到达拥有发起请求的 agent（智能体）的通道，对无人拥有的 agent 失败关闭，并且不侵入没有组合应答者的部署。
@@ -63,7 +63,7 @@ tool/result "escalated" — this one call ran under the wider mode; the gra
#### 每会话策略层
-seam 还拥有[沙箱 Agent Note](2026-07-06-sandbox.zh.md) 所描述的会话级 `'ask' | 'never'` 策略。生效策略由日志中记录的切换在部署默认值之上折叠而成。`'never'` 会在任何应答者运行之前，于 `request()` 内部解析为 `rejected`；`'ask'` 则派发请求，否则一路委派至 `unavailable`。两个当前值都会在每次模型请求前加入原子化的运行时上下文快照，因此策略切换无需单独叙述；每次审批请求仍会记录审计对。
+seam 还拥有[审批参考](../../../../packages/interaction/user-approval/README.zh.md)所描述的会话级 `'ask' | 'never'` 策略。生效策略由日志中记录的切换在部署默认值之上折叠而成。`'never'` 会在任何应答者运行之前，于 `request()` 内部解析为 `rejected`；`'ask'` 则派发请求，否则一路委派至 `unavailable`。两个当前值都会在每次模型请求前加入原子化的运行时上下文快照，因此策略切换无需单独叙述；每次审批请求仍会记录审计对。
#### ACP 应答者
@@ -87,7 +87,7 @@ ACP 桥只应答其会话映射所拥有的精确 agent 对象。它携带既有
## 延后
-- **`allow_always` 授权存储**：兑现持久授权意味着设计存储、作用域标识（调用？路径？前缀？会话？时间窗口？）和撤销；在设计完成之前，只展示一次性选项（[沙箱 Agent Note](2026-07-06-sandbox.zh.md) § Escalation 记录了开放的作用域问题）。
+- **`allow_always` 授权存储**：兑现持久授权意味着设计存储、作用域标识（调用？路径？前缀？会话？时间窗口？）和撤销；在设计完成之前，只展示一次性选项。
- **通过组合应答者录制由钩子驱动的 `ask`**：权限协议格式（wire format）已通过沙箱示例的升级分支录制。钩子矩阵中的 `hook-cc-pretool-ask` 固定无 ApprovalService 时的后备拒绝，而钩子生产者与应答者的组合仍留在单元测试层。
- **将子 agent 的审批路由到父会话**：`subagent-acp` 的子侧自动应答自己的权限请求；将其委派给父控制器是独立的设计。
@@ -123,7 +123,7 @@ ACP 桥只应答其会话映射所拥有的精确 agent 对象。它携带既有
- **谁决定一次调用是否需要 ask？** 策略生产者：返回 `permissionDecision: ask` 的钩子、任何 `tools/pre-execute` 监听器、或沙箱升级门禁。seam 和桥只负责路由和应答；二者都不注入自己对「什么值得弹出提示」的判断。
- **用户关闭提示或轮次在 ask 进行中中止时会发生什么？** 关闭映射为 `cancelled` 并携带自己的拒绝文本。已中止的 signal 直接结算为 `cancelled` 而不派发；ask 进行中的中止丢弃迟到的应答。当两个审计追加都提交时，任一路径都记录恰好一对事件，绝不会两对。
- **如果客户端以 harness 从未提供的选项应答呢？** 除已提供的 `allow_once` 之外的任何选项都映射为 `rejected`——来自不合规客户端的未知 optionId 永远不能授权。
-- **subagent 的审批如何路由？** 不路由：委派会把每个进程内子 agent 钉定为 `'never'`（[审批钉定决策](2026-08-10-subagent-approval-pinned-never.zh.md)），因此子 agent 的每次 ask 都在任何应答者之前解析为 `rejected`，子 agent 则通过其运行时上下文一开始就会得知。`subagent-acp` 的子侧自动应答是独立的；将子 agent 的 ask 路由到父控制器已延后（§ 延后）。
+- **subagent 的审批如何路由？** 不路由：委派会把每个进程内子 agent 钉定为 `'never'`（[审批钉定参考](../../../../packages/subagent/subagent/README.zh.md)），因此子 agent 的每次 ask 都在任何应答者之前解析为 `rejected`，子 agent 则通过其运行时上下文一开始就会得知。`subagent-acp` 的子侧自动应答是独立的；将子 agent 的 ask 路由到父控制器已延后（§ 延后）。
- **`policy: 'never'` 在运行时实际改变了什么？** 服务在派发任何应答者之前，将该会话的每次 ask 解析为 `rejected`（在服务内部，因此没有注册顺序能绕过它）；下一份原子化的运行时上下文快照会声明该策略；每次成功的自动拒绝都会记录审计对。
- **热重载或应答者在会话中途卸载时会发生什么？** 应答者随其拥有的 fiber 一起 dispose，因此下一次 ask 降级为 `unavailable` 而非挂在死通道上；重新挂载会重新注册应答者，无需追赶状态。
- **客户端从哪里获得审批上下文？** 请求携带精确的 `callId` 和发起方的人类可读 `reason`；通道适配器可自行关联更丰富的工具调用状态，而无需在审批 seam 中重复携带参数。
@@ -134,6 +134,6 @@ ACP 桥只应答其会话映射所拥有的精确 agent 对象。它携带既有
- `fs/write-intent` 门禁（`packages/fs/fs/`）——文档化的单占用决策槽 waterfall 语义（先到先得，通过 `next()` 委派），应答者约定复用了它。
- `hook/invoked`/`hook/result`——仅日志审计对先例，`approval/asked`/`approval/decided` 沿用了它；[钩子桥 Agent Note](../../archived/feature/2026-06-30-hook-bridges.md) 交付了 `permissionDecision: ask`，即第一个生产者。
-- [拦截扩展点 Agent Note](2026-06-30-interception-extension-points.zh.md)——`tools/pre-execute` 的 `allow`/`deny`/`ask` 词汇，本 seam 服务其中的 `ask`。
+- [拦截扩展点 参考](../../../../docs/tool-execution-pipeline.zh.md)——`tools/pre-execute` 的 `allow`/`deny`/`ask` 词汇，本 seam 服务其中的 `ask`。
- [仅面向自动化的 ACP Agent Note](../simplification/2026-07-23-acp-automation-only-protocol.zh.md)——应答者路由时对会话映射执行的精确 agent 归属检查；[多会话 Agent Note](../../archived/feature/2026-06-14-acp-multi-session.md)——本设计实现的每会话权限归属阻塞项。
- 机会性 `ctx.get()` 消费模式（`tool-bash` 的 owner-token 查找、loop 的持久化探测）——`dsh-tools` 消费该 seam 而不阻塞其 fiber 的方式。
diff --git a/.agents/notes/implemented/feature/2026-07-06-sandbox.i18n.yaml b/.agents/notes/implemented/feature/2026-07-06-sandbox.i18n.yaml
deleted file mode 100644
index e29631633c..0000000000
--- a/.agents/notes/implemented/feature/2026-07-06-sandbox.i18n.yaml
+++ /dev/null
@@ -1,61 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-06-sandbox.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-06-sandbox.md
-/agent-note-the-subprocess-sandbox-confinement-seam-native-runners-escalation-and-per-session-modes:
- en: b36f59d0746e94f1
- zh: 0d0f8e19917a9eae
-/agent-note-the-subprocess-sandbox-confinement-seam-native-runners-escalation-and-per-session-modes/problem:
- en: 045e61bb682755dc
- zh: ac95eb64ce892f8d
-/agent-note-the-subprocess-sandbox-confinement-seam-native-runners-escalation-and-per-session-modes/decision:
- en: f4748553d52935ff
- zh: 1802a543c6d989ef
-/agent-note-the-subprocess-sandbox-confinement-seam-native-runners-escalation-and-per-session-modes/decision/how-a-deployment-uses-it:
- en: 956a2c069b1ac0b1
- zh: ebf91494b8107ced
-/agent-note-the-subprocess-sandbox-confinement-seam-native-runners-escalation-and-per-session-modes/decision/design-detail:
- en: a6d7884e4359af3a
- zh: e72588705942000a
-/agent-note-the-subprocess-sandbox-confinement-seam-native-runners-escalation-and-per-session-modes/decision/design-detail/scope-grounding:
- en: 0c09534b59e2063e
- zh: 5225d6750d13b9d7
-/agent-note-the-subprocess-sandbox-confinement-seam-native-runners-escalation-and-per-session-modes/decision/design-detail/the-seam-ctx-sandbox:
- en: 2c98e8c0bd8a9ff1
- zh: 661b58f81f6e05c6
-/agent-note-the-subprocess-sandbox-confinement-seam-native-runners-escalation-and-per-session-modes/decision/design-detail/local-backends-and-the-shipped-launcher:
- en: 5c6bf38f958b07d0
- zh: 22bf9fac71eb643d
-/agent-note-the-subprocess-sandbox-confinement-seam-native-runners-escalation-and-per-session-modes/decision/design-detail/asynchronous-preparation:
- en: 7bc0fab85c7c91d0
- zh: 3eafcde6b1e3249c
-/agent-note-the-subprocess-sandbox-confinement-seam-native-runners-escalation-and-per-session-modes/decision/design-detail/the-bash-consumer:
- en: f7f359c89a0e8fd6
- zh: 07d0d551a35716e0
-/agent-note-the-subprocess-sandbox-confinement-seam-native-runners-escalation-and-per-session-modes/decision/design-detail/escalation-one-approved-wider-retry-after-a-denial:
- en: 035640e276225e97
- zh: 09fd95921529369b
-/agent-note-the-subprocess-sandbox-confinement-seam-native-runners-escalation-and-per-session-modes/decision/design-detail/per-session-modes-the-session-log-as-the-store:
- en: 6805c807f584961c
- zh: 687fd4ad687e4dee
-/agent-note-the-subprocess-sandbox-confinement-seam-native-runners-escalation-and-per-session-modes/decision/design-detail/in-process-tools:
- en: 73cd47df9f2acbd0
- zh: 877db86c2a36a9ab
-/agent-note-the-subprocess-sandbox-confinement-seam-native-runners-escalation-and-per-session-modes/decision/testing:
- en: c0189d491354eb48
- zh: ac68b07188402f9c
-/agent-note-the-subprocess-sandbox-confinement-seam-native-runners-escalation-and-per-session-modes/deferred-phases:
- en: f28b530000b8495e
- zh: f256b8b32c4ce4ef
-/agent-note-the-subprocess-sandbox-confinement-seam-native-runners-escalation-and-per-session-modes/alternatives-considered:
- en: eabe577b837f3de2
- zh: 4ef0167c895766a6
-/agent-note-the-subprocess-sandbox-confinement-seam-native-runners-escalation-and-per-session-modes/consequences:
- en: c0d8279a677a0ef1
- zh: 3518fc05f8700c0b
-/agent-note-the-subprocess-sandbox-confinement-seam-native-runners-escalation-and-per-session-modes/faq:
- en: de45c2a398b8abe6
- zh: 93be112960b40736
-/agent-note-the-subprocess-sandbox-confinement-seam-native-runners-escalation-and-per-session-modes/prior-art:
- en: a51744b1cafca339
- zh: 1d27f49f1aa550af
diff --git a/.agents/notes/implemented/feature/2026-07-07-mcp-client-plugin.i18n.yaml b/.agents/notes/implemented/feature/2026-07-07-mcp-client-plugin.i18n.yaml
deleted file mode 100644
index 751b41f4c6..0000000000
--- a/.agents/notes/implemented/feature/2026-07-07-mcp-client-plugin.i18n.yaml
+++ /dev/null
@@ -1,94 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-07-mcp-client-plugin.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-07-mcp-client-plugin.md
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools:
- en: 7d41e632fd40efe0
- zh: 4c7f6410b74a5bd3
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/problem:
- en: 7cef5ed5bc88fba5
- zh: 795917e3321148ab
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/decision:
- en: a15c7c13f167e5ac
- zh: 63bcc2ef60c2f344
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/decision/package:
- en: 90a6e5a22fa99a36
- zh: 4280a5feecd3e6c1
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/decision/sdk:
- en: f69bbd1cfca85fa0
- zh: 9b21abc7e3eeb2fd
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/decision/scope:
- en: 32cd57e8d3ea1ac1
- zh: 7c14401492f22c32
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/decision/plugin-shape:
- en: 3d6e4726e5c890a6
- zh: 888123ed412544a7
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/decision/configuration:
- en: a244e4d7a8294424
- zh: 4be5ed51345a660e
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/decision/lifecycle:
- en: b428a4e72dec4ba0
- zh: c070db6fdd2d3c7f
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/decision/tool-discovery-and-registration:
- en: 75da266ca8141a90
- zh: 078e3a969273ed9b
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/decision/public-name-normalization:
- en: eb0511bd6173c99c
- zh: c5fc98231a733699
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/decision/name-conflict-handling:
- en: 88210585c857f934
- zh: fc0d90d572d6ba45
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/decision/naming-invariants:
- en: 1e2ce84605977339
- zh: 3b3c9d120c0262a7
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/decision/tool-execution:
- en: c82db842e7a6f3db
- zh: ace9e266cd6c4203
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/decision/subprocess-environment-stdio-transport:
- en: d599a7db35e1f96d
- zh: a2655e0410565c93
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/decision/disconnection-crash:
- en: e8207a70c6511778
- zh: aa281be51d85be13
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/alternatives-considered:
- en: 6119e2aff3b6be5a
- zh: 76136ef5249c23eb
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/alternatives-considered/mcp-server-side-expose-harness-tools-to-external-mcp-clients:
- en: 831148b7e748eaa3
- zh: 845172ccc64d7a65
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/alternatives-considered/capability-seam-three-package-split-interface-impl-consumer:
- en: caefc1146f9b2b16
- zh: 9c4a5d55019d8002
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/alternatives-considered/auto-reconnect-with-exponential-backoff:
- en: e92d18530feb1ee3
- zh: 2fecc50b4b6a96d9
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/alternatives-considered/bridge-resources-and-prompts:
- en: 606ee33502fa60cc
- zh: 0c21afec01caf4c2
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/alternatives-considered/raw-model-facing-tool-names-with-an-optional-toolprefix:
- en: ef886d275ac5734c
- zh: 304c578e674f50a2
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/alternatives-considered/server-only-namespace-github-create-issue-no-mcp-marker:
- en: d18be656bd334d18
- zh: b7cdc2d580e9f2ab
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/alternatives-considered/deriving-the-namespace-from-the-server-announced-serverinfo-name:
- en: 17bc5d831e3d06a7
- zh: 6b9e2f5cd76d12f8
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/alternatives-considered/preserve-multiple-textblocks-in-tool-result:
- en: 184f6d75be815400
- zh: a284afac1e2b80e2
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/alternatives-considered/replace-the-canonical-mcp-result-with-core-contentblock:
- en: d5d253f8e466bab9
- zh: 7d93b7fa1c2219ed
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/alternatives-considered/add-a-generic-richcontent-service-or-perform-i-o-in-output-render:
- en: 687c220df3767635
- zh: c87dd8700edc9291
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/alternatives-considered/let-each-image-returning-tool-special-case-ptc-mode-parents:
- en: a5fc7b17970699ce
- zh: 2d7bd23621f62597
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/testing:
- en: 4bb5be21c1097a57
- zh: d12bf01bb70e1bc3
-/agent-note-mcp-client-plugin-connect-to-external-mcp-servers-and-bridge-their-tools/consequences:
- en: ef35ec18568b38e5
- zh: ca85076585c2b787
diff --git a/.agents/notes/implemented/feature/2026-07-08-self-referential-cordis-toolset.i18n.yaml b/.agents/notes/implemented/feature/2026-07-08-self-referential-cordis-toolset.i18n.yaml
deleted file mode 100644
index 67063fa1b4..0000000000
--- a/.agents/notes/implemented/feature/2026-07-08-self-referential-cordis-toolset.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-08-self-referential-cordis-toolset.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-08-self-referential-cordis-toolset.md
-/agent-note-cordis-runtime-inspection-and-runner-isolation:
- en: d96c123d1989b22b
- zh: 4a53cdd763955f19
-/agent-note-cordis-runtime-inspection-and-runner-isolation/problem:
- en: 29d1465c348331e9
- zh: 25dbc885f5d7ee7d
-/agent-note-cordis-runtime-inspection-and-runner-isolation/decision:
- en: 8a4cbb660f2409d7
- zh: 2219e39468e6baee
-/agent-note-cordis-runtime-inspection-and-runner-isolation/alternatives-considered:
- en: 637137a3b035c211
- zh: 5a667bfe2446a5f8
-/agent-note-cordis-runtime-inspection-and-runner-isolation/consequences:
- en: a21f854954e01db6
- zh: c16bbe7c3580b394
diff --git a/.agents/notes/implemented/feature/2026-07-10-parallel-tool-call-execution.i18n.yaml b/.agents/notes/implemented/feature/2026-07-10-parallel-tool-call-execution.i18n.yaml
index 5867da4d43..639381d125 100644
--- a/.agents/notes/implemented/feature/2026-07-10-parallel-tool-call-execution.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-07-10-parallel-tool-call-execution.i18n.yaml
@@ -12,8 +12,8 @@
en: 532bb7268d9b93ce
zh: ad47162233222ab0
/agent-note-parallel-tool-call-execution-by-per-call-safety/scheduling-and-ordering:
- en: a485c530ea4366de
- zh: 6f9915d726de9ac7
+ en: 4e85280cc5eb8697
+ zh: 8e6b09b1527784fa
/agent-note-parallel-tool-call-execution-by-per-call-safety/safety-contract:
en: 16c4ee08b65ead23
zh: df80d6e49982615b
diff --git a/.agents/notes/implemented/feature/2026-07-10-parallel-tool-call-execution.md b/.agents/notes/implemented/feature/2026-07-10-parallel-tool-call-execution.md
index 004d725bfd..40adc9f9aa 100644
--- a/.agents/notes/implemented/feature/2026-07-10-parallel-tool-call-execution.md
+++ b/.agents/notes/implemented/feature/2026-07-10-parallel-tool-call-execution.md
@@ -46,9 +46,9 @@ Only dispatch and the tool body overlap. `tools/pre-execute` and `tools/post-exe
Each started call appends `tool/call` immediately before its pre-execute gate. Completed dispatches occupy model-order slots, and a commit cursor appends `tool/result` and collects `additionalContexts` only when the next slot is ready. Live surfaces may show several pending calls, but results and post-tool context remain model-ordered.
-An abort stops replenishment, waits for already-started calls, commits their results in order, drains accepted batch context after those results, and records synthetic aborted call/result pairs for undispatched calls. An unexpected scheduler failure stops new dispatches, waits for every already-started dispatch to settle, and rethrows the first failure. The driver records missing results before closing the failed step under the [failed-step recovery decision](../bug-fix/2026-09-19-failed-step-tool-results.md).
+An abort stops replenishment, waits for already-started calls, commits their results in order, drains accepted batch context after those results, and records synthetic aborted call/result pairs for undispatched calls. An unexpected scheduler failure stops new dispatches, waits for every already-started dispatch to settle, and rethrows the first failure. The driver records missing results before closing the failed step under the [failed-step recovery reference](../../../../packages/core/agent-loop/README.md).
-PTC mode remains outside this scheduler because the model emits one native `run_code` call. `run_code` and its internal dispatch queue remain serial; native sibling calls in `mode: 'both'` use the normal scheduler.
+The loop schedules native sibling calls and each outer `run_code` call. A `run_code` program has its own bounded dispatch pool, which uses the same parallel/exclusive classification; the [PTC execution reference](../../../../packages/core/tools/README.md#ptc-mode) owns that nested scheduling.
## Safety contract
diff --git a/.agents/notes/implemented/feature/2026-07-10-parallel-tool-call-execution.zh.md b/.agents/notes/implemented/feature/2026-07-10-parallel-tool-call-execution.zh.md
index e78f56e07c..536541370b 100644
--- a/.agents/notes/implemented/feature/2026-07-10-parallel-tool-call-execution.zh.md
+++ b/.agents/notes/implemented/feature/2026-07-10-parallel-tool-call-execution.zh.md
@@ -46,9 +46,9 @@ Status: implemented
每个已启动的调用都会在进入 pre-execute 门禁之前立即追加 `tool/call`。已完成的派发占据模型顺序的槽位；提交游标只有在下一个槽位就绪时，才会追加 `tool/result` 并收集 `additionalContexts`。实时界面可以显示多个待处理调用，但结果和工具执行后的上下文仍按模型顺序排列。
-中止会停止补充池，等待已启动的调用，按顺序提交其结果，在这些结果之后排空已接受的批次上下文，并为未派发的调用记录合成的中止调用／结果对。调度器发生意外故障时，会停止新的派发，等待每项已启动的派发结算，并重新抛出第一个故障。驱动器按照[失败步骤恢复决策](../bug-fix/2026-09-19-failed-step-tool-results.zh.md)，在关闭失败步骤之前记录缺失结果。
+中止会停止补充池，等待已启动的调用，按顺序提交其结果，在这些结果之后排空已接受的批次上下文，并为未派发的调用记录合成的中止调用／结果对。调度器发生意外故障时，会停止新的派发，等待每项已启动的派发结算，并重新抛出第一个故障。驱动器按照[失败步骤恢复参考](../../../../packages/core/agent-loop/README.zh.md)，在关闭失败步骤之前记录缺失结果。
-PTC mode 仍不使用此调度器，因为模型只会发出一个原生 `run_code` 调用。`run_code` 及其内部派发队列仍按串行方式执行；`mode: 'both'` 中的原生并列调用使用常规调度器。
+循环调度原生并列调用和每个外层 `run_code` 调用。`run_code` 程序拥有自己的有界派发池，并使用相同的并行／独占分类；[PTC 执行参考](../../../../packages/core/tools/README.zh.md#ptc-mode)负责说明该嵌套调度。
## 安全约定
diff --git a/.agents/notes/implemented/feature/2026-07-14-cross-family-fs-sandbox.i18n.yaml b/.agents/notes/implemented/feature/2026-07-14-cross-family-fs-sandbox.i18n.yaml
deleted file mode 100644
index 938869414c..0000000000
--- a/.agents/notes/implemented/feature/2026-07-14-cross-family-fs-sandbox.i18n.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-14-cross-family-fs-sandbox.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-14-cross-family-fs-sandbox.md
-/agent-note-cross-family-file-sandbox-one-policy-home-a-sandboxed-fs-provider-and-fs-escalation-parity:
- en: d971839c319030fa
- zh: 29d8cc0ec85337af
-/agent-note-cross-family-file-sandbox-one-policy-home-a-sandboxed-fs-provider-and-fs-escalation-parity/problem:
- en: 2ce70b520caa28b5
- zh: 6f023332dd48bf83
-/agent-note-cross-family-file-sandbox-one-policy-home-a-sandboxed-fs-provider-and-fs-escalation-parity/decision:
- en: dd825d09d6d850ed
- zh: 0c355b56ff17d099
-/agent-note-cross-family-file-sandbox-one-policy-home-a-sandboxed-fs-provider-and-fs-escalation-parity/decision/ctx-sandboxpolicy-one-home-for-mode-and-workspace-root:
- en: e8ef62a480614c1a
- zh: 90c29f6845e2f437
-/agent-note-cross-family-file-sandbox-one-policy-home-a-sandboxed-fs-provider-and-fs-escalation-parity/decision/dsh-fs-sandbox-enforcement-inside-the-provider:
- en: 077a767b86dd7860
- zh: e8797afed2f65fa6
-/agent-note-cross-family-file-sandbox-one-policy-home-a-sandboxed-fs-provider-and-fs-escalation-parity/decision/tool-parity-one-denial-marker-one-escalation-flow:
- en: f1fed3aaf3a1482c
- zh: d4bc7989477b3a0b
-/agent-note-cross-family-file-sandbox-one-policy-home-a-sandboxed-fs-provider-and-fs-escalation-parity/decision/the-enforcement-point-provider-not-intent-gate:
- en: 98549276110ac457
- zh: d680c26086c68a8c
-/agent-note-cross-family-file-sandbox-one-policy-home-a-sandboxed-fs-provider-and-fs-escalation-parity/decision/out-of-scope:
- en: 9157891a477f17bd
- zh: 58d926d0b86bc4fd
-/agent-note-cross-family-file-sandbox-one-policy-home-a-sandboxed-fs-provider-and-fs-escalation-parity/alternatives-considered:
- en: 669431ca494a7783
- zh: e875a63c553135e1
-/agent-note-cross-family-file-sandbox-one-policy-home-a-sandboxed-fs-provider-and-fs-escalation-parity/consequences:
- en: 3848066c5a8c56ef
- zh: 048cdf6cb8dbde4d
-/agent-note-cross-family-file-sandbox-one-policy-home-a-sandboxed-fs-provider-and-fs-escalation-parity/testing:
- en: dc226f5a587ff7d4
- zh: 55f5d937d6bc86e9
diff --git a/.agents/notes/implemented/feature/2026-07-16-harness-level-loop.i18n.yaml b/.agents/notes/implemented/feature/2026-07-16-harness-level-loop.i18n.yaml
deleted file mode 100644
index 624d9c4025..0000000000
--- a/.agents/notes/implemented/feature/2026-07-16-harness-level-loop.i18n.yaml
+++ /dev/null
@@ -1,46 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-16-harness-level-loop.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-16-harness-level-loop.md
-/agent-note-harness-level-goal-based-execution:
- en: 20d103f4160b124d
- zh: 36e888ebeec1d366
-/agent-note-harness-level-goal-based-execution/problem:
- en: b0294f40b8915f39
- zh: 786bcecd8e0df343
-/agent-note-harness-level-goal-based-execution/decision:
- en: f9d2e5774bca2d5b
- zh: 375683705a21f16c
-/agent-note-harness-level-goal-based-execution/decision/vocabulary-and-policy-boundary:
- en: 213a55ec1ef4dd58
- zh: 56076b8524188153
-/agent-note-harness-level-goal-based-execution/decision/package-topology-and-owning-verbs:
- en: fb8e9df7705a2293
- zh: ffe7040bdad4fa64
-/agent-note-harness-level-goal-based-execution/decision/durable-goal-state-and-live-authority:
- en: ef386ad58ff3bcaf
- zh: 9517886000faf515
-/agent-note-harness-level-goal-based-execution/decision/same-session-continuation:
- en: 669447319e89b06a
- zh: 2a08e6a8622aabd1
-/agent-note-harness-level-goal-based-execution/decision/human-and-model-interactions:
- en: 8923f16b40a2f331
- zh: 697417b21f475c1e
-/agent-note-harness-level-goal-based-execution/decision/fresh-agent-ralph-execution:
- en: 3cc9d8fee8dfbd41
- zh: 2c4bf8aab739b0e8
-/agent-note-harness-level-goal-based-execution/decision/external-design-lineage:
- en: 4a7b290a2649720c
- zh: 1a2f32667061e7b4
-/agent-note-harness-level-goal-based-execution/decision/verification:
- en: cb538a23eb170008
- zh: fdd00c5ca70918a1
-/agent-note-harness-level-goal-based-execution/alternatives-considered:
- en: 5f4c2ba58601587c
- zh: a7e2028dd8bc23c1
-/agent-note-harness-level-goal-based-execution/consequences:
- en: 31d109628ee650f4
- zh: 2278dd884e6a088a
-/agent-note-harness-level-goal-based-execution/known-limitations-and-deferred-work:
- en: 2bc0e7709c516ed0
- zh: 614b4ddf8ca6ebc6
diff --git a/.agents/notes/implemented/feature/2026-07-16-persistent-pty-sessions.i18n.yaml b/.agents/notes/implemented/feature/2026-07-16-persistent-pty-sessions.i18n.yaml
index 6f55ce4f48..e56fd4028e 100644
--- a/.agents/notes/implemented/feature/2026-07-16-persistent-pty-sessions.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-07-16-persistent-pty-sessions.i18n.yaml
@@ -18,8 +18,8 @@
en: 9bf79081f102eb51
zh: 34855888f0614b47
/agent-note-persistent-pty-sessions/decision/security-and-process-boundary:
- en: 10d84442483e1d40
- zh: c970ae058e2e0f6d
+ en: 882bbfd3f0dc6e09
+ zh: a547d6ff5e6ef7a1
/agent-note-persistent-pty-sessions/decision/six-model-facing-tools:
en: b92715f36550c728
zh: e18d7e0e2363347a
diff --git a/.agents/notes/implemented/feature/2026-07-16-persistent-pty-sessions.md b/.agents/notes/implemented/feature/2026-07-16-persistent-pty-sessions.md
index b309e1b1f9..43a707e661 100644
--- a/.agents/notes/implemented/feature/2026-07-16-persistent-pty-sessions.md
+++ b/.agents/notes/implemented/feature/2026-07-16-persistent-pty-sessions.md
@@ -45,7 +45,7 @@ A registered `shell` backend constrains how a terminal starts; it does not const
Sandboxing confines local process effects but does not make arbitrary shell input safe: network calls and other external side effects remain governed by deployment policy. Tool descriptions state that PTY sessions are less auditable than one-shot tools and should be used only when persistence or interactive stdin is necessary.
-The local subprocess terminal primitive uses only public `node-pty` capabilities: child PID, `data` and `exit` notifications, `write`, and `kill`. It does not assume access to the native master fd or call `waitpid` from TypeScript. On supported Linux hosts the [native-containment owner](../architecture/2026-08-28-subprocess-native-containment.md) starts that same PTY command inside a user-systemd scope without changing its PID, session, controlling terminal, foreground-group, or readiness semantics. Platform process inspectors below the primitive still derive foreground process groups and fallback parent/child identity from `/proc` on Linux and `ps` on macOS. The [portable execution-world decision](../architecture/2026-07-28-portable-execution-world-consumers.md) owns this process/consumer split.
+The local subprocess terminal primitive uses only public `node-pty` capabilities: child PID, `data` and `exit` notifications, `write`, and `kill`. It does not assume access to the native master fd or call `waitpid` from TypeScript. On supported Linux hosts the [native-containment owner](../../../../packages/subprocess/subprocess-local/README.md) starts that same PTY command inside a user-systemd scope without changing its PID, session, controlling terminal, foreground-group, or readiness semantics. Platform process inspectors below the primitive still derive foreground process groups and fallback parent/child identity from `/proc` on Linux and `ps` on macOS. The [portable execution-world decision](../architecture/2026-07-28-portable-execution-world-consumers.md) owns this process/consumer split.
### Six model-facing tools
diff --git a/.agents/notes/implemented/feature/2026-07-16-persistent-pty-sessions.zh.md b/.agents/notes/implemented/feature/2026-07-16-persistent-pty-sessions.zh.md
index 46257a6835..04891dc106 100644
--- a/.agents/notes/implemented/feature/2026-07-16-persistent-pty-sessions.zh.md
+++ b/.agents/notes/implemented/feature/2026-07-16-persistent-pty-sessions.zh.md
@@ -45,7 +45,7 @@ agent scope dispose（资源释放）时先撤销注册，再等待全部所属
沙箱限制本地进程副作用，但不会让任意 shell 输入自动安全：网络调用和其他外部副作用仍由部署策略治理。工具描述会说明 PTY 会话比一次性工具更难审计，只应在确实需要持久状态或交互式 stdin 时使用。
-本地子进程终端原语只使用 `node-pty` 的公开能力：子进程 PID、`data` 与 `exit` 通知、`write` 和 `kill`。它不假设能访问原生 master fd，也不从 TypeScript 调用 `waitpid`。在受支持的 Linux 宿主上，[原生收容 owner](../architecture/2026-08-28-subprocess-native-containment.zh.md)会在 user-systemd scope 内启动同一条 PTY 命令，同时保持 PID、session、控制终端、前台进程组与就绪语义。该原语下的平台进程检查器仍在 Linux 上通过 `/proc`、在 macOS 上通过 `ps` 推导前台进程组和 fallback 父子进程身份。[可移植执行环境决策](../architecture/2026-07-28-portable-execution-world-consumers.zh.md)负责定义这种进程／消费方拆分。
+本地子进程终端原语只使用 `node-pty` 的公开能力：子进程 PID、`data` 与 `exit` 通知、`write` 和 `kill`。它不假设能访问原生 master fd，也不从 TypeScript 调用 `waitpid`。在受支持的 Linux 宿主上，[原生收容 owner](../../../../packages/subprocess/subprocess-local/README.zh.md)会在 user-systemd scope 内启动同一条 PTY 命令，同时保持 PID、session、控制终端、前台进程组与就绪语义。该原语下的平台进程检查器仍在 Linux 上通过 `/proc`、在 macOS 上通过 `ps` 推导前台进程组和 fallback 父子进程身份。[可移植执行环境决策](../architecture/2026-07-28-portable-execution-world-consumers.zh.md)负责定义这种进程／消费方拆分。
### 6 个面向模型的工具
diff --git a/.agents/notes/implemented/feature/2026-07-19-model-facing-goal-tools.i18n.yaml b/.agents/notes/implemented/feature/2026-07-19-model-facing-goal-tools.i18n.yaml
index c67f4a0d57..179198d487 100644
--- a/.agents/notes/implemented/feature/2026-07-19-model-facing-goal-tools.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-07-19-model-facing-goal-tools.i18n.yaml
@@ -30,5 +30,5 @@
en: e254571a176b37e5
zh: 01f76aff35e3618d
/agent-note-model-facing-same-session-goal-tools/known-limitations-and-deferred-work:
- en: 5b043a930afd4a13
- zh: d91e8a61de2590a4
+ en: 61e119f3d8dc130d
+ zh: 1d543c4143d4cc21
diff --git a/.agents/notes/implemented/feature/2026-07-19-model-facing-goal-tools.md b/.agents/notes/implemented/feature/2026-07-19-model-facing-goal-tools.md
index 2c05c8aa0e..d3dd654e02 100644
--- a/.agents/notes/implemented/feature/2026-07-19-model-facing-goal-tools.md
+++ b/.agents/notes/implemented/feature/2026-07-19-model-facing-goal-tools.md
@@ -62,7 +62,7 @@ Unit coverage pins registration and disposal, exclusive scheduling, generated pr
## Known limitations and deferred work
- Semantic classification of a substantial goal, a request to continue, objective completion, and the same blocking condition remains model judgment. An independent evaluator or completion certificate is deferred.
-- The model cannot resume a durable paused goal; that user-owned path is enforced by the separate [user-owned goal pause decision](../bug-fix/2026-09-03-user-owned-goal-pause-activation.md).
+- The model cannot resume a durable paused goal; that user-owned path is enforced by the separate [user-owned goal pause reference](../../../../packages/goal/tool-goal/README.md).
- These tools mutate goal state but do not schedule goal rounds, classify abnormal driver stops, or cancel an active turn; the same-session driver owns those behaviors.
- Goal-round authority is dormant unless a separately mounted continuation driver admits goal-sourced user turns; this tool package never manufactures that authority itself.
- Human slash-command discovery and rendering are owned by the separate [`dsh-command-goal`](../../../../packages/goal/command-goal/README.md) plugin.
diff --git a/.agents/notes/implemented/feature/2026-07-19-model-facing-goal-tools.zh.md b/.agents/notes/implemented/feature/2026-07-19-model-facing-goal-tools.zh.md
index f16055e52e..8c5c502f37 100644
--- a/.agents/notes/implemented/feature/2026-07-19-model-facing-goal-tools.zh.md
+++ b/.agents/notes/implemented/feature/2026-07-19-model-facing-goal-tools.zh.md
@@ -62,7 +62,7 @@ Status: implemented
## 已知限制与暂缓事项
- 是否属于重大目标、是否要求继续、目标是否完成以及阻塞条件是否相同，仍由模型进行语义分类。独立评估器或完成证书予以延期。
-- 模型不能恢复持久 paused goal；该用户独占路径由独立的[用户独占 goal 暂停决策](../bug-fix/2026-09-03-user-owned-goal-pause-activation.zh.md)强制执行。
+- 模型不能恢复持久 paused goal；该用户独占路径由独立的[用户独占 goal 暂停参考](../../../../packages/goal/tool-goal/README.zh.md)强制执行。
- 这些工具会改变目标状态，但不调度 Goal Round、不分类异常驱动停止，也不取消活跃轮次；这些行为由同会话驱动器负责。
- 除非另行挂载的继续执行驱动器接纳了目标来源的用户轮次，否则 Goal Round 权限路径处于休眠状态；本工具包本身不会制造这种权限。
- 面向人类的斜杠命令发现与渲染由独立的 [`dsh-command-goal`](../../../../packages/goal/command-goal/README.zh.md) 插件负责。
diff --git a/.agents/notes/implemented/feature/2026-07-19-persisted-same-session-goal-domain.i18n.yaml b/.agents/notes/implemented/feature/2026-07-19-persisted-same-session-goal-domain.i18n.yaml
deleted file mode 100644
index 722d00ad1a..0000000000
--- a/.agents/notes/implemented/feature/2026-07-19-persisted-same-session-goal-domain.i18n.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-19-persisted-same-session-goal-domain.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-19-persisted-same-session-goal-domain.md
-/agent-note-persisted-same-session-goal-domain:
- en: 05f6641270399579
- zh: 962259d5bd3b3e16
-/agent-note-persisted-same-session-goal-domain/problem:
- en: 45e351264fabe761
- zh: 6513999a7d83a528
-/agent-note-persisted-same-session-goal-domain/decision:
- en: 7efc52c6215aa755
- zh: e570a4f82e69300b
-/agent-note-persisted-same-session-goal-domain/decision/durable-record-and-replay:
- en: d4520ec456f4023a
- zh: 2ffcb155955539e5
-/agent-note-persisted-same-session-goal-domain/decision/lifecycle-and-live-activation:
- en: d68c058ff7a49fee
- zh: cbcdbce1aade7758
-/agent-note-persisted-same-session-goal-domain/decision/service-boundary:
- en: 0bff035a2664e7c0
- zh: ba303bd3ec64151b
-/agent-note-persisted-same-session-goal-domain/testing:
- en: 9fb97674d1dd45ac
- zh: c56df41a9aa6767a
-/agent-note-persisted-same-session-goal-domain/alternatives-considered:
- en: b8bae793bb1c922d
- zh: 4abb28a01b1fc7f3
-/agent-note-persisted-same-session-goal-domain/consequences:
- en: fa46d172b9d01b52
- zh: 54c40631d1719624
-/agent-note-persisted-same-session-goal-domain/known-limitations-and-deferred-work:
- en: 21f5c50b4eafa028
- zh: 4cad975fb10501bd
diff --git a/.agents/notes/implemented/feature/2026-07-19-plugin-command-registration.i18n.yaml b/.agents/notes/implemented/feature/2026-07-19-plugin-command-registration.i18n.yaml
deleted file mode 100644
index a8a8205207..0000000000
--- a/.agents/notes/implemented/feature/2026-07-19-plugin-command-registration.i18n.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-19-plugin-command-registration.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-19-plugin-command-registration.md
-/agent-note-plugin-owned-human-command-registration:
- en: f1509f79bd9e2445
- zh: 30f62b9b4f611f9d
-/agent-note-plugin-owned-human-command-registration/problem:
- en: 628dcc0bda181677
- zh: 71b110588f89c2b4
-/agent-note-plugin-owned-human-command-registration/decision:
- en: acf2742722ab7c85
- zh: e0bdbd6fd0bf51b1
-/agent-note-plugin-owned-human-command-registration/decision/registry-contract:
- en: 1b3daffaa9a8b56e
- zh: fa99bb6bc553cafb
-/agent-note-plugin-owned-human-command-registration/decision/scope-and-lifecycle:
- en: 6d55a0d4b1b9606a
- zh: 34bf959ef332630f
-/agent-note-plugin-owned-human-command-registration/decision/direct-dispatch-and-cancellation:
- en: 074ee61a689493cb
- zh: 580035e2a4c82d4f
-/agent-note-plugin-owned-human-command-registration/decision/tui-mapping:
- en: 00f0f8b697d9e1ff
- zh: 9c4ceb0024e50835
-/agent-note-plugin-owned-human-command-registration/testing:
- en: 0679c206796636a6
- zh: ca2cc5df6aa3aa2e
-/agent-note-plugin-owned-human-command-registration/alternatives-considered:
- en: ffb2f060314a17b2
- zh: e7707cf5faf80227
-/agent-note-plugin-owned-human-command-registration/consequences:
- en: 6b8525a4ca3213a8
- zh: 286a336a68669f72
-/agent-note-plugin-owned-human-command-registration/known-limitations-and-deferred-work:
- en: 5e2417d5b1237526
- zh: dbfeea7c7ac38cf0
diff --git a/.agents/notes/implemented/feature/2026-07-20-ptc-typed-tool-returns.i18n.yaml b/.agents/notes/implemented/feature/2026-07-20-ptc-typed-tool-returns.i18n.yaml
index 1d59d0072b..5f8169b4c4 100644
--- a/.agents/notes/implemented/feature/2026-07-20-ptc-typed-tool-returns.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-07-20-ptc-typed-tool-returns.i18n.yaml
@@ -6,11 +6,11 @@
en: 4b7c45b382db3a40
zh: 96e9210446ec35ed
/agent-note-typed-tool-returns-in-ptc-mode/problem:
- en: cf7610bb16ff04af
- zh: 73b00b539dbaecd9
+ en: e2403bc358c4e14b
+ zh: dd37923097a3b24c
/agent-note-typed-tool-returns-in-ptc-mode/decision:
- en: 55bb889404c89f4a
- zh: f9a9091569fbf7b4
+ en: 2218fac13ef57c77
+ zh: d4a18daa9debc77c
/agent-note-typed-tool-returns-in-ptc-mode/decision/generated-sdk:
en: 30583e9ac6715952
zh: 3a85c9482abf574c
@@ -21,11 +21,11 @@
en: d907d0a8205157e1
zh: 1ed99168266a7ca4
/agent-note-typed-tool-returns-in-ptc-mode/decision/typed-handles-and-lifetime:
- en: c5d9997ae7c7362d
- zh: 1da8883d17d2748e
+ en: b2b9318c2812e3a4
+ zh: 73cf34bfd487e2f1
/agent-note-typed-tool-returns-in-ptc-mode/decision/persistence-metadata-and-spill:
- en: 4d1e5f83f15f99cc
- zh: b7f41a084cb23745
+ en: c388619f862a92ba
+ zh: d557eae40c7b6b7a
/agent-note-typed-tool-returns-in-ptc-mode/testing:
en: 728513c779f031f8
zh: f6d869f18add7242
@@ -33,8 +33,8 @@
en: dedd87b9b35d8fab
zh: 78db4c7e8c4e5f61
/agent-note-typed-tool-returns-in-ptc-mode/consequences:
- en: 7c2ee65532ab76f8
- zh: 3fb074c69909d390
+ en: f5726b5e7a2fc73f
+ zh: 0b9aa884db5d920f
/agent-note-typed-tool-returns-in-ptc-mode/known-limitations-and-deferred-work:
en: a42af629ad6872cc
zh: 41e5c0bb3de0ae4d
diff --git a/.agents/notes/implemented/feature/2026-07-20-ptc-typed-tool-returns.md b/.agents/notes/implemented/feature/2026-07-20-ptc-typed-tool-returns.md
index 08e760b95a..032322407d 100644
--- a/.agents/notes/implemented/feature/2026-07-20-ptc-typed-tool-returns.md
+++ b/.agents/notes/implemented/feature/2026-07-20-ptc-typed-tool-returns.md
@@ -10,13 +10,13 @@ PTC mode originally projected each nested tool result back from `ContentBlock[]`
The runtime also treated binding values and the final program value as presentation data. Separate log and completion caps could replace an oversized or non-cloneable completion with inspected text even though intermediate values do not enter model context. That made programmatic composition lossy and confused the memory boundary with the prompt boundary.
-The [canonical tool-output contract](../architecture/2026-07-20-canonical-tool-output-contract.md) establishes one validated execution-time value and a separate Native renderer. PTC mode should consume that value directly, preserve it across the worker boundary, and bound only the final output the program deliberately returns to the model.
+The [canonical tool-output contract](../../../../packages/core/tools/README.md) establishes one validated execution-time value and a separate Native renderer. PTC mode should consume that value directly, preserve it across the worker boundary, and bound only the final output the program deliberately returns to the model.
## Decision
PTC mode is a typed projection of the visible tool registry. Each successful binding resolves to the final canonical `JsonValue` after post-execute policy, while a failed binding rejects with a real `ToolCallError`. Intermediate values remain inside the run and cross the worker boundary whole. The outer `run_code` logs, completion value, or failure diagnostic enter the configurable output ledger and model-facing spill pipeline; a successfully settled sub-call whose final Native content contains an image additionally defers that complete ordered content through the parent result as logged, source-attributed context.
-This note owns the return and failure contract layered on the original [PTC mode foundation](2026-06-15-ptc.md). The unified schema vocabulary is owned by the [JSON-value schema DSL note](../architecture/2026-07-20-unified-json-value-schema-dsl.md), and Native rendering and policy projection remain owned by the canonical-output note.
+This note owns the return and failure contract layered on the original [PTC mode foundation](2026-06-15-ptc.md). The unified schema vocabulary is owned by the [JSON-value schema DSL reference](../../../../packages/core/tools/README.md), and Native rendering and policy projection remain owned by the canonical-output note.
### Generated SDK
@@ -67,7 +67,7 @@ Compute time, wall time, worker heap, cancellation, and fresh-worker isolation r
### Typed handles and lifetime
-Background producers return a typed canonical handle such as `{ kind: 'background', jobId }` while retaining their established Native sentence. A pre-aborted background call remains a failure because successful output promises an id and no task was created. After `ctx.jobs.start()` publishes the id, task-owned cancellation governs the work: settlement or later cancellation of the enclosing `run_code` call does not kill it. A later program can pass the returned id to `job_output`, and `job_kill`, owner disposal, or service teardown owns cancellation. Foreground execution remains coupled to the call signal. The task lifetime contract is owned by the [background job runtime note](../architecture/2026-06-20-generic-long-running-tool-runtime.md).
+Background producers return a typed canonical handle such as `{ kind: 'background', jobId }` while retaining their established Native sentence. A pre-aborted background call remains a failure because successful output promises an id and no task was created. After `ctx.jobs.start()` publishes the id, task-owned cancellation governs the work: settlement or later cancellation of the enclosing `run_code` call does not kill it. A later program can pass the returned id to `job_output`, and `job_kill`, owner disposal, or service teardown owns cancellation. Foreground execution remains coupled to the call signal. The task lifetime contract is owned by the [background job runtime reference](../../../../packages/jobs/jobs/README.md).
Temporary Cordis Plugins follow the same rule: `cordis_mount` returns `{ id, pluginName, state, provides, waitingFor }`, so a program can read `mounted.id`, inspect active or pending state, and pass that id to `cordis_unmount` without parsing the stable Native sentence.
@@ -75,7 +75,7 @@ Temporary Cordis Plugins follow the same rule: `cordis_mount` returns `{ id, plu
Nested dispatch logs the sub-call's full rendered `content`/`isError` on `tool/ptc-dispatch` but does not persist canonical values. `tool/result` continues to persist only rendered content, error, and optional metadata. A successful final content sequence containing an image is also wrapped in a source-attributed user message and deferred through the outer result; the normal session event makes that model-visible input reconstructable. The [PTC mode note](2026-06-15-ptc.md) owns durable event names and historical identity preservation; replay cannot recreate intermediate canonical program values.
-The opaque `exec.parent` token marks nested calls. Presentation metadata and generic or tool-owned spill projections skip those calls; their canonical values never enter context. The Client can derive [nested terminal cards](../bug-fix/2026-09-05-nested-terminal-cards.md) from raw dispatch events without metadata. The outer `run_code` call produces the model-facing result and may spill its final post-policy presentation; `run_code` intentionally declares neither a result presenter nor presentation metadata, so UI adapters complete the card through their generic raw-content fallback using durable `tool/result.content`.
+The opaque `exec.parent` token marks nested calls. Presentation metadata and generic or tool-owned spill projections skip those calls; their canonical values never enter context. The Client can derive [nested terminal cards](../../../../packages/client/ui-tool/README.md) from raw dispatch events without metadata. The outer `run_code` call produces the model-facing result and may spill its final post-policy presentation; `run_code` intentionally declares neither a result presenter nor presentation metadata, so UI adapters complete the card through their generic raw-content fallback using durable `tool/result.content`.
## Testing
@@ -99,7 +99,7 @@ Keyless real-worker integration tests pin the two handle workflows that prose re
## Consequences
-Code programs can compose tools through stable values instead of reverse-engineering Native prose. Native and Both Mode retain their existing text and UI presentation, while PTC mode receives output-schema types and exact runtime JSON. Tool authors must treat the canonical value as their programmatic API and put display-only formatting in the renderer.
+Code programs can compose tools through stable values instead of reverse-engineering Native prose. Native mode retains its existing text and UI presentation, while PTC mode receives output-schema types and exact runtime JSON. Tool authors must treat the canonical value as their programmatic API and put display-only formatting in the renderer.
The worker performs bounded-depth flat-wire transport and lossless validation but does not make intermediate values cheap or durable. Outer overflow is an explicit failed run, and error handling remains intentionally human-guided rather than a versioned code union.
diff --git a/.agents/notes/implemented/feature/2026-07-20-ptc-typed-tool-returns.zh.md b/.agents/notes/implemented/feature/2026-07-20-ptc-typed-tool-returns.zh.md
index c2883740e1..6d8bf2d771 100644
--- a/.agents/notes/implemented/feature/2026-07-20-ptc-typed-tool-returns.zh.md
+++ b/.agents/notes/implemented/feature/2026-07-20-ptc-typed-tool-returns.zh.md
@@ -10,13 +10,13 @@ PTC mode 过去会把每个嵌套工具的结果从 `ContentBlock[]` 重新投
运行时还把绑定值和程序最终返回值当作展示数据。日志和完成值分别设置上限，导致过大或无法克隆的完成值可能被替换为检查后生成的文本，而中间值本来就不会进入模型上下文。这种设计使程序化组合产生信息损失，也混淆了内存边界与提示词边界。
-[规范工具输出约定](../architecture/2026-07-20-canonical-tool-output-contract.zh.md)确立了单一、经过校验的执行期值，并将 Native 渲染器与之分离。PTC mode 应直接消费该值，在跨越 worker 边界时完整保留它，并且只限制程序有意返回给模型的最终输出。
+[规范工具输出约定](../../../../packages/core/tools/README.zh.md)确立了单一、经过校验的执行期值，并将 Native 渲染器与之分离。PTC mode 应直接消费该值，在跨越 worker 边界时完整保留它，并且只限制程序有意返回给模型的最终输出。
## 决策
PTC mode 是可见工具注册表的类型化投影。每个成功的绑定调用都会解析为 post-execute 策略处理后的最终规范 `JsonValue`，失败的绑定调用则会以真正的 `ToolCallError` 拒绝 Promise。中间值只存在于本次运行中，并完整跨越 worker 边界。外层 `run_code` 的日志、完成值或失败诊断会进入可配置的输出账本以及面向模型的输出落盘流水线；如果成功结算的子调用最终 Native 内容包含图片，其完整有序内容还会经父结果延后为写入日志且带来源归属的上下文。
-本文档定义叠加在原始 [PTC mode 基础](2026-06-15-ptc.zh.md)之上的返回值与失败约定。统一 schema 词汇由 [JSON 值 schema DSL Agent Note](../architecture/2026-07-20-unified-json-value-schema-dsl.zh.md)负责定义；Native 渲染与策略投影仍由规范输出 Agent Note 负责定义。
+本文档定义叠加在原始 [PTC mode 基础](2026-06-15-ptc.zh.md)之上的返回值与失败约定。统一 schema 词汇由 [JSON 值 schema DSL reference](../../../../packages/core/tools/README.zh.md)负责定义；Native 渲染与策略投影仍由规范输出 Agent Note 负责定义。
### 生成的 SDK
@@ -67,7 +67,7 @@ PTC mode 通过运行时请求中的 `{ name: "ToolCallError", memberNamePropert
### 类型化句柄与生命周期
-后台生产方返回类型化的规范句柄，例如 `{ kind: 'background', jobId }`，同时保留既有的 Native 语句。已预先中止的后台调用仍是失败，因为成功输出承诺返回 id，而此时并未创建任务。`ctx.jobs.start()` 发布 id 后，工作由任务自有的取消机制控制：外围 `run_code` 调用完成，或随后被取消，都不会终止该任务。后续程序可以把返回的 id 传给 `job_output`；任务取消则由 `job_kill`、所有者的 dispose（资源释放）或服务 teardown 流程负责。前台执行仍与本次调用的信号耦合。任务生命周期约定由[后台任务运行时 Agent Note](../architecture/2026-06-20-generic-long-running-tool-runtime.zh.md)定义。
+后台生产方返回类型化的规范句柄，例如 `{ kind: 'background', jobId }`，同时保留既有的 Native 语句。已预先中止的后台调用仍是失败，因为成功输出承诺返回 id，而此时并未创建任务。`ctx.jobs.start()` 发布 id 后，工作由任务自有的取消机制控制：外围 `run_code` 调用完成，或随后被取消，都不会终止该任务。后续程序可以把返回的 id 传给 `job_output`；任务取消则由 `job_kill`、所有者的 dispose（资源释放）或服务 teardown 流程负责。前台执行仍与本次调用的信号耦合。任务生命周期约定由[后台任务运行时 reference](../../../../packages/jobs/jobs/README.zh.md)定义。
临时 Cordis 插件遵循同一规则：`cordis_mount` 返回 `{ id, pluginName, state, provides, waitingFor }`，因此程序可以直接读取 `mounted.id`，检查 active 或 pending 状态，并把该 id 传给 `cordis_unmount`，无需解析稳定的 Native 语句。
@@ -75,7 +75,7 @@ PTC mode 通过运行时请求中的 `{ name: "ToolCallError", memberNamePropert
嵌套分发在 `tool/ptc-dispatch` 上记录子调用完整渲染后的 `content`/`isError`，但不会持久化规范值。`tool/result` 继续只持久化渲染后的内容、错误和可选元数据。包含图片的成功最终内容序列还会包装成带来源归属的用户消息，并经外层结果延后；普通会话事件使该模型可见输入可以重建。[PTC mode note](2026-06-15-ptc.zh.md) 负责持久事件名称与历史标识保留规则；回放无法重建程序的规范中间值。
-不透明的 `exec.parent` token 用于标识嵌套调用。展示元数据以及通用或工具自有的 spill 投影都会跳过这些调用；它们的规范值永远不会进入上下文。Client 可以从原始分发事件派生[嵌套 terminal 卡片](../bug-fix/2026-09-05-nested-terminal-cards.zh.md)，无需元数据。外层 `run_code` 调用产生面向模型的结果，并且可能对 post-policy 处理后的最终展示执行 spill；`run_code` 有意既不声明结果展示器，也不声明展示元数据，因此 UI 适配器会通过通用的原始内容回退机制，使用持久化的 `tool/result.content` 补全该卡片。
+不透明的 `exec.parent` token 用于标识嵌套调用。展示元数据以及通用或工具自有的 spill 投影都会跳过这些调用；它们的规范值永远不会进入上下文。Client 可以从原始分发事件派生[嵌套 terminal 卡片](../../../../packages/client/ui-tool/README.zh.md)，无需元数据。外层 `run_code` 调用产生面向模型的结果，并且可能对 post-policy 处理后的最终展示执行 spill；`run_code` 有意既不声明结果展示器，也不声明展示元数据，因此 UI 适配器会通过通用的原始内容回退机制，使用持久化的 `tool/result.content` 补全该卡片。
## 测试
@@ -99,7 +99,7 @@ PTC mode 通过运行时请求中的 `{ name: "ToolCallError", memberNamePropert
## 后果
-PTC mode 程序可以通过稳定值组合工具，无需逆向解析 Native 自然语言。Native 和 Both Mode 保留现有文本与 UI 展示，PTC mode 则获得输出 schema 类型和精确的运行时 JSON。工具作者必须把规范值视为程序化 API，并将仅用于展示的格式化放入渲染器。
+PTC mode 程序可以通过稳定值组合工具，无需逆向解析 Native 自然语言。Native mode 保留现有文本与 UI 展示，PTC mode 则获得输出 schema 类型和精确的运行时 JSON。工具作者必须把规范值视为程序化 API，并将仅用于展示的格式化放入渲染器。
worker 会以嵌套深度有界的扁平协议格式传输数据并执行无损校验，但不会降低中间值的开销，也不会使其具备持久性。外层输出溢出会显式导致运行失败，错误处理则有意由人类引导，而不是依赖带版本的错误代码联合。
diff --git a/.agents/notes/implemented/feature/2026-07-21-follow-instruction-symlinks.i18n.yaml b/.agents/notes/implemented/feature/2026-07-21-follow-instruction-symlinks.i18n.yaml
deleted file mode 100644
index b85229745f..0000000000
--- a/.agents/notes/implemented/feature/2026-07-21-follow-instruction-symlinks.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-21-follow-instruction-symlinks.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-21-follow-instruction-symlinks.md
-/agent-note-follow-symlinked-instruction-files:
- en: aa37067267aa70ff
- zh: 75aff9256b49199f
-/agent-note-follow-symlinked-instruction-files/problem:
- en: 81e1947150ceb054
- zh: 97575f09a9e57db4
-/agent-note-follow-symlinked-instruction-files/decision:
- en: 911b5bb48a95afd0
- zh: 1a38e50602b86bc4
-/agent-note-follow-symlinked-instruction-files/decision/trust-boundary-and-residual-risk:
- en: 31ea638766861600
- zh: a270db3c868585b0
-/agent-note-follow-symlinked-instruction-files/alternatives-considered:
- en: cf5e62b7cae4f0dc
- zh: ff7d5821958efeac
-/agent-note-follow-symlinked-instruction-files/consequences:
- en: b0ee45a9e4d95dd5
- zh: 338d3758f400a651
diff --git a/.agents/notes/implemented/feature/2026-07-23-session-telemetry-otel-revival.i18n.yaml b/.agents/notes/implemented/feature/2026-07-23-session-telemetry-otel-revival.i18n.yaml
deleted file mode 100644
index a06d830891..0000000000
--- a/.agents/notes/implemented/feature/2026-07-23-session-telemetry-otel-revival.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-23-session-telemetry-otel-revival.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-23-session-telemetry-otel-revival.md
-/agent-note-session-telemetry-seam-with-mandatory-redaction-and-the-otel-backend:
- en: 36222884462b86d2
- zh: 2f834557e3fa3baa
-/agent-note-session-telemetry-seam-with-mandatory-redaction-and-the-otel-backend/problem:
- en: d3383b495424d118
- zh: 4e6ffc8ebfa7f741
-/agent-note-session-telemetry-seam-with-mandatory-redaction-and-the-otel-backend/decision:
- en: 739b871ae583dcbf
- zh: d17053e3b0a35942
-/agent-note-session-telemetry-seam-with-mandatory-redaction-and-the-otel-backend/alternatives-considered:
- en: 01838eefca2bc117
- zh: fc71f5449d095b27
-/agent-note-session-telemetry-seam-with-mandatory-redaction-and-the-otel-backend/consequences:
- en: 487d440abfc7e3a9
- zh: a31d6abc8a0176c6
diff --git a/.agents/notes/implemented/feature/2026-07-25-subagent-policy-inheritance.i18n.yaml b/.agents/notes/implemented/feature/2026-07-25-subagent-policy-inheritance.i18n.yaml
deleted file mode 100644
index f52f1c14fc..0000000000
--- a/.agents/notes/implemented/feature/2026-07-25-subagent-policy-inheritance.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-25-subagent-policy-inheritance.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-25-subagent-policy-inheritance.md
-/agent-note-in-process-subagent-policy-inheritance-the-child-starts-under-the-parent-s-sandbox-override:
- en: 02b7ba888360c75c
- zh: 42a6d20927622c9c
-/agent-note-in-process-subagent-policy-inheritance-the-child-starts-under-the-parent-s-sandbox-override/problem:
- en: 476b4a1b9ada2d8a
- zh: 15b8051d22bb1dd0
-/agent-note-in-process-subagent-policy-inheritance-the-child-starts-under-the-parent-s-sandbox-override/decision:
- en: 1f99951bc562cce4
- zh: d68ee315b7aea792
-/agent-note-in-process-subagent-policy-inheritance-the-child-starts-under-the-parent-s-sandbox-override/decision/what-a-blocked-child-experiences:
- en: 3b6ff196a06c2420
- zh: c04cb8bd81eb1c4b
-/agent-note-in-process-subagent-policy-inheritance-the-child-starts-under-the-parent-s-sandbox-override/alternatives-considered:
- en: 2f659b5b3b6faa21
- zh: c3712d0b6f8903c9
-/agent-note-in-process-subagent-policy-inheritance-the-child-starts-under-the-parent-s-sandbox-override/consequences:
- en: 1b0a242aa33a8005
- zh: 426f83e118771b8e
diff --git a/.agents/notes/implemented/feature/2026-07-26-ptc-live-parallel-dispatch.i18n.yaml b/.agents/notes/implemented/feature/2026-07-26-ptc-live-parallel-dispatch.i18n.yaml
deleted file mode 100644
index 07e8978506..0000000000
--- a/.agents/notes/implemented/feature/2026-07-26-ptc-live-parallel-dispatch.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-26-ptc-live-parallel-dispatch.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-26-ptc-live-parallel-dispatch.md
-/agent-note-ptc-mode-live-dispatch-lifecycle-and-native-contract-parallelism:
- en: f546683c54ae7d6b
- zh: 1c0760c5f49f0188
-/agent-note-ptc-mode-live-dispatch-lifecycle-and-native-contract-parallelism/problem:
- en: ce16b44b1db07ec0
- zh: 30681dab84948cd8
-/agent-note-ptc-mode-live-dispatch-lifecycle-and-native-contract-parallelism/decision:
- en: 7ac907f773ff9d50
- zh: 86982428baf83cde
-/agent-note-ptc-mode-live-dispatch-lifecycle-and-native-contract-parallelism/alternatives-considered:
- en: b015fa95b46e5fd5
- zh: b4fe283a1ab598c1
-/agent-note-ptc-mode-live-dispatch-lifecycle-and-native-contract-parallelism/consequences:
- en: d16ba3a88fa7d528
- zh: 8c374a14a4f34cfe
diff --git a/.agents/notes/implemented/feature/2026-07-27-web-subagent-conversations.i18n.yaml b/.agents/notes/implemented/feature/2026-07-27-web-subagent-conversations.i18n.yaml
deleted file mode 100644
index e811b85577..0000000000
--- a/.agents/notes/implemented/feature/2026-07-27-web-subagent-conversations.i18n.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-27-web-subagent-conversations.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-27-web-subagent-conversations.md
-/agent-note-web-subagent-catalog-and-human-continuation:
- en: c6373db2300cb803
- zh: 4d0589f21ec284ff
-/agent-note-web-subagent-catalog-and-human-continuation/problem:
- en: dfdbe64d34f9e05b
- zh: 4cb7a92a6d3dc3e3
-/agent-note-web-subagent-catalog-and-human-continuation/decision:
- en: 8892eea7f62d45ed
- zh: 18f64966ff53e38b
-/agent-note-web-subagent-catalog-and-human-continuation/design-context:
- en: da3858c86cf685ff
- zh: b13ee4f45e3dff7d
-/agent-note-web-subagent-catalog-and-human-continuation/product-contract:
- en: 2060d607d1cd1ef3
- zh: e7100887358625c4
-/agent-note-web-subagent-catalog-and-human-continuation/host-adapter-and-wire-contract:
- en: e0e82599b0a8d3bf
- zh: e671e1f0f98795b4
-/agent-note-web-subagent-catalog-and-human-continuation/client-object-layer-and-presentation:
- en: c0c891d86b1f7e1e
- zh: c7b8da2bee81755d
-/agent-note-web-subagent-catalog-and-human-continuation/default-web-assembly:
- en: 6d4d8db99535aa18
- zh: 803554b55a67acb1
-/agent-note-web-subagent-catalog-and-human-continuation/alternatives-considered:
- en: 427f0a8ace8ad692
- zh: 876771621858f77d
-/agent-note-web-subagent-catalog-and-human-continuation/testing:
- en: 0c2f7f5cc473ecff
- zh: 00b2c22e109b3429
-/agent-note-web-subagent-catalog-and-human-continuation/consequences:
- en: 143fc76c6d09e8fb
- zh: 01a042fb32b0d6e0
diff --git a/.agents/notes/implemented/feature/2026-07-27-workspace-registration-deletion.i18n.yaml b/.agents/notes/implemented/feature/2026-07-27-workspace-registration-deletion.i18n.yaml
deleted file mode 100644
index ff719e7b97..0000000000
--- a/.agents/notes/implemented/feature/2026-07-27-workspace-registration-deletion.i18n.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-27-workspace-registration-deletion.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-27-workspace-registration-deletion.md
-/agent-note-workspace-registration-deletion:
- en: 68262d0cd61db2ae
- zh: bb2f78757972aae6
-/agent-note-workspace-registration-deletion/problem:
- en: a51dbe0190d4dff0
- zh: 25b6c3083ee60627
-/agent-note-workspace-registration-deletion/decision:
- en: 70182cd2979bdfd6
- zh: a6580a23cfbe6c07
-/agent-note-workspace-registration-deletion/durable-commit-and-publication:
- en: f97d526274c3608b
- zh: b0ae161f4e9febb8
-/agent-note-workspace-registration-deletion/client-convergence:
- en: 84e56775e22ecf23
- zh: ab146e3179868efb
-/agent-note-workspace-registration-deletion/confirmation-interaction:
- en: 95178832030a9697
- zh: 3a2bd50680ed0c97
-/agent-note-workspace-registration-deletion/alternatives-considered:
- en: d7b866f763db5364
- zh: 5e0865d42522d189
-/agent-note-workspace-registration-deletion/verification:
- en: a7e98d39e3ffdba7
- zh: 9c4f8168e3fff83e
-/agent-note-workspace-registration-deletion/consequences:
- en: 3a50bfb5d93f6ef7
- zh: 80b8dd19b2d50b16
diff --git a/.agents/notes/implemented/feature/2026-07-28-continuable-subagent-conversations.i18n.yaml b/.agents/notes/implemented/feature/2026-07-28-continuable-subagent-conversations.i18n.yaml
index e3f1e8bb08..6566e1a57e 100644
--- a/.agents/notes/implemented/feature/2026-07-28-continuable-subagent-conversations.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-07-28-continuable-subagent-conversations.i18n.yaml
@@ -3,29 +3,29 @@
# After editing either side, bring the other along and re-record with:
# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-28-continuable-subagent-conversations.md
/agent-note-continuable-subagents:
- en: 14c7d31032237174
- zh: ac2666670a0ca5ab
+ en: 110c0660aacfa3e4
+ zh: cf405fad1c5834f7
/agent-note-continuable-subagents/problem:
en: a72071eeedb77402
zh: 818d16ce429fd610
/agent-note-continuable-subagents/decision:
- en: 445a8c9783aad214
- zh: 9b5c576bb76100a4
+ en: 3420195435e02a8f
+ zh: 6156eedb3c23d360
/agent-note-continuable-subagents/decision/materialization-and-public-operations:
- en: c7c55e5738a7c0d8
- zh: 54849d8938f7c77f
+ en: c3a83ff748a02143
+ zh: 468bf62c8ddabf70
/agent-note-continuable-subagents/decision/durable-session-and-live-activation:
- en: 92fd7302d4c8f2e5
- zh: e821764c07070ebc
+ en: 5c96c0343564c64a
+ zh: 85686e022d870cc7
/agent-note-continuable-subagents/decision/activation-lifecycle:
- en: 68215c0ae5628608
- zh: fdf038decac8f07a
+ en: 5b84e6825247850c
+ zh: 18d43381aa3e8b05
/agent-note-continuable-subagents/decision/one-inbox-and-follow-up-delivery:
- en: 065399ce5b1de59e
- zh: b60af3c37851323e
+ en: 388934f4c4e50f65
+ zh: 545a66157a4c46c4
/agent-note-continuable-subagents/decision/child-ownership:
- en: 503fb4311cd94674
- zh: 376fa98ec4d22b20
+ en: b6b62a4c083562b6
+ zh: 86d02714e997942d
/agent-note-continuable-subagents/decision/adjacent-agent-messaging:
en: a6899f5a82d5dceb
zh: 0671b89b2dca9c4e
@@ -36,17 +36,17 @@
en: f5ba7e9c5339ceef
zh: 31ae1b2f57e44463
/agent-note-continuable-subagents/decision/durability-disposal-and-recovery:
- en: 276626f3b6d4a080
- zh: 806f9c4786bc4004
+ en: 0bbc18843aa04ad3
+ zh: d56fab1d12a28a96
/agent-note-continuable-subagents/decision/scope:
- en: a47eed90de23351c
- zh: 2351e4acbfe4c8e1
+ en: bb3e8b2f8054e075
+ zh: 15c126d51031fcb3
/agent-note-continuable-subagents/alternatives-considered:
- en: 485aef32231dac62
- zh: 5e2c103afb3e2d6f
+ en: d786fd413fabe0f5
+ zh: c5d66f5b880d9758
/agent-note-continuable-subagents/consequences:
- en: fa5a6b4bf262b8dd
- zh: 4bffd7b8cc2efae5
+ en: d7ba8e86c3f14eaa
+ zh: b31ba49dee6aa85d
/agent-note-continuable-subagents/consequences/accepted-costs:
- en: 4d4330ee4d7c3f31
- zh: 8fd11ba0625fb76d
+ en: 95199dfb2adab107
+ zh: e7644bcb70169368
diff --git a/.agents/notes/implemented/feature/2026-07-28-continuable-subagent-conversations.md b/.agents/notes/implemented/feature/2026-07-28-continuable-subagent-conversations.md
index a30966c4d6..e76aae22fe 100644
--- a/.agents/notes/implemented/feature/2026-07-28-continuable-subagent-conversations.md
+++ b/.agents/notes/implemented/feature/2026-07-28-continuable-subagent-conversations.md
@@ -4,7 +4,7 @@ Status: implemented
English | [中文](2026-07-28-continuable-subagent-conversations.zh.md)
-This record replaces the Task-backed continuation manager from [Continuable background subagents](../../archived/feature/2026-07-21-continuable-background-subagents.md). It retains the single `ctx.subagents` service from [Merge subagent control into the subagent service](../../archived/simplification/2026-07-26-merge-subagent-control-service.md) and the intent-named `followup` operation from [Intent-named subagent continuation operations](../../archived/simplification/2026-07-27-intent-named-subagent-continuation-operations.md).
+This record replaces the Task-backed continuation manager from [Continuable background subagents](../../archived/feature/2026-07-21-continuable-background-subagents.md). It retains the single `ctx.subagents` service from [Merge subagent control into the subagent service](../../archived/simplification/2026-07-26-merge-subagent-control-service.md).
## Problem
@@ -18,6 +18,8 @@ Parent Agents need to send later work to the same live child without changing it
## Decision
+The shared activation entry point, external execution ownership, and caller-versus-parent result delivery are governed by [Unified subagent activations](../simplification/2026-09-17-unified-subagent-activations.md). This record retains the independent rationale described below.
+
A continuable subagent has one durable Session and at most one process-local Activation:
```text
@@ -28,25 +30,25 @@ persisted Session
-> zero or more owned child Activations
```
-An Activation is one residency epoch for a reconstructed child Agent. It may execute multiple FIFO turns and remain resident while waiting for descendants. It is not a request, result, cancellation, or Task boundary.
+An Activation is one residency epoch for a reconstructed child Agent. It may execute multiple FIFO turns and remain resident while waiting for descendants. Its receipt owns the result and cancellation of that exact residency; it does not assign a separate result or Task to each accepted message.
The continuation manager owns activation admission, authority checks, the live ownership graph, cold resume, and child-first disposal. The Agent loop owns all turn ordering and execution. No continuable subagent has a Task, an Activation FIFO, or queued Activation state.
### Materialization and public operations
-The named subagent provider participates only in preparing the initial creation spec, where `spawn` and `fork` differ. Its optional `prepareContinuable(request): Promise` method is the continuable-creation capability. The returned spec contains only detached provider-specific creation inputs such as the optional parent-history seed; it contains no Agent, `AgentHandle`, prompt delivery, result, disposal, or resume operation. The manager reserves the child identity, resolves the durable descriptor and common Agent setup, calls `ctx.agents.create()` through a private activation-owner scope, installs the returned `AgentHandle` into the Activation, establishes any continuable-parent ownership, and then calls `Agent.followup(initialPrompt)`. Inbox acceptance yields a `MessageId`; at that boundary `ctx.subagents.startContinuable()` returns `{ childId, messageId }` without waiting for the turn to start or for the message to enter the Session log.
+The named subagent provider participates only in preparing the initial creation spec, where `spawn` and `fork` differ. Its optional `prepareContinuable(request): Promise` method is the continuable-creation capability. The returned spec contains only detached provider-specific creation inputs such as the optional parent-history seed; it contains no Agent, `AgentHandle`, prompt delivery, result, disposal, or resume operation. The manager reserves the child identity, resolves the durable descriptor and common Agent setup, calls `ctx.agents.create()` through a private activation-owner scope, installs the returned `AgentHandle` into the Activation, establishes any continuable-parent ownership, and then calls `Agent.followup(initialPrompt)`. Inbox acceptance yields a `MessageId`; at that boundary `ctx.subagents.startActivation()` returns a receipt containing `childId`, `messageId`, `result`, and `dispose()` without waiting for the turn to start or for the message to enter the Session log.
Any failure before inbox acceptance rejects without returning either id. Agent creation provides rollback before handle transfer; after transfer, the manager keeps one closing transaction visible to concurrent delivery and drain, disposes the created handle, removes the Activation, and rolls back any parent `ownedChildren` membership before rejecting. Failure before the residency start edge publishes no terminal edge, while failure after a published start closes the lifecycle pair through normal disposal.
-`backgroundMode: 'one-shot' | 'continuable'` remains deployment policy. Configured continuable mode requires `prepareContinuable`; method presence replaces `SubagentProvider.resume?()` as the capability check, while a capable provider may still run one-shot work.
+Provider method presence selects execution: `prepareContinuable()` creates a local activation; otherwise `start()` starts external execution. `delivery` chooses the result recipient without changing the local lifecycle.
-Cold resume does not dispatch through a subagent provider. The continuation manager folds the generic in-process descriptor, calls `ctx.agents.resume()` through the same activation-owner scope, installs the returned `AgentHandle`, and submits the waiting `next-turn`. `SubagentProvider.resume?()` and `SubagentProviderResumeRequest` are absent. The descriptor retains the initial provider name after that provider unregisters; the name does not grant a recovery capability or require the provider for later residency. Remote providers require a separate design.
+Cold resume does not dispatch through a subagent provider. The continuation manager folds the generic in-process descriptor, calls `ctx.agents.resume()` through the same activation-owner scope, installs the returned `AgentHandle`, and submits the waiting `next-turn`. `SubagentProvider.resume?()` and `SubagentProviderResumeRequest` are absent. The descriptor retains the initial provider name after that provider unregisters; the name does not grant a recovery capability or require the provider for later residency. External executions do not support cold resume.
-`SubagentProvider.start()` and `SubagentRun` remain exclusively on the unchanged one-shot path. A continuable Activation directly owns its `AgentHandle` and never creates, wraps, or retains a `SubagentRun`; `SubagentRun.steer?()` is therefore absent.
+`SubagentProvider.start()` and `SubagentRun` belong to external execution. A local Activation directly owns its `AgentHandle`; both kinds share manager-owned capacity, settlement, and disposal.
-`ctx.subagents.sendMessage(sender, targetId, content, { signal })` is the sole model-authored continuation-message operation. The exact live sender authorizes delivery to its direct parent or direct continuable child; cold resume checks direct-child authority before reconstruction and every path checks again in the final no-await inbox-admission span, so an Agent unregistered or replaced during materialization cannot authorize delivery. The service derives a durable `agent-message` source from that sender. The model-facing `send_message` tool keeps only `agent_id` and `message` and uses fixed Steer scheduling. Both start and send return the accepted `MessageId`, and neither reports how the manager materialized the Activation.
+`ctx.subagents.sendMessage(sender, targetId, content, { signal })` is the sole model-authored continuation-message operation. The exact live sender authorizes delivery to its direct parent or direct continuable child; cold resume checks direct-child authority before reconstruction and every path checks again in the final no-await inbox-admission span, so an Agent unregistered or replaced during materialization cannot authorize delivery. The service derives a durable `agent-message` source from that sender. The model-facing `send_message` tool keeps only `agent_id` and `message` and uses fixed Steer scheduling. Local start returns an activation receipt containing the accepted `MessageId`; send returns the `MessageId` directly. Neither exposes whether materialization created or resumed the Agent.
-For start and follow-up, the caller signal owns lookup, materialization, and admission only until inbox acceptance. After the operation returns its `MessageId`, the manager owns the Activation independently; later caller cancellation does not cancel the accepted turn or dispose the child.
+For start and follow-up, the caller signal owns lookup, materialization, and admission only until inbox acceptance. After inbox acceptance, the manager owns the Activation independently; later caller cancellation does not cancel the accepted turn or dispose the child.
### Durable Session and live Activation
@@ -54,7 +56,7 @@ The Session owns the stable child identity, transcript, direct-parent lineage, d
An idle historical Session has no `AgentHandle`. The first authorized `next-turn` delivery resumes an Activation from the persisted Session and submits the message to its inbox. Cold resume uses the exact live parent Agent for authorization and, when that parent has an Activation, ownership; it never uses the parent for reconstruction.
-The Activation directly owns the published `AgentHandle` until it settles, while the manager's private activation-owner scope is its structural Cordis owner. The continuable path creates no intermediate result-bearing execution wrapper, including `SubagentRun`; one-shot delegation remains unchanged and outside this lifecycle. Remote providers are out of scope here and require a separate Activation ownership contract when introduced. Historical Sessions consume no runtime memory after their Activation is disposed.
+A local Activation directly owns the published `AgentHandle` until settlement; the private activation-owner scope is its structural Cordis owner. It creates no intermediate `SubagentRun`. The unified manager also owns external executions through their provider handles. Historical Sessions retain no Agent resources after disposal.
### Activation lifecycle
@@ -81,21 +83,21 @@ no Activation
The manager derives these states from Agent quiescence, the Inbox's pending state, and the owned-child set rather than maintaining a second execution state machine. A `next-turn` delivered while `running` joins the Agent inbox. A waking delivery while `waiting` wakes the same Agent and returns the Activation to `running`. Delivery after disposal cold-resumes a new Activation.
-The manager linearizes manager-owned delivery, child release, and disposal for each durable child. A private `SubagentInbox` delegates Queue and Steer to the Agent inbox and owns the Activation's existing close transaction. If manager delivery races with final disposal, exactly one side wins this admission cutoff: delivery either enters the still-live Agent inbox, or observes closing and follows its operation-specific rejection or cold-resume path. Direct Agent work does not use this wrapper, so natural settlement uses short maintenance claims to validate the idle phase before the final flush and final disposal decision, then revalidates the Session sequence, Inbox pending state, wake generation, and owned-child set under the child lock. Accepted work that remains active or changes Session, Inbox, or ownership state invalidates that settlement attempt instead of being cancelled by it; maintenance that starts and finishes entirely during the flush has completed before the cutoff.
+The manager linearizes manager-owned delivery, child release, and disposal for each durable child. Private manager delivery delegates Queue and Steer to the Agent inbox and checks the Activation closing promise. If manager delivery races with final disposal, exactly one side wins this admission cutoff: delivery either enters the still-live Agent inbox, or observes closing and follows its operation-specific rejection or cold-resume path. Direct Agent work does not use this wrapper, so natural settlement uses short maintenance claims to validate the idle phase before the final flush and final disposal decision, then revalidates the Session sequence, Inbox pending state, wake generation, and owned-child set under the child lock. Accepted work that remains active or changes Session, Inbox, or ownership state invalidates that settlement attempt instead of being cancelled by it; maintenance that starts and finishes entirely during the flush has completed before the cutoff.
### One inbox and follow-up delivery
-The Agent inbox is the only queue. Every continuation message uses `Agent.followup()` and becomes one FIFO turn; neither the continuation manager nor the host maintains another message queue. Every pending Inbox occurrence keeps the current Activation live until it is claimed or discarded. This conservative rule also retains injected context: a quiet injection that remains after quiescence can keep the Activation and its live ancestors resident until a waking delivery claims it, a queue mutation removes it, or manager teardown disposes the tree.
+The Agent inbox is the only queue. Agent messages use Steer; human prompts choose Queue or Steer. Every pending Inbox occurrence keeps the current Activation live until claimed or discarded, including quiet injected context. Neither the manager nor the host maintains a second message queue.
Routing depends only on Activation residency:
-| Activation state | `followup` |
+| Activation state | Waking message delivery |
|---|---|
| `running` | enqueue in the same Activation |
| `waiting` | wake the same Activation |
| no Activation | cold-resume a new Activation |
-The continuation layer defines no separate delivery-route result. Successful `ctx.subagents.followup()` and `send_message` delivery returns the accepted `MessageId`, while delivery failure throws. Existing `agent/inbox/enqueue`, `agent/inbox/dequeue`, and `agent/inbox/discard` events remain the message-lifecycle observations; adapters may render a generic acceptance but do not expose `started`, `queued`, `resumed`, or another subagent-specific route vocabulary.
+Successful `sendMessage()` returns the accepted `MessageId`; failed delivery throws. Inbox events remain the message-lifecycle observations. The service exposes no separate started/queued/resumed routing result.
### Child ownership
@@ -107,9 +109,9 @@ Child release occurs only after the child Agent is quiescent, its Inbox is empty
Ownership is retained until the child Activation is disposed. A later refinement may release a request-scoped lease earlier, but it would require an exact turn-completion correlation that this Task-free design deliberately does not add.
-Top-level teardown is host-owned rather than represented as another Activation. Manager unload invokes its internal manager-wide drain to close admission synchronously, await every admitted materialization through publication or rollback, stop the stable live forest, and release it child-first. A host that owns selected top-level Agents uses `drainContinuableDescendants(parents)`: exact Agent identities close admission only below those roots until each leaves the registry, while unrelated forests and manager-wide admission remain live; the manager stops their visible descendants before its first await, waits only materializations admitted below those roots, and releases only the selected branches. Every materialized start and live delivery rechecks caller cancellation, the applicable draining scope, Activation disposal, and exact parent authority in the same synchronous span as inbox submission, so teardown or parent replacement that wins before acceptance prevents delivery to the closing handle. Only after the applicable drain settles may the host dispose its top-level Agents; only manager-wide drain precedes manager-scope disposal.
+Top-level teardown is host-owned rather than represented as another Activation. Manager unload invokes its internal manager-wide drain to close admission synchronously, await every admitted materialization through publication or rollback, stop the stable live forest, and release it child-first. A host that owns selected top-level Agents uses `drainDescendants(parents)`: exact Agent identities close admission only below those roots until each leaves the registry, while unrelated forests and manager-wide admission remain live; the manager stops their visible descendants before its first await, waits only materializations admitted below those roots, and releases only the selected branches. Every materialized start and live delivery rechecks caller cancellation, the applicable draining scope, Activation disposal, and exact parent authority in the same synchronous span as inbox submission, so teardown or parent replacement that wins before acceptance prevents delivery to the closing handle. Only after the applicable drain settles may the host dispose its top-level Agents; only manager-wide drain precedes manager-scope disposal.
-The activation-owner scope exists because ordinary Cordis owner effects unwind in reverse registration order, which cannot express the dynamic child graph. Manager initialization registers the private scope's structural disposer first and its drain disposer afterward, so reverse unwind invokes the drain before releasing that scope; merely registering a cleanup effect on the same scope as later Agent handles would allow structural handle disposal to bypass child-first ordering. Each materialization registers its barrier participant and snapshots its exact live ancestry before starting the inner transaction, then remains tracked until it installs an Activation or fully rolls back. The Activation retains weak membership of that ancestry, so an intermediate Agent may leave the registry without hiding a still-live descendant from its host root. Its private `SubagentInbox` installs one memoized closing promise before cancellation or recursive callbacks, allowing scoped host shutdown, global manager unload, child release, and normal settlement to converge without double release. Cancellation propagates top-down before slow descendant cleanup; handle release remains child-first. Sibling branches drain independently; one disposal failure is recorded but does not prevent the manager from attempting the remaining selected handles, and the aggregate drain reports failure after all selected branches settle. Durable child Sessions survive this process-local teardown.
+The activation-owner scope exists because ordinary Cordis owner effects unwind in reverse registration order, which cannot express the dynamic child graph. Manager initialization registers the private scope's structural disposer first and its drain disposer afterward, so reverse unwind invokes the drain before releasing that scope; merely registering a cleanup effect on the same scope as later Agent handles would allow structural handle disposal to bypass child-first ordering. Each materialization registers its barrier participant and snapshots its exact live ancestry before starting the inner transaction, then remains tracked until it installs an Activation or fully rolls back. The Activation retains weak membership of that ancestry, so an intermediate Agent may leave the registry without hiding a still-live descendant from its host root. The manager installs one memoized closing promise before cancellation or recursive callbacks, allowing scoped host shutdown, global manager unload, child release, and normal settlement to converge without double release. Cancellation propagates top-down before slow descendant cleanup; handle release remains child-first. Sibling branches drain independently; one disposal failure is recorded but does not prevent the manager from attempting the remaining selected handles, and the aggregate drain reports failure after all selected branches settle. Durable child Sessions survive this process-local teardown.
### Adjacent-Agent messaging
@@ -129,7 +131,7 @@ Parent-originated delivery requires the parent to be live when admitted and keep
### Durability, disposal, and recovery
-Without Jobs there is no `job_output`, `job_kill`, Task status, or per-message result promise. The caller signal can abort start or follow-up only before inbox acceptance. After acceptance, the parent cannot cancel the accepted message or dispose the Activation through `ctx.subagents`; the only public stop is the later [current-turn interrupt](2026-08-06-continuable-subagent-interrupt.md), which cancels the live target's current turn with `keepInbox` and leaves residency, pending work, and descendants intact.
+An activation receipt exposes `result` and `dispose()` without Jobs. The caller signal owns unpublished work; receipt disposal cancels the exact activation and awaits descendant startup rollback and child-first release. The [current-turn interrupt](../../../../packages/subagent/subagent/README.md) cancels only the live target turn with `keepInbox`, preserving residency, pending work, and descendants.
Host and manager teardown remains the lifecycle stop path. Manager unload applies it globally; a host applies it only below the exact top-level Agents it owns. Each form closes the applicable admission scope, stops the selected visible Activations, awaits admitted materializations in that scope, releases child-first, and preserves the durable Sessions.
@@ -141,9 +143,9 @@ Session and descriptor persistence survive restart. Activation state, Agent inbo
### Scope
-This version covers continuable in-process children and leaves one-shot delegation unchanged. Remote providers require a separate Activation handle with equivalent authenticated control and child-first quiescence contracts before they can support the same behavior.
+Local continuable control and external execution share activation ownership. Only local children support later messages and cold resume.
-It adds no host-user continuation, subagent steering operation, durable mailbox, cross-process lease, automatic replay of interrupted inbox work, team authority, workflow authority, public residency query, or runtime cache; the later [current-turn interrupt](2026-08-06-continuable-subagent-interrupt.md) added the one public stop operation on top of this lifecycle. Existing delegation-depth policy remains unchanged. Optional child-to-parent reporting is a later consumer of this lifecycle rather than part of the base continuable capability.
+Human Queue/Steer delivery and [current-turn interruption](../../../../packages/subagent/subagent/README.md) use this lifecycle; receipt disposal stops its exact activation and owned descendants. Durable mailboxes, cross-process leases, automatic replay of interrupted inbox work, team authority, workflow authority, public residency queries, and runtime caches remain outside this capability. Delegation-depth policy and adjacent-Agent message authorization retain their own owners.
## Alternatives considered
@@ -155,7 +157,7 @@ It adds no host-user continuation, subagent steering operation, durable mailbox,
**Let the provider create, resume, or deliver through an Agent handle.** Initial providers own only `prepareContinuable()` and its detached creation-spec distinction: whether a child begins fresh or with a parent prefix. The manager must call `ctx.agents.create()` through its private activation-owner scope so that scope is a structural owner of every handle. A persisted in-process Session already contains the initial prefix and generic reconstruction descriptor, while delivery belongs to the Agent inbox. Giving providers any later handle, `SubagentRun`, or message ownership would retain provider ownership with no shipped behavior to justify it.
-**Make report delivery part of the base lifecycle.** Repeatable child-to-parent reporting is compatible with this lifecycle, but quiet versus next-step delivery, acknowledgement, durability, and retry behavior are independent product choices. The later report package remains optional and consumes an explicit child-setup hook, so continuable residency does not silently grant a return channel.
+**Make child-authored reporting part of residency.** Adjacent-Agent messaging is separately composed through `send_message`; its authority and scheduling are independent of residency. Parent-result delivery belongs to the manager and includes a runtime settlement notice even when the child sends no message.
**Treat `SessionHeader.parentSession` as live ownership.** Durable lineage does not prove that the recorded parent currently owns the child. Membership in the live parent's `ownedChildren` records the process-local relationship without changing the durable parent id.
@@ -176,39 +178,39 @@ It adds no host-user continuation, subagent steering operation, durable mailbox,
The implementation pins these behaviors:
- A continuable child has at most one live Activation and one Agent inbox; the continuation manager has no Activation FIFO or queued Activation state.
-- `SubagentProvider.prepareContinuable?()` returns only a detached `ContinuableCreateSpec`; configured continuable mode requires that capability, while `backgroundMode` remains an independent policy choice.
-- The manager calls `ctx.agents.create()` through its private activation-owner scope, installs the returned `AgentHandle` and parent ownership, calls `Agent.followup(initialPrompt)`, and returns `{ childId, messageId }` when inbox acceptance yields the `MessageId`, without waiting for turn start or a Session-log write.
+- `SubagentProvider.prepareContinuable?()` returns detached local creation inputs; `start()` establishes external execution.
+- The manager calls `ctx.agents.create()` through its private activation-owner scope, installs the returned `AgentHandle` and parent ownership, calls `Agent.followup(initialPrompt)`, and returns a receipt containing `childId`, `messageId`, `result`, and `dispose()` when inbox acceptance yields the `MessageId`, without waiting for turn start or a Session-log write.
- Every failure before initial-prompt inbox acceptance rejects without ids and rolls back any created handle, Activation, and parent `ownedChildren` membership through a closing transaction visible to concurrent delivery and drain; lifecycle publication failure emits no unmatched terminal edge.
- Cold resume calls `ctx.agents.resume()` from the continuation manager and never dispatches through or requires the initial subagent provider; the descriptor retains the initial provider name after provider removal, while `SubagentProvider.resume?()` and `SubagentProviderResumeRequest` are absent.
-- A continuable Activation directly owns `AgentHandle` and never creates, wraps, or retains `SubagentRun`; `SubagentProvider.start()` and `SubagentRun` remain one-shot-only, without `SubagentRun.steer?()`.
-- `followup()` accepts only the exact live direct parent and rechecks that identity at the final no-await inbox-admission boundary after any materialization; durable message source fields cannot authorize delivery.
-- Continuation messages always use `Agent.followup()` and share its inbox FIFO, including when the child already has an open turn.
-- `ctx.subagents.followup()` and its `send_message` adapter return only the accepted `MessageId`; the continuation layer accepts no delivery target and defines no subagent-specific route result.
-- Caller signals stop start and follow-up only before inbox acceptance, while host-scoped and manager-global teardown retain child-first cleanup; the [current-turn interrupt](2026-08-06-continuable-subagent-interrupt.md) is the one public stop and does not enter teardown.
-- This version exposes no subagent steering operation or current-turn controller state.
+- A local Activation directly owns `AgentHandle`; an external Activation owns `SubagentRun`.
+- `sendMessage()` accepts only an exact live adjacent Agent and rechecks authority at final inbox admission after materialization; recorded source fields cannot authorize delivery.
+- Agent messages use Steer; human Queue prompts retain FIFO turn ordering.
+- `ctx.subagents.sendMessage()` returns the accepted `MessageId` without exposing materialization routing.
+- Caller signals stop unpublished work; activation receipts and host drains own child-first teardown. The [current-turn interrupt](../../../../packages/subagent/subagent/README.md) preserves pending work and residency.
+- Human prompt delivery and current-turn interruption retain their separate authorization checks.
- An idle Agent with live owned children yields a `waiting` Activation whose `AgentHandle` remains retained.
- A `next-turn` delivered to `waiting` wakes the same Activation; delivery after completed disposal cold-resumes a new Activation.
- Every continuation-managed parent Activation disposes only after all directly owned child Activations complete `AgentHandle` disposal; top-level Agents do not join the waiting graph.
- Final Activation settlement awaits `ctx.sessions.flush(child.session)` with admission open, logs rejection without interpreting listener participation as durability proof, revalidates the final state under the child lock, then closes admission, disposes the child handle, and releases parent ownership so a flush failure cannot leak a `waiting` Activation.
- Manager teardown closes admission globally; a host owning selected top-level Agents instead closes admission only below their exact identities until those roots leave the registry. Both track admitted materializations by exact ancestry, install one memoized disposal cutoff per selected visible Activation, propagate cancellation top-down, release handles child-first, await every selected branch despite individual failures, and only then dispose the corresponding top-level Agents or manager scope.
-- The base lifecycle has no implicit report behavior; the optional report package contributes an explicit child-scoped tool through the setup hook.
+- Parent delivery emits runtime settlement notices independently of child-authored messages.
- Session logs reconstruct only messages that were actually written, with the source that supplied each message; inbox-accepted but unlogged messages have no restart guarantee.
- No continuable-subagent path creates or depends on a Task, `JobId`, Task completion notice, Task cancellation, or intermediate result-bearing execution wrapper.
-- Unit coverage pins the `startContinuable()` inbox-acceptance return boundary, complete rollback for each pre-acceptance and lifecycle-publication failure, global and parent-scoped drain quiescence for materialization caught between Agent publication and Activation registration, sibling-forest isolation, exact ancestry after an intermediate Agent leaves the registry, provider-independent cold resume, final exact-parent reauthorization after cold-resume materialization, caller-signal and teardown ownership on both sides of acceptance, and the absence of automatic replay for accepted-but-unlogged messages.
-- Unit coverage pins the residency-only routing table, single-inbox ordering, `MessageId` correlation through inbox events, follow-up during an open turn, waiting wakeup, cold resume, ownership registration and release, child-first disposal, send-versus-dispose races, direct Agent turns, Session-only work, and maintenance accepted during the final-flush await, best-effort final flush with absent and failing listeners, and the absence of public subagent cancellation and steering.
-- Report-package unit coverage separately pins child-only visibility, setup revocation, authority, delivery modes, stable message identity, and lifecycle races.
-- A keyless assembled-app snapshot covers parent delegation and follow-up queueing, the absence of subagent steering and implicit report delivery, retained waiting `AgentHandle`, and child-first disposal. A separate report snapshot covers the optional explicit return channel.
+- Unit coverage pins the `startActivation()` inbox-acceptance return boundary, complete rollback for each pre-acceptance and lifecycle-publication failure, global and parent-scoped drain quiescence for materialization caught between Agent publication and Activation registration, sibling-forest isolation, exact ancestry after an intermediate Agent leaves the registry, provider-independent cold resume, final exact-parent reauthorization after cold-resume materialization, caller-signal and teardown ownership on both sides of acceptance, and the absence of automatic replay for accepted-but-unlogged messages.
+- Unit coverage pins the residency-only routing table, single-inbox ordering, `MessageId` correlation through inbox events, follow-up during an open turn, waiting wakeup, cold resume, ownership registration and release, child-first disposal, send-versus-dispose races, direct Agent turns, Session-only work, and maintenance accepted during the final-flush await, best-effort final flush with absent and failing listeners, and separately authorized human prompt delivery and interruption.
+- Adjacent-Agent tests cover direct-parent authority, tool visibility, cold resume, and delivery during settlement.
+- Keyless assembled-app snapshots cover delegation, adjacent-Agent messaging, runtime settlement notices, and child-first disposal.
### Accepted costs
Removing Jobs gives up generic background-work inspection, result collection, and exact Task cancellation. If those product features become requirements, they need a request ticket or inbox capability that does not reintroduce a second execution queue.
-Retaining an Activation while descendants run consumes Agent resources proportional to the unfinished ownership graph. The existing delegation-depth policy still bounds nesting, and [shared Activation capacity](2026-09-15-continuable-activation-capacity.md) bounds live continuable descendants; settled historical Sessions retain no `AgentHandle`.
+Retaining an Activation while descendants run consumes Agent resources proportional to the unfinished ownership graph. The existing delegation-depth policy still bounds nesting, and [shared Activation capacity](../../../../packages/subagent/subagent/README.md) bounds live continuable descendants; settled historical Sessions retain no `AgentHandle`.
The process-local inbox and ownership graph do not coordinate two harness processes. Deployments allowing concurrent access to one persistence store still require a durable lease and mailbox protocol.
-Without the optional report package, completing a child turn neither sends its content to nor wakes the historical parent. With the package, only an explicit `report` call sends selected content; quiet delivery does not wake the parent, while next-step delivery wakes it and joins its nearest step boundary. In every case the detailed child output remains in its durable Session.
+Child-authored `send_message` calls and manager-authored settlement notices remain distinct in the parent log. The detailed local child transcript remains in its own durable Session.
-Queueing every continuation message means a parent cannot correct an in-progress child turn immediately; the correction runs as the next turn. A later UI steering action may reduce that latency without changing follow-up ordering.
+Steer delivery reaches the next available step boundary; it does not preempt an executing tool. Queue delivery retains later-turn ordering.
A failed best-effort final flush is logged while the runtime ownership graph continues draining; the persisted child state may be missing or stale. Retry and repair require a separate recovery design.
diff --git a/.agents/notes/implemented/feature/2026-07-28-continuable-subagent-conversations.zh.md b/.agents/notes/implemented/feature/2026-07-28-continuable-subagent-conversations.zh.md
index 59a02a211e..ce543b4efa 100644
--- a/.agents/notes/implemented/feature/2026-07-28-continuable-subagent-conversations.zh.md
+++ b/.agents/notes/implemented/feature/2026-07-28-continuable-subagent-conversations.zh.md
@@ -4,7 +4,7 @@ Status: implemented
[English](2026-07-28-continuable-subagent-conversations.md) | 中文
-本记录取代[可继续的后台 subagent](../../archived/feature/2026-07-21-continuable-background-subagents.md)中由 Task 支撑的继续执行管理器。它保留[将 subagent 控制合并到 subagent 服务](../../archived/simplification/2026-07-26-merge-subagent-control-service.md)确立的单一 `ctx.subagents` 服务，以及[以意图命名的 subagent 继续执行操作](../../archived/simplification/2026-07-27-intent-named-subagent-continuation-operations.md)确立的 `followup` 操作。
+本记录取代[可继续的后台 subagent](../../archived/feature/2026-07-21-continuable-background-subagents.md)中由 Task 支撑的继续执行管理器。它保留[将 subagent 控制合并到 subagent 服务](../../archived/simplification/2026-07-26-merge-subagent-control-service.md)确立的单一 `ctx.subagents` 服务。
## 问题
@@ -18,6 +18,8 @@ parent Agent 还需要在不改变当前轮次的前提下，向同一个在线
## 决策
+共享 activation 入口、外部执行所有权，以及调用方与父级之间的结果投递选择由[统一 subagent activation](../simplification/2026-09-17-unified-subagent-activations.zh.md) 决策拥有。本记录保留下述独立理由。
+
一个可继续 subagent 拥有一个持久化会话，并且至多拥有一个进程内激活：
```text
@@ -28,25 +30,25 @@ persisted Session
-> zero or more owned child Activations
```
-激活是重建 child Agent 的一次驻留周期。它可以执行多个 FIFO 轮次，并在等待后代时保持驻留。它不是请求、结果、取消或 Task 边界。
+激活是重建 child Agent 的一次驻留周期。它可以执行多个 FIFO 轮次，并在等待后代时保持驻留。其回执持有这次确切驻留的结果与取消操作；它不会为每条已接受的消息分配独立结果或 Task。
继续执行管理器负责激活准入、权限检查、在线所有权图、冷恢复和 child-first dispose。Agent loop 负责全部轮次排序与执行。没有任何可继续 subagent 拥有 Task、激活 FIFO 或 queued 激活状态。
### 物化与公开操作
-具名 subagent 提供方只参与准备初始创建规格，此时 `spawn` 与 `fork` 有所区别。其可选的 `prepareContinuable(request): Promise` 方法就是可继续创建能力。返回的规格只包含与 Agent 实例分离且由提供方决定的创建输入，例如可选的 parent 历史种子；它不包含 Agent、`AgentHandle`、提示词投递、结果、dispose 或恢复操作。管理器会预留 child 身份，解析持久化描述符和通用 Agent 配置，通过私有 activation-owner 作用域调用 `ctx.agents.create()`，将返回的 `AgentHandle` 安装到激活中，建立适用的可继续 parent 所有权，然后调用 `Agent.followup(initialPrompt)`。inbox 接受消息后会产生一个 `MessageId`；`ctx.subagents.startContinuable()` 在此边界返回 `{ childId, messageId }`，不等待轮次开始，也不等待消息写入会话日志。
+具名 subagent 提供方只参与准备初始创建规格，此时 `spawn` 与 `fork` 有所区别。其可选的 `prepareContinuable(request): Promise` 方法就是可继续创建能力。返回的规格只包含与 Agent 实例分离且由提供方决定的创建输入，例如可选的 parent 历史种子；它不包含 Agent、`AgentHandle`、提示词投递、结果、dispose 或恢复操作。管理器会预留 child 身份，解析持久化描述符和通用 Agent 配置，通过私有 activation-owner 作用域调用 `ctx.agents.create()`，将返回的 `AgentHandle` 安装到激活中，建立适用的可继续 parent 所有权，然后调用 `Agent.followup(initialPrompt)`。inbox 接受消息后会产生一个 `MessageId`；`ctx.subagents.startActivation()` 在此边界返回包含 `childId`、`messageId`、`result` 与 `dispose()` 的回执，不等待轮次开始，也不等待消息写入会话日志。
inbox 接受消息前发生任何失败，操作都会在不返回任何 id 的情况下被拒绝。Agent 创建流程负责 handle 移交前的回滚；移交后，管理器会保留一个对并发投递和 drain 可见的关闭事务，dispose 已创建的 handle、移除激活并回滚 parent `ownedChildren` 中的任何成员关系，再拒绝操作。在驻留 start 事件发布前失败不会发布终止事件，start 发布后失败则通过正常 dispose 闭合生命周期配对。
-`backgroundMode: 'one-shot' | 'continuable'` 仍是部署策略。配置为 continuable 时要求存在 `prepareContinuable`；该方法是否存在会取代 `SubagentProvider.resume?()` 成为能力检查，而具备该能力的提供方仍可运行 one-shot 工作。
+提供方方法是否存在决定执行方式：`prepareContinuable()` 创建本地 activation，否则由 `start()` 启动外部执行。`delivery` 选择结果接收方，不改变本地生命周期。
-冷恢复不会通过 subagent 提供方分发。继续执行管理器会归并通用的进程内描述符，通过同一个 activation-owner 作用域调用 `ctx.agents.resume()`，安装返回的 `AgentHandle`，并提交等待中的 `next-turn`。`SubagentProvider.resume?()` 和 `SubagentProviderResumeRequest` 均不存在。初始提供方注销后，描述符仍保留其名称；该名称不赋予恢复能力，也不要求后续驻留时该提供方存在。远程提供方需要单独设计。
+冷恢复不会通过 subagent 提供方分发。继续执行管理器会归并通用的进程内描述符，通过同一个 activation-owner 作用域调用 `ctx.agents.resume()`，安装返回的 `AgentHandle`，并提交等待中的 `next-turn`。`SubagentProvider.resume?()` 和 `SubagentProviderResumeRequest` 均不存在。初始提供方注销后，描述符仍保留其名称；该名称不赋予恢复能力，也不要求后续驻留时该提供方存在。外部执行不支持冷恢复。
-`SubagentProvider.start()` 和 `SubagentRun` 只保留在不变的 one-shot 路径上。可继续激活直接持有自身的 `AgentHandle`，绝不创建、包装或保留 `SubagentRun`；因此，`SubagentRun.steer?()` 不存在。
+`SubagentProvider.start()` 与 `SubagentRun` 属于外部执行。本地 Activation 直接持有其 `AgentHandle`；两类执行共享管理器持有的容量、结算与 dispose。
-`ctx.subagents.sendMessage(sender, targetId, content, { signal })` 是唯一由模型编写的继续执行消息操作。确切在线 sender 授权向其直接 parent 或直接可继续 child 投递；冷恢复会在重建前检查直接 child 权限，每条路径还会在最终无 await 的 inbox 准入区间再次检查，因此在物化期间被注销或替换的 Agent 无法授权投递。服务从该 sender 推导持久化 `agent-message` 来源信息。面向模型的 `send_message` 工具只保留 `agent_id` 和 `message`，并使用固定 Steer 调度。start 与 send 都返回已接受的 `MessageId`，两者都不报告管理器如何物化 Activation。
+`ctx.subagents.sendMessage(sender, targetId, content, { signal })` 是唯一由模型编写的继续执行消息操作。确切在线 sender 授权向其直接 parent 或直接可继续 child 投递；冷恢复会在重建前检查直接 child 权限，每条路径还会在最终无 await 的 inbox 准入区间再次检查，因此在物化期间被注销或替换的 Agent 无法授权投递。服务从该 sender 推导持久化 `agent-message` 来源信息。面向模型的 `send_message` 工具只保留 `agent_id` 和 `message`，并使用固定 Steer 调度。本地 start 返回包含已接受 `MessageId` 的 activation 回执；send 直接返回 `MessageId`。两者都不暴露物化过程是创建还是恢复 Agent。
-对于 start 和 follow-up，调用方 signal 只在 inbox 接受消息前持有查找、物化和准入。操作返回 `MessageId` 后，管理器会独立持有该激活；调用方之后的取消不会取消已接受的轮次，也不会 dispose child。
+对于 start 和 follow-up，调用方 signal 只在 inbox 接受消息前持有查找、物化和准入。inbox 接受消息后，管理器会独立持有该激活；调用方之后的取消不会取消已接受的轮次，也不会 dispose child。
### 持久化会话与在线激活
@@ -54,7 +56,7 @@ inbox 接受消息前发生任何失败，操作都会在不返回任何 id 的
空闲的历史会话没有 `AgentHandle`。第一条通过鉴权的 `next-turn` 投递会根据持久化会话恢复激活，并将消息提交到其 inbox。冷恢复使用经过身份认证的确切在线 parent Agent 执行鉴权；当该 parent 有激活时，还使用它建立所有权，但绝不使用 parent 执行重建。
-激活会直接持有已发布的 `AgentHandle` 直至结算，而管理器的私有 activation-owner 作用域则是其 Cordis 结构化所有者。可继续 subagent 路径不创建任何中间的带结果执行包装层，包括 `SubagentRun`；一次性委派保持不变，且不属于该生命周期。远程提供方不在此处的范围内，引入时需要单独的激活所有权约定。激活 dispose 后，历史会话不消耗运行时内存。
+本地 Activation 直接持有已发布的 `AgentHandle` 直至结算；私有 activation-owner 作用域是其 Cordis 结构化所有者。它不创建中间 `SubagentRun`。统一管理器也通过提供方 handle 持有外部执行。dispose 后历史 Session 不保留 Agent 资源。
### 激活生命周期
@@ -81,21 +83,21 @@ no Activation
管理器根据 Agent 是否完全停稳、Inbox 的待处理状态以及所持 child 集合派生这些状态，而不是维护第二套执行状态机。在 `running` 时投递的 `next-turn` 会进入 Agent inbox。在 `waiting` 时到达的唤醒投递会唤醒同一个 Agent，并使激活回到 `running`。在 dispose 完成后投递消息则会冷恢复新激活。
-管理器会针对每个持久化 child，将 manager 所有的投递、child 释放和 dispose 线性化。私有 `SubagentInbox` 会把 Queue 与 Steer 委托给 Agent inbox，并持有 Activation 既有的关闭事务。如果 manager 投递与最终 dispose 发生竞争，只有一方能越过这条准入截止点：投递要么进入仍在线的 Agent inbox，要么观察到正在关闭，并遵循该操作特有的拒绝或冷恢复路径。直接操作 Agent 的工作不经过这层包装，因此自然结算会通过短暂的 maintenance 占用，在最终 flush 与最终 dispose 决策之前验证 idle 阶段，并在 child lock 内重新验证 Session 序号、Inbox 待处理状态、wake generation 与 owned-child set。仍然活跃或改变 Session、Inbox 或所有权状态的已接受工作会让本次结算尝试失效，而不会被它取消；完全在 flush 期间开始并结束的 maintenance 已在截止点前完成。
+管理器会针对每个持久化 child，将 manager 所有的投递、child 释放和 dispose 线性化。管理器的私有投递将 Queue 与 Steer 委托给 Agent inbox，并检查 Activation 的 closing promise。如果 manager 投递与最终 dispose 发生竞争，只有一方能越过这条准入截止点：投递要么进入仍在线的 Agent inbox，要么观察到正在关闭，并遵循该操作特有的拒绝或冷恢复路径。直接操作 Agent 的工作不经过这层包装，因此自然结算会通过短暂的 maintenance 占用，在最终 flush 与最终 dispose 决策之前验证 idle 阶段，并在 child lock 内重新验证 Session 序号、Inbox 待处理状态、wake generation 与 owned-child set。仍然活跃或改变 Session、Inbox 或所有权状态的已接受工作会让本次结算尝试失效，而不会被它取消；完全在 flush 期间开始并结束的 maintenance 已在截止点前完成。
### 一个 inbox 与 follow-up 投递
-Agent inbox 是唯一队列。每条继续执行消息都使用 `Agent.followup()`，并成为一个 FIFO 轮次；继续执行管理器和宿主都不维护另一条消息队列。每个待处理 Inbox occurrence 都会让当前激活保持在线，直到它被 claim 或 discard。这条保守规则也会保留注入 context：完全停稳后仍存在的静默注入可以让 Activation 及其在线祖先继续驻留，直到唤醒投递将其 claim、queue 变更将其移除，或 manager teardown dispose 整棵树。
+Agent inbox 是唯一队列。Agent 消息使用 Steer；人类提示词选择 Queue 或 Steer。每个待处理 Inbox 项（包括静默注入的上下文）都会让当前 Activation 保持在线，直到被认领或丢弃。管理器与宿主都不维护第二条消息队列。
路由只取决于激活的驻留状态：
-| 激活状态 | `followup` |
+| 激活状态 | 唤醒消息投递 |
|---|---|
| `running` | 在同一激活中排队 |
| `waiting` | 唤醒同一激活 |
| 无激活 | 冷恢复新激活 |
-继续执行层不定义单独的投递路由结果。成功投递 `ctx.subagents.followup()` 或 `send_message` 时会返回已接受的 `MessageId`，投递失败则会抛出异常。现有的 `agent/inbox/enqueue`、`agent/inbox/dequeue` 和 `agent/inbox/discard` 事件仍用于观测消息生命周期；适配器可以呈现通用的接受确认，但不暴露 `started`、`queued`、`resumed` 或其他 subagent 专属路由词汇。
+成功的 `sendMessage()` 返回已接受的 `MessageId`；投递失败则抛错。Inbox 事件仍是消息生命周期的观察来源。服务不暴露独立的 started/queued/resumed 路由结果。
### child 所有权
@@ -107,9 +109,9 @@ Agent inbox 是唯一队列。每条继续执行消息都使用 `Agent.followup(
系统会一直保留所有权，直至 child 激活完成 dispose。后续改进可以更早释放限定到请求的 lease，但这需要精确关联轮次完成，而本 Task-free 设计特意不增加该机制。
-顶层拆卸由宿主负责，而不表示为另一次激活。管理器卸载会调用其内部的管理器全局 drain，同步关闭准入，等待每个已获准的物化过程完成发布或回滚，停止稳定的在线森林，并按 child-first 顺序释放。拥有选定顶层 Agent 的宿主使用 `drainContinuableDescendants(parents)`：确切的 Agent 身份只关闭这些根之下的准入，直到每个身份离开注册表，而无关森林和管理器全局准入保持在线；管理器会在第一次 await 之前停止其可见后代，只等待这些根之下已获准的物化过程，并且只释放选定分支。每个已物化的 start 和在线投递都会在与 inbox 提交相同的同步区间内重新检查调用方取消、适用的 draining 作用域、Activation dispose 和确切的 parent 权限，因此只要拆卸或 parent 替换先于接受发生，就会阻止向正在关闭的 handle 投递。只有适用的 drain 结算后，宿主才能 dispose 自己的顶层 Agent；只有管理器全局 drain 会先于管理器作用域 dispose。
+顶层拆卸由宿主负责，而不表示为另一次激活。管理器卸载会调用其内部的管理器全局 drain，同步关闭准入，等待每个已获准的物化过程完成发布或回滚，停止稳定的在线森林，并按 child-first 顺序释放。拥有选定顶层 Agent 的宿主使用 `drainDescendants(parents)`：确切的 Agent 身份只关闭这些根之下的准入，直到每个身份离开注册表，而无关森林和管理器全局准入保持在线；管理器会在第一次 await 之前停止其可见后代，只等待这些根之下已获准的物化过程，并且只释放选定分支。每个已物化的 start 和在线投递都会在与 inbox 提交相同的同步区间内重新检查调用方取消、适用的 draining 作用域、Activation dispose 和确切的 parent 权限，因此只要拆卸或 parent 替换先于接受发生，就会阻止向正在关闭的 handle 投递。只有适用的 drain 结算后，宿主才能 dispose 自己的顶层 Agent；只有管理器全局 drain 会先于管理器作用域 dispose。
-activation-owner 作用域之所以存在，是因为普通 Cordis owner effect 按注册逆序撤销，无法表达动态 child 图。管理器初始化时先注册私有作用域的结构化 disposer，再注册自身的 drain disposer，使逆序撤销先执行 drain、再释放该作用域；如果只在与后续 Agent handle 相同的作用域上注册 cleanup effect，结构化 handle dispose 就可能绕过 child-first 顺序。每个物化过程都会在启动内部事务前注册其屏障参与项，并对其确切的在线祖先建立快照，然后保持跟踪，直到安装 Activation 或完全回滚。Activation 会保留其在这组祖先中的弱成员关系，因此中间 Agent 即使离开注册表，也不会让仍在线的后代脱离宿主根节点的可见范围。其私有 `SubagentInbox` 会在取消或递归回调前安装一个记忆化的 closing promise，使限定作用域的宿主关闭、全局管理器卸载、child 释放和正常结算能够汇合，而不会重复释放。取消会在等待缓慢的后代清理之前自顶向下传播；handle 释放仍是 child-first。同级分支独立 drain；系统会记录单次 dispose 失败，但仍会尝试其余选中 handle，聚合 drain 则在所有选中分支结算后报告失败。这次进程内拆卸不会销毁持久化 child 会话。
+activation-owner 作用域之所以存在，是因为普通 Cordis owner effect 按注册逆序撤销，无法表达动态 child 图。管理器初始化时先注册私有作用域的结构化 disposer，再注册自身的 drain disposer，使逆序撤销先执行 drain、再释放该作用域；如果只在与后续 Agent handle 相同的作用域上注册 cleanup effect，结构化 handle dispose 就可能绕过 child-first 顺序。每个物化过程都会在启动内部事务前注册其屏障参与项，并对其确切的在线祖先建立快照，然后保持跟踪，直到安装 Activation 或完全回滚。Activation 会保留其在这组祖先中的弱成员关系，因此中间 Agent 即使离开注册表，也不会让仍在线的后代脱离宿主根节点的可见范围。管理器会在取消或递归回调前安装一个记忆化的 closing promise，使限定作用域的宿主关闭、全局管理器卸载、child 释放和正常结算能够汇合，而不会重复释放。取消会在等待缓慢的后代清理之前自顶向下传播；handle 释放仍是 child-first。同级分支独立 drain；系统会记录单次 dispose 失败，但仍会尝试其余选中 handle，聚合 drain 则在所有选中分支结算后报告失败。这次进程内拆卸不会销毁持久化 child 会话。
### 相邻 Agent 消息
@@ -129,7 +131,7 @@ activation-owner 作用域之所以存在，是因为普通 Cordis owner effect
### 持久性、dispose 与恢复
-没有 Task 后，系统不再提供 `job_output`、`job_kill`、Task 状态或逐消息结果 promise。调用方 signal 只能在 inbox 接受消息前中止 start 或 follow-up。消息被接受后，parent 不能通过 `ctx.subagents` 取消已接受的消息或 dispose 激活；唯一的公开停止操作是后来的[当前轮次中断](2026-08-06-continuable-subagent-interrupt.zh.md)，它以 `keepInbox` 取消在线目标的当前轮次，驻留、待处理工作与后代均保持不变。
+activation 回执无需 Jobs 即可暴露 `result` 与 `dispose()`。调用方 signal 持有未发布工作；回执 dispose 会取消确切的 activation，并等待后代启动回滚与 child-first 释放。[当前轮次中断](../../../../packages/subagent/subagent/README.zh.md)仅以 `keepInbox` 取消在线目标轮次，保留驻留、待处理工作与后代。
宿主和管理器拆卸仍是生命周期停止路径。管理器卸载会全局应用它；宿主只会在自己确切拥有的顶层 Agent 之下应用它。两种形式都会关闭适用的准入作用域，停止选中的可见 Activation，等待该作用域中已获准的物化过程，按 child-first 顺序释放，并保留持久化 Session。
@@ -141,9 +143,9 @@ activation-owner 作用域之所以存在，是因为普通 Cordis owner effect
### 范围
-本版本覆盖可继续的进程内 child，一次性委派保持不变。远程提供方必须具备单独的激活 handle，以及等价的认证控制与 child-first 完全停稳约定，才能支持同样的行为。
+本地可继续控制与外部执行共享 activation 所有权。只有本地 child 支持后续消息与冷恢复。
-它不新增 host-user 继续执行、subagent steering 操作、持久化邮箱、跨进程 lease、中断 inbox 工作的自动回放、团队权限、工作流权限、公开驻留查询、以及运行时缓存；后来的[当前轮次中断](2026-08-06-continuable-subagent-interrupt.zh.md)在此生命周期之上补充了唯一的公开停止操作。现有委派深度策略保持不变。可选的 child 到 parent 报告是后续消费该生命周期的功能，不属于基础可继续能力。
+人工 Queue/Steer 投递和[当前轮次中断](../../../../packages/subagent/subagent/README.zh.md)使用此生命周期；回执释放会停止这次确切 activation 及其所属后代。持久化邮箱、跨进程 lease、中断 inbox 工作的自动回放、团队权限、工作流权限、公开驻留查询和运行时缓存仍不属于此能力。委派深度策略和相邻 Agent 消息授权各自由其原有组件管理。
## 曾考虑的替代方案
@@ -155,7 +157,7 @@ activation-owner 作用域之所以存在，是因为普通 Cordis owner effect
**让提供方通过 Agent handle 创建、恢复 child 或投递消息。** 初始提供方只持有 `prepareContinuable()` 及其分离式创建规格这一项差异：child 是全新启动，还是带有 parent 前缀。管理器必须通过私有 activation-owner 作用域自行调用 `ctx.agents.create()`，使该作用域成为每个 handle 的结构化所有者。持久化的进程内会话已经包含初始前缀及通用重建描述符，消息投递则属于 Agent inbox。让提供方持有任何后续 handle、`SubagentRun` 或消息所有权，会让提供方保留所有权，却没有已发布行为需要它。
-**将报告投递纳入基础生命周期。** 可重复的 child 到 parent 报告与该生命周期兼容，但静默投递还是 next-step 投递、确认、持久性和重试行为都是独立的产品决策。后续的 report 包保持可选，并消费一个显式的 child 设置钩子，因此可继续驻留不会默认授予返回通道。
+**把 child 编写的报告纳入驻留。** 相邻 Agent 消息通过 `send_message` 独立组合；其权限与调度独立于驻留。父级结果投递由管理器持有，即使 child 没有发消息，也会包含运行时结算通知。
**将 `SessionHeader.parentSession` 视为在线所有权。** 持久化谱系不能证明已记录的 parent 当前持有 child。在线 parent 的 `ownedChildren` 成员关系会记录进程内关系，而不改变持久化 parent id。
@@ -176,39 +178,39 @@ activation-owner 作用域之所以存在，是因为普通 Cordis owner effect
本实现固定了以下行为：
- 可继续 child 至多拥有一个在线激活和一个 Agent inbox；继续执行管理器没有激活 FIFO 或 queued 激活状态。
-- `SubagentProvider.prepareContinuable?()` 只返回分离式 `ContinuableCreateSpec`；配置为 continuable 时要求具备该能力，而 `backgroundMode` 仍是独立的策略选择。
-- 管理器通过私有 activation-owner 作用域调用 `ctx.agents.create()`，安装返回的 `AgentHandle` 并建立 parent 所有权，调用 `Agent.followup(initialPrompt)`，然后在 inbox 接受消息并产生 `MessageId` 时返回 `{ childId, messageId }`，而不等待轮次开始或消息写入会话日志。
+- `SubagentProvider.prepareContinuable?()` 返回独立的本地创建输入；`start()` 建立外部执行。
+- 管理器通过私有 activation-owner 作用域调用 `ctx.agents.create()`，安装返回的 `AgentHandle` 并建立 parent 所有权，调用 `Agent.followup(initialPrompt)`，然后在 inbox 接受消息并产生 `MessageId` 时返回包含 `childId`、`messageId`、`result` 与 `dispose()` 的回执，而不等待轮次开始或消息写入会话日志。
- 初始提示词被 inbox 接受前的每条失败路径都会导致操作被拒绝且不返回 id，并通过一个对并发投递和 drain 可见的关闭事务回滚已创建的任何 handle、激活和 parent `ownedChildren` 成员关系；生命周期发布失败不会产生无配对的终止事件。
- 冷恢复由继续执行管理器调用 `ctx.agents.resume()`，绝不通过或依赖初始 subagent 提供方；提供方移除后，描述符仍保留初始提供方名称，且 `SubagentProvider.resume?()` 和 `SubagentProviderResumeRequest` 均不存在。
-- 可继续激活直接持有 `AgentHandle`，绝不创建、包装或保留 `SubagentRun`；`SubagentProvider.start()` 和 `SubagentRun` 只用于 one-shot，且没有 `SubagentRun.steer?()`。
-- `followup()` 只接受确切的在线直接 parent，并在任何物化之后的最终无 await 的 inbox 准入边界再次检查该身份；持久化消息来源信息不能授权投递。
-- 继续执行消息始终使用 `Agent.followup()` 并共享其 inbox FIFO，包括 child 已有开放轮次的情况。
-- `ctx.subagents.followup()` 及其 `send_message` 适配器只返回已接受的 `MessageId`；继续执行层不接受投递 target，也不定义 subagent 专属路由结果。
-- 调用方 signal 只能在 inbox 接受消息前停止 start 和 follow-up，限定到宿主的拆卸与管理器全局拆卸则保留 child-first 清理；[当前轮次中断](2026-08-06-continuable-subagent-interrupt.zh.md)是唯一的公开停止操作，且不进入拆卸流程。
-- 本版本不暴露 subagent steering 操作或当前轮次控制方状态。
+- 本地 Activation 直接持有 `AgentHandle`；外部 Activation 持有 `SubagentRun`。
+- `sendMessage()` 只接受确切在线的相邻 Agent，并在物化后的最终 inbox 准入处重新检查权限；记录的来源字段不能授权投递。
+- Agent 消息使用 Steer；人类 Queue 提示词保留 FIFO 轮次顺序。
+- `ctx.subagents.sendMessage()` 返回已接受的 `MessageId`，不暴露物化路由。
+- 调用方 signal 停止未发布工作；activation 回执与宿主 drain 持有 child-first 拆卸。[当前轮次中断](../../../../packages/subagent/subagent/README.zh.md)保留待处理工作与驻留。
+- 人类提示词投递与当前轮次中断保留各自的权限检查。
- 带有在线所持 child 的空闲 Agent 会产生 `waiting` 激活，其 `AgentHandle` 继续保留。
- 向 `waiting` 投递 `next-turn` 会唤醒同一个激活；完成 dispose 后投递消息会冷恢复新激活。
- 每个由继续执行管理器管理的 parent 激活只会在直接持有的所有 child 激活完成 `AgentHandle` dispose 后进行 dispose；顶层 Agent 不加入等待图。
- Activation 最终结算会在准入开放时等待 `ctx.sessions.flush(child.session)`，将其作为 best-effort 屏障；它会记录 rejection，但不会把 listener 参与解释为持久性证明，随后在 child lock 内重新验证最终状态，再关闭准入、dispose child handle 并释放 parent 所有权，使 flush 失败不会泄漏 `waiting` Activation。
- 管理器拆卸会全局关闭准入；拥有选定顶层 Agent 的宿主则只关闭这些确切身份之下的准入，直到这些根离开注册表。两者都会按确切祖先关系跟踪已获准的物化过程，为每个选中的可见 Activation 安装一个记忆化 dispose 截止点，自顶向下传播取消，按 child-first 顺序释放 handle，即使个别分支失败也会等待所有选中分支，之后才 dispose 对应的顶层 Agent 或管理器作用域。
-- 基础生命周期不暴露隐式报告行为；可选的 report 包通过 setup 钩子贡献一个显式的 child 作用域工具。
+- parent 投递独立于 child 编写的消息发出运行时结算通知。
- 会话日志只会重建实际写入的消息，并保留每条消息的提供来源；已被 inbox 接受但未写入日志的消息没有重启保证。
- 可继续 subagent 路径不创建或依赖 Task、`JobId`、Task 完成通知、Task 取消或中间的带结果执行包装层。
-- 单元覆盖固定 `startContinuable()` 在 inbox 接受消息时的返回边界、每条接受前和生命周期发布失败路径的完整回滚、全局和限定到 parent 作用域的 drain 都会等待夹在 Agent 发布与 Activation 注册之间的物化过程完全停稳、同级森林隔离、中间 Agent 离开注册表后的确切祖先关系、不依赖提供方的冷恢复、冷恢复物化后的最终确切 parent 再授权、接受前后两个阶段的调用方 signal 与拆卸所有权，以及已接受但未写入日志的消息不会自动回放。
-- 单元覆盖固定仅由驻留状态决定的路由表、单 inbox 顺序、通过 inbox 事件关联 `MessageId`、在开放轮次期间 follow-up、等待唤醒、冷恢复、所有权注册与释放、child-first dispose、发送与 dispose 的竞争、在最终 flush await 期间接受的直接 Agent 轮次、仅修改 Session 的工作与 maintenance、没有 listener 和 listener 失败时的 best-effort 最终 flush，以及不存在公开 subagent 取消和 steering。
-- report 包的单元覆盖会分别固定仅 child 可见性、setup 撤销、权限、投递模式、稳定消息身份和生命周期竞争。
-- 一项无密钥整套应用快照覆盖 parent 委派和 follow-up 排队、不存在 subagent steering 和隐式 report 投递、保留 waiting 中的 `AgentHandle` 以及 child-first dispose。另一项 report 快照覆盖可选的显式返回通道。
+- 单元覆盖固定 `startActivation()` 在 inbox 接受消息时的返回边界、每条接受前和生命周期发布失败路径的完整回滚、全局和限定到 parent 作用域的 drain 都会等待夹在 Agent 发布与 Activation 注册之间的物化过程完全停稳、同级森林隔离、中间 Agent 离开注册表后的确切祖先关系、不依赖提供方的冷恢复、冷恢复物化后的最终确切 parent 再授权、接受前后两个阶段的调用方 signal 与拆卸所有权，以及已接受但未写入日志的消息不会自动回放。
+- 单元覆盖固定仅由驻留状态决定的路由表、单 inbox 顺序、通过 inbox 事件关联 `MessageId`、在开放轮次期间 follow-up、等待唤醒、冷恢复、所有权注册与释放、child-first dispose、发送与 dispose 的竞争、在最终 flush await 期间接受的直接 Agent 轮次、仅修改 Session 的工作与 maintenance、没有 listener 和 listener 失败时的 best-effort 最终 flush，以及单独鉴权的人类提示词投递与中断。
+- 相邻 Agent 测试覆盖直接 parent 权限、工具可见性、冷恢复与结算期间投递。
+- keyless 组装应用快照覆盖委派、相邻 Agent 消息、运行时结算通知与 child-first dispose。
### 已接受的代价
移除 Task 会放弃通用后台工作检查、结果收集和精确 Task 取消。如果这些产品功能成为需求，就需要不会重新引入第二条执行队列的请求 ticket 或 inbox 能力。
-在后代运行期间保留激活，会按尚未完成所有权图的规模消耗 Agent 资源。现有委派深度策略仍会限制嵌套层级，而[共享 Activation 容量](2026-09-15-continuable-activation-capacity.zh.md)限制存活的可续接后代数；已结算的历史会话不保留 `AgentHandle`。
+在后代运行期间保留激活，会按尚未完成所有权图的规模消耗 Agent 资源。现有委派深度策略仍会限制嵌套层级，而[共享 Activation 容量](../../../../packages/subagent/subagent/README.zh.md)限制存活的可续接后代数；已结算的历史会话不保留 `AgentHandle`。
进程内 inbox 和所有权图无法协调两个 harness 进程。允许多个进程并发访问同一持久化存储的部署，仍需要持久化 lease 和邮箱协议。
-未安装可选 report 包时，完成 child 轮次既不会把内容发送给历史 parent，也不会唤醒它。安装后，只有显式调用 `report` 才会发送选中内容；静默投递不唤醒 parent，next-step 投递则会唤醒它并加入最近的 step 边界。无论如何，child 的详细输出都会保留在其持久化会话中。
+child 编写的 `send_message` 调用与管理器编写的结算通知在父级日志中保持区分。本地 child 的完整文本记录保留在其自身的持久化 Session 中。
-将每条继续执行消息排队，意味着 parent 无法立即纠正正在进行的 child 轮次；纠正操作会在下一个轮次执行。后续 UI steering 操作可以缩短该延迟，而不改变 follow-up 排序。
+Steer 投递抵达下一个可用 step 边界，不会抢占正在执行的工具。Queue 投递保留后续轮次顺序。
best-effort 最终 flush 失败时会记录日志，同时运行时所有权图继续 drain；持久化 child 状态可能缺失或陈旧。重试与修复需要单独的恢复设计。
diff --git a/.agents/notes/implemented/feature/2026-07-28-skill-invocation-policy.i18n.yaml b/.agents/notes/implemented/feature/2026-07-28-skill-invocation-policy.i18n.yaml
deleted file mode 100644
index 55f7304827..0000000000
--- a/.agents/notes/implemented/feature/2026-07-28-skill-invocation-policy.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-28-skill-invocation-policy.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-28-skill-invocation-policy.md
-/agent-note-independent-model-and-user-skill-invocation-policy:
- en: d5f87e846ef041b1
- zh: 273e87043d19a709
-/agent-note-independent-model-and-user-skill-invocation-policy/problem:
- en: 9fc564115fca4b22
- zh: 3a414ee5c1f7f842
-/agent-note-independent-model-and-user-skill-invocation-policy/decision:
- en: dbd7aabf9fdd7c37
- zh: d71a2fd355e30fd1
-/agent-note-independent-model-and-user-skill-invocation-policy/alternatives-considered:
- en: fdffcd101a494c4a
- zh: db802bf9bc04ae74
-/agent-note-independent-model-and-user-skill-invocation-policy/consequences:
- en: 94071073367396eb
- zh: 5afca22d8140b5c0
diff --git a/.agents/notes/implemented/feature/2026-07-30-queued-manual-compaction.i18n.yaml b/.agents/notes/implemented/feature/2026-07-30-queued-manual-compaction.i18n.yaml
deleted file mode 100644
index 9da56d634b..0000000000
--- a/.agents/notes/implemented/feature/2026-07-30-queued-manual-compaction.i18n.yaml
+++ /dev/null
@@ -1,43 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-30-queued-manual-compaction.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-30-queued-manual-compaction.md
-/agent-note-queued-manual-compaction-with-one-durable-lock:
- en: 45504a64618db51a
- zh: f8dfebaf42ee4ddf
-/agent-note-queued-manual-compaction-with-one-durable-lock/problem:
- en: ffd033e0cea4b612
- zh: 63fa18871f038eb7
-/agent-note-queued-manual-compaction-with-one-durable-lock/decision:
- en: a15c7c13f167e5ac
- zh: 63bcc2ef60c2f344
-/agent-note-queued-manual-compaction-with-one-durable-lock/decision/compact-is-a-command-over-a-backend-independent-seam:
- en: a8631732e038e08d
- zh: 68cb705f38ddfa57
-/agent-note-queued-manual-compaction-with-one-durable-lock/decision/idle-maintenance-is-synchronously-claimed:
- en: a11c700f32838561
- zh: c20636c5f7efabaf
-/agent-note-queued-manual-compaction-with-one-durable-lock/decision/one-parameterized-transaction-owns-every-bracket:
- en: 7b75672fafc370c9
- zh: 4fb473856c9c7265
-/agent-note-queued-manual-compaction-with-one-durable-lock/decision/bracket-first-deliberately-differs-from-the-surveyed-implementations:
- en: 309671a79b437033
- zh: 86e0f366aed73c35
-/agent-note-queued-manual-compaction-with-one-durable-lock/decision/markers-are-time-points-not-an-event-container:
- en: e9d8043178dc946f
- zh: 56808150ba2ab275
-/agent-note-queued-manual-compaction-with-one-durable-lock/decision/end-seed-distinguishes-live-and-stale-orphans:
- en: cc767e216225e117
- zh: 4ec7dbc179f96c37
-/agent-note-queued-manual-compaction-with-one-durable-lock/decision/reference-implementation-boundaries:
- en: 97b121c53b8f3b68
- zh: 13d86db92c30bef1
-/agent-note-queued-manual-compaction-with-one-durable-lock/alternatives-considered:
- en: f1c5bae090425598
- zh: 60a30f851d85dfb0
-/agent-note-queued-manual-compaction-with-one-durable-lock/verification:
- en: 37587419460fcf36
- zh: e45c752f93d5a87e
-/agent-note-queued-manual-compaction-with-one-durable-lock/consequences:
- en: b8c71ea1d1db7b8e
- zh: 0d276bb8317ada91
diff --git a/.agents/notes/implemented/feature/2026-07-30-web-remote-markdown-images.i18n.yaml b/.agents/notes/implemented/feature/2026-07-30-web-remote-markdown-images.i18n.yaml
deleted file mode 100644
index aea31db0d2..0000000000
--- a/.agents/notes/implemented/feature/2026-07-30-web-remote-markdown-images.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-30-web-remote-markdown-images.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-30-web-remote-markdown-images.md
-/agent-note-remote-web-markdown-images:
- en: a11eadff0703761d
- zh: 59841eaf2993b7c4
-/agent-note-remote-web-markdown-images/problem:
- en: 97447c93b654eda7
- zh: 456a3ceed4967d0a
-/agent-note-remote-web-markdown-images/decision:
- en: 8dfbdb81dff9cae3
- zh: 217042998b65c158
-/agent-note-remote-web-markdown-images/alternatives-considered:
- en: 32a4116e8ffc4b16
- zh: 59dd991fede9ac71
-/agent-note-remote-web-markdown-images/consequences:
- en: 12b97c75c5d19308
- zh: ee8102b7d01e579b
diff --git a/.agents/notes/implemented/feature/2026-07-31-even-out-shipped-tool-rosters.i18n.yaml b/.agents/notes/implemented/feature/2026-07-31-even-out-shipped-tool-rosters.i18n.yaml
deleted file mode 100644
index 2a3d4bae8d..0000000000
--- a/.agents/notes/implemented/feature/2026-07-31-even-out-shipped-tool-rosters.i18n.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-31-even-out-shipped-tool-rosters.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-31-even-out-shipped-tool-rosters.md
-/agent-note-even-out-the-shipped-tool-rosters:
- en: aa8ec8438dc609aa
- zh: 28172207b09ea3ad
-/agent-note-even-out-the-shipped-tool-rosters/problem:
- en: 69e127b53366cf66
- zh: 63f783ac453d4cbe
-/agent-note-even-out-the-shipped-tool-rosters/decision:
- en: 45662b711bd9a201
- zh: 845cd2a9193cbe0f
-/agent-note-even-out-the-shipped-tool-rosters/decision/what-stays-unmounted-and-why:
- en: 7a74b42b428b9cf9
- zh: 4f534ccd26b9ecc4
-/agent-note-even-out-the-shipped-tool-rosters/decision/mcp-is-a-dependency-not-a-row:
- en: 45358314e6adae26
- zh: 85ca6a6ce7bbf947
-/agent-note-even-out-the-shipped-tool-rosters/testing:
- en: 07e46125d49a2068
- zh: 83a1b2737768651b
-/agent-note-even-out-the-shipped-tool-rosters/alternatives-considered:
- en: cf41f0bf700af59c
- zh: 1dcaafe6bb944d92
-/agent-note-even-out-the-shipped-tool-rosters/consequences:
- en: cf1821c985507b13
- zh: 0f7396a06d1b19fb
diff --git a/.agents/notes/implemented/feature/2026-07-31-web-default-search.i18n.yaml b/.agents/notes/implemented/feature/2026-07-31-web-default-search.i18n.yaml
deleted file mode 100644
index f398e72a4e..0000000000
--- a/.agents/notes/implemented/feature/2026-07-31-web-default-search.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-31-web-default-search.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-31-web-default-search.md
-/agent-note-default-web-search-in-shipped-compositions:
- en: 030dc2ef246ba33d
- zh: 94cc720adfd3d4ef
-/agent-note-default-web-search-in-shipped-compositions/problem:
- en: cd5af0c73d578874
- zh: 29e14c7ff1c77391
-/agent-note-default-web-search-in-shipped-compositions/decision:
- en: 7062647c8e227743
- zh: 26bdd8dc4b0cd7ad
-/agent-note-default-web-search-in-shipped-compositions/alternatives-considered:
- en: f28e0f1183e755ce
- zh: 2cbf256a33d99686
-/agent-note-default-web-search-in-shipped-compositions/consequences:
- en: d69965f3be327186
- zh: 4e2b10bb0a227f0a
diff --git a/.agents/notes/implemented/feature/2026-07-31-web-workspace-file-links.i18n.yaml b/.agents/notes/implemented/feature/2026-07-31-web-workspace-file-links.i18n.yaml
deleted file mode 100644
index 25355eb4d5..0000000000
--- a/.agents/notes/implemented/feature/2026-07-31-web-workspace-file-links.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-31-web-workspace-file-links.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-31-web-workspace-file-links.md
-/agent-note-opening-a-produced-file-from-the-web-ui:
- en: bdfcd62110aaefa2
- zh: 92981f1fe8ca52c9
-/agent-note-opening-a-produced-file-from-the-web-ui/problem:
- en: 06ba78ace240645c
- zh: 07a46477d41ddcee
-/agent-note-opening-a-produced-file-from-the-web-ui/decision:
- en: a3d6e9aa14dc6fb8
- zh: d9696d46eb4a348d
-/agent-note-opening-a-produced-file-from-the-web-ui/alternatives-considered:
- en: ba9603055aea84aa
- zh: 3ab217f1b1ccb3b6
-/agent-note-opening-a-produced-file-from-the-web-ui/consequences:
- en: aa460548654a89a5
- zh: ebb8e51f5cd18f0b
diff --git a/.agents/notes/implemented/feature/2026-08-02-pwsh-tool-bash-parity.i18n.yaml b/.agents/notes/implemented/feature/2026-08-02-pwsh-tool-bash-parity.i18n.yaml
deleted file mode 100644
index 4ac0e96629..0000000000
--- a/.agents/notes/implemented/feature/2026-08-02-pwsh-tool-bash-parity.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-02-pwsh-tool-bash-parity.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-02-pwsh-tool-bash-parity.md
-/agent-note-pwsh-tool-bash-parity:
- en: 76e33af7ff962cd2
- zh: 392f3d5f7100c564
-/agent-note-pwsh-tool-bash-parity/problem:
- en: de5bfad14ef58243
- zh: fe8168a215719127
-/agent-note-pwsh-tool-bash-parity/decision:
- en: 169a42b6c2dc965d
- zh: 4172091b0299c748
-/agent-note-pwsh-tool-bash-parity/alternatives-considered:
- en: 7dc381c52b191bc9
- zh: 6c07393519d3bb21
-/agent-note-pwsh-tool-bash-parity/consequences:
- en: ea302108933e8a69
- zh: 563db786f22d07fa
diff --git a/.agents/notes/implemented/feature/2026-08-04-claude-code-and-codex-subagent-backends.i18n.yaml b/.agents/notes/implemented/feature/2026-08-04-claude-code-and-codex-subagent-backends.i18n.yaml
deleted file mode 100644
index dc33cc6355..0000000000
--- a/.agents/notes/implemented/feature/2026-08-04-claude-code-and-codex-subagent-backends.i18n.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-04-claude-code-and-codex-subagent-backends.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-04-claude-code-and-codex-subagent-backends.md
-/agent-note-claude-code-and-codex-subagent-backends:
- en: 0f3599cefa53ad5b
- zh: 988c28cdd9ee4e61
-/agent-note-claude-code-and-codex-subagent-backends/problem:
- en: dbd5758c1c46b303
- zh: ca5b8479f4358c9b
-/agent-note-claude-code-and-codex-subagent-backends/decision:
- en: caf8c74c3466b27a
- zh: 5b1daf0a738221cd
-/agent-note-claude-code-and-codex-subagent-backends/decision/ownership-and-lifecycle:
- en: 1c106b8b0063fee2
- zh: 0a38a1ffbe93086d
-/agent-note-claude-code-and-codex-subagent-backends/codex-provider:
- en: 5835894b4ac2e182
- zh: c1fcbd2b2b7e0ea0
-/agent-note-claude-code-and-codex-subagent-backends/claude-code-provider:
- en: 81a92541d399b155
- zh: d73a1f20c34982bb
-/agent-note-claude-code-and-codex-subagent-backends/distribution-and-evidence:
- en: ff6d6216e5ce11dd
- zh: 6198c006ba8c61e7
-/agent-note-claude-code-and-codex-subagent-backends/alternatives-considered:
- en: 10b5b282fac03988
- zh: bf9fb4899f2c8e16
-/agent-note-claude-code-and-codex-subagent-backends/consequences:
- en: 4154bcdc7ad9ff7c
- zh: e2bc1f2010bb48a9
diff --git a/.agents/notes/implemented/feature/2026-08-05-agent-teams.i18n.yaml b/.agents/notes/implemented/feature/2026-08-05-agent-teams.i18n.yaml
index 1f9b21f587..a38c0852ba 100644
--- a/.agents/notes/implemented/feature/2026-08-05-agent-teams.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-08-05-agent-teams.i18n.yaml
@@ -9,8 +9,8 @@
en: bab62798c2dc07b4
zh: fe42c5abf9127d37
/agent-note-durable-agent-teams-over-continuable-children/decision:
- en: 58568b3a9b5f60d5
- zh: 02d67b6cb0736c0a
+ en: 95e7d723d6b00930
+ zh: d18fdf9b2bf69bdb
/agent-note-durable-agent-teams-over-continuable-children/profile-delegation:
en: 3a66308576f74247
zh: 3453f0bcce88033d
@@ -24,8 +24,8 @@
en: ab2ad55021eb34e0
zh: 2d1996df7a69201d
/agent-note-durable-agent-teams-over-continuable-children/shared-checkout-boundary:
- en: 3969de3b44e412c8
- zh: 12be5854816cb808
+ en: 34920da68b5763e0
+ zh: 7604392594e4b8a8
/agent-note-durable-agent-teams-over-continuable-children/web-projection:
en: e6348054f024725b
zh: 8740636e99940308
@@ -33,8 +33,8 @@
en: bb266fe7a97f0828
zh: 7c86c2d6d11ba02a
/agent-note-durable-agent-teams-over-continuable-children/testing:
- en: 151b462649212acf
- zh: 983c4bee7b71c1e3
+ en: 35ce199351d8b63d
+ zh: 332f0520e27e3309
/agent-note-durable-agent-teams-over-continuable-children/consequences:
en: c3740ae56809e537
zh: 76a1e77d14cb6f26
diff --git a/.agents/notes/implemented/feature/2026-08-05-agent-teams.md b/.agents/notes/implemented/feature/2026-08-05-agent-teams.md
index 6333e511ba..74556d041f 100644
--- a/.agents/notes/implemented/feature/2026-08-05-agent-teams.md
+++ b/.agents/notes/implemented/feature/2026-08-05-agent-teams.md
@@ -16,7 +16,7 @@ Agent Teams needs an explicit opt-in composition while its public contracts rema
Every ordinary runtime root is the implicit Lead of a Team identified by that root's `SessionId`. The Team has no creation event: its Lead pseudo-row exists by identity, while durable state begins with the first member, message, or task event. A roster is flat and contains at most the configured number of immutable lowercase-kebab-case names. Each teammate is a continuable direct child with a reserved Session id; only the Lead creates or interrupts teammates. Ordinary provider-owned subagents outside the roster are not Team members, and an ordinary fork is a new root whose inherited Team records are excluded by their ancestor `TeamId`.
-The implementation is split into `@deepseek-ai/dsh-experimental-agent-team`, which owns `ctx.agentTeams` and durable semantics, and `@deepseek-ai/dsh-experimental-tool-agent-team`, which owns scoped schemas and model guidance. Every Team tool declares its complete result schema and renders that value as compact JSON, so the compiler checks each `execute` against what the model is promised and no result spends tokens on indentation. Deployments mount both plugins explicitly and may disable legacy continuable controls with the same model-visible names. The explicit delegation policy permits Team creation only when the user asks for Agent Teams or teammates. Both packages are public members of `packages/experimental/`; the [experimental package decision](../architecture/2026-08-18-experimental-agent-teams-packages.md) owns publication, dependency isolation, and promotion.
+The implementation is split into `@deepseek-ai/dsh-experimental-agent-team`, which owns `ctx.agentTeams` and durable semantics, and `@deepseek-ai/dsh-experimental-tool-agent-team`, which owns scoped schemas and model guidance. Every Team tool declares its complete result schema and renders that value as compact JSON, so the compiler checks each `execute` against what the model is promised and no result spends tokens on indentation. Deployments mount both plugins explicitly and may disable legacy continuable controls with the same model-visible names. The explicit delegation policy permits Team creation only when the user asks for Agent Teams or teammates. Both packages are public members of `packages/experimental/`; the [experimental package reference](../../../../packages/experimental/AGENTS.md) owns publication, dependency isolation, and promotion.
The Lead must wait for required work before its final answer. Process teardown remains the final lifecycle owner and drains continuation Activations; a Team task owner is durable state and is not automatically released by idle, interruption, or process exit.
@@ -50,9 +50,9 @@ Shared tasks are complete snapshots with Team-local ids and monotonic revisions.
## Shared checkout boundary
-All members use the same cwd and observe writes immediately. The policy tells members to partition tasks, record advisory write scopes, order dependent work, and let the Lead inspect the final diff and run tests. A filesystem stale-version rejection requires rereading and rebasing the intended change. No equivalent guarantee is claimed for Bash, formatters, code generation, or direct external writes.
+Members start in the Lead’s current directory and observe shared filesystem writes immediately. Later directory changes stay local to each Session. The policy tells members to partition tasks, record advisory write scopes, order dependent work, and let the Lead inspect the final diff and run tests. A filesystem stale-version rejection requires rereading and rebasing the intended change. No equivalent guarantee is claimed for Bash, formatters, code generation, or direct external writes.
-Worktree isolation is not a harness runtime behavior. A deployment or prompt may arrange separate worktrees, but the Team domain does not infer branches, merge changes, or silently change cwd. This preserves the existing same-world subagent and sandbox contracts.
+The Team domain does not infer branches, create worktrees, merge changes, or silently change cwd. A deployment or caller can use [explicit worktree creation](2026-09-13-explicit-worktree-creation.md) separately. This preserves the existing same-world subagent and sandbox contracts.
## Web projection
@@ -82,7 +82,7 @@ Publication requires `apply` to return a new state object per applied Team event
Package tests cover identity, name and authority checks, provider selection, reserved-id persistence collisions, child-before-Lead flush ordering, durable provisioning failure and pending-inbox JSONL reconciliation, concurrent target-local ordering, pending/history de-duplication, mailbox limits, post-flush notification, bounded disposal with in-flight creation and dispatch cancellation, failed-member cleanup, task CAS and DAG validation, write-scope warnings, wait cancellation/timeout, inbox-preserving interruption, ordinary-fork isolation, legacy-control shadowing, compact declared-schema result rendering, and scoped registration HMR at per-file 100% coverage. A keyless product snapshot loads the Agent Teams profile bundle through `dsh --profile headless` and pins its complete model-visible tool list, Team policy, and durable workflow projection for two teammates, dependent tasks, peer delivery, waiting, completion, and aggregation. A CLI e2e reuses the same deterministic adapter and verifies normal process exit with persisted Team and child logs.
-Model-facing member identities and availability follow the [tool projection decision](../simplification/2026-09-15-model-agent-availability-and-team-targets.md); service residency and durable identity remain distinct.
+Model-facing member identities and availability follow the [tool projection reference](../../../../packages/experimental/tool-agent-team/README.md); service residency and durable identity remain distinct.
## Consequences
diff --git a/.agents/notes/implemented/feature/2026-08-05-agent-teams.zh.md b/.agents/notes/implemented/feature/2026-08-05-agent-teams.zh.md
index 3fed130214..d7c2bd7d7e 100644
--- a/.agents/notes/implemented/feature/2026-08-05-agent-teams.zh.md
+++ b/.agents/notes/implemented/feature/2026-08-05-agent-teams.zh.md
@@ -16,7 +16,7 @@ Agent Teams 的公开约定仍处于实验阶段，因此需要显式启用的
每个普通运行时 Root 都是一个隐式 Team 的 Lead，Team id 等于该 Root 的 `SessionId`。Team 没有 creation event：Lead pseudo-row 由身份直接存在，持久状态从第一条 member、message 或 task event 开始。roster 是扁平结构，最多包含配置数量、不可变且采用小写 kebab-case 的名字。每个 teammate 都是使用预留 Session id 的 continuable 直接 child；只有 Lead 可以创建或 interrupt teammate。roster 外由 provider 管理的普通 subagent 不是 Team member；普通 fork 是新的 Root，继承的 Team 记录会因 ancestor `TeamId` 被排除。
-实现拆分为 `@deepseek-ai/dsh-experimental-agent-team` 与 `@deepseek-ai/dsh-experimental-tool-agent-team`：前者负责 `ctx.agentTeams` 和持久语义，后者负责 scoped schema 与模型指引。每个 Team 工具都声明完整的结果 schema，并把该值渲染为紧凑 JSON，因此编译器会检查每个 `execute` 是否符合对模型的承诺，也没有结果把 token 花在缩进上。部署显式挂载两个插件，并可禁用具有相同模型可见名称的旧 continuable control。显式 delegation 策略只允许在用户要求 Agent Teams 或 teammate 时创建 Team。两个包都是 `packages/experimental/` 的公开成员；[实验性包决策](../architecture/2026-08-18-experimental-agent-teams-packages.zh.md)负责发布、依赖隔离与 promotion。
+实现拆分为 `@deepseek-ai/dsh-experimental-agent-team` 与 `@deepseek-ai/dsh-experimental-tool-agent-team`：前者负责 `ctx.agentTeams` 和持久语义，后者负责 scoped schema 与模型指引。每个 Team 工具都声明完整的结果 schema，并把该值渲染为紧凑 JSON，因此编译器会检查每个 `execute` 是否符合对模型的承诺，也没有结果把 token 花在缩进上。部署显式挂载两个插件，并可禁用具有相同模型可见名称的旧 continuable control。显式 delegation 策略只允许在用户要求 Agent Teams 或 teammate 时创建 Team。两个包都是 `packages/experimental/` 的公开成员；[实验性包参考](../../../../packages/experimental/AGENTS.md)负责发布、依赖隔离与 promotion。
Lead 必须等待所需工作后才能给出最终答案。进程 teardown 仍是最终生命周期 owner，并会 drain continuation Activation；Team task owner 是持久状态，不会因 idle、interrupt 或进程退出自动释放。
@@ -50,9 +50,9 @@ Peer 通讯使用 Lead 日志 mailbox。投递前先追加并 flush `team/messag
## Shared checkout boundary
-所有 member 使用相同 cwd，并立即观察写入。策略要求 member 切分任务、记录提示性 write scope、为有序工作添加依赖，并由 Lead 检查最终 diff 和运行测试。文件系统 stale-version 拒绝后必须重新读取并 rebase 修改意图。Bash、formatter、codegen 与直接外部写入不具备等价保证。
+所有 member 创建时使用 Lead 的当前目录，并立即观察共享文件系统写入。后续目录变更仅影响各自 Session。策略要求 member 切分任务、记录提示性 write scope、为有序工作添加依赖，并由 Lead 检查最终 diff 和运行测试。文件系统 stale-version 拒绝后必须重新读取并 rebase 修改意图。Bash、formatter、codegen 与直接外部写入不具备等价保证。
-Worktree isolation 不是 harness runtime 行为。deployment 或 prompt 可以安排独立 worktree，但 Team 领域不会推断 branch、merge 变更或静默改变 cwd。这样保留既有 same-world subagent 与 sandbox 契约。
+Team 领域不会推断 branch、创建 worktree、merge 变更或静默改变 cwd。deployment 或调用方可以另外使用[显式工作树创建](2026-09-13-explicit-worktree-creation.zh.md)。这样保留既有 same-world subagent 与 sandbox 契约。
## Web projection
@@ -82,7 +82,7 @@ Web panel 读取 Lead Session 的 `agentTeam` 传输投影，因为现有投影
Package test 以逐文件 100% coverage 覆盖身份、名字与权限检查、provider 选择、预留 id 持久化冲突、child-before-Lead flush 顺序、持久 provisioning 失败与 pending-inbox JSONL 对账、target-local 并发顺序、pending／history 去重、mailbox 限额、flush 后 notification、取消在途创建与 dispatch 的有界 dispose、failed member cleanup、task CAS 与 DAG 校验、write-scope warning、wait cancel／timeout、保留 inbox 的 interrupt、普通 fork 隔离、旧 control shadowing、声明 schema 的紧凑结果渲染与 scoped registration HMR。一条 keyless 产品快照会通过 `dsh --profile headless` 加载 Agent Teams profile bundle，并为两个 teammate、依赖任务、peer 投递、等待、完成和汇总固定完整的面向模型工具列表、Team policy 与持久 workflow 投影。CLI e2e 会复用同一个确定性 adapter，并验证带持久 Team 与 child 日志的正常退出。
-模型可见的成员身份与可用状态遵循[工具投影决策](../simplification/2026-09-15-model-agent-availability-and-team-targets.zh.md)；服务驻留状态和持久身份仍保持区分。
+模型可见的成员身份与可用状态遵循[工具投影说明](../../../../packages/experimental/tool-agent-team/README.zh.md)；服务驻留状态和持久身份仍保持区分。
## Consequences
diff --git a/.agents/notes/implemented/feature/2026-08-05-durable-web-schedule.i18n.yaml b/.agents/notes/implemented/feature/2026-08-05-durable-web-schedule.i18n.yaml
deleted file mode 100644
index 74f90930fc..0000000000
--- a/.agents/notes/implemented/feature/2026-08-05-durable-web-schedule.i18n.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-05-durable-web-schedule.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-05-durable-web-schedule.md
-/agent-note-durable-scheduled-reminders:
- en: 7d312bc635f68bef
- zh: f675a214bfe26dac
-/agent-note-durable-scheduled-reminders/problem:
- en: 85e09d88c1383aeb
- zh: 2d90fcbf2fe5ad3c
-/agent-note-durable-scheduled-reminders/decision:
- en: a15c7c13f167e5ac
- zh: 63bcc2ef60c2f344
-/agent-note-durable-scheduled-reminders/decision/explicit-absolute-time-boundary:
- en: 16cc539a319f99b4
- zh: ae06872529f2227d
-/agent-note-durable-scheduled-reminders/decision/bounded-fixed-rate-semantics:
- en: 4a12a91087629614
- zh: 4f23eee242eeadd3
-/agent-note-durable-scheduled-reminders/decision/queue-admission-is-not-completion:
- en: 1d88821105254303
- zh: 08982a1534d8fd18
-/agent-note-durable-scheduled-reminders/alternatives-considered:
- en: f6d44a87797410ca
- zh: 383ac9e712492c93
-/agent-note-durable-scheduled-reminders/verification:
- en: 113a6d381ff1b145
- zh: 59f9693741adbbab
-/agent-note-durable-scheduled-reminders/consequences:
- en: 2121b1640094e601
- zh: 9420468b80ff1155
diff --git a/.agents/notes/implemented/feature/2026-08-06-continuable-subagent-interrupt.i18n.yaml b/.agents/notes/implemented/feature/2026-08-06-continuable-subagent-interrupt.i18n.yaml
deleted file mode 100644
index 8862a5bc60..0000000000
--- a/.agents/notes/implemented/feature/2026-08-06-continuable-subagent-interrupt.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-06-continuable-subagent-interrupt.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-06-continuable-subagent-interrupt.md
-/agent-note-continuable-subagent-current-turn-interrupt:
- en: 0940bfeaf12caf8c
- zh: e6a1da625950371d
-/agent-note-continuable-subagent-current-turn-interrupt/problem:
- en: be2b1e9ef5bb2511
- zh: 36c7ee54c37c0700
-/agent-note-continuable-subagent-current-turn-interrupt/decision:
- en: db543685b2fd2f88
- zh: fcc848c04036253c
-/agent-note-continuable-subagent-current-turn-interrupt/alternatives-considered:
- en: e7e953783cc4a332
- zh: be5d47a503b47170
-/agent-note-continuable-subagent-current-turn-interrupt/consequences:
- en: 8e75516b07cdc842
- zh: 10e31033e14241e7
-/agent-note-continuable-subagent-current-turn-interrupt/testing:
- en: e46413bc89f9238e
- zh: 4fb1639ae696e9a4
diff --git a/.agents/notes/implemented/feature/2026-08-06-manager-owned-subagent-settlement-delivery.i18n.yaml b/.agents/notes/implemented/feature/2026-08-06-manager-owned-subagent-settlement-delivery.i18n.yaml
deleted file mode 100644
index c405aca74b..0000000000
--- a/.agents/notes/implemented/feature/2026-08-06-manager-owned-subagent-settlement-delivery.i18n.yaml
+++ /dev/null
@@ -1,43 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-06-manager-owned-subagent-settlement-delivery.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-06-manager-owned-subagent-settlement-delivery.md
-/agent-note-settlement-delivery-belongs-to-the-continuation-manager:
- en: e8e4fec15acfe5d4
- zh: 6dac0279cf244edc
-/agent-note-settlement-delivery-belongs-to-the-continuation-manager/problem:
- en: 325f283354af59f6
- zh: 059179e883da78c2
-/agent-note-settlement-delivery-belongs-to-the-continuation-manager/decision:
- en: 472a34f28ed5200a
- zh: 70dcbbd2e26dc32f
-/agent-note-settlement-delivery-belongs-to-the-continuation-manager/decision/closing-text:
- en: 229151705efda8a9
- zh: b4e94b52280a2076
-/agent-note-settlement-delivery-belongs-to-the-continuation-manager/decision/runtime-source:
- en: b2e4931dfb6c21b1
- zh: 9bf619cd5b697e68
-/agent-note-settlement-delivery-belongs-to-the-continuation-manager/decision/two-ordering-rules-and-why-the-manager-owns-them:
- en: 34fad866d5c6377b
- zh: e865e2cb70c3e00a
-/agent-note-settlement-delivery-belongs-to-the-continuation-manager/decision/establishment-holds-ownership-open:
- en: bcaf3f22ba44fa01
- zh: d7b0968990f41a66
-/agent-note-settlement-delivery-belongs-to-the-continuation-manager/decision/scheduling:
- en: 3d1862329727a379
- zh: 92fcf4ffd366ea30
-/agent-note-settlement-delivery-belongs-to-the-continuation-manager/decision/the-epoch-s-own-log-is-the-whole-account:
- en: f444a596a75f0180
- zh: ec9c0b61a38a3458
-/agent-note-settlement-delivery-belongs-to-the-continuation-manager/decision/snapshot-coverage:
- en: 9e50e4014df1d5b0
- zh: 1a111b53a149a21b
-/agent-note-settlement-delivery-belongs-to-the-continuation-manager/alternatives-considered:
- en: dd3073a05a8e13bd
- zh: e58debc18a591077
-/agent-note-settlement-delivery-belongs-to-the-continuation-manager/consequences:
- en: 10ebfbc70ff94e20
- zh: c32a335007de89d1
-/agent-note-settlement-delivery-belongs-to-the-continuation-manager/consequences/accepted-risks:
- en: 615cd09443411b4d
- zh: f74b5dcab43975d3
diff --git a/.agents/notes/implemented/feature/2026-08-08-web-background-job-display.i18n.yaml b/.agents/notes/implemented/feature/2026-08-08-web-background-job-display.i18n.yaml
deleted file mode 100644
index adc20bec51..0000000000
--- a/.agents/notes/implemented/feature/2026-08-08-web-background-job-display.i18n.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-08-web-background-job-display.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-08-web-background-job-display.md
-/agent-note-web-background-job-display:
- en: 78eff738bc5ed554
- zh: c8a8a83853fa806b
-/agent-note-web-background-job-display/problem:
- en: 41ddca92193cbbf1
- zh: ec8f39ad20044d1c
-/agent-note-web-background-job-display/decision:
- en: 50058c6557e05f15
- zh: bbf35bb475474cd8
-/agent-note-web-background-job-display/decision/wire-shape:
- en: 4d6b92cbfde80add
- zh: d32e0421100eeb71
-/agent-note-web-background-job-display/decision/the-task-registry-change-feed:
- en: a7a9416ab3b325dc
- zh: 448820bad0224785
-/agent-note-web-background-job-display/decision/the-session-controller-carrier:
- en: e9ef574e65e8fb7d
- zh: d1a6e446c48a0921
-/agent-note-web-background-job-display/decision/the-client-mirror:
- en: 6185994020e639ee
- zh: df9b464f95c0f3e2
-/agent-note-web-background-job-display/decision/the-header-action:
- en: 8985aa8f6ade32c3
- zh: 94ea0844ed8649b5
-/agent-note-web-background-job-display/decision/what-this-deliberately-does-not-do:
- en: c9ff2d1fec1459d9
- zh: b28a573ca9fbb1c2
-/agent-note-web-background-job-display/alternatives-considered:
- en: a648d1748674d866
- zh: 0f68b82476121c38
-/agent-note-web-background-job-display/testing:
- en: f41d5017ea4beabb
- zh: cb216dd1d802ebe2
-/agent-note-web-background-job-display/consequences:
- en: 5204e04c3ed02d53
- zh: 9eaa9b52b69be7b2
diff --git a/.agents/notes/implemented/feature/2026-08-08-windows-acl-restricted-token-sandbox.i18n.yaml b/.agents/notes/implemented/feature/2026-08-08-windows-acl-restricted-token-sandbox.i18n.yaml
index 89e9e156f9..98b9eecb42 100644
--- a/.agents/notes/implemented/feature/2026-08-08-windows-acl-restricted-token-sandbox.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-08-08-windows-acl-restricted-token-sandbox.i18n.yaml
@@ -6,8 +6,8 @@
en: cfc871213b6d8360
zh: 18ff96c2272fee09
/agent-note-windows-sandbox-rung-raw-acl-restricted-tokens-over-mxc-and-appcontainer/problem:
- en: 86e01a1c009ac595
- zh: 91844972d41dd6f9
+ en: f62d87b7623a9904
+ zh: 48bbb7c35298f96c
/agent-note-windows-sandbox-rung-raw-acl-restricted-tokens-over-mxc-and-appcontainer/decision:
en: 125dea7427047966
zh: 1e459b1106597695
@@ -30,8 +30,8 @@
en: e2c573d90c4ddeb9
zh: f0259213e1321722
/agent-note-windows-sandbox-rung-raw-acl-restricted-tokens-over-mxc-and-appcontainer/consequences:
- en: b9f3a7c6890707f1
- zh: c9a344b50732c296
+ en: dd43744417f207a5
+ zh: d7b4fee1e2d87b60
/agent-note-windows-sandbox-rung-raw-acl-restricted-tokens-over-mxc-and-appcontainer/testing:
en: b223cb2cf13193c9
zh: 61ddd0a0b99f8f56
diff --git a/.agents/notes/implemented/feature/2026-08-08-windows-acl-restricted-token-sandbox.md b/.agents/notes/implemented/feature/2026-08-08-windows-acl-restricted-token-sandbox.md
index c1cf8c7faf..a108e42626 100644
--- a/.agents/notes/implemented/feature/2026-08-08-windows-acl-restricted-token-sandbox.md
+++ b/.agents/notes/implemented/feature/2026-08-08-windows-acl-restricted-token-sandbox.md
@@ -6,7 +6,7 @@ English | [中文](2026-08-08-windows-acl-restricted-token-sandbox.zh.md)
## Problem
-The original [sandbox decision](2026-07-06-sandbox.md) left `PLATFORM_CHAINS.win32` empty, so shipped Windows profiles degraded to danger-full-access because no confining executor existed. The win32 rung must govern the two file-effect modes in the sandbox vocabulary — `read-only` (no explicit writable root) and `workspace-write` (writes under the workspace root plus a backend-defined temp area) — while reporting any effects its mechanism cannot govern; reads, network, and process visibility remain outside this vocabulary.
+The original [historical sandbox decision](../../archived/feature/2026-07-06-sandbox.md) left `PLATFORM_CHAINS.win32` empty, so shipped Windows profiles degraded to danger-full-access because no confining executor existed. The win32 rung must govern the two file-effect modes in the sandbox vocabulary — `read-only` (no explicit writable root) and `workspace-write` (writes under the workspace root plus a backend-defined temp area) — while reporting any effects its mechanism cannot govern; reads, network, and process visibility remain outside this vocabulary.
## Decision
@@ -40,7 +40,7 @@ The landstrip evaluation was rejected before implementation (not battle-tested;
## Consequences
-Bought: write-only confinement with no new OS floor (`CreateRestrictedToken` predates the mxc releases by two decades; mandatory integrity control predates it as well), reads/network/process visibility untouched exactly as the mode vocabulary requires, deletes confined through every authority Windows accepts and confined to the granted root that owns them, and fail-closed errors carrying the API name and exact Win32 code. Sessions share the intentionally standing workspace capability but not their revocable temp capabilities; restart residue cannot block or authorize a resumed session. Cost: enforcement is structurally partial because NTFS hard-link aliases cannot be path-confined by this token shape and because a Low-integrity token cannot open a file whose DACL carries another sandbox's AppContainer package SID, which makes a tree stamped by such a tool unreadable to the confined child; no read-side or network isolation; console isolation unavailable (children created with `CREATE_NO_WINDOW` or `CREATE_NEW_CONSOLE` die with `STATUS_DLL_INIT_FAILED`; [startup visibility](../bug-fix/2026-09-16-windows-subprocess-console-visibility.md) preserves console inheritance); standing workspace security-descriptor mutations (the reuse cache, plus inert residue when a workspace is renamed) and random temp litter after an unclean shutdown until OS hygiene reclaims it; EAGER full-tree workspace propagation (`SetNamedSecurityInfoW` walks every descendant immediately — tens of seconds on large workspaces), paid once per workspace per machine; CIM unavailable in both confined modes (Authenticated Users is absent, closing the C:\-root tree-creation escape); FAT-class non-ACL targets unverified rather than writable; NULL-DACL directories not identity-preserving under a grant/revoke round trip; read-only pwsh entering ConstrainedLanguage while workspace-write remains FullLanguage absent host policy; and named-pipe opens remaining denied, so libuv piped-stdio grandchildren fail with EPERM while inherited/ignored stdio and anonymous pipes work. The package README owns these operational limits.
+Bought: write-only confinement with no new OS floor (`CreateRestrictedToken` predates the mxc releases by two decades; mandatory integrity control predates it as well), reads/network/process visibility untouched exactly as the mode vocabulary requires, deletes confined through every authority Windows accepts and confined to the granted root that owns them, and fail-closed errors carrying the API name and exact Win32 code. Sessions share the intentionally standing workspace capability but not their revocable temp capabilities; restart residue cannot block or authorize a resumed session. Cost: enforcement is structurally partial because NTFS hard-link aliases cannot be path-confined by this token shape and because a Low-integrity token cannot open a file whose DACL carries another sandbox's AppContainer package SID, which makes a tree stamped by such a tool unreadable to the confined child; no read-side or network isolation; console isolation unavailable (children created with `CREATE_NO_WINDOW` or `CREATE_NEW_CONSOLE` die with `STATUS_DLL_INIT_FAILED`; [startup visibility](../../../../packages/subprocess/subprocess-local/README.md) preserves console inheritance); standing workspace security-descriptor mutations (the reuse cache, plus inert residue when a workspace is renamed) and random temp litter after an unclean shutdown until OS hygiene reclaims it; EAGER full-tree workspace propagation (`SetNamedSecurityInfoW` walks every descendant immediately — tens of seconds on large workspaces), paid once per workspace per machine; CIM unavailable in both confined modes (Authenticated Users is absent, closing the C:\-root tree-creation escape); FAT-class non-ACL targets unverified rather than writable; NULL-DACL directories not identity-preserving under a grant/revoke round trip; read-only pwsh entering ConstrainedLanguage while workspace-write remains FullLanguage absent host policy; and named-pipe opens remaining denied, so libuv piped-stdio grandchildren fail with EPERM while inherited/ignored stdio and anonymous pipes work. The package README owns these operational limits.
## Testing
diff --git a/.agents/notes/implemented/feature/2026-08-08-windows-acl-restricted-token-sandbox.zh.md b/.agents/notes/implemented/feature/2026-08-08-windows-acl-restricted-token-sandbox.zh.md
index c7ca1c3632..63d97f85a8 100644
--- a/.agents/notes/implemented/feature/2026-08-08-windows-acl-restricted-token-sandbox.zh.md
+++ b/.agents/notes/implemented/feature/2026-08-08-windows-acl-restricted-token-sandbox.zh.md
@@ -6,7 +6,7 @@ Status: implemented
## 问题
-最初的[沙箱决策](2026-07-06-sandbox.zh.md)将 `PLATFORM_CHAINS.win32` 留空，因此交付的 Windows profile 因不存在隔离执行器而退化为 danger-full-access。win32 档必须约束沙箱词汇表中的两种文件效果模式——`read-only`（不显式授予任何可写根目录）与 `workspace-write`（允许写入工作区根目录及后端定义的临时区域）——并报告其机制无法约束的任何效果；读取、网络与进程可见性仍在这套词汇之外。
+最初的[历史沙箱决策](../../archived/feature/2026-07-06-sandbox.md)将 `PLATFORM_CHAINS.win32` 留空，因此交付的 Windows profile 因不存在隔离执行器而退化为 danger-full-access。win32 档必须约束沙箱词汇表中的两种文件效果模式——`read-only`（不显式授予任何可写根目录）与 `workspace-write`（允许写入工作区根目录及后端定义的临时区域）——并报告其机制无法约束的任何效果；读取、网络与进程可见性仍在这套词汇之外。
## 决策
@@ -41,7 +41,7 @@ landstrip 评估在实现前已被否决（未经实战检验；自建 launcher
## 后果
-所得：仅写隔离、不引入新的 OS 版本下限（`CreateRestrictedToken` 比 mxc 的版本早二十年；强制完整性控制出现得更早）、读/网络/进程可见性完全不受影响（与模式词汇表一致）、删除在 Windows 接受的每条授权路径上都被约束且被约束在各自的授权根目录内，且 fail-closed 错误携带 API 名与精确 Win32 错误码。会话共享有意常驻的工作区能力，但不共享各自可回收的临时能力；重启残留既不能阻塞恢复的会话，也不能向其授权。所失：强制执行在结构上只能是部分的，因为此令牌形态无法把 NTFS 硬链接别名限制在路径边界内，而 Low 完整性的令牌也无法打开 DACL 中携带其他沙箱 AppContainer 包 SID 的文件——被这类工具标记过的目录树对受限子进程将不可读；无读侧或网络隔离；控制台隔离不可用（通过 `CREATE_NO_WINDOW` 或 `CREATE_NEW_CONSOLE` 创建的子进程以 `STATUS_DLL_INIT_FAILED` 死亡；[启动可见性](../bug-fix/2026-09-16-windows-subprocess-console-visibility.zh.md)保留控制台继承）；工作区常驻安全描述符改动（复用缓存，以及工作区改名后的失效残留）与异常关闭后遗留的随机临时目录垃圾，直到 OS 卫生机制将其回收；工作区授权采用急切的全树传播（`SetNamedSecurityInfoW` 立即遍历每个后代——大型工作区上耗时数十秒），每台机器每个工作区只付一次；CIM 在两种受限模式下均不可用（Authenticated Users 不存在，从而关闭 C:\-root 建树逃逸）；FAT 类无 ACL 目标的行为未经验证而非「仍可写」；NULL-DACL 目录在 grant/revoke 往返下不保持身份；read-only pwsh 会进入 ConstrainedLanguage，而在没有主机策略时 workspace-write 保持 FullLanguage；named pipe 打开仍被拒绝，因此 libuv 管道 stdio 的孙进程以 EPERM 失败，而继承/忽略的 stdio 与匿名管道可用。包 README 负责记录这些运行限制。
+所得：仅写隔离、不引入新的 OS 版本下限（`CreateRestrictedToken` 比 mxc 的版本早二十年；强制完整性控制出现得更早）、读/网络/进程可见性完全不受影响（与模式词汇表一致）、删除在 Windows 接受的每条授权路径上都被约束且被约束在各自的授权根目录内，且 fail-closed 错误携带 API 名与精确 Win32 错误码。会话共享有意常驻的工作区能力，但不共享各自可回收的临时能力；重启残留既不能阻塞恢复的会话，也不能向其授权。所失：强制执行在结构上只能是部分的，因为此令牌形态无法把 NTFS 硬链接别名限制在路径边界内，而 Low 完整性的令牌也无法打开 DACL 中携带其他沙箱 AppContainer 包 SID 的文件——被这类工具标记过的目录树对受限子进程将不可读；无读侧或网络隔离；控制台隔离不可用（通过 `CREATE_NO_WINDOW` 或 `CREATE_NEW_CONSOLE` 创建的子进程以 `STATUS_DLL_INIT_FAILED` 死亡；[启动可见性](../../../../packages/subprocess/subprocess-local/README.zh.md)保留控制台继承）；工作区常驻安全描述符改动（复用缓存，以及工作区改名后的失效残留）与异常关闭后遗留的随机临时目录垃圾，直到 OS 卫生机制将其回收；工作区授权采用急切的全树传播（`SetNamedSecurityInfoW` 立即遍历每个后代——大型工作区上耗时数十秒），每台机器每个工作区只付一次；CIM 在两种受限模式下均不可用（Authenticated Users 不存在，从而关闭 C:\-root 建树逃逸）；FAT 类无 ACL 目标的行为未经验证而非「仍可写」；NULL-DACL 目录在 grant/revoke 往返下不保持身份；read-only pwsh 会进入 ConstrainedLanguage，而在没有主机策略时 workspace-write 保持 FullLanguage；named pipe 打开仍被拒绝，因此 libuv 管道 stdio 的孙进程以 EPERM 失败，而继承/忽略的 stdio 与匿名管道可用。包 README 负责记录这些运行限制。
## 测试
diff --git a/.agents/notes/implemented/feature/2026-08-10-subagent-approval-pinned-never.i18n.yaml b/.agents/notes/implemented/feature/2026-08-10-subagent-approval-pinned-never.i18n.yaml
deleted file mode 100644
index 0841a07056..0000000000
--- a/.agents/notes/implemented/feature/2026-08-10-subagent-approval-pinned-never.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-10-subagent-approval-pinned-never.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-10-subagent-approval-pinned-never.md
-/agent-note-delegated-subagents-run-with-approvals-pinned-to-never:
- en: f38cf8f2c67fc976
- zh: a4b357a3452383c3
-/agent-note-delegated-subagents-run-with-approvals-pinned-to-never/problem:
- en: fa1add8bd8bb3733
- zh: 35ac0951e676acaf
-/agent-note-delegated-subagents-run-with-approvals-pinned-to-never/decision:
- en: 2d2e42923663abc7
- zh: 5728346e7c5ea291
-/agent-note-delegated-subagents-run-with-approvals-pinned-to-never/alternatives-considered:
- en: 32fe1eb5bd7cd5ab
- zh: ea437edee4fbc1c6
-/agent-note-delegated-subagents-run-with-approvals-pinned-to-never/consequences:
- en: 4503eecfc7f17fed
- zh: 1f201ba769ec0354
diff --git a/.agents/notes/implemented/feature/2026-08-11-background-job-completion-wakes-an-idle-owner.i18n.yaml b/.agents/notes/implemented/feature/2026-08-11-background-job-completion-wakes-an-idle-owner.i18n.yaml
deleted file mode 100644
index 562d31b711..0000000000
--- a/.agents/notes/implemented/feature/2026-08-11-background-job-completion-wakes-an-idle-owner.i18n.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-11-background-job-completion-wakes-an-idle-owner.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-11-background-job-completion-wakes-an-idle-owner.md
-/agent-note-background-job-completion-wakes-an-idle-owner:
- en: b761777a02303d0e
- zh: a65eb415e75bcac5
-/agent-note-background-job-completion-wakes-an-idle-owner/problem:
- en: da112fe20077acdf
- zh: b0e3e099c3aacde5
-/agent-note-background-job-completion-wakes-an-idle-owner/decision:
- en: c5d7901d87803d0c
- zh: 8a1e473e88f3e400
-/agent-note-background-job-completion-wakes-an-idle-owner/decision/the-busy-owner-keeps-injection:
- en: 841588bc73fc4613
- zh: 7fb4095bd55ee241
-/agent-note-background-job-completion-wakes-an-idle-owner/decision/the-cap-on-consecutive-wakes-is-opt-in-and-it-is-not-time:
- en: fa9f572f763bc6b0
- zh: f3924fa49d2be22d
-/agent-note-background-job-completion-wakes-an-idle-owner/decision/teardown-claims-the-report:
- en: f79257596c755a32
- zh: 856bf42492425f9c
-/agent-note-background-job-completion-wakes-an-idle-owner/decision/completion-is-announced-last:
- en: 9cab013b3513f1e0
- zh: 78ea1b05df94d8a8
-/agent-note-background-job-completion-wakes-an-idle-owner/alternatives-considered:
- en: debb2c9b924474c3
- zh: 90e2cefc230e3ec8
-/agent-note-background-job-completion-wakes-an-idle-owner/consequences:
- en: a2a6f76c8cc92d57
- zh: 6eed3e6a5c75dfb9
-/agent-note-background-job-completion-wakes-an-idle-owner/consequences/accepted-risks:
- en: 2141374aa4f79a2b
- zh: acff1b68abf2db7e
diff --git a/.agents/notes/implemented/feature/2026-08-11-deepseek-request-user-id-header.i18n.yaml b/.agents/notes/implemented/feature/2026-08-11-deepseek-request-user-id-header.i18n.yaml
deleted file mode 100644
index 8f60e2293e..0000000000
--- a/.agents/notes/implemented/feature/2026-08-11-deepseek-request-user-id-header.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-11-deepseek-request-user-id-header.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-11-deepseek-request-user-id-header.md
-/agent-note-deepseek-request-user-and-session-identity-headers:
- en: 6888d1c6a57a6839
- zh: e3817ccbcd782a44
-/agent-note-deepseek-request-user-and-session-identity-headers/problem:
- en: fdeb3bc22bab88c0
- zh: 089ea4713776fb7a
-/agent-note-deepseek-request-user-and-session-identity-headers/decision:
- en: b168d3c975d191aa
- zh: fdd92a1a92f87537
-/agent-note-deepseek-request-user-and-session-identity-headers/verification:
- en: 3984cb1cb953605e
- zh: 59e06d6eac8070d7
-/agent-note-deepseek-request-user-and-session-identity-headers/alternatives-considered:
- en: 2233f9f6a934a48f
- zh: c73d1db971239742
-/agent-note-deepseek-request-user-and-session-identity-headers/consequences:
- en: 1621a8eab7787622
- zh: 636cf922cf76d2bc
diff --git a/.agents/notes/implemented/feature/2026-08-11-minimal-profiles-bare-two-tool-runtime.i18n.yaml b/.agents/notes/implemented/feature/2026-08-11-minimal-profiles-bare-two-tool-runtime.i18n.yaml
deleted file mode 100644
index 13d32374f6..0000000000
--- a/.agents/notes/implemented/feature/2026-08-11-minimal-profiles-bare-two-tool-runtime.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-11-minimal-profiles-bare-two-tool-runtime.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-11-minimal-profiles-bare-two-tool-runtime.md
-/agent-note-minimal-profiles-use-a-bare-runtime:
- en: b086c2a8d0fca111
- zh: 3c81b90a2818e7ff
-/agent-note-minimal-profiles-use-a-bare-runtime/problem:
- en: 725fe45436a65f26
- zh: 97f96497173bec4f
-/agent-note-minimal-profiles-use-a-bare-runtime/decision:
- en: ef9aa81743b6bc46
- zh: 86bcf7e3a7e34f4b
-/agent-note-minimal-profiles-use-a-bare-runtime/verification:
- en: c9d0b2145e4c1271
- zh: 186919163b20379c
-/agent-note-minimal-profiles-use-a-bare-runtime/alternatives-considered:
- en: 35b3346928cb6c3f
- zh: 6e60d1073b5a95e3
-/agent-note-minimal-profiles-use-a-bare-runtime/consequences:
- en: 462abbbe168de14c
- zh: 13f9e257a5f18984
diff --git a/.agents/notes/implemented/feature/2026-08-15-product-subagent-noninteractive-permissions.i18n.yaml b/.agents/notes/implemented/feature/2026-08-15-product-subagent-noninteractive-permissions.i18n.yaml
index c0058f198d..1f5c66710f 100644
--- a/.agents/notes/implemented/feature/2026-08-15-product-subagent-noninteractive-permissions.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-08-15-product-subagent-noninteractive-permissions.i18n.yaml
@@ -6,8 +6,8 @@
en: feb20636c72ade23
zh: fd2e9f192a3fa527
/agent-note-product-subagents-use-profile-selected-non-interactive-permissions/problem:
- en: 905b54b06f35015a
- zh: b0b3a79e9f92b33d
+ en: 04481e9087fdfca0
+ zh: 33071e25054460c5
/agent-note-product-subagents-use-profile-selected-non-interactive-permissions/decision:
en: a4635e16af21d478
zh: 6cd59ad7e2bb9885
diff --git a/.agents/notes/implemented/feature/2026-08-15-product-subagent-noninteractive-permissions.md b/.agents/notes/implemented/feature/2026-08-15-product-subagent-noninteractive-permissions.md
index 1ec45f9ada..af302dacc9 100644
--- a/.agents/notes/implemented/feature/2026-08-15-product-subagent-noninteractive-permissions.md
+++ b/.agents/notes/implemented/feature/2026-08-15-product-subagent-noninteractive-permissions.md
@@ -6,9 +6,9 @@ English | [中文](2026-08-15-product-subagent-noninteractive-permissions.zh.md)
## Problem
-The [Claude Code and Codex product providers](2026-08-04-claude-code-and-codex-subagent-backends.md) run without a human interface. Native permission prompts, user dialogs, or MCP elicitation therefore cannot wait for a person, but relying on either product's ambient default can still select an interactive mode. A deployment also needs to choose broader native modes without giving the parent model or one tool call a way to raise its own authority.
+The [Claude Code and Codex product providers](../../../../packages/subagent/subagent-codex/README.md) run without a human interface. Native permission prompts, user dialogs, or MCP elicitation therefore cannot wait for a person, but relying on either product's ambient default can still select an interactive mode. A deployment also needs to choose broader native modes without giving the parent model or one tool call a way to raise its own authority.
-A failed product run previously reached the [subagent seam](2026-06-21-subagent-capability-seam.md) only as a stop reason. Logs could retain the product error, but the foreground parent and a [one-shot background Job](../../archived/feature/2026-08-12-product-subagent-one-shot-background-tasks.md) could not distinguish a permission refusal from another failure. Reusing assistant output for that fact would misattribute infrastructure detail to the child model.
+A failed product run previously reached the [subagent seam](../../../../packages/subagent/subagent/README.md) only as a stop reason. Logs could retain the product error, but the foreground parent and a [one-shot background Job](../../archived/feature/2026-08-12-product-subagent-one-shot-background-tasks.md) could not distinguish a permission refusal from another failure. Reusing assistant output for that fact would misattribute infrastructure detail to the child model.
## Decision
diff --git a/.agents/notes/implemented/feature/2026-08-15-product-subagent-noninteractive-permissions.zh.md b/.agents/notes/implemented/feature/2026-08-15-product-subagent-noninteractive-permissions.zh.md
index 80e99d9ee4..8e5065e640 100644
--- a/.agents/notes/implemented/feature/2026-08-15-product-subagent-noninteractive-permissions.zh.md
+++ b/.agents/notes/implemented/feature/2026-08-15-product-subagent-noninteractive-permissions.zh.md
@@ -6,9 +6,9 @@ Status: implemented
## Problem
-[Claude Code 与 Codex 产品提供方](2026-08-04-claude-code-and-codex-subagent-backends.zh.md)都在没有人工界面的情况下运行。因此，原生权限提示、用户对话或 MCP elicitation 不能等待人员响应，但依赖任一产品环境中的默认值仍可能选择交互模式。部署也需要选择更宽松的原生模式，同时不能让父模型或单次工具调用提升自身权限。
+[Claude Code 与 Codex 产品提供方](../../../../packages/subagent/subagent-codex/README.zh.md)都在没有人工界面的情况下运行。因此，原生权限提示、用户对话或 MCP elicitation 不能等待人员响应，但依赖任一产品环境中的默认值仍可能选择交互模式。部署也需要选择更宽松的原生模式，同时不能让父模型或单次工具调用提升自身权限。
-失败的产品运行此前只能把终止原因送入 [subagent seam](2026-06-21-subagent-capability-seam.zh.md)。日志可以保留产品错误，但前台父 agent 与[一次性后台 Job](../../archived/feature/2026-08-12-product-subagent-one-shot-background-tasks.md)无法区分权限拒绝和其他失败。若复用 assistant 输出承载该事实，则会把基础设施说明错误归因给子模型。
+失败的产品运行此前只能把终止原因送入 [subagent seam](../../../../packages/subagent/subagent/README.zh.md)。日志可以保留产品错误，但前台父 agent 与[一次性后台 Job](../../archived/feature/2026-08-12-product-subagent-one-shot-background-tasks.md)无法区分权限拒绝和其他失败。若复用 assistant 输出承载该事实，则会把基础设施说明错误归因给子模型。
## Decision
diff --git a/.agents/notes/implemented/feature/2026-08-18-arbitrary-seq-session-fork.i18n.yaml b/.agents/notes/implemented/feature/2026-08-18-arbitrary-seq-session-fork.i18n.yaml
deleted file mode 100644
index 167308d649..0000000000
--- a/.agents/notes/implemented/feature/2026-08-18-arbitrary-seq-session-fork.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-18-arbitrary-seq-session-fork.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-18-arbitrary-seq-session-fork.md
-/agent-note-exact-event-session-forks-with-shared-crash-repair:
- en: f75e952184cae150
- zh: 32c2519c85aa6822
-/agent-note-exact-event-session-forks-with-shared-crash-repair/problem:
- en: e01b73d9d4b50c50
- zh: 14f7816869b76241
-/agent-note-exact-event-session-forks-with-shared-crash-repair/decision:
- en: 0b7afc12950ce308
- zh: 384d26f698a344a7
-/agent-note-exact-event-session-forks-with-shared-crash-repair/alternatives-considered:
- en: 49544ba70825c8e9
- zh: 41c7dceb9241fc5a
-/agent-note-exact-event-session-forks-with-shared-crash-repair/consequences:
- en: a829fc736a132d89
- zh: 03b116766bd44d64
-/agent-note-exact-event-session-forks-with-shared-crash-repair/testing:
- en: f15e826fa12a4f55
- zh: fe053fa01304e072
diff --git a/.agents/notes/implemented/feature/2026-08-18-model-selected-subagent-routes.i18n.yaml b/.agents/notes/implemented/feature/2026-08-18-model-selected-subagent-routes.i18n.yaml
deleted file mode 100644
index 2095b6be29..0000000000
--- a/.agents/notes/implemented/feature/2026-08-18-model-selected-subagent-routes.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-18-model-selected-subagent-routes.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-18-model-selected-subagent-routes.md
-/agent-note-model-selected-subagent-routes:
- en: 1e719fd754836549
- zh: 603cce7a5f9ec6bd
-/agent-note-model-selected-subagent-routes/problem:
- en: f4010276228f4441
- zh: 50ac98640dbf519a
-/agent-note-model-selected-subagent-routes/decision:
- en: 39836773d1830515
- zh: 537c96bfa93573e7
-/agent-note-model-selected-subagent-routes/alternatives-considered:
- en: 3b9fd91294fbfd27
- zh: 2854dd690ead3d15
-/agent-note-model-selected-subagent-routes/consequences:
- en: 55969d3742da39ce
- zh: a248167f9bb2fa4e
-/agent-note-model-selected-subagent-routes/related-decisions:
- en: 28c4eb2e90488ff0
- zh: ba59bb2fafdd4720
diff --git a/.agents/notes/implemented/feature/2026-08-20-unified-image-request-pipeline.i18n.yaml b/.agents/notes/implemented/feature/2026-08-20-unified-image-request-pipeline.i18n.yaml
deleted file mode 100644
index 6e1c636324..0000000000
--- a/.agents/notes/implemented/feature/2026-08-20-unified-image-request-pipeline.i18n.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-20-unified-image-request-pipeline.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-20-unified-image-request-pipeline.md
-/agent-note-unified-normalized-attachments-request-versions-and-provider-files:
- en: 79d1a6f50ac76c3d
- zh: 9af0070009537602
-/agent-note-unified-normalized-attachments-request-versions-and-provider-files/problem:
- en: 7ce3a351a1492dd0
- zh: 7c7e3bb6799822f8
-/agent-note-unified-normalized-attachments-request-versions-and-provider-files/decision:
- en: 98e7aad889f5b79c
- zh: 84b24f6fd9209fcf
-/agent-note-unified-normalized-attachments-request-versions-and-provider-files/decision/provider-independent-normalized-attachment:
- en: 75b1d3732f3a9d05
- zh: c8683df3c6f0c989
-/agent-note-unified-normalized-attachments-request-versions-and-provider-files/decision/deterministic-request-versions:
- en: 8afa51d02643bd40
- zh: d27d9a5b09fc6d74
-/agent-note-unified-normalized-attachments-request-versions-and-provider-files/decision/stable-handles:
- en: 1b204c138b0d8e6c
- zh: 3d6a2e82372e6825
-/agent-note-unified-normalized-attachments-request-versions-and-provider-files/decision/deepseek-files-lifecycle:
- en: b35a18963d122b21
- zh: faa21c45cef3555a
-/agent-note-unified-normalized-attachments-request-versions-and-provider-files/decision/diagnostics:
- en: e4c79434bedfc385
- zh: 9e7de1061629ef5e
-/agent-note-unified-normalized-attachments-request-versions-and-provider-files/alternatives-considered:
- en: 7bfd39c761549b85
- zh: 6ac48c5842f7df91
-/agent-note-unified-normalized-attachments-request-versions-and-provider-files/verification:
- en: 7697f72ce5a7d969
- zh: 733ca1e0a05ae4ed
-/agent-note-unified-normalized-attachments-request-versions-and-provider-files/consequences:
- en: 1a6ef14a3e13b502
- zh: bc4ab273755b2739
diff --git a/.agents/notes/implemented/feature/2026-08-22-fire-and-forget-webhook-sessions.i18n.yaml b/.agents/notes/implemented/feature/2026-08-22-fire-and-forget-webhook-sessions.i18n.yaml
deleted file mode 100644
index 99cd729035..0000000000
--- a/.agents/notes/implemented/feature/2026-08-22-fire-and-forget-webhook-sessions.i18n.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-22-fire-and-forget-webhook-sessions.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-22-fire-and-forget-webhook-sessions.md
-/agent-note-fire-and-forget-webhook-sessions:
- en: adb18c2b0d575306
- zh: 2605913ffe5bafaa
-/agent-note-fire-and-forget-webhook-sessions/problem:
- en: 394e062b7e8f31a0
- zh: bcb26075cf62115c
-/agent-note-fire-and-forget-webhook-sessions/decision:
- en: 08ff83adfec1a7da
- zh: 871b9998631f22ac
-/agent-note-fire-and-forget-webhook-sessions/provider-adapters:
- en: 8eb2865f18fcf018
- zh: 1b73dfd634a8c07a
-/agent-note-fire-and-forget-webhook-sessions/session-creation:
- en: fbc57974dd81bf5a
- zh: 1a4810df6b7a776f
-/agent-note-fire-and-forget-webhook-sessions/alternatives-considered:
- en: 59634068f7c22476
- zh: 844472f7a5e9de91
-/agent-note-fire-and-forget-webhook-sessions/verification:
- en: e2a3192fc68b1ade
- zh: 63c2b07bf5f32696
-/agent-note-fire-and-forget-webhook-sessions/consequences:
- en: 8b40a7c91834a281
- zh: 882125d8070d77c1
diff --git a/.agents/notes/implemented/feature/2026-08-22-standard-acp-automation-controls.i18n.yaml b/.agents/notes/implemented/feature/2026-08-22-standard-acp-automation-controls.i18n.yaml
deleted file mode 100644
index b6b5b90bc1..0000000000
--- a/.agents/notes/implemented/feature/2026-08-22-standard-acp-automation-controls.i18n.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-22-standard-acp-automation-controls.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-22-standard-acp-automation-controls.md
-/agent-note-standard-acp-v1-automation-controls:
- en: e6a4b457afbf12ac
- zh: b1d83f4892e05f99
-/agent-note-standard-acp-v1-automation-controls/problem:
- en: ba88135e9528b4c7
- zh: 8bc1be92b1f5178e
-/agent-note-standard-acp-v1-automation-controls/decision:
- en: 0a2b2a83aca7d189
- zh: 8de789db33953283
-/agent-note-standard-acp-v1-automation-controls/per-session-ownership:
- en: 5b98c5e68eccfe76
- zh: c22dc47ad8003f22
-/agent-note-standard-acp-v1-automation-controls/persistent-session-controls:
- en: 122752f1cb116417
- zh: 96971bcc1fed4a8a
-/agent-note-standard-acp-v1-automation-controls/standard-configuration-options:
- en: 61cb15891965c67a
- zh: a0a958094b60951f
-/agent-note-standard-acp-v1-automation-controls/standard-mcp-mapping:
- en: 57acbe1c89af4c6b
- zh: 3417e3d4b1874d94
-/agent-note-standard-acp-v1-automation-controls/semantic-update-projection:
- en: 8e5128cd34629af3
- zh: 6132e78ddf9b3cf9
-/agent-note-standard-acp-v1-automation-controls/alternatives-considered:
- en: fc94c87f43787d95
- zh: 17850ecc35e6ab9d
-/agent-note-standard-acp-v1-automation-controls/verification:
- en: 08e2b98606d9d362
- zh: 99d6aef7c89e287f
-/agent-note-standard-acp-v1-automation-controls/consequences:
- en: 9f839d4720f07d28
- zh: 5164ae3eb5b52385
diff --git a/.agents/notes/implemented/feature/2026-08-24-activity-observation-seam.i18n.yaml b/.agents/notes/implemented/feature/2026-08-24-activity-observation-seam.i18n.yaml
deleted file mode 100644
index d5220cd2f4..0000000000
--- a/.agents/notes/implemented/feature/2026-08-24-activity-observation-seam.i18n.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-24-activity-observation-seam.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-24-activity-observation-seam.md
-/agent-note-the-activity-observation-seam-ctx-activities-and-live-output-streaming-to-the-web-client:
- en: 7fe6230c2327e0b5
- zh: 13a07f7926f6861c
-/agent-note-the-activity-observation-seam-ctx-activities-and-live-output-streaming-to-the-web-client/problem:
- en: 8b50b64ed5a852bd
- zh: 21d651e0109dc641
-/agent-note-the-activity-observation-seam-ctx-activities-and-live-output-streaming-to-the-web-client/decision:
- en: 88b51276287344bd
- zh: 0827faa6c822e4a5
-/agent-note-the-activity-observation-seam-ctx-activities-and-live-output-streaming-to-the-web-client/decision/why-not-durable-session-events-the-control-stream-or-the-jobs-seam:
- en: 58d884216caa6d85
- zh: aa47eb76bdb1ece0
-/agent-note-the-activity-observation-seam-ctx-activities-and-live-output-streaming-to-the-web-client/decision/two-cursor-regimes-kept-separate:
- en: 7ab433f08fa6140a
- zh: d001a90815b0156b
-/agent-note-the-activity-observation-seam-ctx-activities-and-live-output-streaming-to-the-web-client/alternatives-considered:
- en: 4462632fd94010c1
- zh: 01d1285f2ac6e42c
-/agent-note-the-activity-observation-seam-ctx-activities-and-live-output-streaming-to-the-web-client/testing:
- en: 26687866bbf7be90
- zh: 32dea8052bd5465b
-/agent-note-the-activity-observation-seam-ctx-activities-and-live-output-streaming-to-the-web-client/consequences:
- en: e975f4f2410e8619
- zh: 42f16406950a4d6f
diff --git a/.agents/notes/implemented/feature/2026-08-24-user-authorized-subagent-model-routes.i18n.yaml b/.agents/notes/implemented/feature/2026-08-24-user-authorized-subagent-model-routes.i18n.yaml
index 75bb4b5177..d4f615792e 100644
--- a/.agents/notes/implemented/feature/2026-08-24-user-authorized-subagent-model-routes.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-08-24-user-authorized-subagent-model-routes.i18n.yaml
@@ -18,5 +18,5 @@
en: f1927d31ffc1dee9
zh: b0fed04b80043c71
/agent-note-user-authorized-subagent-model-routes/related-decisions:
- en: 0b54fad7171103ec
- zh: 8cf1d007a42fb991
+ en: 595a9485d91592c6
+ zh: 7b32611ea380498c
diff --git a/.agents/notes/implemented/feature/2026-08-24-user-authorized-subagent-model-routes.md b/.agents/notes/implemented/feature/2026-08-24-user-authorized-subagent-model-routes.md
index ef6f90d2cc..e7f3b4fcae 100644
--- a/.agents/notes/implemented/feature/2026-08-24-user-authorized-subagent-model-routes.md
+++ b/.agents/notes/implemented/feature/2026-08-24-user-authorized-subagent-model-routes.md
@@ -40,4 +40,4 @@ Model selection has no unrestricted static mode. The default-off Host setting is
## Related decisions
-The route arguments, adapter preflight, discovery tool, and fork cache restriction remain owned by [model-selected subagent routes](2026-08-18-model-selected-subagent-routes.md).
+The route arguments, adapter preflight, discovery tool, and fork cache restriction remain owned by [model-selected subagent routes](../../../../packages/subagent/tool-subagent/README.md).
diff --git a/.agents/notes/implemented/feature/2026-08-24-user-authorized-subagent-model-routes.zh.md b/.agents/notes/implemented/feature/2026-08-24-user-authorized-subagent-model-routes.zh.md
index 23519bfc66..f55f60de1b 100644
--- a/.agents/notes/implemented/feature/2026-08-24-user-authorized-subagent-model-routes.zh.md
+++ b/.agents/notes/implemented/feature/2026-08-24-user-authorized-subagent-model-routes.zh.md
@@ -40,4 +40,4 @@ Host 自有的 `subagent-model-selection` 设置 section 保存显式 `enabled`
## Related decisions
-路由参数、适配器预检、发现工具与 fork 缓存限制仍由[模型选择的 subagent 路由](2026-08-18-model-selected-subagent-routes.zh.md)负责。
+路由参数、适配器预检、发现工具与 fork 缓存限制仍由[模型选择的 subagent 路由](../../../../packages/subagent/tool-subagent/README.zh.md)负责。
diff --git a/.agents/notes/implemented/feature/2026-08-25-feedback-gated-telemetry-default.i18n.yaml b/.agents/notes/implemented/feature/2026-08-25-feedback-gated-telemetry-default.i18n.yaml
deleted file mode 100644
index ee45f9f6ea..0000000000
--- a/.agents/notes/implemented/feature/2026-08-25-feedback-gated-telemetry-default.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-25-feedback-gated-telemetry-default.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-25-feedback-gated-telemetry-default.md
-/agent-note-feedback-gated-session-telemetry-default:
- en: 213a794503e0d7bc
- zh: e086babdf2ad52c9
-/agent-note-feedback-gated-session-telemetry-default/problem:
- en: 46b3efd996067d48
- zh: fc59ee763b07987e
-/agent-note-feedback-gated-session-telemetry-default/decision:
- en: 4136623e5589a592
- zh: db7bc5e9e6ebc19f
-/agent-note-feedback-gated-session-telemetry-default/alternatives-considered:
- en: 14b51f0de8771943
- zh: 616afb4097857368
-/agent-note-feedback-gated-session-telemetry-default/consequences:
- en: d3ed844cc1e29b0b
- zh: 76838815edb0a450
diff --git a/.agents/notes/implemented/feature/2026-08-25-promote-open-anywhere-plugin.i18n.yaml b/.agents/notes/implemented/feature/2026-08-25-promote-open-anywhere-plugin.i18n.yaml
deleted file mode 100644
index 9c2732ed18..0000000000
--- a/.agents/notes/implemented/feature/2026-08-25-promote-open-anywhere-plugin.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-25-promote-open-anywhere-plugin.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-25-promote-open-anywhere-plugin.md
-/agent-note-promote-open-anywhere-from-community-plugin-to-first-party-package:
- en: 279cf946b4f6c386
- zh: cf76602956b811de
-/agent-note-promote-open-anywhere-from-community-plugin-to-first-party-package/problem:
- en: 08d8d5454fdc2e75
- zh: 22381ce00cb51148
-/agent-note-promote-open-anywhere-from-community-plugin-to-first-party-package/decision:
- en: 26a46d3b6f21288a
- zh: 94c32f789b3e28ac
-/agent-note-promote-open-anywhere-from-community-plugin-to-first-party-package/alternatives-considered:
- en: cc7c2ed172e4de3f
- zh: b8fed28d9ee835c5
-/agent-note-promote-open-anywhere-from-community-plugin-to-first-party-package/consequences:
- en: 5be6b2891e3429c9
- zh: 68ffcff52676824f
diff --git a/.agents/notes/implemented/feature/2026-08-26-generic-file-upload.i18n.yaml b/.agents/notes/implemented/feature/2026-08-26-generic-file-upload.i18n.yaml
index 49360cffec..496d2e8136 100644
--- a/.agents/notes/implemented/feature/2026-08-26-generic-file-upload.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-08-26-generic-file-upload.i18n.yaml
@@ -21,5 +21,5 @@
en: 3a50ac370d51cda9
zh: d490f58922f8795b
/agent-note-generic-file-upload/related:
- en: f7e186f0decb4e79
- zh: e5bc9fbd24b6d626
+ en: 7579c49eefdb8488
+ zh: 68ad384fd9d2f8f9
diff --git a/.agents/notes/implemented/feature/2026-08-26-generic-file-upload.md b/.agents/notes/implemented/feature/2026-08-26-generic-file-upload.md
index 196d048da9..f60649a083 100644
--- a/.agents/notes/implemented/feature/2026-08-26-generic-file-upload.md
+++ b/.agents/notes/implemented/feature/2026-08-26-generic-file-upload.md
@@ -51,6 +51,6 @@ Unit and integration coverage pins verbatim and streamed storage, name sanitizat
## Related
-The [Trajectory attachment presentation decision](../bug-fix/2026-09-15-trajectory-attachment-presentation.md) owns ledger counts and inspector attachment layouts.
+The [Trajectory reference](../../../../packages/client/ui-trajectory/README.md) documents ledger counts and inspector attachment layouts.
-The [input echo admission decision](../bug-fix/2026-09-22-input-echo-admission-ownership.md) owns placement-specific retirement and delayed Inbox suppression for submissions with or without attachments.
+The [input echo admission reference](../../../../packages/api/session-controller/README.md) owns placement-specific retirement and delayed Inbox suppression for submissions with or without attachments.
diff --git a/.agents/notes/implemented/feature/2026-08-26-generic-file-upload.zh.md b/.agents/notes/implemented/feature/2026-08-26-generic-file-upload.zh.md
index fce7cef76c..3d1667d181 100644
--- a/.agents/notes/implemented/feature/2026-08-26-generic-file-upload.zh.md
+++ b/.agents/notes/implemented/feature/2026-08-26-generic-file-upload.zh.md
@@ -51,6 +51,6 @@ Status: implemented
## 相关记录
-[Trajectory 附件展示决定](../bug-fix/2026-09-15-trajectory-attachment-presentation.zh.md)负责列表计数与详情面板附件布局。
+[Trajectory 参考](../../../../packages/client/ui-trajectory/README.zh.md)说明列表计数与详情面板附件布局。
-[输入回显入档决策](../bug-fix/2026-09-22-input-echo-admission-ownership.zh.md)负责有无附件提交的按展示归属回收和迟到 Inbox 排除。
+[输入回显入档参考](../../../../packages/api/session-controller/README.zh.md)负责有无附件提交的按展示归属回收和迟到 Inbox 排除。
diff --git a/.agents/notes/implemented/feature/2026-08-26-human-job-kill.i18n.yaml b/.agents/notes/implemented/feature/2026-08-26-human-job-kill.i18n.yaml
deleted file mode 100644
index 787b132459..0000000000
--- a/.agents/notes/implemented/feature/2026-08-26-human-job-kill.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-26-human-job-kill.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-26-human-job-kill.md
-/agent-note-human-job-kill-an-unclaimed-terminal-report-instead-of-a-second-cancellation-path:
- en: d47dedfab1caa170
- zh: 00bb8cd62ed79d54
-/agent-note-human-job-kill-an-unclaimed-terminal-report-instead-of-a-second-cancellation-path/problem:
- en: 3690502ccc80b5a3
- zh: cfd3c378e3921864
-/agent-note-human-job-kill-an-unclaimed-terminal-report-instead-of-a-second-cancellation-path/decision:
- en: ccd3751d2ecaba5c
- zh: f8f820f9492a9bf3
-/agent-note-human-job-kill-an-unclaimed-terminal-report-instead-of-a-second-cancellation-path/alternatives-considered:
- en: 74a385c561d8854a
- zh: c131a4e386d9b976
-/agent-note-human-job-kill-an-unclaimed-terminal-report-instead-of-a-second-cancellation-path/testing:
- en: 094513090d51adfc
- zh: b6598110da6c5793
-/agent-note-human-job-kill-an-unclaimed-terminal-report-instead-of-a-second-cancellation-path/consequences:
- en: 0bcec15bd9c760fe
- zh: 754269206f110f69
diff --git a/.agents/notes/implemented/feature/2026-08-26-shell-execute-projection-and-jobs-at-start.i18n.yaml b/.agents/notes/implemented/feature/2026-08-26-shell-execute-projection-and-jobs-at-start.i18n.yaml
deleted file mode 100644
index 428a985b5b..0000000000
--- a/.agents/notes/implemented/feature/2026-08-26-shell-execute-projection-and-jobs-at-start.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-26-shell-execute-projection-and-jobs-at-start.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-26-shell-execute-projection-and-jobs-at-start.md
-/agent-note-one-shell-execute-foreground-as-a-projection-timeout-as-a-bounded-wait-on-the-job:
- en: bbc82e3f79a66fcb
- zh: 6c348491e0db97b0
-/agent-note-one-shell-execute-foreground-as-a-projection-timeout-as-a-bounded-wait-on-the-job/problem:
- en: e0e1292e5a785322
- zh: 34ec6572ed6cf406
-/agent-note-one-shell-execute-foreground-as-a-projection-timeout-as-a-bounded-wait-on-the-job/decision:
- en: 332ddaffd22e473f
- zh: 15c0ff6808316770
-/agent-note-one-shell-execute-foreground-as-a-projection-timeout-as-a-bounded-wait-on-the-job/alternatives-considered:
- en: d888a561fafa5bb3
- zh: 719d687f2b3e4c10
-/agent-note-one-shell-execute-foreground-as-a-projection-timeout-as-a-bounded-wait-on-the-job/testing:
- en: 65f59286de9fa00a
- zh: 664d7f82a1479153
-/agent-note-one-shell-execute-foreground-as-a-projection-timeout-as-a-bounded-wait-on-the-job/consequences:
- en: 5a5278fc96afacc1
- zh: cc088ea97c6249c9
diff --git a/.agents/notes/implemented/feature/2026-08-27-continuable-subagent-human-inbox-control.i18n.yaml b/.agents/notes/implemented/feature/2026-08-27-continuable-subagent-human-inbox-control.i18n.yaml
deleted file mode 100644
index db46bc5f64..0000000000
--- a/.agents/notes/implemented/feature/2026-08-27-continuable-subagent-human-inbox-control.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-27-continuable-subagent-human-inbox-control.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-27-continuable-subagent-human-inbox-control.md
-/agent-note-human-inbox-controls-for-continuable-subagents:
- en: 42b7ed7255c6c527
- zh: c3faf95870ba0e0c
-/agent-note-human-inbox-controls-for-continuable-subagents/problem:
- en: 4241f01a3a205ff5
- zh: 415c642ad379a53c
-/agent-note-human-inbox-controls-for-continuable-subagents/decision:
- en: 4f8c53964ac18aff
- zh: 31d747618ca608cc
-/agent-note-human-inbox-controls-for-continuable-subagents/alternatives-considered:
- en: c1f10fb70c8bb500
- zh: 4dc0ec6cac95595c
-/agent-note-human-inbox-controls-for-continuable-subagents/consequences:
- en: 5fdc5b07eae2633c
- zh: 1359d126d182d219
diff --git a/.agents/notes/implemented/feature/2026-08-28-auto-review.i18n.yaml b/.agents/notes/implemented/feature/2026-08-28-auto-review.i18n.yaml
index ab336fff79..f985dfc4a3 100644
--- a/.agents/notes/implemented/feature/2026-08-28-auto-review.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-08-28-auto-review.i18n.yaml
@@ -9,8 +9,8 @@
en: 492ba2355360d81a
zh: 825c0e7ab1cf4beb
/agent-note-experimental-auto-review-before-each-tool-call/decision:
- en: fd4103b65b24f6e2
- zh: 5c1a364355b7e9ab
+ en: 3868c5c4b087bdba
+ zh: c3dff98fc5f05f19
/agent-note-experimental-auto-review-before-each-tool-call/decision/effects-and-authority:
en: 55a79d8572fb4332
zh: f63d03d0f3bb5811
@@ -21,8 +21,8 @@
en: 237018634b5f9dcf
zh: cbc49d9c1b794065
/agent-note-experimental-auto-review-before-each-tool-call/decision/process-catalog-and-children:
- en: c305e3506fb4febc
- zh: aecc99cda8be3de2
+ en: 6ebe6f90241fd322
+ zh: eafdebc5277e83a1
/agent-note-experimental-auto-review-before-each-tool-call/alternatives-considered:
en: fe97128ed05b9e43
zh: 4aaa344933fa89b4
diff --git a/.agents/notes/implemented/feature/2026-08-28-auto-review.md b/.agents/notes/implemented/feature/2026-08-28-auto-review.md
index 54a2609e33..c19e780d01 100644
--- a/.agents/notes/implemented/feature/2026-08-28-auto-review.md
+++ b/.agents/notes/implemented/feature/2026-08-28-auto-review.md
@@ -10,7 +10,7 @@ Full access lets useful project work proceed without repeated approvals, but it
## Decision
-[`dsh-experimental-auto-review`](../../../../packages/experimental/auto-review/README.md) is an explicitly installed experimental Web layer, published under the [experimental package publication decision](../process/2026-09-12-publish-all-experimental-packages.md). Default Web retains Read Only, Workspace Write, and Full access. The layer contributes current-session `auto`, whose only durable identity is `permission/preset:auto`; it uses Full access's `danger-full-access` sandbox and tool definitions with the approval policy chosen by [the user-approval fallback decision](2026-09-24-auto-review-user-approval-fallback.md). Headless, General settings, and new-session defaults exclude the integration.
+[`dsh-experimental-auto-review`](../../../../packages/experimental/auto-review/README.md) is an explicitly installed experimental Web layer, published under the [experimental package publication policy](../../../../packages/experimental/README.md). Default Web retains Read Only, Workspace Write, and Full access. The layer contributes current-session `auto`, whose only durable identity is `permission/preset:auto`; it uses Full access's `danger-full-access` sandbox and tool definitions with the approval policy chosen by [the user-approval fallback decision](2026-09-24-auto-review-user-approval-fallback.md). Headless, General settings, and new-session defaults exclude the integration.
Every native call and started PTC `tools.*` inner call receives one review before its body. The outer `run_code` transport and direct Node effects in a PTC program remain outside this guarantee. There are no tool-name exemptions, cached grants, retries, configurable policy, or second authorization check; [the user-approval fallback decision](2026-09-24-auto-review-user-approval-fallback.md) owns what follows a denial. A repeated call receives a fresh review.
@@ -60,7 +60,7 @@ The permission owner publishes one complete process catalog through generated `p
Auto appears with a superscript `EXP` badge. Both visible current-session pickers require the experimental confirmation; explicit `/permission auto` is already consent. The composer uses the generic Menu's existing portal placement to stay within the viewport while keeping its 218–360px bounds. The slash popup keeps `min(220px, 100%)` with `max-width: 100%`, including when a narrow composer collapses its trigger.
-The [delegation-time policy capture](2026-07-25-subagent-policy-inheritance.md) records Auto or Full access before the first await and appends that existing preset event after fork seeding and sandbox/approval overrides. One-shot and continuable creation share the rule; cold resume reads only the child log. Later parent switches do not alter that child, while a later child switch can win. Read Only and Workspace Write retain sandbox inheritance plus `approval: never` and may therefore remain `custom`. Auto children classify each call independently using the existing lineage and messages, without parent call metadata, delegation records, receipts, Header/descriptor additions, or a Session-format change. Out-of-process children retain their own permission systems after the parent delegation is allowed.
+The [delegation-time policy capture](../../../../packages/subagent/subagent/README.md) records Auto or Full access before the first await and appends that existing preset event after fork seeding and sandbox/approval overrides. One-shot and continuable creation share the rule; cold resume reads only the child log. Later parent switches do not alter that child, while a later child switch can win. Read Only and Workspace Write retain sandbox inheritance plus `approval: never` and may therefore remain `custom`. Auto children classify each call independently using the existing lineage and messages, without parent call metadata, delegation records, receipts, Header/descriptor additions, or a Session-format change. Out-of-process children retain their own permission systems after the parent delegation is allowed.
## Alternatives considered
diff --git a/.agents/notes/implemented/feature/2026-08-28-auto-review.zh.md b/.agents/notes/implemented/feature/2026-08-28-auto-review.zh.md
index 6555a7b5cd..bd99839132 100644
--- a/.agents/notes/implemented/feature/2026-08-28-auto-review.zh.md
+++ b/.agents/notes/implemented/feature/2026-08-28-auto-review.zh.md
@@ -10,7 +10,7 @@ Full access 让有用的项目工作无需反复审批即可继续，但也允
## 决策
-[`dsh-experimental-auto-review`](../../../../packages/experimental/auto-review/README.zh.md)是显式安装的实验性 Web 层，按[实验包发布决策](../process/2026-09-12-publish-all-experimental-packages.zh.md)参与发布。默认 Web 保持 Read Only、Workspace Write 与 Full access。此层贡献仅限当前会话的 `auto`，唯一持久身份为 `permission/preset:auto`；它使用 Full access 的 `danger-full-access` 沙箱与工具定义，审批策略由[用户审批兜底决策](2026-09-24-auto-review-user-approval-fallback.zh.md)决定。Headless、通用设置与新会话默认值都排除此 integration。
+[`dsh-experimental-auto-review`](../../../../packages/experimental/auto-review/README.zh.md)是显式安装的实验性 Web 层，按[实验包发布策略](../../../../packages/experimental/README.zh.md)参与发布。默认 Web 保持 Read Only、Workspace Write 与 Full access。此层贡献仅限当前会话的 `auto`，唯一持久身份为 `permission/preset:auto`；它使用 Full access 的 `danger-full-access` 沙箱与工具定义，审批策略由[用户审批兜底决策](2026-09-24-auto-review-user-approval-fallback.zh.md)决定。Headless、通用设置与新会话默认值都排除此 integration。
每个原生调用与已开始的 PTC `tools.*` inner call 都在 body 前接受一次审查。外层 `run_code` transport 与 PTC 程序内直接 Node 效果不在保证范围内。不提供按工具名豁免、缓存 grant、重试、可配置策略或第二授权检查；拒绝之后的行为由[用户审批兜底决策](2026-09-24-auto-review-user-approval-fallback.zh.md)负责。重复调用也重新审查。
@@ -60,7 +60,7 @@ Permission owner 通过生成的 `permissionPresets` Remote 方法发布一份
Auto 带右上标 `EXP`。两个可见当前会话选择器都要求实验确认；显式 `/permission auto` 已构成同意。Composer 使用通用 Menu 既有 portal 定位保持在视口内，同时保留 218–360px 边界。Slash popup 保留 `min(220px, 100%)` 与 `max-width: 100%`，窄 composer 将 trigger 折叠时也一样。
-[委派时权限捕获](2026-07-25-subagent-policy-inheritance.zh.md)在首次 await 前记录 Auto 或 Full access，并在 fork seed 与 sandbox／approval override 之后追加该既有 preset event。单次与可继续创建共用此规则；cold resume 只读取 child 日志。后续 parent 切换不改变该 child，后续 child 自己的切换仍可胜出。Read Only 与 Workspace Write 保留 sandbox 继承加 `approval: never`，因此可能保持 `custom`。Auto child 使用既有 lineage 与消息独立分类每次调用，不增加父 call metadata、委派记录、receipt、Header／descriptor 字段或 Session format。进程外 child 在父委派获准后保留自己的权限系统。
+[委派时权限捕获](../../../../packages/subagent/subagent/README.zh.md)在首次 await 前记录 Auto 或 Full access，并在 fork seed 与 sandbox／approval override 之后追加该既有 preset event。单次与可继续创建共用此规则；cold resume 只读取 child 日志。后续 parent 切换不改变该 child，后续 child 自己的切换仍可胜出。Read Only 与 Workspace Write 保留 sandbox 继承加 `approval: never`，因此可能保持 `custom`。Auto child 使用既有 lineage 与消息独立分类每次调用，不增加父 call metadata、委派记录、receipt、Header／descriptor 字段或 Session format。进程外 child 在父委派获准后保留自己的权限系统。
## 考虑过的替代方案
diff --git a/.agents/notes/implemented/feature/2026-09-01-workflow-run-in-background.i18n.yaml b/.agents/notes/implemented/feature/2026-09-01-workflow-run-in-background.i18n.yaml
deleted file mode 100644
index c220a01232..0000000000
--- a/.agents/notes/implemented/feature/2026-09-01-workflow-run-in-background.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-01-workflow-run-in-background.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-01-workflow-run-in-background.md
-/agent-note-workflow-runs-gain-run-in-background-over-the-job-registry:
- en: f009de4a29acc7d0
- zh: d207b3722564338d
-/agent-note-workflow-runs-gain-run-in-background-over-the-job-registry/problem:
- en: 4ef955f5184800a3
- zh: 8e4e74557efac4ca
-/agent-note-workflow-runs-gain-run-in-background-over-the-job-registry/decision:
- en: b0bc1669a6e61b1e
- zh: 99ba5afe693aed9d
-/agent-note-workflow-runs-gain-run-in-background-over-the-job-registry/alternatives-considered:
- en: 70c9a5dd502eae0c
- zh: 2b4f7b6a83cfec18
-/agent-note-workflow-runs-gain-run-in-background-over-the-job-registry/consequences:
- en: 439882b972d28d4e
- zh: 3bd61f42e29f490c
diff --git a/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.i18n.yaml b/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.i18n.yaml
index 091e991d76..d5bc1499d0 100644
--- a/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.i18n.yaml
@@ -9,8 +9,8 @@
en: dae256ae605900f2
zh: 11e9c51126ad836c
/agent-note-right-sidebar-docking-infrastructure/decision:
- en: a30a377c8df0e654
- zh: f2577e74c6be3e88
+ en: a4e8f98a9ed5a52f
+ zh: 5e8a9afff0939348
/agent-note-right-sidebar-docking-infrastructure/decision/package-topology:
en: 7dfd8ad3a822b421
zh: 338151c69866c7d5
@@ -18,17 +18,17 @@
en: af79bc03cd8e8f72
zh: 88145221570301bf
/agent-note-right-sidebar-docking-infrastructure/decision/the-frame-s-right-column:
- en: 78c5b5bf86d0293a
- zh: 28b8856d88b78d1e
+ en: add016d9b9a2bbc4
+ zh: 2a089451b4381467
/agent-note-right-sidebar-docking-infrastructure/decision/state:
- en: 7a73e989059c0871
- zh: ef4f8783fc5f3229
+ en: c0548c6c6d55c952
+ zh: 268473645c953a63
/agent-note-right-sidebar-docking-infrastructure/decision/beyond-the-surface:
- en: 82b5fd9d88c3ea43
- zh: d8581e996abbe034
+ en: 2a6ff6980587f18a
+ zh: 912723a000b32006
/agent-note-right-sidebar-docking-infrastructure/decision/entry-points-and-removals:
- en: e9cb121a18afadc2
- zh: 37ff2e89d5641e11
+ en: 372a1a775a7d8e4e
+ zh: f9ad77b399a07f1d
/agent-note-right-sidebar-docking-infrastructure/alternatives-considered:
en: 6569babd25fc0599
zh: f9d93c937b2cad60
diff --git a/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.md b/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.md
index c5bfb75730..a01ba5bc6f 100644
--- a/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.md
+++ b/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.md
@@ -12,7 +12,7 @@ Files the agent produced were the sharpest case. A produced-file chip or a `read
## Decision
-The right column is a per-session docking surface — split panes, tabs, floating panels, and an undoable operation sequence — owned by `ui-sidebar-right` over the `ui-dockkit` engine, replacing the Detail panel. This note owns the surface: the engine, the frame's right column, the panel's presentations and controls, and the per-session state. What lives in the surface is decided elsewhere: how plugins declare tab types, open content, and receive their props is [tab types and navigation](../architecture/2026-09-05-sidebar-tab-types-and-navigation.md); live data behind an address is the [client resource model](../architecture/2026-09-05-client-resource-model.md); reading workspace files is the [workspace file service](../architecture/2026-09-05-workspace-files-service.md); and the guide, the text preview, and the file tree are the [shipped types](2026-09-05-sidebar-text-preview-and-file-tree.md).
+The right column is a per-session docking surface — split panes, tabs, floating panels, and an undoable operation sequence — owned by `ui-sidebar-right` over the `ui-dockkit` engine, replacing the Detail panel. This note owns the surface: the engine, the frame's right column, the panel's presentations and controls, and the per-session state. What lives in the surface is decided elsewhere: how plugins declare tab types, open content, and receive their props is [tab types and navigation](../../../../packages/client/ui-sidebar-right/README.md); live data behind an address is the [client resource model](../architecture/2026-09-05-client-resource-model.md); reading workspace files is the [workspace file service](../architecture/2026-09-05-workspace-files-service.md); and the guide, the text preview, and the file tree are the [shipped types](../../../../packages/client/ui-sidebar-documentpreview/README.md).
### Package topology
@@ -33,23 +33,23 @@ Components render a snapshot and report settled intents, one per gesture: a drag
### The frame's right column
-[Responsive Sidebar and tab information](../architecture/2026-09-07-sidebar-responsive-tab-info.md) supersedes this note's no-concession layout, overlay presentation and product pane limit. `ui-layout` still owns three-column geometry and pixel width preferences; the Sidebar occupant reports presentation through `ctx.layout.openRightbar(track, fullscreen)` and `closeRightbar()`, without the frame injecting the Sidebar package. Exact width rules belong to [ui-layout](../../../../packages/client/ui-layout/README.md).
+[Responsive Sidebar and tab information](../../../../packages/client/ui-sidebar-right/README.md) supersedes this note's no-concession layout, overlay presentation and product pane limit. `ui-layout` still owns three-column geometry and pixel width preferences; the Sidebar occupant reports presentation through `ctx.layout.openRightbar(track, fullscreen)` and `closeRightbar()`, without the frame injecting the Sidebar package. Exact width rules belong to [ui-layout](../../../../packages/client/ui-layout/README.md).
The right Sidebar uses one mounted content tree in normal and fullscreen modes; hiding preserves retained tab state, and fullscreen covers the viewport while retaining underlying column reservation. `DockLayout` renders stable Grid cells with fixed-position floating frames in the same tree; foreground floats remain open when the Sidebar closes. The product limits docking to two horizontal panes and a 20–80% divider; the generic engine keeps its own defaults.
### State
-[Default pages](2026-09-08-sidebar-default-pages.md) supersede default-guide reseeding here; [last-tab close rules](2026-09-08-sidebar-last-tab-close-rules.md) own explicit closing, while moving tabs still settles emptied panes.
+[Sidebar guide rules](../../../../packages/client/ui-sidebar-right/README.md#the-guide) define default-page selection and explicit closing, while moving tabs still settles emptied panes.
-`ui-sidebar-right` keeps one `SurfaceState` per session id — the layout, its history, and the mint counter — in a store declared at the seat registration. Every action mints the ids its intent needs, asks a kit planner for the operations, runs the settle planner over the result, and records the whole intent as one history entry before assigning the session's surface back; no action edits a layout in place. The settle step is the product's rule: a docked pane whose last tab is closed, moved out, or floated is merged away, and an expanded empty root pane receives the current default page. A collapsed surface may remain empty until its next expansion; no separate pane-closing gesture exists. [Layout persistence and provider recovery](../architecture/2026-09-14-sidebar-layout-provider-recovery.md) owns Session-scoped browser storage and reload. Layout is presentation state and never enters the session log.
+`ui-sidebar-right` keeps one `SurfaceState` per session id — the layout, its history, and the mint counter — in a store declared at the seat registration. Every action mints the ids its intent needs, asks a kit planner for the operations, runs the settle planner over the result, and records the whole intent as one history entry before assigning the session's surface back; no action edits a layout in place. The settle step is the product's rule: a docked pane whose last tab is closed, moved out, or floated is merged away, and an expanded empty root pane receives the current default page. A collapsed surface may remain empty until its next expansion; no separate pane-closing gesture exists. [Layout persistence and provider recovery](../../../../packages/client/ui-sidebar-right/README.md) owns Session-scoped browser storage and reload. Layout is presentation state and never enters the session log.
### Beyond the surface
-The surface renders tabs whose bodies it does not know: each tab carries a `kind`, and the panel asks the type registry for the implementation in force and dispatches to its keyed body seat. Everything a body may rely on — its record, its pane, whether it is visible, how it was navigated to, an abort signal, and the actions it may take — is read through the framework-injected `useTabInfo()`. The registry, the navigation face `ctx.sidebarRight`, the seats, and the tab information are specified in [tab types and navigation](../architecture/2026-09-05-sidebar-tab-types-and-navigation.md); a body that shows data reads it through the [client resource model](../architecture/2026-09-05-client-resource-model.md).
+The surface renders tabs whose bodies it does not know: each tab carries a `kind`, and the panel asks the type registry for the implementation in force and dispatches to its keyed body seat. Everything a body may rely on — its record, its pane, whether it is visible, how it was navigated to, an abort signal, and the actions it may take — is read through the framework-injected `useTabInfo()`. The registry, the navigation face `ctx.sidebarRight`, the seats, and the tab information are specified in [tab types and navigation](../../../../packages/client/ui-sidebar-right/README.md); a body that shows data reads it through the [client resource model](../architecture/2026-09-05-client-resource-model.md).
### Entry points and removals
-`ui-chat`'s `openFile(path, { line? })` — reached by tool-row path links, produced-file chips, and closing-message mentions — now opens the file into the Sidebar through the navigation face (see [tab types and navigation](../architecture/2026-09-05-sidebar-tab-types-and-navigation.md)). The `Show in folder` action and its `canOpenWorkspacePath` probe are removed from `ui-deliverables`: the Sidebar has no directory form, and the product keeps no secondary entry. `DetailsPanel`, `ToolDetails`, the tool-node reader, the chat store's selection, `ToolDetailsProps`, and `CENTER_MIN` are removed. `session/openWorkspacePath` remains on the Host with no web caller.
+`ui-chat`'s `openFile(path, { line? })` — reached by tool-row path links, produced-file chips, and closing-message mentions — now opens the file into the Sidebar through the navigation face (see [tab types and navigation](../../../../packages/client/ui-sidebar-right/README.md)). The `Show in folder` action and its `canOpenWorkspacePath` probe are removed from `ui-deliverables`: the Sidebar has no directory form, and the product keeps no secondary entry. `DetailsPanel`, `ToolDetails`, the tool-node reader, the chat store's selection, `ToolDetailsProps`, and `CENTER_MIN` are removed. `session/openWorkspacePath` remains on the Host with no web caller.
## Alternatives considered
diff --git a/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.zh.md b/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.zh.md
index 4959032b53..57aa63fd4d 100644
--- a/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.zh.md
+++ b/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.zh.md
@@ -12,7 +12,7 @@ Agent 产出的文件是最尖锐的案例。产出文件 chip 或 `read` 行的
## Decision
-右列是每会话一份的停靠面（分栏 pane、tab、浮动面板与可撤销的操作序列），由 `ui-sidebar-right` 基于 `ui-dockkit` 引擎持有，取代原来的 Detail 面板。本篇只管这个面：引擎、框架的右列、面板的两种呈现与控件、每会话的状态。面里放什么由别处决定：插件如何声明 tab 类型、打开内容、拿到 props 见[tab 类型与导航](../architecture/2026-09-05-sidebar-tab-types-and-navigation.zh.md)；地址背后的活数据见[客户端资源模型](../architecture/2026-09-05-client-resource-model.zh.md)；读工作区文件见[工作区文件服务](../architecture/2026-09-05-workspace-files-service.zh.md)；引导页、文本预览与文件树见[随包类型](2026-09-05-sidebar-text-preview-and-file-tree.zh.md)。
+右列是每会话一份的停靠面（分栏 pane、tab、浮动面板与可撤销的操作序列），由 `ui-sidebar-right` 基于 `ui-dockkit` 引擎持有，取代原来的 Detail 面板。本篇只管这个面：引擎、框架的右列、面板的两种呈现与控件、每会话的状态。面里放什么由别处决定：插件如何声明 tab 类型、打开内容、拿到 props 见[tab 类型与导航](../../../../packages/client/ui-sidebar-right/README.zh.md)；地址背后的活数据见[客户端资源模型](../architecture/2026-09-05-client-resource-model.zh.md)；读工作区文件见[工作区文件服务](../architecture/2026-09-05-workspace-files-service.zh.md)；引导页、文本预览与文件树见[随包类型](../../../../packages/client/ui-sidebar-documentpreview/README.zh.md)。
### 包拓扑
@@ -33,23 +33,23 @@ Agent 产出的文件是最尖锐的案例。产出文件 chip 或 `read` 行的
### 框架的右列
-[响应式 Sidebar 与标签信息](../architecture/2026-09-07-sidebar-responsive-tab-info.zh.md)取代本记录中的无让步布局、覆盖模式与产品窗格上限。`ui-layout` 仍拥有三列几何与像素宽度偏好，Sidebar 占位项通过 `ctx.layout.openRightbar(track, fullscreen)` 和 `closeRightbar()` 报告呈现方式，框架不注入 Sidebar 包。具体宽度规则见 [ui-layout](../../../../packages/client/ui-layout/README.zh.md)。
+[响应式 Sidebar 与标签信息](../../../../packages/client/ui-sidebar-right/README.zh.md)取代本记录中的无让步布局、覆盖模式与产品窗格上限。`ui-layout` 仍拥有三列几何与像素宽度偏好，Sidebar 占位项通过 `ctx.layout.openRightbar(track, fullscreen)` 和 `closeRightbar()` 报告呈现方式，框架不注入 Sidebar 包。具体宽度规则见 [ui-layout](../../../../packages/client/ui-layout/README.zh.md)。
右栏在普通与全屏模式下使用同一棵已挂载内容树；隐藏保留已保活的标签状态，全屏覆盖视口并保留底层列占位。`DockLayout` 在同一棵树中渲染稳定 Grid cell 与 fixed 定位的浮动 frame，前台浮窗不随右栏关闭。产品限制为两个水平窗格与 20–80% 分割比例，通用引擎保留自己的默认值。
### 状态
-[默认页](2026-09-08-sidebar-default-pages.zh.md)取代此处的默认补入引导页；[最后一个 tab 的关闭规则](2026-09-08-sidebar-last-tab-close-rules.zh.md)负责显式关闭，移动 tab 仍会处理被清空的格。
+[Sidebar 引导页规则](../../../../packages/client/ui-sidebar-right/README.zh.md#the-guide)定义默认页选择与显式关闭，移动 tab 仍会处理被清空的格。
-`ui-sidebar-right` 为每个会话 id 保存一份 `SurfaceState`——布局、历史与铸造计数——住在坑位注册时声明的 store 里。每个 action 先铸造意图所需的 id，向库的 planner 索取操作，对结果跑一遍 settle planner，把整个意图记为一条历史账，再把该会话的 surface 整体赋回；没有 action 就地改布局。settle 是产品规则：最后一个 tab 被关闭、拖走或悬浮出去的停靠 pane 会被合并掉；展开且为空的根 pane 会填入当前默认页。折叠的布局可以保持为空，直到下次展开；没有单独的关闭 pane 手势。[布局持久化与 provider 恢复](../architecture/2026-09-14-sidebar-layout-provider-recovery.zh.md)负责 Session 作用域的浏览器存储和刷新。布局是呈现状态，永不进入会话日志。
+`ui-sidebar-right` 为每个会话 id 保存一份 `SurfaceState`——布局、历史与铸造计数——住在坑位注册时声明的 store 里。每个 action 先铸造意图所需的 id，向库的 planner 索取操作，对结果跑一遍 settle planner，把整个意图记为一条历史账，再把该会话的 surface 整体赋回；没有 action 就地改布局。settle 是产品规则：最后一个 tab 被关闭、拖走或悬浮出去的停靠 pane 会被合并掉；展开且为空的根 pane 会填入当前默认页。折叠的布局可以保持为空，直到下次展开；没有单独的关闭 pane 手势。[布局持久化与 provider 恢复](../../../../packages/client/ui-sidebar-right/README.zh.md)负责 Session 作用域的浏览器存储和刷新。布局是呈现状态，永不进入会话日志。
### 面之外
-这个面渲染的 tab 正文它自己并不认识：每个 tab 带一个 `kind`，面板向类型注册表询问该 kind 生效的实现，再派发到其 keyed 正文坑位。正文能依赖的一切——它的记录、所在格、是否可见、如何被导航到、中止信号、可做的动作——均通过框架注入的 `useTabInfo()` 从标签域读取。注册表、导航面 `ctx.sidebarRight`、坑位与 标签信息 在[tab 类型与导航](../architecture/2026-09-05-sidebar-tab-types-and-navigation.zh.md)里定；展示数据的正文经[客户端资源模型](../architecture/2026-09-05-client-resource-model.zh.md)读取。
+这个面渲染的 tab 正文它自己并不认识：每个 tab 带一个 `kind`，面板向类型注册表询问该 kind 生效的实现，再派发到其 keyed 正文坑位。正文能依赖的一切——它的记录、所在格、是否可见、如何被导航到、中止信号、可做的动作——均通过框架注入的 `useTabInfo()` 从标签域读取。注册表、导航面 `ctx.sidebarRight`、坑位与 标签信息 在[tab 类型与导航](../../../../packages/client/ui-sidebar-right/README.zh.md)里定；展示数据的正文经[客户端资源模型](../architecture/2026-09-05-client-resource-model.zh.md)读取。
### 入口与删除
-`ui-chat` 的 `openFile(path, { line? })`——工具行路径链接、产出文件 chip 与收尾消息提及都经由它——现在经导航面把文件开进 Sidebar（见[tab 类型与导航](../architecture/2026-09-05-sidebar-tab-types-and-navigation.zh.md)）。`Show in folder` 动作及其 `canOpenWorkspacePath` 探针从 `ui-deliverables` 移除：Sidebar 没有目录形态，产品也不保留次级入口。`DetailsPanel`、`ToolDetails`、tool-node reader、chat store 的 selection、`ToolDetailsProps` 与 `CENTER_MIN` 一并删除。`session/openWorkspacePath` 留在 Host 上，已无 web 调用方。
+`ui-chat` 的 `openFile(path, { line? })`——工具行路径链接、产出文件 chip 与收尾消息提及都经由它——现在经导航面把文件开进 Sidebar（见[tab 类型与导航](../../../../packages/client/ui-sidebar-right/README.zh.md)）。`Show in folder` 动作及其 `canOpenWorkspacePath` 探针从 `ui-deliverables` 移除：Sidebar 没有目录形态，产品也不保留次级入口。`DetailsPanel`、`ToolDetails`、tool-node reader、chat store 的 selection、`ToolDetailsProps` 与 `CENTER_MIN` 一并删除。`session/openWorkspacePath` 留在 Host 上，已无 web 调用方。
## Alternatives considered
diff --git a/.agents/notes/implemented/feature/2026-09-05-sidebar-text-preview-and-file-tree.i18n.yaml b/.agents/notes/implemented/feature/2026-09-05-sidebar-text-preview-and-file-tree.i18n.yaml
deleted file mode 100644
index 7c077c2da7..0000000000
--- a/.agents/notes/implemented/feature/2026-09-05-sidebar-text-preview-and-file-tree.i18n.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-05-sidebar-text-preview-and-file-tree.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-05-sidebar-text-preview-and-file-tree.md
-/agent-note-sidebar-text-preview-and-file-tree:
- en: 2f9ef6cc50ad825d
- zh: 5ec8592ac9963f85
-/agent-note-sidebar-text-preview-and-file-tree/problem:
- en: 4e647765dfcd2ef9
- zh: 2c362ffdee7ff3d4
-/agent-note-sidebar-text-preview-and-file-tree/decision:
- en: f8ea6a52a404b064
- zh: c91528d66487bb33
-/agent-note-sidebar-text-preview-and-file-tree/decision/the-guide:
- en: cc4eaeefe4de9a02
- zh: bc9e727d6316ae88
-/agent-note-sidebar-text-preview-and-file-tree/decision/the-text-preview:
- en: efc84d800d52a69e
- zh: 0061138d7cd12ae7
-/agent-note-sidebar-text-preview-and-file-tree/decision/the-file-tree:
- en: f03013eee6c293de
- zh: 54796ac3da91047f
-/agent-note-sidebar-text-preview-and-file-tree/alternatives-considered:
- en: 87fddbd01f117061
- zh: 1810d283202db648
-/agent-note-sidebar-text-preview-and-file-tree/consequences:
- en: 00b1675fcd76ad0d
- zh: caf3eb340c74aef7
-/agent-note-sidebar-text-preview-and-file-tree/testing:
- en: 2987a6417b7e4c14
- zh: 97eeb97e67536c70
-/agent-note-sidebar-text-preview-and-file-tree/deferred:
- en: 6c788b26fb65227b
- zh: 1bafda76bac92edd
-/agent-note-sidebar-text-preview-and-file-tree/related:
- en: 0a2531b19968c69b
- zh: 4065017075aa11cc
diff --git a/.agents/notes/implemented/feature/2026-09-07-composer-session-stats-pills.i18n.yaml b/.agents/notes/implemented/feature/2026-09-07-composer-session-stats-pills.i18n.yaml
deleted file mode 100644
index b54791c599..0000000000
--- a/.agents/notes/implemented/feature/2026-09-07-composer-session-stats-pills.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-07-composer-session-stats-pills.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-07-composer-session-stats-pills.md
-/agent-note-composer-session-stats-two-icon-pills-with-click-open-stat-dialogs:
- en: 76e613674da56884
- zh: 4c9c5d750eace3e0
-/agent-note-composer-session-stats-two-icon-pills-with-click-open-stat-dialogs/problem:
- en: 654462fa4eeb58dc
- zh: 7c9cd57947ab8639
-/agent-note-composer-session-stats-two-icon-pills-with-click-open-stat-dialogs/decision:
- en: 27eb1718cd80b39b
- zh: e39576842a3578c1
-/agent-note-composer-session-stats-two-icon-pills-with-click-open-stat-dialogs/alternatives-considered:
- en: 7798b1fb9824b920
- zh: 7e75cd154ab58a0b
-/agent-note-composer-session-stats-two-icon-pills-with-click-open-stat-dialogs/consequences:
- en: c078fb870536eec6
- zh: 17076d824c74ee9d
diff --git a/.agents/notes/implemented/feature/2026-09-07-composer-session-stats-pills.md b/.agents/notes/implemented/feature/2026-09-07-composer-session-stats-pills.md
deleted file mode 100644
index 50d3d3294e..0000000000
--- a/.agents/notes/implemented/feature/2026-09-07-composer-session-stats-pills.md
+++ /dev/null
@@ -1,34 +0,0 @@
-# Agent Note: Composer session stats — two icon pills with click-open stat dialogs
-
-Status: implemented
-
-English | [中文](2026-09-07-composer-session-stats-pills.zh.md)
-
-## Problem
-
-The session stats strip under the composer (`StatsLine`, ui-chat, mounted on `conversation.composer.dock`) rendered every figure as one resident text line: turn/step counts, LLM and tool wall times, TTFT/TPS averages, and compact token totals with cache-hit share. The line crowded as figures accumulated, exact token counts appeared nowhere (the `ResizeObserver`-measured hover tooltip only restated the same compact line when it truncated), and the flat text gave no grouping — time figures and billing figures read as one undifferentiated row. An in-page A/B against a two-pill variant settled the direction: the pills won on scannability and on giving each figure family a home.
-
-## Decision
-
-The [performance and usage preference](2026-09-16-performance-usage-preference.md) governs statistic visibility and removes the completed-turn elapsed-time action.
-
-`StatsPills` (packages/client/ui-chat/src/client/chat/StatsPills.tsx) replaces `StatsLine` on the same `conversation.composer.dock` slot; the losing variant is deleted, its shared helpers (`deriveStats`, `formatDuration`, `cacheHitPercent`, `billedInputTokens`) absorbed into the new module, and the dead `stats.llm`, `stats.toolCall`, `stats.ttftAverage`, `stats.tokensPerSecond`, and `stats.tokens` locale keys removed.
-
-- **Two icon pills, two dialogs.** A gauge pill (new `IconGaugeOutlineRegular`, dial center optically dropped to y=8.75 because the bottom-open arc reads high) shows `{turns} 轮 {steps} 步` plus output TPS and click-opens the 会话统计 dialog (LLM time, tool time, average TTFT, TPS); a log with no timed figure would open an empty dialog, so that pill renders as a static reading instead of a button. A database pill (`IconDatabaseOutlineRegular`) shows the compact billed total plus cache-hit share and click-opens the Token 用量 dialog (cache hit, uncached input, cache read, output, and cache write when non-zero — exact counts). Both dialogs wear the shared `stat-dialog` module (portal panel, anchored placement, outside-dismiss, optionally externally owned open state) extracted for exactly this two-consumer split; the pills row owns one exclusive open slot, so opening either dialog closes the other, and each button carries an explicit `aria-label` that separates with ` · ` the segments the aria-hidden sep glyph joins visually. [StatsPills](../../../../packages/client/ui-chat/src/client/chat/StatsPills.tsx) owns the zero cache-write omission.
-- **Shared information tier.** Composer stats and per-turn tail metadata use the secondary font size minus one pixel. Assistant-tail metadata uses the action icons' tertiary label color and starts after an extra 8px separation from the action cluster.
-- **Data sourcing is unchanged in architecture.** Counts and times prefer the durable `sessionStats` projection with the window fold as the assembly-without-the-unit fallback ([whole-session counts](../../archived/bug-fix/2026-08-12-full-session-turn-step-counts.md)); token figures ride `tokenUsage` only, so an absent projection drops the usage pill rather than showing window-derived billing. Cache writes stay in the billed total and the cache-hit denominator ([projection decision](../architecture/2026-07-29-projected-token-usage-and-request-context.md)). Context occupancy remains owned by ui-conversation's `ContextMeter`, with its ring and percentage after the two stats pills below the input card. The common dock groups statistics together and leaves the toolbar for input actions; ui-chat does not import the context component. The context panel renders through a portal and uses ui-primitives for viewport-clamped positioning and outside-pointer dismissal, including when the statistics contribution is absent.
-- **Render discipline.** The row folds settled nodes only (`chat.legacy.nodes` identity), so streaming chunk frames cause zero rerenders — pinned by a render-count unit test. A session with no closed step and no billed tokens renders nothing.
-- **The composer owns dock spacing.** `InputBar` places slot contributions and `ContextMeter` in one centered flex row, supplies 4px above the dock and 4px below it even when the slot has no visible contribution. The hero keeps no bottom padding and hides its empty dock. `StatsPills` supplies shrinkable time and billing content; it does not claim the full row width or add outer padding.
-
-## Alternatives considered
-
-- **The single-line variant (StatsLine, the A/B loser).** All figures resident in one text row, with a hover tooltip restating the full line when it truncated. Lost on crowding and reach: exact token counts appeared nowhere (the line and its tooltip both carried compact totals only), and one row gave time and billing figures no visual grouping.
-- **Three resident groups with one shared dialog.** An intermediate iteration kept counts, time, and tokens as three inline groups. Two pills won because the time/usage split matches the two underlying projections one-to-one and each pill's icon telegraphs its dialog.
-- **Extracting the dl bucket rows shared with `TurnUsagePanel`.** The session-total dialog and the per-turn panel render the same skin but different contracts (required session input, cache-read, and output rows plus a non-zero cache-write row, versus optional per-turn fields and model routes); a shared component would be conditionals around nine lines. The mirror is marked `jscpd:ignore` with the reason inline.
-
-## Consequences
-
-- `ChatSnapshotBuilder`'s legacy slice now serves StatsPills; the [node-assembly note](../architecture/2026-08-09-client-conversation-node-assembly.md) tracks that consumer rename.
-- Exact token counts become reachable at all — one click — where `StatsLine` showed only compact totals; the strip itself carries only the two headline readings.
-- Web e2e strip assertions match substring text inside the time pill; the fresh-round-trip aria goldens pin time, billing, and context order below the submit action, and stats-paged-history pins the counts reading alone over a log with no billed tokens.
-- The `conversation.composer.dock` occupant in the generated slot catalog is `client-ui-chat StatsPills id 'stats'`.
diff --git a/.agents/notes/implemented/feature/2026-09-07-composer-session-stats-pills.zh.md b/.agents/notes/implemented/feature/2026-09-07-composer-session-stats-pills.zh.md
deleted file mode 100644
index 97b91b601e..0000000000
--- a/.agents/notes/implemented/feature/2026-09-07-composer-session-stats-pills.zh.md
+++ /dev/null
@@ -1,34 +0,0 @@
-# Agent Note: 输入框下的会话统计 —— 双图标 pill 与点击展开的统计弹层
-
-Status: implemented
-
-[English](2026-09-07-composer-session-stats-pills.md) | 中文
-
-## 问题
-
-输入框下方的会话统计条（`StatsLine`，ui-chat，挂载于 `conversation.composer.dock`）把所有数字渲染成一整行常驻文本：轮/步计数、模型与工具用时、TTFT/TPS 均值、紧凑 token 总量与缓存命中率。数字越多行越拥挤，精确 token 计数无处可看（带 `ResizeObserver` 溢出测量的悬停提示只在截断时复述同一行紧凑文本），纯文本也没有分组——时间类数字和计费类数字读起来混作一行。一次页面内 A/B 对比双 pill 变体后方向定案：pill 方案在可扫读性和"每类数字有归属"上胜出。
-
-## 决定
-
-[性能与用量偏好](2026-09-16-performance-usage-preference.zh.md)管理统计可见性，并移除已完成轮次的耗时操作。
-
-`StatsPills`（packages/client/ui-chat/src/client/chat/StatsPills.tsx）在同一 `conversation.composer.dock` 插槽上取代 `StatsLine`；落选变体已删除，其共享工具函数（`deriveStats`、`formatDuration`、`cacheHitPercent`、`billedInputTokens`）并入新模块，废弃的 `stats.llm`、`stats.toolCall`、`stats.ttftAverage`、`stats.tokensPerSecond`、`stats.tokens` 文案键一并移除。
-
-- **两个图标 pill、两个弹层。** 仪表盘 pill（新增 `IconGaugeOutlineRegular`，因下开口圆弧视觉偏高而把表盘中心光学下移到 y=8.75）展示 `{turns} 轮 {steps} 步` 加输出 TPS，点击打开「会话统计」弹层（模型用时、工具调用用时、首 token 平均、输出速度）；日志里没有任何计时数字时弹层会是空的，此时该 pill 渲染为静态读数而非按钮。数据库 pill（`IconDatabaseOutlineRegular`）展示紧凑计费总量加缓存命中率，点击打开「Token 用量」弹层（缓存命中、未缓存输入、缓存读取、输出，以及非零时的缓存写入——精确计数）。两个弹层共用为这两处消费者抽出的 `stat-dialog` 模块（portal 面板、锚定定位、点击外部关闭、可选的外部持有开合状态）；pill 行持有唯一的互斥开合槽位，打开任一弹层即关闭另一个，且每个按钮携带显式 `aria-label`，用 ` · ` 分隔 aria-hidden 分隔符在视觉上连接的两段文本。[StatsPills](../../../../packages/client/ui-chat/src/client/chat/StatsPills.tsx)负责缓存写入为零时省略该行的规则。
-- **统一信息层级。** 输入框底部统计与单轮回答末尾信息都使用次级字号减 1px。回答末尾信息使用与操作图标一致的 tertiary 文字颜色，并与操作图标组额外拉开 8px。
-- **数据来源架构不变。** 计数与用时优先读取持久的 `sessionStats` 投影，窗口折叠仅作无该单元装配时的回退（[全会话计数](../../archived/bug-fix/2026-08-12-full-session-turn-step-counts.md)）；token 数字只走 `tokenUsage`，投影缺席时直接不渲染用量 pill，而非展示窗口推算的计费。缓存写入仍计入计费总量与缓存命中分母（[投影决定](../architecture/2026-07-29-projected-token-usage-and-request-context.zh.md)）。上下文占用仍归 ui-conversation 的 `ContextMeter` 所有，在输入卡片下方、两个统计 pill 之后显示圆环和百分比。共用 dock 将统计信息放在一起，工具栏保留给输入操作；ui-chat 不导入上下文组件。上下文面板通过 portal 渲染，复用 ui-primitives 的视口内定位与外部指针关闭工具，统计贡献项缺席时也不会越界。
-- **渲染纪律。** 该行只折叠已定稿节点（`chat.legacy.nodes` 身份），流式 chunk 帧零重渲染——由渲染计数单测钉住。无已完成步且无计费 token 的会话什么都不渲染。
-- **输入框负责 dock 间距。** `InputBar` 将 slot 贡献项和 `ContextMeter` 放在同一个居中的 flex 行中，在 dock 上下各提供 4px 留白，即使 slot 没有可见贡献项也保持该间距。hero 保持无底部留白，并隐藏空 dock。`StatsPills` 提供可收缩的时间与计费内容，不占满整行宽度，也不添加外部 padding。
-
-## 备选方案
-
-- **单行变体（StatsLine，A/B 落选方）。** 全部数字常驻一行文本，悬停提示只在截断时复述整行。败在拥挤与可达性：精确 token 计数无处可看（行内和提示里都只有紧凑总量），单行也无法给时间与计费数字分组。
-- **三个常驻分组共享一个弹层。** 中间迭代曾把计数、时间、token 保持为三个内联分组。双 pill 胜出是因为时间/用量的切分与两个底层投影一一对应，且每个 pill 的图标直接预告其弹层内容。
-- **抽出与 `TurnUsagePanel` 共享的 dl 分桶行。** 会话总量弹层与逐轮面板皮肤相同但约定不同（会话输入、缓存读取与输出行始终存在，缓存写入行仅在非零时出现；逐轮字段可选且含模型路由）；共享组件只是给九行代码包一层条件。该镜像以 `jscpd:ignore` 标注并内联说明理由。
-
-## 后果
-
-- `ChatSnapshotBuilder` 的 legacy 切片现在服务于 StatsPills；[节点装配 note](../architecture/2026-08-09-client-conversation-node-assembly.zh.md) 已跟进该消费者更名。
-- 精确 token 计数第一次变得可达——一次点击即可；`StatsLine` 只展示过紧凑总量。统计条本身只承载两个头条读数。
-- Web e2e 对统计条的断言匹配时间 pill 内的子串文本；fresh-round-trip 的 aria golden 钉住提交操作下方的时间、计费、上下文顺序，stats-paged-history 则在无计费 token 的日志上钉住单独的计数读数。
-- 生成的插槽目录中 `conversation.composer.dock` 占用者为 `client-ui-chat StatsPills id 'stats'`。
diff --git a/.agents/notes/implemented/feature/2026-09-07-deepseek-messages-adapter.i18n.yaml b/.agents/notes/implemented/feature/2026-09-07-deepseek-messages-adapter.i18n.yaml
index 65061d8855..cc1c2f1695 100644
--- a/.agents/notes/implemented/feature/2026-09-07-deepseek-messages-adapter.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-09-07-deepseek-messages-adapter.i18n.yaml
@@ -9,11 +9,11 @@
en: 6c9d47e829752afe
zh: 98bd3b5300bfea8c
/agent-note-deepseek-through-the-anthropic-messages-protocol/decision:
- en: 3c28330671a1e6db
- zh: 0d7ef9a8cf22c51f
+ en: a1499bb2fe6514ce
+ zh: f67e0acbabf97f1d
/agent-note-deepseek-through-the-anthropic-messages-protocol/alternatives-considered:
en: 4297bc439e8b23e4
zh: 2bb4dec78040d81e
/agent-note-deepseek-through-the-anthropic-messages-protocol/consequences:
- en: 76aa9259724323d2
- zh: 0aac83847bbd4ab6
+ en: 6a1044aba27f62a6
+ zh: 032ffa849afb8a30
diff --git a/.agents/notes/implemented/feature/2026-09-07-deepseek-messages-adapter.md b/.agents/notes/implemented/feature/2026-09-07-deepseek-messages-adapter.md
index 29f712e57c..d2d1ded714 100644
--- a/.agents/notes/implemented/feature/2026-09-07-deepseek-messages-adapter.md
+++ b/.agents/notes/implemented/feature/2026-09-07-deepseek-messages-adapter.md
@@ -10,13 +10,13 @@ Messages represents thinking, signatures, tool calls, tool results, and cumulati
## Decision
-The [DeepSeek adapter](../../../../packages/llm/llm-deepseek/README.md) serves Messages under one `deepseek-official` route and `llm-deepseek` settings namespace. The [single-protocol decision](../simplification/2026-09-19-deepseek-messages-only.md) owns the transport scope. `PreparedAdapterCall` freezes the endpoint, credential reference, and model capabilities; retries retain that generation while subsequent calls read new configuration.
+The [DeepSeek adapter](../../../../packages/llm/llm-deepseek/README.md) serves Messages under one `deepseek-official` route and `llm-deepseek` settings namespace. The [single-protocol reference](../../../../packages/llm/llm-deepseek/README.md) owns the transport scope. `PreparedAdapterCall` freezes the endpoint, credential reference, and model capabilities; retries retain that generation while subsequent calls read new configuration.
The adapter follows the [DeepSeek compatibility documentation](https://api-docs.deepseek.com/zh-cn/guides/anthropic_api) and [Anthropic streaming protocol](https://platform.claude.com/docs/en/build-with-claude/streaming). The pi-ai Anthropic implementation informed the handling of adjacent user messages, cumulative usage, fragmented tool arguments, and optional thinking signatures. DeepSeek effort uses `output_config.effort`; an Anthropic thinking token budget does not control DeepSeek effort. The adapter forwards explicit `temperature` values; DeepSeek accepts that parameter with thinking enabled and ignores its value, so callers retain their existing thinking configuration.
-Assistant blocks remain the durable model-visible content. A versioned `ReplayEnvelope` stores only the protocol format, model identity, aligned block kinds, and signatures absent from those blocks. Same-model Messages continuation restores signatures verbatim, including empty signatures; foreign history carries no invented signature. Unusable metadata follows the existing [replay degradation rule](../architecture/2026-07-14-provider-routed-llm-adapters.md): the request omits signatures with a warning while preserving durable content; historical tool arguments use the [empty-input fallback](../bug-fix/2026-09-16-messages-historical-tool-input.md) when Messages cannot represent them. This keeps provider replay data opaque to the loop while preserving it through Session persistence and block pruning.
+Assistant blocks remain the durable model-visible content. A versioned `ReplayEnvelope` stores only the protocol format, model identity, aligned block kinds, and signatures absent from those blocks. Same-model Messages continuation restores signatures verbatim, including empty signatures; foreign history carries no invented signature. Unusable metadata follows the existing [replay degradation rule](../architecture/2026-07-14-provider-routed-llm-adapters.md): the request omits signatures with a warning while preserving durable content; historical tool arguments use the [empty-input fallback](../../../../packages/llm/llm-deepseek/README.md) when Messages cannot represent them. This keeps provider replay data opaque to the loop while preserving it through Session persistence and block pruning.
-The adapter prefers Files references for deterministic request images, with upload caching, refresh, quota recovery, and attachment offload. The Files client follows the [exact `/v1` root rule](../bug-fix/2026-09-15-messages-v1-base-url.md) and sends the required beta header. Cached ids remain scoped by the resolved Files root and credential, so equivalent `/v1` and unversioned roots share uploads. Metadata omits expiry, so local reuse is bounded from the original upload time without asserting remote deletion. A Files-resolution failure rebuilds the complete request under the independent inline-image budget; caller cancellation stops it. The image policy preserves the 128 MiB retained-image budget, 20 MiB inline base64 budget, and oldest-prefix offload in both requests and token measurement.
+The adapter prefers Files references for deterministic request images, with upload caching, refresh, quota recovery, and attachment offload. The Files client follows the [exact `/v1` root rule](../../../../packages/llm/llm-deepseek/README.md) and sends the required beta header. Cached ids remain scoped by the resolved Files root and credential, so equivalent `/v1` and unversioned roots share uploads. Metadata omits expiry, so local reuse is bounded from the original upload time without asserting remote deletion. A Files-resolution failure rebuilds the complete request under the independent inline-image budget; caller cancellation stops it. The image policy preserves the 128 MiB retained-image budget, 20 MiB inline base64 budget, and oldest-prefix offload in both requests and token measurement.
JSON syntax failure after a successful HTTP response does not establish a transport failure. Files decoding uses the existing `INVALID_RESPONSE` code with operation context instead of relabeling the failure as `TRANSPORT` or adding a retry; the [provider README](../../../../packages/llm/llm-deepseek/README.md) owns the error fields.
@@ -38,6 +38,6 @@ The adapter uses the existing [request-extension registry](../architecture/2026-
## Consequences
-The package owns wire validation, stop-reason mapping, cancellation, and error classification, so protocol changes require adapter maintenance. User and tool-result input follows the [saved-input compatibility rule](../bug-fix/2026-09-18-messages-input-history-compatibility.md); other unsupported content and incomplete streams fail explicitly. The existing retry consumer owns retries; the existing assembler drops incomplete tool calls at the output limit. Messages serves the shared base, Web, and standalone first-party compositions. Explicit endpoint overrides must support Messages.
+The package owns wire validation, stop-reason mapping, cancellation, and error classification, so protocol changes require adapter maintenance. User and tool-result input follows the [saved-input compatibility rule](../../../../packages/llm/llm-deepseek/README.md); other unsupported content and incomplete streams fail explicitly. The existing retry consumer owns retries; the existing assembler drops incomplete tool calls at the output limit. Messages serves the shared base, Web, and standalone first-party compositions. Explicit endpoint overrides must support Messages.
Verification covers wire fixtures, real Loader composition, per-file unit coverage, [recorded Session replay](../../../../snapshots/session/deepseek-messages-replay/snapshot.yml) with [unknown replay versions](../../../../snapshots/session/deepseek-messages-degraded-replay/snapshot.yml), a Web Messages Session replay, and credential-gated text, thinking, tool continuation, image, and cancellation requests. Live gateway checks establish compatibility with the configured gateway; they do not establish compatibility with every Anthropic proxy.
diff --git a/.agents/notes/implemented/feature/2026-09-07-deepseek-messages-adapter.zh.md b/.agents/notes/implemented/feature/2026-09-07-deepseek-messages-adapter.zh.md
index 3cf60fc210..3f5251b645 100644
--- a/.agents/notes/implemented/feature/2026-09-07-deepseek-messages-adapter.zh.md
+++ b/.agents/notes/implemented/feature/2026-09-07-deepseek-messages-adapter.zh.md
@@ -10,13 +10,13 @@ Messages 以原生协议字段表示思考、签名、工具调用、工具结
## 决策
-[DeepSeek 适配器](../../../../packages/llm/llm-deepseek/README.zh.md)在唯一的 `deepseek-official` 路由和 `llm-deepseek` 设置命名空间下提供 Messages。[单协议决策](../simplification/2026-09-19-deepseek-messages-only.zh.md)拥有传输范围。`PreparedAdapterCall` 固定端点、凭据引用与模型能力；重试保留该代配置，后续调用读取新配置。
+[DeepSeek 适配器](../../../../packages/llm/llm-deepseek/README.zh.md)在唯一的 `deepseek-official` 路由和 `llm-deepseek` 设置命名空间下提供 Messages。[单协议说明](../../../../packages/llm/llm-deepseek/README.zh.md)拥有传输范围。`PreparedAdapterCall` 固定端点、凭据引用与模型能力；重试保留该代配置，后续调用读取新配置。
适配器遵循 [DeepSeek 兼容文档](https://api-docs.deepseek.com/zh-cn/guides/anthropic_api) 和 [Anthropic 流协议](https://platform.claude.com/docs/en/build-with-claude/streaming)。pi-ai 的 Anthropic 实现为相邻用户消息、累计用量、工具参数分片和可选思考签名的处理提供参考。DeepSeek 通过 `output_config.effort` 设置思考强度；Anthropic 思考 token 预算不控制 DeepSeek 思考强度。适配器转发显式 `temperature` 值；DeepSeek 在启用思考时接受该参数但忽略其值，因此调用方可以保留已有思考配置。
-助手内容块保留持久化的模型可见内容。带版本的 `ReplayEnvelope` 仅保存协议格式、模型标识、对齐的块类型以及内容块未包含的签名。同模型续接原样恢复签名，包括空签名；外部历史不生成虚构签名。不可用的元数据遵循现有[回放降级规则](../architecture/2026-07-14-provider-routed-llm-adapters.zh.md)：请求省略签名并记录警告，保留持久化内容；Messages 无法表示历史工具参数时使用[空输入兜底](../bug-fix/2026-09-16-messages-historical-tool-input.zh.md)。提供者回放数据对循环保持不透明，同时能够随 Session 持久化和内容块裁剪保留。
+助手内容块保留持久化的模型可见内容。带版本的 `ReplayEnvelope` 仅保存协议格式、模型标识、对齐的块类型以及内容块未包含的签名。同模型续接原样恢复签名，包括空签名；外部历史不生成虚构签名。不可用的元数据遵循现有[回放降级规则](../architecture/2026-07-14-provider-routed-llm-adapters.zh.md)：请求省略签名并记录警告，保留持久化内容；Messages 无法表示历史工具参数时使用[空输入兜底](../../../../packages/llm/llm-deepseek/README.zh.md)。提供者回放数据对循环保持不透明，同时能够随 Session 持久化和内容块裁剪保留。
-适配器优先使用确定性请求图片的 Files 引用，并管理上传缓存、刷新、配额恢复与附件省略。Files 客户端遵循[精确 `/v1` 根地址规则](../bug-fix/2026-09-15-messages-v1-base-url.zh.md)并发送必需的 beta 标头。缓存 id 按解析后的 Files 根地址与凭据限定作用域，因此等价的 `/v1` 与无版本根地址共用上传。元数据不含过期时间，因此本地复用以原始上传时间为界，不断言远端删除。Files 解析失败会按独立内联图片预算重建完整请求；调用方取消会停止它。图片策略在请求和 token 计量中保留 128 MiB 保留图片预算、20 MiB 内联 base64 预算及最旧前缀省略。
+适配器优先使用确定性请求图片的 Files 引用，并管理上传缓存、刷新、配额恢复与附件省略。Files 客户端遵循[精确 `/v1` 根地址规则](../../../../packages/llm/llm-deepseek/README.zh.md)并发送必需的 beta 标头。缓存 id 按解析后的 Files 根地址与凭据限定作用域，因此等价的 `/v1` 与无版本根地址共用上传。元数据不含过期时间，因此本地复用以原始上传时间为界，不断言远端删除。Files 解析失败会按独立内联图片预算重建完整请求；调用方取消会停止它。图片策略在请求和 token 计量中保留 128 MiB 保留图片预算、20 MiB 内联 base64 预算及最旧前缀省略。
成功 HTTP 响应之后的 JSON 语法错误不足以证明传输故障。Files 解码复用已有的 `INVALID_RESPONSE` code 并补充操作上下文，不将其改标为 `TRANSPORT` 或添加重试；错误字段由 [provider README](../../../../packages/llm/llm-deepseek/README.zh.md) 维护。
@@ -38,6 +38,6 @@ Web 显示 DeepSeek，并提供端点与凭据引用。没有端点覆盖时，
## 结果
-该包负责协议校验、停止原因映射、取消和错误分类，因此协议变化需要维护适配器。用户与工具结果输入遵循[已保存输入兼容规则](../bug-fix/2026-09-18-messages-input-history-compatibility.zh.md)；其他不支持的内容和不完整的流会明确报错。现有重试消费者负责重试；现有装配器在输出达到上限时丢弃未完成的工具调用。Messages 服务共享 base、Web 和独立的官方组合。显式端点覆盖必须支持 Messages。
+该包负责协议校验、停止原因映射、取消和错误分类，因此协议变化需要维护适配器。用户与工具结果输入遵循[已保存输入兼容规则](../../../../packages/llm/llm-deepseek/README.zh.md)；其他不支持的内容和不完整的流会明确报错。现有重试消费者负责重试；现有装配器在输出达到上限时丢弃未完成的工具调用。Messages 服务共享 base、Web 和独立的官方组合。显式端点覆盖必须支持 Messages。
验证覆盖协议夹具、真实 Loader 组合、逐文件单元覆盖率、[已记录 Session 回放](../../../../snapshots/session/deepseek-messages-replay/snapshot.yml)与[未知回放版本](../../../../snapshots/session/deepseek-messages-degraded-replay/snapshot.yml)，Web Messages Session 回放，以及凭证控制的文本、思考、工具续接、图片和取消请求。真实网关检查证明与已配置网关的兼容性，不能证明与所有 Anthropic 代理兼容。
diff --git a/.agents/notes/implemented/feature/2026-09-07-model-switch-notice.i18n.yaml b/.agents/notes/implemented/feature/2026-09-07-model-switch-notice.i18n.yaml
deleted file mode 100644
index d1cc740eac..0000000000
--- a/.agents/notes/implemented/feature/2026-09-07-model-switch-notice.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-07-model-switch-notice.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-07-model-switch-notice.md
-/agent-note-model-visible-route-change-notices:
- en: 8e372ee5814c99d1
- zh: 3fd0faa18fc02f75
-/agent-note-model-visible-route-change-notices/problem:
- en: 0c0be027f271e132
- zh: c4f6aa9217633f43
-/agent-note-model-visible-route-change-notices/decision:
- en: 86dbb17229ae9634
- zh: 6b0af5f12441461c
-/agent-note-model-visible-route-change-notices/alternatives-considered:
- en: 9e8ac73976d39c99
- zh: e637370a5f2b0de8
-/agent-note-model-visible-route-change-notices/consequences:
- en: 93976aae03285052
- zh: 27791c4f1f36dc92
diff --git a/.agents/notes/implemented/feature/2026-09-07-session-prose-local-media-display.i18n.yaml b/.agents/notes/implemented/feature/2026-09-07-session-prose-local-media-display.i18n.yaml
deleted file mode 100644
index ddf9d83bdd..0000000000
--- a/.agents/notes/implemented/feature/2026-09-07-session-prose-local-media-display.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-07-session-prose-local-media-display.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-07-session-prose-local-media-display.md
-/agent-note-session-prose-local-media-paths-display-through-a-same-origin-file-route:
- en: 58736e33d45c5578
- zh: 224ab6304833ce7f
-/agent-note-session-prose-local-media-paths-display-through-a-same-origin-file-route/problem:
- en: 934cbf480461e9e6
- zh: 986d53c72b94cfe4
-/agent-note-session-prose-local-media-paths-display-through-a-same-origin-file-route/decision:
- en: 37e189446dd25601
- zh: 0321b091e2250650
-/agent-note-session-prose-local-media-paths-display-through-a-same-origin-file-route/alternatives-considered:
- en: b184da259c41e4de
- zh: 5c75e50fa595a30e
-/agent-note-session-prose-local-media-paths-display-through-a-same-origin-file-route/consequences:
- en: 9929a8ad123b21b0
- zh: ac5bf7f3a317d180
-/agent-note-session-prose-local-media-paths-display-through-a-same-origin-file-route/testing:
- en: 3c29c3c506a993b2
- zh: 2dfac506ae2ff93a
diff --git a/.agents/notes/implemented/feature/2026-09-08-composer-menu-sections-and-localized-rows.i18n.yaml b/.agents/notes/implemented/feature/2026-09-08-composer-menu-sections-and-localized-rows.i18n.yaml
deleted file mode 100644
index 9956298fd4..0000000000
--- a/.agents/notes/implemented/feature/2026-09-08-composer-menu-sections-and-localized-rows.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-08-composer-menu-sections-and-localized-rows.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-08-composer-menu-sections-and-localized-rows.md
-/agent-note-composer-menu-sections-localized-rows-and-the-file-row:
- en: c917d19351c56a78
- zh: f443c8b88e4f71dd
-/agent-note-composer-menu-sections-localized-rows-and-the-file-row/problem:
- en: 3047bf5dd9f33e93
- zh: 34b017add5329b49
-/agent-note-composer-menu-sections-localized-rows-and-the-file-row/decision:
- en: 7f9b8265d826561e
- zh: e2eca2e3f58d296f
-/agent-note-composer-menu-sections-localized-rows-and-the-file-row/alternatives-considered:
- en: a7806a39ab7a1bac
- zh: 421815a13d53e306
-/agent-note-composer-menu-sections-localized-rows-and-the-file-row/consequences:
- en: 8d4daba9e67cdfaa
- zh: 6ef43f58f9abf3bc
diff --git a/.agents/notes/implemented/feature/2026-09-08-composer-menu-sections-and-localized-rows.md b/.agents/notes/implemented/feature/2026-09-08-composer-menu-sections-and-localized-rows.md
deleted file mode 100644
index 50b97ce2c7..0000000000
--- a/.agents/notes/implemented/feature/2026-09-08-composer-menu-sections-and-localized-rows.md
+++ /dev/null
@@ -1,43 +0,0 @@
-# Agent Note: Composer menu sections, localized rows, and the File row
-
-Status: implemented
-
-English | [中文](2026-09-08-composer-menu-sections-and-localized-rows.zh.md)
-
-## Problem
-
-The composer's `+` button and a typed `/` listed every command in Host registration order as `name description`, all lowercase, with no glyphs and no grouping, beside a separate paperclip button for files. Under Chinese the rows stayed English because Host descriptors carry English text only, and a user who knew a command by its Chinese title could neither find it by that title nor see what to type. Issue #3567 and the design doc for it ask for two sections in usage order, a glyph and a left-aligned title per row with the description right-aligned, capitalized English titles, Chinese titles and descriptions that stay searchable in both languages and show the English command name, a Chinese fill for the Plan and Goal claims, and a File entry inside the menu.
-
-## Decision
-
-`ui-commands` owns the menu's presentation in `src/client/presentation.ts`: an Add section (`file`, `goal`, `plan`, `feedback`) and a Commands section (`compact`, `permission`, `model`, `export`), each in usage order, with rows outside both lists closing Commands in catalog order. The section lists are keyed by name; an empty query returns the sectioned rows, and a typed query returns the flat ranking of every visible row so the best match is always first.
-
-The six built-in Host commands get their localized title, description, glyph, and claim token from the client. Stable identity selection and input resolution follow the [command identity decision](../architecture/2026-09-10-command-identities-and-composer-file-action.md). Contributions carry `label()`, `description()`, and `icon`, read on every candidate pass, so the `/model` row localizes without re-registration.
-
-A menu pick fills the locale's claim token: under Chinese, picking Plan fills `/计划 ` and the submission executes `/plan `. A typed token keeps its typed spelling as the claim, because the composer reads the arguments after the token it holds. The effective Session catalog resolves Chinese and English aliases through the same input path in every locale.
-
-The File row is an `action` contribution: a bare invocation consumes the trigger token and runs a client callback without submitting a message. Conversation owns that registration, its live availability, and the hidden file input. The menu replaces the separate paperclip button; the `+` button's accessible name and tooltip read "Add files or run commands".
-
-`ui-input-trigger` renders the new row anatomy: `InputTriggerCandidate.label` is the title and a second search key of the shared `rankByName`, the name renders as a trailing alias when the label differs from it, `icon` accepts an icon component beside the reference glyph tokens, and the description is right-aligned. Aliases and descriptions use a font one pixel below the primary labels. `ui-primitives` gains the Plan glyph from the design doc, a static ring for Compact, and the permission shield contour.
-
-The menu uses a 400 px border-box height cap, which fits both headings and the eight built-in rows before the viewport clamp reduces it. A real overflow keeps a 6 px draggable WebKit rail around a 2 px visible thumb, insets the track from the rounded ends, and shows a bottom fade until the viewport reaches the final row; Firefox keeps its standard thin scrollbar.
-
-## Alternatives considered
-
-**Release a claim when its separator is deleted.** The complete command name still identifies the selected command. Keeping the claim until the name changes preserves its highlight through argument replacement and avoids relying on an IME-generated space to run ordinary keydown adjudication. The shared input machine applies this rule to every command token, including failure recovery; neither the command name nor the locale selects a separate implementation.
-
-**Restore placeholders directly on native composition end.** Browsers can deliver that event before Lexical reconciles the final text. The shared editor binding keeps command hints and ordinary placeholders hidden while either native or editor composition remains active, and reevaluates visibility after an editor commit, including a cancellation that changes no text. Keyboard submit guards retain their separate post-composition window.
-
-**Localize descriptions on the Host.** The Host has no locale and its catalog is shared by every client; localized product copy belongs to the client.
-
-**Keep sections under a typed query.** Ranking inside sections put a prefix hit in Commands below weaker matches in Add (typing `e` listed Feedback and File above Export); a flat ranking keeps the best match first, and the headings only carry information while the list is complete.
-
-**Keep the paperclip beside the menu.** The design doc and the issue's acceptance criteria integrate the entry into the menu and forbid the old icon from showing twice; the hidden file input and the drop gate stay where they were.
-
-**A contribution-owned copy for the built-in Host rows.** Host packages have no client half to register from, so the copy has to live on the client; one table keyed by name in the package that already owns the `/` source keeps the design decision in one place.
-
-**A `token` alias only under the active locale.** Resolving through every dictionary costs nothing and lets a draft persisted under one locale submit under another.
-
-## Consequences
-
-The menu and localized presentation remain client-owned, while the Host owns effective command definitions. Adding a localized first-party command requires its identity mapping, dictionary entries, icon, and menu position. Session-driven browser scenarios and owner-local ARIA expectations cover the menu. Unrelated same-name definitions keep their own copy and no first-party glyph. The command identity decision owns this distinction and the File action's lifecycle.
diff --git a/.agents/notes/implemented/feature/2026-09-08-composer-menu-sections-and-localized-rows.zh.md b/.agents/notes/implemented/feature/2026-09-08-composer-menu-sections-and-localized-rows.zh.md
deleted file mode 100644
index 92bcb04bfe..0000000000
--- a/.agents/notes/implemented/feature/2026-09-08-composer-menu-sections-and-localized-rows.zh.md
+++ /dev/null
@@ -1,43 +0,0 @@
-# Agent Note: Composer 菜单分节、本地化行与「文件」行
-
-Status: implemented
-
-[English](2026-09-08-composer-menu-sections-and-localized-rows.md) | 中文
-
-## 问题
-
-composer 的 `+` 按钮与键入的 `/` 按宿主注册顺序把每个命令列成 `name description`，全部小写，没有图标也不分组，旁边还有一个单独的回形针按钮用于添加文件。中文界面下各行仍是英文，因为宿主描述符只携带英文文案；只知道命令中文名的用户既搜不到它，也看不出该输入什么。Issue #3567 及其设计稿要求：按使用频次分成两个小节，每行带图标、标题左对齐、说明右对齐，英文标题首字母大写，中文标题与说明在两种语言下都能搜索并同时显示英文命令名，计划与目标的声明用中文填入，以及把「文件」入口放进菜单。
-
-## 决策
-
-`ui-commands` 在 `src/client/presentation.ts` 里拥有菜单的展示：「添加」小节（`file`、`goal`、`plan`、`feedback`）与「指令」小节（`compact`、`permission`、`model`、`export`），各按使用频次排列，不在两个清单里的行按目录顺序排在「指令」末尾。小节清单按名字索引；空查询返回分节的行，输入查询后返回所有可见行的平铺排序，最佳匹配始终在第一位。
-
-六个内置宿主命令从客户端取得本地化标题、说明、图标和认领 token。稳定标识选择与输入解析遵循[命令标识决策](../architecture/2026-09-10-command-identities-and-composer-file-action.zh.md)。贡献项携带 `label()`、`description()` 和 `icon`，每次生成候选项时读取，因此 `/model` 行无需重新注册即可本地化。
-
-菜单选中填入当前语言的认领 token：中文下选中「计划」填入 `/计划 `，提交时执行 `/plan `。手输 token 保留原写法作为认领，因为输入框从它持有的 token 之后读取参数。会话有效目录在所有界面语言下通过同一输入路径解析中英文别名。
-
-「文件」行是一个 `action` 贡献项：裸调用消费触发 token 后运行客户端回调，不提交消息。Conversation 负责该注册、实时可用性和隐藏文件输入框。菜单取代单独的回形针按钮，`+` 按钮的无障碍名称与提示为「添加文件或调用指令」。
-
-`ui-input-trigger` 渲染新的行结构：`InputTriggerCandidate.label` 是标题，也是共享 `rankByName` 的第二个搜索键；label 与名字不同时名字渲染为尾随别名；`icon` 在引用图标 token 之外接受图标组件；说明右对齐。别名与说明使用比主标签小 1px 的字号。`ui-primitives` 新增设计稿给出的计划图标、压缩用的静态环形，以及权限盾形轮廓。
-
-菜单采用 400 px 的 border-box 高度上限，在视口限制缩小高度前可容纳两个小节标题与八个内置入口。内容确实溢出时，WebKit 系浏览器用 6 px 的可拖动区域承载 2 px 的可见滑块，轨道避开圆角两端，视口抵达最后一行前显示底部渐隐；Firefox 保留标准细滚动条。
-
-## 考虑过的替代方案
-
-**删除分隔空格时释放命令认领。** 完整命令名仍能标识已选命令。保留认领直到命令名改变，可以在替换参数时保持高亮，也无需依赖输入法生成的空格触发普通按键裁决。共享输入状态机对所有命令 token 使用这个规则，提交失败后的恢复也相同；命令名和界面语言都不选择另一套实现。
-
-**在原生组合输入结束事件中直接恢复占位文字。** 浏览器可能先发送该事件，Lexical 随后才完成最终文字更新。共享编辑器绑定在原生输入法或编辑器仍处于组合输入时隐藏命令提示和普通占位文字，并在编辑器提交更新后重新判断显隐，包括没有文字变化的取消操作。键盘提交保护保留独立的组合输入结束后保护时段。
-
-**在宿主侧本地化说明。** 宿主没有语言设置，目录由所有客户端共享，本地化产品文案属于客户端。
-
-**输入查询后保留小节。** 在小节内排序会把「指令」里的前缀命中排在「添加」里较弱的匹配之下（输入 `e` 时反馈与文件排在导出之上）；平铺排序让最佳匹配始终靠前，小节标题只在列表完整时才有信息量。
-
-**在菜单旁保留回形针。** 设计稿与 issue 的验收条件都要求把入口整合进菜单且旧图标不再重复显示；隐藏的文件输入框与拖放门槛保持原位。
-
-**由贡献项拥有内置宿主行的文案。** 宿主包没有客户端一半可供注册，文案只能放在客户端；在已经拥有 `/` source 的包里用一张按名字索引的表，能把设计决策集中在一处。
-
-**只在当前语言下解析 `token` 别名。** 遍历所有词典解析没有成本，还能让在一种语言下持久化的草稿在另一种语言下提交。
-
-## 后果
-
-菜单与本地化展示由客户端负责，宿主负责有效命令定义。新增本地化内置命令需要对应的标识映射、词典条目、图标和菜单位置。会话驱动的浏览器场景与归属模块的 ARIA 预期覆盖菜单。无关的同名定义保留自己的文案，不获得内置图标。命令标识决策负责这一划分和文件动作的生命周期。
diff --git a/.agents/notes/implemented/feature/2026-09-08-desktop-uninstall-preserve-dsh-home.i18n.yaml b/.agents/notes/implemented/feature/2026-09-08-desktop-uninstall-preserve-dsh-home.i18n.yaml
deleted file mode 100644
index ea1536b2ae..0000000000
--- a/.agents/notes/implemented/feature/2026-09-08-desktop-uninstall-preserve-dsh-home.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-08-desktop-uninstall-preserve-dsh-home.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-08-desktop-uninstall-preserve-dsh-home.md
-/agent-note-windows-uninstall-retains-the-harness-home:
- en: ae26a8eee5e5ef6e
- zh: 2549190b3d8890e1
-/agent-note-windows-uninstall-retains-the-harness-home/problem:
- en: 7e0091e3af8b52d8
- zh: b40193a58711c6a5
-/agent-note-windows-uninstall-retains-the-harness-home/decision:
- en: fd2608389491a1f8
- zh: b007e1d35a049292
-/agent-note-windows-uninstall-retains-the-harness-home/alternatives-considered:
- en: f3a2c8263d598b30
- zh: 226a3203c940bdd3
-/agent-note-windows-uninstall-retains-the-harness-home/deferred:
- en: 7d13267e5928961a
- zh: 79398501c8e099dd
-/agent-note-windows-uninstall-retains-the-harness-home/consequences:
- en: 9f94a327edbd7685
- zh: fa53c77c2d9df54d
diff --git a/.agents/notes/implemented/feature/2026-09-08-feedback-dialog-and-categories.i18n.yaml b/.agents/notes/implemented/feature/2026-09-08-feedback-dialog-and-categories.i18n.yaml
deleted file mode 100644
index 5de5db011a..0000000000
--- a/.agents/notes/implemented/feature/2026-09-08-feedback-dialog-and-categories.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-08-feedback-dialog-and-categories.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-08-feedback-dialog-and-categories.md
-/agent-note-feedback-dialog-categories-and-the-acknowledgement-toast:
- en: 0ca76fe002b0b0fc
- zh: 14fa2772a6a23e25
-/agent-note-feedback-dialog-categories-and-the-acknowledgement-toast/problem:
- en: 90ac7f116156c209
- zh: 20274add2ffbcdc0
-/agent-note-feedback-dialog-categories-and-the-acknowledgement-toast/decision:
- en: 4cde40e5b1ad6beb
- zh: fb49e47434faf06f
-/agent-note-feedback-dialog-categories-and-the-acknowledgement-toast/alternatives-considered:
- en: 3713257ee75869da
- zh: 5892d375fe8d0764
-/agent-note-feedback-dialog-categories-and-the-acknowledgement-toast/consequences:
- en: a55c05291a78e922
- zh: 1373131586665daf
diff --git a/.agents/notes/implemented/feature/2026-09-08-file-display-through-filesystem.i18n.yaml b/.agents/notes/implemented/feature/2026-09-08-file-display-through-filesystem.i18n.yaml
deleted file mode 100644
index efe36291ac..0000000000
--- a/.agents/notes/implemented/feature/2026-09-08-file-display-through-filesystem.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-08-file-display-through-filesystem.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-08-file-display-through-filesystem.md
-/agent-note-authenticated-file-display-reuses-filesystem-byte-reads:
- en: 1db6d91b6011384e
- zh: 68152c2e3fff2931
-/agent-note-authenticated-file-display-reuses-filesystem-byte-reads/problem:
- en: c8e25473775da151
- zh: af807ea30d423858
-/agent-note-authenticated-file-display-reuses-filesystem-byte-reads/decision:
- en: d448ed98f635fd14
- zh: 81795f947a0c1c99
-/agent-note-authenticated-file-display-reuses-filesystem-byte-reads/alternatives-considered:
- en: 80e52b422305ca28
- zh: d0e38b1cd96be951
-/agent-note-authenticated-file-display-reuses-filesystem-byte-reads/consequences:
- en: 15ec0dd18d621f24
- zh: e4925a96395edd8c
-/agent-note-authenticated-file-display-reuses-filesystem-byte-reads/testing:
- en: 9d28b1552a2decde
- zh: 6ea9f91992bcfa1a
diff --git a/.agents/notes/implemented/feature/2026-09-08-present-workspace-source-files.i18n.yaml b/.agents/notes/implemented/feature/2026-09-08-present-workspace-source-files.i18n.yaml
index e2c08a0acd..72705e7a3a 100644
--- a/.agents/notes/implemented/feature/2026-09-08-present-workspace-source-files.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-09-08-present-workspace-source-files.i18n.yaml
@@ -9,8 +9,8 @@
en: 8598b8d2e92bcfa1
zh: e3ae5fc294711095
/agent-note-present-declares-workspace-source-files/decision:
- en: 481549ced705b010
- zh: 8cad3ea14f84decf
+ en: 13ea1b1be39b214b
+ zh: cd4cea316f8eae51
/agent-note-present-declares-workspace-source-files/alternatives-considered:
en: b959eae9786351da
zh: 030c06051d6ac4be
diff --git a/.agents/notes/implemented/feature/2026-09-08-present-workspace-source-files.md b/.agents/notes/implemented/feature/2026-09-08-present-workspace-source-files.md
index 52cc3e9cdb..45780be4da 100644
--- a/.agents/notes/implemented/feature/2026-09-08-present-workspace-source-files.md
+++ b/.agents/notes/implemented/feature/2026-09-08-present-workspace-source-files.md
@@ -10,13 +10,13 @@ Users need to open and edit the files produced in their workspace, including she
## Decision
-The [present tool](../../../../packages/deliverables/tool-present/README.md) declares existing regular source files under the [Session filesystem access policy](2026-09-09-present-filesystem-access.md). It records paths and optional descriptions without reading or copying contents. The [deliverables plugin](../../../../packages/client/ui-deliverables/README.md) opens current workspace sources in the Host's default application. Edits are visible on the next open; deletion or movement makes the declaration unavailable. File-content preservation and copy-on-write storage are deferred until a persistence design owns them.
+The [present tool](../../../../packages/deliverables/tool-present/README.md) declares existing regular source files under the [Session filesystem access policy](../../../../packages/deliverables/tool-present/README.md). It records paths and optional descriptions without reading or copying contents. The [deliverables plugin](../../../../packages/client/ui-deliverables/README.md) opens current workspace sources in the Host's default application. Edits are visible on the next open; deletion or movement makes the declaration unavailable. File-content preservation and copy-on-write storage are deferred until a persistence design owns them.
The [tool description](../../../../packages/deliverables/tool-present/README.md#model-experience) guides the model's choice of files for explicit delivery. A declaration remains distinct from a prose file reference. The recorded [SVG delivery scenario](../../../../snapshots/web/present-svg/snapshot.yml) covers the resulting file, delivery event, and card. New recordings explicitly request a separate file card; replay preserves the recorded request. This scenario verifies explicit delivery, not a requirement to call `present` for every SVG. Its UI snapshot covers the expanded Chat transcript; navigation and composer controls belong to their own scenarios, so unrelated chrome changes cannot invalidate file-delivery expectations.
The tool remains an ordinary package with shared filesystem and tool error classes. Its pure type entry owns the delivery event without importing Host code into the browser. The `standard`, `ptc`, and `cordis` presets mount it; `minimal` retains its two tools. Each plugin instance correlates its executions with successful final `tools/result` notifications before appending `deliverables/presented`. Native and nested calls share this rule. A later enclosing program failure does not revoke a completed nested declaration; blocked results publish none, and same-name scoped replacements cannot publish another instance's results.
-An authenticated POST selects a declaration by viewed Session, event sequence, and original file index. The event carries no owning Session ID; relative paths in inherited history resolve against the viewed Session's workspace. The Host verifies regular-file existence and Host-path mapping before native opening. Route disposal cancels and awaits pending commands. The [changed-files card](2026-09-11-turn-changed-files-card.md) lists the turn's recorded changes beside the delivery cards; neither surface implies final delivery.
+An authenticated POST selects a declaration by viewed Session, event sequence, and original file index. The event carries no owning Session ID; relative paths in inherited history resolve against the viewed Session's workspace. The Host verifies regular-file existence and Host-path mapping before native opening. Route disposal cancels and awaits pending commands. The [changed-files card](../../../../packages/deliverables/workspace-changes/README.md) lists the turn's recorded changes beside the delivery cards; neither surface implies final delivery.
File cards use the same split-control pattern as the Session header. The card and the left Open segment preview the source in the right Sidebar; the chevron opens the standard menu for default-app and file-manager actions. The Host selects the file in Finder or Explorer, or opens its containing folder through the default Linux file manager. Both native actions resolve the same saved declaration and verify the Session filesystem and Host path; neither accepts a browser-supplied replacement path. Host-derived desktop metadata keeps remote-browser labels and availability honest, and the route enforces the configured availability on each native gesture. One delivery spans the row; multiple deliveries use at most two columns, retain every declaration, and collapse after the first four cards until the user expands the list. Desktop metadata is invalidated with the connection generation so an old Host cannot keep native actions disabled or supply the wrong file-manager labels. Old metadata requests are cancelled and cannot replace the new generation’s response.
diff --git a/.agents/notes/implemented/feature/2026-09-08-present-workspace-source-files.zh.md b/.agents/notes/implemented/feature/2026-09-08-present-workspace-source-files.zh.md
index 99b7b9df1d..74214756a7 100644
--- a/.agents/notes/implemented/feature/2026-09-08-present-workspace-source-files.zh.md
+++ b/.agents/notes/implemented/feature/2026-09-08-present-workspace-source-files.zh.md
@@ -10,13 +10,13 @@ Status: implemented
## 决策
-[present 工具](../../../../packages/deliverables/tool-present/README.zh.md)声明交付[Session 文件系统访问策略](2026-09-09-present-filesystem-access.zh.md)允许的已有普通源文件。它记录路径和可选说明，不读取或复制内容。[交付插件](../../../../packages/client/ui-deliverables/README.zh.md)使用 Host 默认应用打开当前工作区源文件。下次打开会看到编辑后的内容；删除或移动文件会使声明不可用。文件内容保留与写时复制存储延期到有持久化设计负责时实现。
+[present 工具](../../../../packages/deliverables/tool-present/README.zh.md)声明交付[Session 文件系统访问策略](../../../../packages/deliverables/tool-present/README.zh.md)允许的已有普通源文件。它记录路径和可选说明，不读取或复制内容。[交付插件](../../../../packages/client/ui-deliverables/README.zh.md)使用 Host 默认应用打开当前工作区源文件。下次打开会看到编辑后的内容；删除或移动文件会使声明不可用。文件内容保留与写时复制存储延期到有持久化设计负责时实现。
[工具说明](../../../../packages/deliverables/tool-present/README.zh.md#model-experience)指导模型选择需要显式交付的文件。交付声明与正文中的文件引用各自独立。录制的 [SVG 交付场景](../../../../snapshots/web/present-svg/snapshot.yml)覆盖生成文件、交付事件和卡片。新录制明确请求独立文件卡片，回放保留录制时的请求。该场景验证显式交付，不要求所有 SVG 都调用 `present`。其 UI 快照覆盖展开后的 Chat 对话内容；导航和输入框控件由各自场景负责，避免无关界面改动使文件交付预期失效。
工具保持为普通包，共享文件系统和工具错误类型。其纯类型入口拥有交付事件，不向浏览器导入 Host 代码。`standard`、`ptc` 与 `cordis` preset 挂载工具；`minimal` 保持两个工具。每个插件实例将其执行与成功的最终 `tools/result` 通知关联，再追加 `deliverables/presented`。原生与嵌套调用遵循同一规则。外层程序随后失败不会撤销已完成的嵌套声明；被阻止的结果不发布声明，同名作用域替换也不能发布其他实例的结果。
-经过认证的 POST 按当前查看的 Session、事件序号和原始文件索引选择声明。事件不携带所属 Session ID；继承历史中的相对路径按当前查看的 Session 工作区解析。Host 在原生打开前检查普通文件是否存在，并验证 Host 路径映射。路由释放时取消并等待进行中的命令。[改动文件卡片](2026-09-11-turn-changed-files-card.zh.md)在交付卡片旁列出本轮记录的改动；两个表面均不表示最终交付。
+经过认证的 POST 按当前查看的 Session、事件序号和原始文件索引选择声明。事件不携带所属 Session ID；继承历史中的相对路径按当前查看的 Session 工作区解析。Host 在原生打开前检查普通文件是否存在，并验证 Host 路径映射。路由释放时取消并等待进行中的命令。[改动文件卡片](../../../../packages/deliverables/workspace-changes/README.zh.md)在交付卡片旁列出本轮记录的改动；两个表面均不表示最终交付。
文件卡片采用与 Session 顶栏相同的分段控件。点击卡片或左侧“打开”区域会在右侧 Sidebar 预览源文件；右侧箭头打开包含默认应用与文件管理器操作的标准菜单。Host 在 Finder 或文件资源管理器中选中文件，或通过 Linux 默认文件管理器打开所在文件夹。两个原生操作都解析同一份已保存声明并验证 Session 文件系统与 Host 路径；均不接受浏览器提供的替代路径。来自 Host 的桌面信息使远程浏览器中的文案和可用性保持准确，路由在每次原生操作时执行配置的可用性检查。单个交付占满整行；多个交付每行最多两列，并保留所有声明，前四张卡片之后的内容在用户展开列表前保持收起。 桌面元数据随连接代次失效，避免旧主机信息让原生操作持续禁用或显示错误的文件管理器名称。旧元数据请求会被取消，不能覆盖新代次的响应。
diff --git a/.agents/notes/implemented/feature/2026-09-08-shared-file-type-icons.i18n.yaml b/.agents/notes/implemented/feature/2026-09-08-shared-file-type-icons.i18n.yaml
deleted file mode 100644
index 569b09933e..0000000000
--- a/.agents/notes/implemented/feature/2026-09-08-shared-file-type-icons.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-08-shared-file-type-icons.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-08-shared-file-type-icons.md
-/agent-note-shared-file-type-icons:
- en: d83f437754356503
- zh: 7f5b673537312d8c
-/agent-note-shared-file-type-icons/problem:
- en: 67d8c2d11e0ae0a2
- zh: fb2a576b528db3ad
-/agent-note-shared-file-type-icons/decision:
- en: 418ba69021928ba0
- zh: 7fc1b5cef5f22004
-/agent-note-shared-file-type-icons/alternatives-considered:
- en: 67dc36a02b841541
- zh: cf262c343957ff69
-/agent-note-shared-file-type-icons/testing:
- en: 16768b2ea13d16ef
- zh: e7455e31220bb2e6
-/agent-note-shared-file-type-icons/consequences:
- en: fb30a1c743dbe885
- zh: 858fb79479434d69
diff --git a/.agents/notes/implemented/feature/2026-09-08-shared-file-type-icons.md b/.agents/notes/implemented/feature/2026-09-08-shared-file-type-icons.md
deleted file mode 100644
index 5dbe0ade14..0000000000
--- a/.agents/notes/implemented/feature/2026-09-08-shared-file-type-icons.md
+++ /dev/null
@@ -1,44 +0,0 @@
-# Agent Note: Shared file-type icons
-
-Status: implemented
-
-English | [中文](2026-09-08-shared-file-type-icons.zh.md)
-
-## Problem
-
-Client feature plugins can share React components only through `@deepseek-ai/dsh-client-ui-primitives`, but file cards had no shared file-type presentation. The package-owned classifier provides the only extension table and deliberately folds detailed file types into six link categories for `LinkIconMedium`, while attachment cards, sent-message attachments, queued files, and workspace file rows use detailed file glyphs. Adding a precise file icon anywhere else would require another extension table or a runtime import between feature plugins.
-
-## Decision
-
-`ui-primitives` owns one Cordis-free file classification and rendering API. `fileExtension(path)` applies the shared basename and final-dot semantics to either path separator. `classifyFileType(path)` matches without case sensitivity and returns the closed `FileType` union: the traditional `code`, `excel`, `folder`, `html`, `image`, `markdown`, `other`, `pdf`, `ppt`, `video`, and `word` categories plus the detailed `CodeFileType` categories rendered by `CodeFileIcon`. Exact filenames, filename prefixes, filename suffixes, optional project context, and extensions run in that order. The path classifier returns every member except `folder`; callers use the explicit `FileTypeIcon` `kind` override when they know an entry is a directory. Unknown extensions, missing extensions, and trailing dots resolve to `other`, except the shared table recognizes named files such as `Dockerfile`, `Makefile`, `package.json`, `.gitignore`, `README`, and `CHANGELOG`.
-
-`FileTypeIcon` accepts a path, shared `IconProps`, the explicit `kind`, and an optional project-file snapshot. Traditional file types render the supplied 28px document and folder contours as inline SVG. The spreadsheet glyph uses the supplied unscaled 1.2px table grid; Markdown, PDF, PPT, and Word foreground marks scale to 122% around their visual center, and the remaining marked traditional glyphs use 112%. The file body and folded corner retain their source geometry, and the generic file has no invented center mark. The sheet is a solid category color, the foreground mark and ordinary folded corner are white, and the generic file has a darker grey corner. CSS assigns the supplied category palette through static design tokens: DeepSeek blue for code/HTML/Markdown, the lighter DeepSeek blue for Word, green for spreadsheets, two amber steps for folder/PPT, red for PDF, and neutral grey for unknown files. Image and video share the supplied violet through a component-local variable because the design platform has no matching violet token. A caller may override a traditional sheet through `--dsh-file-type-icon-color`.
-
-Recognized code and configuration files render the corresponding 20px square artwork scaled to the requested icon size. The embedded static table contains exactly the 48 established `CodeFileType` entries; archive-only artwork does not add a category, and an adjacent manifest records the responsible design owner and source digests. Tests reject scripts, event attributes, external references, and duplicate ids in that table. `CodeFileIcon` replaces local SVG ids with a per-component prefix before insertion so repeated gradients and clip paths remain independent. These technology marks retain their embedded multicolor fills and are the explicit exception to the ordinary current-color icon rule. The map selects React before TypeScript/JavaScript, Angular filename suffixes before their base extension, Docker/Node/Git/Make/CMake by filename rules, and Flutter only when the optional project snapshot contains a `pubspec.yaml` whose text includes `flutter:`. Markdown and SVG remain owned by the traditional Markdown and image categories. CSV, TSV, Excel workbooks and templates, OpenDocument spreadsheets, and Numbers use the spreadsheet glyph in file cards, rows, and preview titles; their clickable links use the document category. Both `.env` and names ending in `.env` use the environment glyph. Every traditional and technology SVG is `aria-hidden`, and the card, row, or button that owns the file identity supplies the accessible name.
-
-`LinkIconMedium` delegates extension classification to `classifyFileType` and folds the detailed result into its existing link vocabulary: code and HTML use `code`, images use `image`, PDF/Word/Excel/PPT use `document`, and Markdown/video/unknown files use `other`. Extensionless names remain `other` in link contexts, so the 14px clickable-link appearance defined by the [link styling rules](../../../../docs/web-styling.md) does not change.
-
-Attachment upload cards, sent-message file cards, queued-file rows, and workspace file rows render `FileTypeIcon`. The Files tab title renders its explicit `folder` kind at 16px. Explicit delivery cards use `FileTypeIcon` at 20px and `fileExtension` for their fallback metadata. The two metadata rows use `fileExtension` rather than local parsers; a leading-dot basename such as `.env` therefore displays `ENV`, while an absent or trailing suffix displays no extension label. Image content continues to render as a preview rather than a file-type glyph, and produced-file links and Markdown file mentions continue to use `LinkIconMedium` because they are link surfaces.
-
-## Alternatives considered
-
-**Use `LinkIconMedium` for every file surface.** Rejected. Its six categories and 14px outline drawings communicate link destinations at text size; a 28px file card has room for the supplied HTML, Markdown, PDF, Word, Excel, PPT, and video identities.
-
-**Keep a second extension table beside `LinkIconMedium`.** Rejected. The same path could drift to different categories as either list grows. One detailed table plus an explicit detailed-to-link adapter preserves both consumers' semantics.
-
-**Put the supplied traditional-file colors directly in each SVG path.** Rejected. Traditional SVG geometry stays reusable and follows the icon set's `currentColor` rule; the component stylesheet owns the default category palette, and render sites retain one CSS-variable override instead of rewriting path fills. The technology artwork is exempt because its embedded multicolor marks identify the language or tool rather than decorating a generic file silhouette.
-
-**Add archive, audio, and data categories for symmetry.** Rejected. The supplied artwork and current consumers require no such glyphs. New `FileType` members require a shipped render site and artwork that remains legible at the 28px seat.
-
-## Testing
-
-The `ui-primitives` specs cover case-insensitive suffixes, both path separators, leading-dot files, missing and trailing suffixes, common named files, unknown fallback, all detailed code mappings, rule priority, Flutter context, the exact 48-key artwork set, rejected archive-only categories, static-markup safety, instance-safe SVG ids and references, `aria-hidden`, sizing/class forwarding, distinct artwork, the supplied spreadsheet grid, the 112% and 122% foreground-mark transforms, and the traditional solid-sheet/contrast-mark layers without literal SVG colors. A stylesheet spec pins every traditional category-to-color mapping, the caller override, and the local violet value. The `LinkIconMedium` classification table pins its coarse output, including `Makefile` remaining `other`. Attachment, chat, queue, and sidebar component suites exercise the migrated render paths; their accessibility output does not change because the glyphs remain decorative.
-
-## Consequences
-
-- Client packages use one filename parser and one detailed file-type table instead of importing or recreating feature-local logic.
-- A new suffix joins the detailed table only when an existing glyph truthfully represents it. If its link category differs from the current adapter, the change must also decide whether the 14px link appearance changes.
-- Code and configuration artwork preserves its embedded palette and does not accept the traditional `--dsh-file-type-icon-color` override.
-- The fixed 48-entry artwork table adds about 35 kB uncompressed and 17 kB gzip to the shared browser bundle; adding categories must justify that static baseline cost.
-- The primitive owns no copy but does own the default file-type palette. Consumers continue to own accessible labels and surrounding text, and may replace the category color through `--dsh-file-type-icon-color`.
-- The detailed category names describe presentation, not MIME validation. A suffix is a display hint and does not establish file contents or trust.
diff --git a/.agents/notes/implemented/feature/2026-09-08-shared-file-type-icons.zh.md b/.agents/notes/implemented/feature/2026-09-08-shared-file-type-icons.zh.md
deleted file mode 100644
index 9dbccdf10f..0000000000
--- a/.agents/notes/implemented/feature/2026-09-08-shared-file-type-icons.zh.md
+++ /dev/null
@@ -1,44 +0,0 @@
-# Agent Note: 共享文件类型图标
-
-Status: implemented
-
-[English](2026-09-08-shared-file-type-icons.md) | 中文
-
-## 问题
-
-客户端功能插件只能通过 `@deepseek-ai/dsh-client-ui-primitives` 共享 React 组件，但文件卡片没有共享的文件类型呈现。本包拥有唯一一份扩展名分类表，并为 `LinkIconMedium` 将细分文件类型有意折叠为六种链接类别；附件卡片、已发送消息附件、排队文件和工作区文件行使用细分文件图形。在其他位置增加精细文件图标，需要再复制一份扩展名表或让功能插件之间产生运行时 import。
-
-## 决策
-
-`ui-primitives` 统一拥有一套 Cordis-free 的文件分类与渲染 API。`fileExtension(path)` 对两种路径分隔符采用共享的 basename 与最终点号语义。`classifyFileType(path)` 不区分大小写，并返回闭合的 `FileType` 联合：传统的 `code`、`excel`、`folder`、`html`、`image`、`markdown`、`other`、`pdf`、`ppt`、`video`、`word` 类别，以及由 `CodeFileIcon` 渲染的细分 `CodeFileType` 集合。解析按完整文件名、文件名前缀、文件名后缀、可选项目上下文、扩展名的顺序执行。路径分类器返回 `folder` 之外的全部成员；调用方确认条目是目录时，通过 `FileTypeIcon` 的显式 `kind` 覆盖指定目录。未知扩展名、无扩展名和末尾点号回退到 `other`，但共享表识别 `Dockerfile`、`Makefile`、`package.json`、`.gitignore`、`README`、`CHANGELOG` 等具名文件。
-
-`FileTypeIcon` 接受路径、共享 `IconProps`、显式 `kind`和可选的项目文件快照。传统文件类型把所提供的 28px 文档与文件夹轮廓渲染为 inline SVG。表格图形使用所提供的未缩放 1.2px 表格网格；Markdown、PDF、PPT、Word 的前景标记围绕自身视觉中心缩放至 122%，其余带标记的传统图形使用 112%。文件底板与折角保持源图几何，通用文件不凭空增加中心标记。底板使用实色分类颜色，前景标记与普通折角使用白色，通用文件使用较深的灰色折角。CSS 通过静态设计 token 分配所提供的分类调色板：code/HTML/Markdown 使用 DeepSeek 蓝，Word 使用较浅的 DeepSeek 蓝，表格使用绿色，folder/PPT 使用两档琥珀色，PDF 使用红色，未知文件使用中性灰。image 与 video 通过组件本地变量共用所提供的紫色，因为设计平台没有匹配的紫色 token。调用方可通过 `--dsh-file-type-icon-color` 覆盖传统底板颜色。
-
-已识别的代码与配置文件把对应的 20px 方形图稿缩放到请求的图标尺寸。内嵌静态表只包含现有 48 个 `CodeFileType` 条目；资源包中额外的图稿不会新增类别，相邻 manifest 记录负责的设计归属方与来源摘要。测试会拒绝该表中的脚本、事件属性、外部引用与重复 id。`CodeFileIcon` 在插入前为本地 SVG id 加上组件实例前缀，使重复渐变与裁剪路径互不干扰。这些技术标记保留自身内嵌的多色填充，是普通 current-color 图标规则的明确例外。映射让 React 优先于 TypeScript/JavaScript、Angular 文件名后缀优先于基础扩展名，并按文件名识别 Docker/Node/Git/Make/CMake；只有可选项目快照包含内容带 `flutter:` 的 `pubspec.yaml` 时才选择 Flutter。Markdown 与 SVG 仍由传统 Markdown 和图片类别拥有。CSV、TSV、Excel 工作簿与模板、OpenDocument 表格和 Numbers 在文件卡片、文件行及预览标题中使用表格图标，其可点击链接使用文档类别。`.env` 和以 `.env` 结尾的文件名均使用环境配置图标。所有传统与技术 SVG 都是 `aria-hidden` 的，拥有文件身份的卡片、行或按钮提供无障碍名称。
-
-`LinkIconMedium` 委托 `classifyFileType` 做扩展名分类，再把精细结果折叠进原有链接词汇：code 与 HTML 使用 `code`，图片使用 `image`，PDF/Word/Excel/PPT 使用 `document`，Markdown、video 与未知文件使用 `other`。无扩展名文件在链接语境中仍是 `other`，因此[链接样式规则](../../../../docs/web-styling.zh.md)定义的 14px 外观不变。
-
-附件上传卡片、已发送消息文件卡片、排队文件行和工作区文件行渲染 `FileTypeIcon`。Files 标签页标题使用显式的 `folder` 类别，尺寸为 16px。显式交付卡片使用 20px 的 `FileTypeIcon`，并通过 `fileExtension` 提供默认元数据。两处元数据行统一使用 `fileExtension`；`.env` 这样的前导点 basename 会显示 `ENV`，无后缀或末尾点号则不显示扩展名 label。图片内容继续渲染为预览而不是文件类型图形，产物文件链接与 Markdown 文件提及继续使用 `LinkIconMedium`，因为它们属于链接表面。
-
-## 备选方案
-
-**所有文件表面都使用 `LinkIconMedium`。** 否决。它的六种类别和 14px outline 图形用于在文字尺寸下表达链接目标；28px 文件卡片有空间表达所提供的 HTML、Markdown、PDF、Word、Excel、PPT 与 video 身份。
-
-**在 `LinkIconMedium` 旁保留第二份扩展名表。** 否决。任一列表增长后，同一路径可能漂移到不同类别。一份精细表加一个显式的精细到链接适配，能同时保住两类消费方的语义。
-
-**把所提供的传统文件颜色直接写入每一条 SVG path。** 否决。传统 SVG 几何保持可复用，并遵守图标集的 `currentColor` 规则；组件样式表拥有默认分类调色板，渲染点只需一个 CSS 变量即可覆盖颜色，不需要重写 path 填充。技术图稿是例外，因为其内嵌的多色标记用于识别语言或工具，而不是装饰通用文件轮廓。
-
-**为了对称增加 archive、audio 与 data 类别。** 否决。提供的图稿与当前消费方都不需要这些图形。新增 `FileType` 成员必须有已发布的渲染点，以及在 28px slot 中仍可辨认的图稿。
-
-## 测试
-
-`ui-primitives` 测试覆盖不区分大小写的后缀、两种路径分隔符、前导点文件、无后缀与末尾点号、常见具名文件、未知回退、全部细分代码映射、规则优先级、Flutter 上下文、精确的 48 键图稿集、被拒绝的资源包额外类别、静态 markup 安全性、实例安全的 SVG id 与引用、`aria-hidden`、尺寸/class 转发、不同图稿、所提供的表格网格、112% 与 122% 前景标记变换，以及不含 SVG 字面颜色的传统实色底板/对比标记层。样式表测试钉住每一项传统类别到颜色的映射、调用方覆盖变量与本地紫色值。`LinkIconMedium` 分类表钉住它的粗粒度输出，包括 `Makefile` 仍为 `other`。附件、聊天、队列和侧边栏组件测试覆盖迁移后的渲染路径；由于图形仍是装饰性的，其无障碍输出不变。
-
-## 后果
-
-- 客户端包使用一个文件名解析器与一份精细文件类型表，不再 import 或重新实现功能包本地逻辑。
-- 新后缀只在已有图形能准确表达它时加入精细表。若它的链接类别与当前适配不同，这次改动还必须决定是否改变 14px 链接外观。
-- 代码与配置图稿保留内嵌调色板，不接受传统图形的 `--dsh-file-type-icon-color` 覆盖。
-- 固定的 48 项图稿表为共享浏览器 bundle 增加约 35 kB 未压缩体积和 17 kB gzip 体积；新增类别必须证明这份静态基线成本是必要的。
-- primitive 不拥有文案，但拥有默认文件类型调色板。消费方继续拥有无障碍 label 与周围文字，并可通过 `--dsh-file-type-icon-color` 替换分类颜色。
-- 精细类别名称描述展示意图，不是 MIME 校验。后缀只是展示提示，不能证明文件内容或可信度。
diff --git a/.agents/notes/implemented/feature/2026-09-08-sidebar-default-pages.i18n.yaml b/.agents/notes/implemented/feature/2026-09-08-sidebar-default-pages.i18n.yaml
deleted file mode 100644
index b7a60a735c..0000000000
--- a/.agents/notes/implemented/feature/2026-09-08-sidebar-default-pages.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-08-sidebar-default-pages.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-08-sidebar-default-pages.md
-/agent-note-sidebar-default-pages:
- en: 0b6b9c156b3653d9
- zh: f4650c41660ea99d
-/agent-note-sidebar-default-pages/problem:
- en: 48127a7f5a873a52
- zh: a722f139876a415a
-/agent-note-sidebar-default-pages/decision:
- en: b6707d5c48eb414a
- zh: c920061739304dfc
-/agent-note-sidebar-default-pages/alternatives-considered:
- en: 8d981eef6c5088b8
- zh: 0bc9541a7f7d7b53
-/agent-note-sidebar-default-pages/consequences:
- en: eb418364a7c202e2
- zh: d2372099a1ed3e6e
diff --git a/.agents/notes/implemented/feature/2026-09-08-sidebar-default-pages.md b/.agents/notes/implemented/feature/2026-09-08-sidebar-default-pages.md
deleted file mode 100644
index 13374ab294..0000000000
--- a/.agents/notes/implemented/feature/2026-09-08-sidebar-default-pages.md
+++ /dev/null
@@ -1,25 +0,0 @@
-# Agent Note: Sidebar default pages
-
-Status: implemented
-
-English | [中文](2026-09-08-sidebar-default-pages.zh.md)
-
-## Problem
-
-A guide with one registered entry adds a click without offering a choice.
-
-## Decision
-
-The Sidebar selects each default page from the registered guide-entry list. Exactly one entry opens that entry's page; zero or multiple entries open the guide. Resource viewers without guide entries do not affect this count. Explicitly adding a guide always opens a guide, and each pane holds at most one.
-
-The [last-tab close rule](2026-09-08-sidebar-last-tab-close-rules.md) owns close protection: the sole docked guide remains open, while any other sole tab closes together with the column. The generic docking kit accepts a presentation callback and has no file-browser or guide policy. Moving tabs still settles empty panes, and layout state remains memory-only.
-
-This replaces default-guide selection in [the shipped types](2026-09-05-sidebar-text-preview-and-file-tree.md) and explicit last-tab closing in [docking infrastructure](2026-09-04-right-sidebar-docking-infrastructure.md). Their registration, content-state, engine and layout ownership decisions remain active.
-
-## Alternatives considered
-
-**Count all registered tab types or currently open tabs.** Neither counts choices available on the guide; resource viewers need not contribute an entry.
-
-## Consequences
-
-One-entry compositions open directly into their registered page without hardcoding Files. Guide selection can still replace its own tab. Store and component tests cover registration counts; the assembled browser scenarios cover default Files, explicit guide creation, and returning to Files after closing a lone tab.
diff --git a/.agents/notes/implemented/feature/2026-09-08-sidebar-default-pages.zh.md b/.agents/notes/implemented/feature/2026-09-08-sidebar-default-pages.zh.md
deleted file mode 100644
index 6730a87fbe..0000000000
--- a/.agents/notes/implemented/feature/2026-09-08-sidebar-default-pages.zh.md
+++ /dev/null
@@ -1,25 +0,0 @@
-# Agent Note: Sidebar 默认页
-
-Status: implemented
-
-[English](2026-09-08-sidebar-default-pages.md) | 中文
-
-## 问题
-
-只有一个注册入口的引导页增加一次点击，却不提供选择。
-
-## 决策
-
-Sidebar 从已注册的引导入口列表选择每个默认页。恰好一个入口时打开对应页面；没有入口或有多个入口时打开引导页。没有引导入口的资源查看器不影响计数。显式添加引导页始终打开引导，每个格最多持有一个。
-
-[最后一个 tab 的关闭规则](2026-09-08-sidebar-last-tab-close-rules.zh.md)负责关闭保护：作为唯一停靠 tab 的引导页保持打开，其他任何唯一 tab 都会连同整列一起关闭。通用停靠套件接收呈现回调，不拥有文件浏览器或引导页策略。移动 tab 仍会处理空格，布局状态仅存于内存。
-
-本决策取代[随包类型](2026-09-05-sidebar-text-preview-and-file-tree.zh.md)中的默认引导选择，以及[停靠基础设施](2026-09-04-right-sidebar-docking-infrastructure.zh.md)中的显式关闭最后一个 tab。它们的注册、内容状态、引擎与布局所有权决策继续有效。
-
-## 考虑过的替代方案
-
-**统计所有已注册 tab 类型或已打开的 tab。** 两者都不代表引导页提供的选择；资源查看器不一定贡献入口。
-
-## 后果
-
-单入口组合直接打开已注册页面，不写死 Files。引导页选择仍可替换自身 tab。store 与组件测试覆盖注册数量；组装后的浏览器场景覆盖默认 Files、显式新增引导及关闭唯一 tab 后返回 Files。
diff --git a/.agents/notes/implemented/feature/2026-09-08-sidebar-last-tab-close-rules.i18n.yaml b/.agents/notes/implemented/feature/2026-09-08-sidebar-last-tab-close-rules.i18n.yaml
deleted file mode 100644
index a4049b0446..0000000000
--- a/.agents/notes/implemented/feature/2026-09-08-sidebar-last-tab-close-rules.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-08-sidebar-last-tab-close-rules.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-08-sidebar-last-tab-close-rules.md
-/agent-note-last-tab-close-rules-on-the-sidebar-s-docked-surface:
- en: 4f38145de396b08f
- zh: 3e65231a5ebb8fdd
-/agent-note-last-tab-close-rules-on-the-sidebar-s-docked-surface/problem:
- en: 90a9c3dc146c7d11
- zh: a12b784b66fa3979
-/agent-note-last-tab-close-rules-on-the-sidebar-s-docked-surface/decision:
- en: a760dcb29bb9645c
- zh: ad4dafd7d5b407e7
-/agent-note-last-tab-close-rules-on-the-sidebar-s-docked-surface/alternatives-considered:
- en: 4e2673d521d6540e
- zh: 0d5f0b99ea80d5ff
-/agent-note-last-tab-close-rules-on-the-sidebar-s-docked-surface/consequences:
- en: 3e43dd3066e8b05b
- zh: ed6ed81abb18131b
diff --git a/.agents/notes/implemented/feature/2026-09-08-sidebar-last-tab-close-rules.md b/.agents/notes/implemented/feature/2026-09-08-sidebar-last-tab-close-rules.md
deleted file mode 100644
index ed76b0ad0b..0000000000
--- a/.agents/notes/implemented/feature/2026-09-08-sidebar-last-tab-close-rules.md
+++ /dev/null
@@ -1,27 +0,0 @@
-# Agent Note: Last-tab close rules on the Sidebar's docked surface
-
-Status: implemented
-
-English | [中文](2026-09-08-sidebar-last-tab-close-rules.zh.md)
-
-## Problem
-
-The settle planner guarantees the docked surface is never empty: closing the last tab reseeds the current default page. That guarantee made the last tab's close control a dead end in both directions. Closing the guide standing alone put the same guide straight back — a control that does nothing. Closing any other lone tab left the user with a column showing only the default page — after "close the last thing", an expanded panel with nothing in it is not what the gesture meant. The guide's chip also drew a hover capsule and a context menu whose only item was that no-op close.
-
-## Decision
-
-The docked surface's last tab carries one rule, decided in the Sidebar store's `closeTab` and mirrored to the kit through a new `canCloseTab(tabId)` control-policy prop (joining `canSplit` and `canAddTab`): the guide standing as the only docked tab is unclosable — no chip close control, no menu close item, and a programmatic close records nothing; any other lone tab closes together with the column in one history entry, resets fullscreen to push mode, and leaves the layout empty until the next expansion seeds the then-current default page. `soleDockedTab(state, tabId)` in [stores.ts](../../../../packages/client/ui-sidebar-right/src/client/stores.ts) names the condition; floating panels take no part in it. Per the packages rule "enforce a decision in the operation that makes it", the store's `closeTab` is the enforcement and `canCloseTab` only mirrors it into the chrome. This rule supersedes the close-protection part of [the default-page decision](2026-09-08-sidebar-default-pages.md); its selection rule remains active.
-
-Two kit-side presentation rules complete it in [TabPanel.tsx](../../../../packages/client/ui-dockkit/src/components/TabPanel.tsx) and [TabMenu.tsx](../../../../packages/client/ui-dockkit/src/components/TabMenu.tsx): a pane's lone chip whose close is withheld draws quiet — no capsule, no hover fill — since there is nothing to select against and nothing to do to it; and a menu that would hold no item at all produces no visible popup, so a secondary press on such a chip shows nothing rather than an empty box.
-
-## Alternatives considered
-
-**Keep the guide closable and let settle reseed it.** The visible result is a close control that does nothing; the control lies about what a press will do.
-
-**Hide the close in the Sidebar's renderer instead of a kit prop.** The kit draws the chip's close and the menu's close item, so the embedder cannot withhold them without a seam; a CSS override would leave the menu item live and split one decision across two owners.
-
-**Collapse the column from the kit when the last tab closes.** The kit has no concept of the column or its expansion; the collapse is the embedder's intent, recorded by the store alongside the close in the same entry.
-
-## Consequences
-
-`canCloseTab` is a third control-policy prop every embedder may set; leaving it out keeps every tab closable. The quiet-chip and empty-menu rules are unconditional kit behavior keyed on the same policy, so any embedder withholding a lone tab's close gets the same presentation. Reopening the column after a lone-tab close shows the default page selected from the current guide entries. Kit specs cover the withheld control, the quiet chip, and the self-dismissing menu; Sidebar unit specs cover `closeTab`'s refusal and the close-with-column entry; a [browser case](../../../../apps/web/tests/sidebar-right.e2e.ts) walks the whole rule on the rendered panel.
diff --git a/.agents/notes/implemented/feature/2026-09-08-sidebar-last-tab-close-rules.zh.md b/.agents/notes/implemented/feature/2026-09-08-sidebar-last-tab-close-rules.zh.md
deleted file mode 100644
index bcc54c0c39..0000000000
--- a/.agents/notes/implemented/feature/2026-09-08-sidebar-last-tab-close-rules.zh.md
+++ /dev/null
@@ -1,27 +0,0 @@
-# Agent Note：Sidebar 停靠面最后一个 tab 的关闭规则
-
-Status: implemented
-
-[English](2026-09-08-sidebar-last-tab-close-rules.md) | 中文
-
-## 问题
-
-settle planner 保证停靠面永不为空：关掉最后一个 tab 会重新播种当前默认页。这条保证让最后一个 tab 的关闭控件在两个方向上都走进死胡同。独自留下的引导页被关闭后，同一个引导页立刻回来——一个什么也不做的控件。任何其它 tab 独自留下时被关闭，用户面前只剩一列只显示默认页的面板——在「关掉最后一个东西」之后，一块展开着却空无内容的面板不是这个手势的本意。引导页的 chip 还画着悬停胶囊，右键菜单里唯一的条目就是那个无效的关闭。
-
-## 决定
-
-停靠面的最后一个 tab 带一条规则，由 Sidebar store 的 `closeTab` 决定，并经新的控制策略 prop `canCloseTab(tabId)`（与 `canSplit`、`canAddTab` 并列）镜像给套件：作为唯一停靠 tab 的引导页不可关闭——chip 上没有关闭控件，菜单里没有关闭项，编程式关闭什么都不记录；任何其它 tab 独自留下时，关闭会连同整列一起收起、把全屏重置为挤压模式并记为一条历史，布局保持为空，直到下次展开时创建当时的默认页。[stores.ts](../../../../packages/client/ui-sidebar-right/src/client/stores.ts) 里的 `soleDockedTab(state, tabId)` 命名这个条件；浮动面板不参与。按照 packages 规则「在做出决定的操作里执行它」，store 的 `closeTab` 是执行点，`canCloseTab` 只是把它镜像到界面。本规则取代[默认页决策](2026-09-08-sidebar-default-pages.zh.md)中的关闭保护部分；其默认页选择规则仍然有效。
-
-两条套件侧的呈现规则在 [TabPanel.tsx](../../../../packages/client/ui-dockkit/src/components/TabPanel.tsx) 与 [TabMenu.tsx](../../../../packages/client/ui-dockkit/src/components/TabMenu.tsx) 里补全它：某格仅剩的一个 chip 在关闭被收起时画成安静样式——没有胶囊底色，没有悬停填充——因为既没有别的 tab 可供选择，也没有任何可对它做的事；一个连一项都没有的菜单不会产生可见弹层，于是对这样的 chip 次键按下什么都不显示，而不是画一个空框。
-
-## 考虑过的替代方案
-
-**让引导页保持可关闭，由 settle 重新播种。** 可见的结果是一个什么也不做的关闭控件；这个控件在按下会发生什么这件事上撒谎。
-
-**在 Sidebar 的渲染器里藏掉关闭，而不加套件 prop。** chip 的关闭控件与菜单的关闭项都由套件绘制，没有接缝嵌入方就无法收起它们；CSS 覆盖会留下仍然生效的菜单项，把一个决定拆给两个所有者。
-
-**由套件在最后一个 tab 关闭时收起整列。** 套件没有「列」或「展开」的概念；收起是嵌入方的意图，由 store 在同一条历史里与关闭一并记录。
-
-## 后果
-
-`canCloseTab` 成为每个嵌入方都可设置的第三个控制策略 prop；不设置时每个 tab 都可关闭。安静 chip 与空菜单两条规则是套件的无条件行为，键在同一策略上，任何收起了独 tab 关闭的嵌入方都得到同样的呈现。独 tab 关闭后重新展开的列显示根据当前引导入口选出的默认页。套件 spec 覆盖收起的控件、安静 chip 与自行消失的菜单；Sidebar 单元 spec 覆盖 `closeTab` 的拒绝与「关闭连带整列」的历史条目；一个[浏览器用例](../../../../apps/web/tests/sidebar-right.e2e.ts)在渲染出的面板上走完整条规则。
diff --git a/.agents/notes/implemented/feature/2026-09-09-headless-machine-readable-run-surface.i18n.yaml b/.agents/notes/implemented/feature/2026-09-09-headless-machine-readable-run-surface.i18n.yaml
deleted file mode 100644
index f4cc113bc2..0000000000
--- a/.agents/notes/implemented/feature/2026-09-09-headless-machine-readable-run-surface.i18n.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-09-headless-machine-readable-run-surface.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-09-headless-machine-readable-run-surface.md
-/agent-note-headless-machine-readable-run-surface:
- en: bcf2251478004e35
- zh: 70ade47c837c6bab
-/agent-note-headless-machine-readable-run-surface/problem:
- en: 9d2c64ed47b82129
- zh: bb0de126368e9f07
-/agent-note-headless-machine-readable-run-surface/decision:
- en: ed08acff9c4ea030
- zh: 484c2646de4aa5d8
-/agent-note-headless-machine-readable-run-surface/decision/command-line-contract:
- en: 59470d5c2eba0a57
- zh: 342c1ac9042c6b46
-/agent-note-headless-machine-readable-run-surface/decision/event-stream:
- en: b6837e3de1305559
- zh: 183956da3319a126
-/agent-note-headless-machine-readable-run-surface/decision/session-identity:
- en: ebb2c5da4ea076a9
- zh: a706416d290e7424
-/agent-note-headless-machine-readable-run-surface/consequences:
- en: 1ba14087f533dd8e
- zh: 66f4aa9d63a0da23
-/agent-note-headless-machine-readable-run-surface/alternatives-considered:
- en: 42f321bd399f906e
- zh: 3b13791afa256781
diff --git a/.agents/notes/implemented/feature/2026-09-09-present-filesystem-access.i18n.yaml b/.agents/notes/implemented/feature/2026-09-09-present-filesystem-access.i18n.yaml
deleted file mode 100644
index 4b6f724f0b..0000000000
--- a/.agents/notes/implemented/feature/2026-09-09-present-filesystem-access.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-09-present-filesystem-access.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-09-present-filesystem-access.md
-/agent-note-present-follows-session-filesystem-access:
- en: 33cf0a75284f8392
- zh: 5299af2f77bf6fd8
-/agent-note-present-follows-session-filesystem-access/problem:
- en: dda1953cb567c3dc
- zh: 3c447175454c844a
-/agent-note-present-follows-session-filesystem-access/decision:
- en: 2668dd51b07e2653
- zh: 3cd895017f568c42
-/agent-note-present-follows-session-filesystem-access/alternatives-considered:
- en: 85336cd165610ddf
- zh: 75608e3bfeab5dc5
-/agent-note-present-follows-session-filesystem-access/consequences:
- en: e31784fe619d4d1c
- zh: 7cadc3941a0c7b33
diff --git a/.agents/notes/implemented/feature/2026-09-09-ptc-trajectory-code-inspection.i18n.yaml b/.agents/notes/implemented/feature/2026-09-09-ptc-trajectory-code-inspection.i18n.yaml
deleted file mode 100644
index 6ae3a85d71..0000000000
--- a/.agents/notes/implemented/feature/2026-09-09-ptc-trajectory-code-inspection.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-09-ptc-trajectory-code-inspection.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-09-ptc-trajectory-code-inspection.md
-/agent-note-inspect-recorded-ptc-source-in-trajectory:
- en: 29f601adfcaa6019
- zh: bdd1c59d1bbbff62
-/agent-note-inspect-recorded-ptc-source-in-trajectory/problem:
- en: 6b49bc4faca04ae0
- zh: 60165937e0a7c71d
-/agent-note-inspect-recorded-ptc-source-in-trajectory/decision:
- en: 43dd488c270c1664
- zh: 3fdf6d374c49fee3
-/agent-note-inspect-recorded-ptc-source-in-trajectory/alternatives-considered:
- en: bbf705774c5c608a
- zh: 1af9b4aa3d4fa025
-/agent-note-inspect-recorded-ptc-source-in-trajectory/consequences:
- en: c680634fe8b95880
- zh: 7660cd3354522ef8
diff --git a/.agents/notes/implemented/feature/2026-09-09-sidebar-and-preview-interaction-polish.i18n.yaml b/.agents/notes/implemented/feature/2026-09-09-sidebar-and-preview-interaction-polish.i18n.yaml
deleted file mode 100644
index e82abbb700..0000000000
--- a/.agents/notes/implemented/feature/2026-09-09-sidebar-and-preview-interaction-polish.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-09-sidebar-and-preview-interaction-polish.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-09-sidebar-and-preview-interaction-polish.md
-/agent-note-sidebar-and-preview-interaction-polish:
- en: bce3b5bc9f49bbff
- zh: bebc5b0ce3a370a7
-/agent-note-sidebar-and-preview-interaction-polish/problem:
- en: 2d6e8ec1b08dcce9
- zh: 75e1c454d71da103
-/agent-note-sidebar-and-preview-interaction-polish/decision:
- en: 7358c236daed510b
- zh: 93cf67bbffa2c20b
-/agent-note-sidebar-and-preview-interaction-polish/alternatives-considered:
- en: c828e83875412d49
- zh: d0277bf0d1f5d7a9
-/agent-note-sidebar-and-preview-interaction-polish/consequences:
- en: cb7cb72724552f2b
- zh: 05705b4795ade85f
diff --git a/.agents/notes/implemented/feature/2026-09-09-sidebar-and-preview-interaction-polish.md b/.agents/notes/implemented/feature/2026-09-09-sidebar-and-preview-interaction-polish.md
deleted file mode 100644
index eba8bd3a23..0000000000
--- a/.agents/notes/implemented/feature/2026-09-09-sidebar-and-preview-interaction-polish.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# Agent Note: Sidebar and preview interaction polish
-
-Status: implemented
-
-English | [中文](2026-09-09-sidebar-and-preview-interaction-polish.zh.md)
-
-## Problem
-
-Five small interaction defects around the right Sidebar and the document preview. Every session's surface was born with a seeded default page, so a collapsed column the user never opened already held a page, and the first open into a fresh surface showed the seed beside the content it opened. Page tabs deduplicated surface-wide: opening a page whose tab sat in the other pane pulled focus across panes instead of opening it where asked. Dragging a pane's sole tab onto its own edge did nothing, though the user plainly asked for a split. A dropdown over the HTML preview did not dismiss on a click inside the sandboxed iframe, because that pointerdown never reaches the parent document. And the code preview's copy banner and card background scrolled away under horizontal scrolling, while the code kept the chat card's gray fill instead of sitting on the pane's own background.
-
-## Decision
-
-**Default pages seed lazily.** `createSurface` in [stores.ts](../../../../packages/client/ui-sidebar-right/src/client/stores.ts) mints a collapsed, empty surface; the store's `advance` passes the seed factory to `planSettle` only when the intent leaves the column expanded. The expansion that would first show an empty layout is what seeds the then-current default page, and closing the last closable tab collapses the column and leaves the layout empty until the next expansion. The [last-tab close rule](2026-09-08-sidebar-last-tab-close-rules.md) and [default-page selection](2026-09-08-sidebar-default-pages.md) stay as decided; default pages are created on expansion. Splitting an empty pane is a no-op: it mints no tabs, records no history, and reports no new pane.
-
-**Page uniqueness is pane-scoped.** The guide-only merge generalized to every page kind (`pageKind`/`panePage`): opening a page focuses an existing tab only inside the pane the open targets, and a page dragged, dropped, or docked into a pane already showing that kind's page merges into the pane's own. Resource tabs keep the kit's surface-wide reveal.
-
-**A sole tab splits its own pane when a factory backfills it.** `planDropTab` in [planner.ts](../../../../packages/client/ui-dockkit/src/engine/planner.ts) takes an optional `TabFactory`; with one, the previously refused self-edge release splits, the factory's tab backfills the vacated pane before the move so the dragged tab ends focused. Without a factory the release still changes nothing.
-
-**Menus close on focus entering an iframe.** [Menu.tsx](../../../../packages/client/ui-primitives/src/Menu.tsx) adds a window `blur` listener gated on `document.activeElement instanceof HTMLIFrameElement` — the focus move is the only signal a pointerdown inside a cross-origin iframe leaves, and the gate keeps app or tab switches from closing the list.
-
-**The code preview separates its banner from scrolling source and drops the card fill.** The shared CodeBlock wraps its rendered source in a stable `data-code-block-content` node that defaults to `display: contents`, so existing consumers keep their layout. [CodeBody.module.css](../../../../packages/client/ui-sidebar-documentpreview/src/client/code/CodeBody.module.css) materializes that node as a full-height inner scrollport below the banner; the code renderer reports it through a callback ref, so the document owner follows Slot replacement for position restoration, paging, and line navigation. The shared CodeBlock's fill is routed through `--dsl-code-block-background` (default unchanged, so chat keeps its gray card), while the preview sets it to `transparent` so code sits on the pane's own background.
-
-## Alternatives considered
-
-**Keep seeding at surface creation.** A collapsed column held a page nobody asked for, and the seed took slot 0 of every fresh surface ahead of the first real open.
-
-**Keep surface-wide page dedupe.** Focus jumped to the other pane on an explicit "open here", the exact complaint that started the change.
-
-**A bare window-blur close for menus.** Closes the list on every app or tab switch; the `activeElement` gate scopes the close to the one case the document cannot see.
-
-**Keep code in the shared document scroller.** A child banner cannot cover its parent's native scrollbar. Giving the stable source wrapper both scroll axes keeps the scrollbar at the visible viewport edge below the adjacent banner, rather than at the end of a long code block.
-
-## Consequences
-
-`planDropTab`'s factory parameter is new kit API any embedder may pass; `planSettle` already accepted an absent factory, which now also names the Sidebar's collapsed-state behavior. The `--dsl-code-block-background` variable keeps chat's default gray card while the preview uses the pane background, and `data-code-block-content` lets an owner materialize a dedicated source viewport without changing other CodeBlock layouts. Kit planner specs cover the backfilled self-split and its focus order; Sidebar store, service, and seat specs cover lazy seeding, pane-scoped page merges, and the empty collapsed layout; document-preview specs cover inner scrolling and line navigation; a Menu spec covers the gated blur close. The `ui-sidebar-right`, `ui-dockkit`, and `ui-sidebar-documentpreview` READMEs restate the rules.
diff --git a/.agents/notes/implemented/feature/2026-09-09-sidebar-and-preview-interaction-polish.zh.md b/.agents/notes/implemented/feature/2026-09-09-sidebar-and-preview-interaction-polish.zh.md
deleted file mode 100644
index 93d88d41e9..0000000000
--- a/.agents/notes/implemented/feature/2026-09-09-sidebar-and-preview-interaction-polish.zh.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# Agent Note: 侧边栏与文件预览交互打磨
-
-Status: implemented
-
-[English](2026-09-09-sidebar-and-preview-interaction-polish.md) | 中文
-
-## Problem
-
-右侧边栏与文档预览周边的五个小交互缺陷。每个会话的停靠面出生时就播种默认页，于是用户从未打开过的折叠列里已经躺着一个页面，向全新停靠面的第一次打开会让种子页出现在所开内容旁边。页 tab 在整个停靠面范围去重：打开一个页时，若它的 tab 在另一格里，焦点会被拽到那一格，而不是在被要求的格里打开。把一个格的唯一 tab 拖到本格边缘什么都不发生，尽管用户明明要的是分栏。HTML 预览上方的下拉菜单在点击沙箱 iframe 内部时不消失，因为那次 pointerdown 根本到不了父文档。代码预览的复制条和卡片背景会被横向滚动甩开，而且代码保留了会话卡片的灰色填充，而不是坐在分栏自身的背景上。
-
-## Decision
-
-**默认页惰性播种。**[stores.ts](../../../../packages/client/ui-sidebar-right/src/client/stores.ts) 的 `createSurface` 铸造一个折叠且为空的停靠面；store 的 `advance` 只在意图让列保持展开时才把种子工厂传给 `planSettle`。首次会展示空布局的那次展开播种彼时的默认页；关闭最后一个可关 tab 时收起整列，布局保持为空直到下次展开。[最后一个 tab 的关闭规则](2026-09-08-sidebar-last-tab-close-rules.zh.md)与[默认页选择](2026-09-08-sidebar-default-pages.zh.md)维持原决定；默认页在展开时创建。对空分栏执行 split 不产生变化，不创建 tab，不记录历史，也不返回新分栏。
-
-**页唯一性以格为界。**只对引导页的合并规则推广到每种页 kind（`pageKind`/`panePage`）：打开一个页只在这次打开的目标格内聚焦既有 tab；把页拖入、放入或收回到已展示该 kind 页的格会并入该格自己的 tab。资源 tab 保留套件的全停靠面聚焦。
-
-**有工厂回填时，唯一 tab 可对本格分栏。**[planner.ts](../../../../packages/client/ui-dockkit/src/engine/planner.ts) 的 `planDropTab` 接受可选 `TabFactory`：带工厂时，先前被拒绝的本格边缘释放会分栏，工厂的 tab 先于移动回填腾出的格，因此被拖的 tab 最终保持聚焦。不带工厂时该释放仍不改变任何东西。
-
-**焦点进入 iframe 时关闭菜单。**[Menu.tsx](../../../../packages/client/ui-primitives/src/Menu.tsx) 增加 window `blur` 监听，以 `document.activeElement instanceof HTMLIFrameElement` 为门：焦点移动是跨源 iframe 内 pointerdown 留下的唯一信号，这道门也让应用或标签页切换不会误关列表。
-
-**代码预览把复制条与滚动源码分开，并去掉卡片填充。**共享 CodeBlock 用稳定的 `data-code-block-content` 节点包裹渲染后的源码；该节点默认使用 `display: contents`，因此既有消费者保持原布局。[CodeBody.module.css](../../../../packages/client/ui-sidebar-documentpreview/src/client/code/CodeBody.module.css) 将该节点实体化为复制条下方占满剩余高度的内部滚动区；代码渲染器通过 callback ref 报告该节点，使文档 owner 在 Slot 替换后仍能用当前节点恢复位置、分页和跳转代码行。共享 CodeBlock 的填充通过 `--dsl-code-block-background` 设置（默认值不变，会话保持灰色卡片），预览将它设为 `transparent`，代码因此直接使用分栏背景。
-
-## Alternatives considered
-
-**保留出生即播种。**折叠列里躺着没人要的页面，且种子占据每个新停靠面的 0 号位，排在第一次真实打开之前。
-
-**保留全停靠面的页去重。**显式"在这里打开"时焦点跳到另一格——正是引发这次改动的抱怨。
-
-**菜单用裸的 window blur 关闭。**每次应用或标签页切换都会关掉列表；`activeElement` 门把关闭收窄到父文档看不见的那一种情形。
-
-**让代码继续使用共享文档滚动区。**子级复制条无法覆盖父级的原生滚动条。让稳定的源码包装节点同时承载两个滚动轴，滚动条会停在复制条下方的可见视口边缘，而不是长代码块的末端。
-
-## Consequences
-
-`planDropTab` 的工厂参数是任何嵌入方都可传的新套件 API；`planSettle` 本就接受缺省工厂，如今它同时命名了侧边栏的折叠态行为。`--dsl-code-block-background` 变量保留 Chat 默认的灰色卡片，Preview 则使用分栏背景；`data-code-block-content` 允许 owner 实体化专用源码视口，而不改变其它 CodeBlock 布局。套件 planner 规格覆盖带回填的本格分栏及其聚焦顺序；侧边栏 store、service 与 seat 规格覆盖惰性播种、格内页合并与折叠后的空布局；文档预览规格覆盖内部滚动与行跳转；一条 Menu 规格覆盖带门的 blur 关闭。`ui-sidebar-right`、`ui-dockkit` 与 `ui-sidebar-documentpreview` 的 README 重述了这些规则。
diff --git a/.agents/notes/implemented/feature/2026-09-09-web-sidebar-terminal.i18n.yaml b/.agents/notes/implemented/feature/2026-09-09-web-sidebar-terminal.i18n.yaml
index 73ba0975be..d74aa0ba75 100644
--- a/.agents/notes/implemented/feature/2026-09-09-web-sidebar-terminal.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-09-09-web-sidebar-terminal.i18n.yaml
@@ -9,11 +9,11 @@
en: 71813b1cb1f750ba
zh: 64d2b999933ccd98
/agent-note-web-sidebar-terminals/decision:
- en: d73dc0a37bd7c9dd
- zh: f5c6cf8cce36090a
+ en: 8d28949572d990ef
+ zh: f6e26790415134d2
/agent-note-web-sidebar-terminals/alternatives-considered:
- en: 0c129fba63a60777
- zh: c334f34dd71bbaf6
+ en: b0ffb94cd5033e9c
+ zh: 9294bb76503c858a
/agent-note-web-sidebar-terminals/consequences:
en: d710787595b5dc89
zh: 4df9518c32698f85
diff --git a/.agents/notes/implemented/feature/2026-09-09-web-sidebar-terminal.md b/.agents/notes/implemented/feature/2026-09-09-web-sidebar-terminal.md
index 09be4a142f..448bcf84c1 100644
--- a/.agents/notes/implemented/feature/2026-09-09-web-sidebar-terminal.md
+++ b/.agents/notes/implemented/feature/2026-09-09-web-sidebar-terminal.md
@@ -18,7 +18,7 @@ The application theme supplies terminal default colors. The body reads resolved
Close and replacement remove the tab synchronously and run process cleanup in the background. The Client first records the unfinished close request under a terminal-specific localStorage key; success removes it, and startup retries requests that remain. Cleanup failures have no notification or manual retry action. Host terminals missing from the saved layout are not reopened automatically and have no UI recovery entry. Independent keys prevent another window from overwriting unrelated cleanup requests. Collapse, tab/Session switching, floating, fullscreen and browser disconnection preserve the process. Component cleanup and `TabDomain.signal` only detach browser work because the same lifetime can end during plugin reload. Failed process cleanup retains ownership, including failures after allocation but before create publication. Session owner disposal and Host plugin disposal also clean up terminals. A definitive missing-Session response retires its saved close request because the Session owns process cleanup; transport failures remain retryable. Client plugin disposal awaits every detached stream so a replacement plugin does not inherit unfinished Client cleanup.
-[Sidebar layout persistence and provider recovery](../architecture/2026-09-14-sidebar-layout-provider-recovery.md) owns browser reload: layout and tab identities are restored before the terminal provider reconnects its views. Listing still takes the Session ID directly because history can outlive its Agent and terminal owner; an offline Session has no retained terminals to restore. Only a new view may allocate a process; a recovered target that disappears reports an error. The Host remains authoritative for process state, titles and screen contents.
+[Sidebar layout persistence and provider recovery](../../../../packages/client/ui-sidebar-right/README.md) owns browser reload: layout and tab identities are restored before the terminal provider reconnects its views. Listing still takes the Session ID directly because history can outlive its Agent and terminal owner; an offline Session has no retained terminals to restore. Only a new view may allocate a process; a recovered target that disappears reports an error. The Host remains authoritative for process state, titles and screen contents.
The caller retains a terminal ID before creating it. Repeating create with the same Session and open ID does not allocate a second process. Closing an uncertain create uses that ID even when no creation response arrived. The Host records closed IDs before awaiting allocation, preventing a delayed create from reviving a closed terminal. Each attachment begins with a consistent, bounded serialized xterm screen; ordered output follows through the Gateway's existing multiplexed Remote stream. Output and screen snapshots share one operation queue. Followers retain final output on normal closure and fail explicitly on buffer overflow. Browser render acknowledgement prevents React batching from dropping increments.
@@ -30,7 +30,7 @@ The latest attachment controls input and dimensions; other attachments remain re
**Keep the tab visible until process cleanup finishes.** A slow or failed termination would delay the user's close action. Saving the cleanup intent allows immediate removal while preserving failure reporting and retry.
-**Persist an authoritative active-process registry.** Browser process state can become stale independently of Host state. The [layout persistence decision](../architecture/2026-09-14-sidebar-layout-provider-recovery.md) supersedes the exclusion of saved tab associations while retaining Host authority for process liveness.
+**Persist an authoritative active-process registry.** Browser process state can become stale independently of Host state. The [layout persistence reference](../../../../packages/client/ui-sidebar-right/README.md) supersedes the exclusion of saved tab associations while retaining Host authority for process liveness.
**Share the Agent terminal registry.** Its controlled prompts and semantic send/wait behavior would change human shell configuration and blur process ownership. User terminals share the subprocess capability instead.
diff --git a/.agents/notes/implemented/feature/2026-09-09-web-sidebar-terminal.zh.md b/.agents/notes/implemented/feature/2026-09-09-web-sidebar-terminal.zh.md
index c2ac146875..81bdf81ed9 100644
--- a/.agents/notes/implemented/feature/2026-09-09-web-sidebar-terminal.zh.md
+++ b/.agents/notes/implemented/feature/2026-09-09-web-sidebar-terminal.zh.md
@@ -18,7 +18,7 @@ Web 用户需要在 Session 旁使用交互式 shell 检查工作区和运行命
关闭和替换会同步移除标签页，并在后台清理进程。Client 先以终端独立的 localStorage key 保存未完成的关闭请求；成功后删除，启动时重试剩余请求。清理失败没有通知或手动重试操作。保存布局之外的 Host 终端不会自动重新打开，也没有 UI 恢复入口。独立 key 避免其他窗口覆盖无关的清理请求。折叠、切换标签页或 Session、浮动、全屏和浏览器断线均保留进程。组件清理和 `TabDomain.signal` 只停止浏览器工作，因为插件重新加载也会结束这些生命周期。进程清理失败时保留所有权，包括分配完成但 create 尚未发布时的失败。Session owner 和 Host 插件卸载也会清理终端。 明确的 Session 不存在响应会清除已保存的关闭请求，因为进程清理由 Session 负责；传输失败仍可重试。Client 插件卸载等待所有断开的流结束，避免替换插件继承未完成的 Client 清理。
-[侧栏布局持久化与 provider 恢复](../architecture/2026-09-14-sidebar-layout-provider-recovery.zh.md)负责浏览器刷新：先恢复布局和标签身份，再由 terminal provider 重连视图。列表仍直接使用 Session ID，因为历史记录可以比 Agent 和终端 owner 存活更久；离线 Session 没有需要恢复的保留终端。只有新视图可以分配进程，恢复目标消失时显示错误。进程状态、标题和屏幕内容仍以 Host 为准。
+[侧栏布局持久化与 provider 恢复](../../../../packages/client/ui-sidebar-right/README.zh.md)负责浏览器刷新：先恢复布局和标签身份，再由 terminal provider 重连视图。列表仍直接使用 Session ID，因为历史记录可以比 Agent 和终端 owner 存活更久；离线 Session 没有需要恢复的保留终端。只有新视图可以分配进程，恢复目标消失时显示错误。进程状态、标题和屏幕内容仍以 Host 为准。
调用者在创建之前保留终端 ID。相同 Session 和未关闭 ID 的重复 create 不再分配进程。创建结果不确定时，关闭仍使用该 ID，即使没有收到创建响应。Host 在等待分配完成前记录已关闭 ID，防止迟到的 create 复活已关闭终端。每次连接先接收一致、有界的 xterm 序列化屏幕，后续有序输出使用 Gateway 已有的复用 Remote stream。输出和屏幕快照共享操作队列。订阅者正常关闭时保留末尾输出，缓存超限时明确失败。浏览器在完成渲染后确认帧，避免 React 批处理丢失增量。
@@ -30,7 +30,7 @@ Web 用户需要在 Session 旁使用交互式 shell 检查工作区和运行命
**进程清理完成前保留标签页。** 缓慢或失败的终止会拖延用户关闭操作。保存清理意图后，可以立即移除标签页，同时保留错误反馈与重试。
-**持久化作为权威的活跃进程注册表。** 浏览器进程状态可能独立于 Host 状态失效。[布局持久化决策](../architecture/2026-09-14-sidebar-layout-provider-recovery.zh.md)取代了不保存标签关联的限定，同时保留 Host 对进程存活状态的决定权。
+**持久化作为权威的活跃进程注册表。** 浏览器进程状态可能独立于 Host 状态失效。[布局持久化参考](../../../../packages/client/ui-sidebar-right/README.zh.md)取代了不保存标签关联的限定，同时保留 Host 对进程存活状态的决定权。
**共用 Agent 终端注册表。** 受控提示符和语义化 send/wait 会改变人工 shell 配置并混淆进程所有权。用户终端只共享 subprocess 能力。
diff --git a/.agents/notes/implemented/feature/2026-09-10-composer-reference-previews.i18n.yaml b/.agents/notes/implemented/feature/2026-09-10-composer-reference-previews.i18n.yaml
deleted file mode 100644
index e5beccba4f..0000000000
--- a/.agents/notes/implemented/feature/2026-09-10-composer-reference-previews.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-10-composer-reference-previews.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-10-composer-reference-previews.md
-/agent-note-composer-reference-previews:
- en: 4077f5f4bb6cbbc1
- zh: 0ed641c53ecc9ff9
-/agent-note-composer-reference-previews/problem:
- en: b6c93af7ecb4f6df
- zh: e6efd6ac2e2193fc
-/agent-note-composer-reference-previews/decision:
- en: f895747aad30a9ea
- zh: 1a736bbf64f82041
-/agent-note-composer-reference-previews/alternatives-considered:
- en: c76709c683a56316
- zh: a6708957a465c3ce
-/agent-note-composer-reference-previews/consequences:
- en: d67f32b4450e8c71
- zh: 7d3a8c6588959e04
diff --git a/.agents/notes/implemented/feature/2026-09-10-symmetric-message-feedback-submission.i18n.yaml b/.agents/notes/implemented/feature/2026-09-10-symmetric-message-feedback-submission.i18n.yaml
deleted file mode 100644
index 9a45958b42..0000000000
--- a/.agents/notes/implemented/feature/2026-09-10-symmetric-message-feedback-submission.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-10-symmetric-message-feedback-submission.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-10-symmetric-message-feedback-submission.md
-/agent-note-symmetric-message-feedback-submission:
- en: 40f6c11f8f4332a2
- zh: fa31c26c296f892c
-/agent-note-symmetric-message-feedback-submission/problem:
- en: f5afa64229a1e8db
- zh: b73e730754f33cc5
-/agent-note-symmetric-message-feedback-submission/decision:
- en: a8a9598cb30f8f8e
- zh: 3073219d585bc5fd
-/agent-note-symmetric-message-feedback-submission/alternatives-considered:
- en: b425d01d854f8962
- zh: f74131c171c9f74a
-/agent-note-symmetric-message-feedback-submission/consequences:
- en: 833bc3370c02fd1e
- zh: 2718d60cdf762436
diff --git a/.agents/notes/implemented/feature/2026-09-11-desktop-mandatory-update-client.i18n.yaml b/.agents/notes/implemented/feature/2026-09-11-desktop-mandatory-update-client.i18n.yaml
deleted file mode 100644
index fd0a14a09f..0000000000
--- a/.agents/notes/implemented/feature/2026-09-11-desktop-mandatory-update-client.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-11-desktop-mandatory-update-client.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-11-desktop-mandatory-update-client.md
-/agent-note-desktop-mandatory-update-client-and-blocking-window:
- en: 059254153764a162
- zh: 17dfd84fd2ba6eea
-/agent-note-desktop-mandatory-update-client-and-blocking-window/problem:
- en: f1aeaa7df97a744f
- zh: 039b2cccd9a45198
-/agent-note-desktop-mandatory-update-client-and-blocking-window/decision:
- en: 7d8ece211be36774
- zh: d25c3ebac6420187
-/agent-note-desktop-mandatory-update-client-and-blocking-window/alternatives-considered:
- en: 136afb04a37db4a1
- zh: 2b049e0d9fd8aa27
-/agent-note-desktop-mandatory-update-client-and-blocking-window/consequences:
- en: 6f7a3decf4f0504f
- zh: 16241131d1053989
diff --git a/.agents/notes/implemented/feature/2026-09-11-sidebar-document-preview-polish.i18n.yaml b/.agents/notes/implemented/feature/2026-09-11-sidebar-document-preview-polish.i18n.yaml
deleted file mode 100644
index bffd9997fe..0000000000
--- a/.agents/notes/implemented/feature/2026-09-11-sidebar-document-preview-polish.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-11-sidebar-document-preview-polish.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-11-sidebar-document-preview-polish.md
-/agent-note-sidebar-document-preview-polish:
- en: f6de5780a080c43b
- zh: 43c5fe472e41c955
-/agent-note-sidebar-document-preview-polish/problem:
- en: 4a52e0a397d95c28
- zh: ecaeb3f570c775da
-/agent-note-sidebar-document-preview-polish/decision:
- en: 6292b936ed7ee1bb
- zh: 1758900c96a6811b
-/agent-note-sidebar-document-preview-polish/alternatives-considered:
- en: e2e5b8bbd191385e
- zh: 29b37f3ec312f5ca
-/agent-note-sidebar-document-preview-polish/consequences:
- en: 38951cfb55e9214c
- zh: 6ca3845e206be2da
diff --git a/.agents/notes/implemented/feature/2026-09-11-turn-changed-files-card.i18n.yaml b/.agents/notes/implemented/feature/2026-09-11-turn-changed-files-card.i18n.yaml
deleted file mode 100644
index 26ab339a79..0000000000
--- a/.agents/notes/implemented/feature/2026-09-11-turn-changed-files-card.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-11-turn-changed-files-card.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-11-turn-changed-files-card.md
-/agent-note-turn-changed-files-card:
- en: 21aea14160ab0796
- zh: c8b389f1b684f677
-/agent-note-turn-changed-files-card/problem:
- en: f3416b4d37371155
- zh: 52e22bd5a90358e5
-/agent-note-turn-changed-files-card/decision:
- en: 75a1a9aa9b204844
- zh: 941fdb3556ebe035
-/agent-note-turn-changed-files-card/alternatives-considered:
- en: 7ade7ce52c2a320d
- zh: 18832d5f45568429
-/agent-note-turn-changed-files-card/consequences:
- en: 33504bcb31f30f84
- zh: c6626b532701fcc7
diff --git a/.agents/notes/implemented/feature/2026-09-12-mcp-resources-and-instructions.i18n.yaml b/.agents/notes/implemented/feature/2026-09-12-mcp-resources-and-instructions.i18n.yaml
deleted file mode 100644
index 05daf52fa7..0000000000
--- a/.agents/notes/implemented/feature/2026-09-12-mcp-resources-and-instructions.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-12-mcp-resources-and-instructions.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-12-mcp-resources-and-instructions.md
-/agent-note-on-demand-mcp-resources-and-scoped-server-instructions:
- en: 052fc1f95f280688
- zh: fdfacc841597d4da
-/agent-note-on-demand-mcp-resources-and-scoped-server-instructions/problem:
- en: 0d6c75e85a04c36a
- zh: fe5043f324369cdd
-/agent-note-on-demand-mcp-resources-and-scoped-server-instructions/decision:
- en: 69a021dd23820bb8
- zh: 447d2d8d03f12896
-/agent-note-on-demand-mcp-resources-and-scoped-server-instructions/alternatives-considered:
- en: 02bc8e76ce4d68ab
- zh: 0991cc64ff9e3011
-/agent-note-on-demand-mcp-resources-and-scoped-server-instructions/verification:
- en: 41694d9121383436
- zh: 781ea7503ea149f1
-/agent-note-on-demand-mcp-resources-and-scoped-server-instructions/consequences:
- en: 432b24aa763eff2e
- zh: 236825ede84e2c0d
diff --git a/.agents/notes/implemented/feature/2026-09-12-mcp-sdk-protocol-negotiation.i18n.yaml b/.agents/notes/implemented/feature/2026-09-12-mcp-sdk-protocol-negotiation.i18n.yaml
deleted file mode 100644
index 25b2735cf8..0000000000
--- a/.agents/notes/implemented/feature/2026-09-12-mcp-sdk-protocol-negotiation.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-12-mcp-sdk-protocol-negotiation.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-12-mcp-sdk-protocol-negotiation.md
-/agent-note-mcp-sdk-protocol-negotiation:
- en: 9228ca2f4da2f41b
- zh: 7cd10429865c3f2d
-/agent-note-mcp-sdk-protocol-negotiation/problem:
- en: bd614e17c62d137e
- zh: ee71fdcd310a9592
-/agent-note-mcp-sdk-protocol-negotiation/decision:
- en: ed7b45ffcaeffedd
- zh: 2287d525ec04006c
-/agent-note-mcp-sdk-protocol-negotiation/alternatives-considered:
- en: 1fba2ebdcc100c37
- zh: 45c384641d3b0300
-/agent-note-mcp-sdk-protocol-negotiation/consequences:
- en: 1a50179c0254517c
- zh: 046e4f72bfc2ea89
diff --git a/.agents/notes/implemented/feature/2026-09-13-explicit-worktree-creation.i18n.yaml b/.agents/notes/implemented/feature/2026-09-13-explicit-worktree-creation.i18n.yaml
new file mode 100644
index 0000000000..6f3cb5f94d
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-09-13-explicit-worktree-creation.i18n.yaml
@@ -0,0 +1,19 @@
+# Bilingual-pair consistency record for 2026-09-13-explicit-worktree-creation.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-13-explicit-worktree-creation.md
+/agent-note-explicit-worktree-creation:
+ en: 68d9e5eab7671458
+ zh: fc889567986f2bbe
+/agent-note-explicit-worktree-creation/problem:
+ en: 12ab239ab0c58e31
+ zh: c32874442ce66041
+/agent-note-explicit-worktree-creation/decision:
+ en: e3be190201a36710
+ zh: 9ef0036b9b95377e
+/agent-note-explicit-worktree-creation/alternatives-considered:
+ en: 72d42e892a37b94c
+ zh: 92a14a51c6a89c53
+/agent-note-explicit-worktree-creation/consequences:
+ en: 083851db27cc4846
+ zh: b3db48d41356c9cf
diff --git a/.agents/notes/implemented/feature/2026-09-13-explicit-worktree-creation.md b/.agents/notes/implemented/feature/2026-09-13-explicit-worktree-creation.md
new file mode 100644
index 0000000000..9b84d0c9fd
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-09-13-explicit-worktree-creation.md
@@ -0,0 +1,33 @@
+# Agent Note: Explicit worktree creation
+
+Status: implemented
+
+English | [中文](2026-09-13-explicit-worktree-creation.zh.md)
+
+## Problem
+
+A Session that needs an isolated checkout otherwise has to coordinate Git commands with its own working directory. Changing a shell process directory does not update the Session's later tools or recorded context, and a linked worktree's Git administration directory can lie outside the Session's existing write grant.
+
+## Decision
+
+The experimental [worktree runtime](../../../../packages/experimental/worktree/README.md) creates a new named branch and checkout from a pinned local commit, then enters its canonical directory through the shared working-directory service. The [tool](../../../../packages/experimental/tool-worktree/README.md) exposes `create_worktree({ name?, from? })`. These packages use ordinary explicit composition, with no additional runtime feature flag.
+
+The source repository comes from the calling Session's current directory. Creation does not fetch or copy uncommitted files. The default pool is `.agents/worktrees` under the current checkout’s top-level directory, including when the caller is in a linked checkout. The process that creates a pool writes its self-ignoring `.gitignore`; existing directories and ignore files are preserved. Names must be new branches and unused checkout paths.
+
+Git and directory creation use the mounted subprocess and sandbox providers without widening the calling Session's policy. Both destination and shared Git metadata writes must already be permitted. Successful creation changes only the current working directory; the Session identity and original sandbox root remain owned by their existing services.
+
+Leaving uses the shared working-directory operation and retains the checkout and branch. Failed setup can retain partial artifacts and reports their location. The service does not own a checkout registry, cleanup schedule, branch merge policy, or task association database.
+
+## Alternatives considered
+
+**A separate worktree-exit tool.** Leaving is the existing working-directory operation; another exit operation would needlessly couple directory changes to Git ownership or deletion.
+
+**Copy the dirty checkout into each new worktree.** A pinned local commit gives the caller an explicit baseline without mixing staged, unstaged, untracked, and ignored state or inventing conflict rules.
+
+**Automatic subagent isolation.** [Agent Teams](2026-08-05-agent-teams.md) keeps its existing explicit coordination model. Creating a checkout is available as an operation rather than an implicit consequence of delegation.
+
+**Expand write grants during creation.** A convenience operation cannot acquire authority over a shared Git administration directory merely because the destination is writable.
+
+## Consequences
+
+The caller can continue one Session in a new checkout with a reconstructable directory change. Retention avoids deleting work on exit or a failed final publication, but callers must manage unused checkouts and branches themselves. Git and Node must be available in the filesystem provider's execution world. Submodule setup and dependency installation remain separate operations.
diff --git a/.agents/notes/implemented/feature/2026-09-13-explicit-worktree-creation.zh.md b/.agents/notes/implemented/feature/2026-09-13-explicit-worktree-creation.zh.md
new file mode 100644
index 0000000000..f93a4a2cd7
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-09-13-explicit-worktree-creation.zh.md
@@ -0,0 +1,33 @@
+# Agent Note: 显式创建工作树
+
+Status: implemented
+
+[English](2026-09-13-explicit-worktree-creation.md) | 中文
+
+## Problem
+
+需要隔离检出目录的 Session 原本必须自行协调 Git 命令与工作目录。改变 shell 进程目录不会更新 Session 后续工具或已记录的上下文，而且链接工作树的 Git 管理目录可能位于 Session 既有写权限范围之外。
+
+## Decision
+
+实验性[工作树运行时](../../../../packages/experimental/worktree/README.zh.md)从固定的本地提交创建新的具名分支与检出目录，然后通过共享工作目录服务进入其规范路径。[工具](../../../../packages/experimental/tool-worktree/README.zh.md)公开 `create_worktree({ name?, from? })`。这些包使用普通的显式组合，不添加额外运行时功能开关。
+
+源仓库由调用 Session 的当前目录决定。创建操作不会获取远端提交或复制未提交文件。默认父目录是当前检出目录顶层路径下的 `.agents/worktrees`，调用方位于链接检出目录中时也一样。创建该目录的进程写入忽略自身的 `.gitignore`；已有目录与忽略文件保持不变。名称必须对应新分支与尚未使用的检出路径。
+
+Git 与目录创建使用挂载的子进程及沙箱提供方，不扩大调用 Session 的策略。目标目录与共享 Git 元数据必须均已允许写入。成功创建只改变当前工作目录；Session 身份与原始沙箱根目录仍由已有服务拥有。
+
+离开使用共享工作目录操作，保留检出目录与分支。初始化失败可能留下部分产物，并报告其位置。该服务不拥有工作树注册表、清理计划、分支合并策略或任务关联数据库。
+
+## Alternatives considered
+
+**单独提供工作树退出工具。** 离开就是已有工作目录操作；另一个退出操作会无谓地将目录切换与 Git 所有权或删除耦合。
+
+**将未提交状态复制到每个新工作树。** 固定本地提交为调用方提供显式基准，无需混合暂存、未暂存、未跟踪和被忽略的状态，也无需制定冲突规则。
+
+**自动隔离子代理。** [Agent Teams](2026-08-05-agent-teams.zh.md)保留已有的显式协调模型。创建检出目录是一项可调用操作，而不是委派的隐含结果。
+
+**创建时扩大写权限。** 便捷操作不能仅因目标目录可写，就获得共享 Git 管理目录的权限。
+
+## Consequences
+
+调用方可以在新的检出目录继续同一个 Session，且目录切换可重建。保留策略避免在离开或最后发布失败时删除工作，但调用方必须自行管理闲置检出目录与分支。Git 与 Node 必须存在于文件系统提供方的执行环境中。子模块配置与依赖安装仍是独立操作。
diff --git a/.agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.i18n.yaml b/.agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.i18n.yaml
deleted file mode 100644
index ccb4558c12..0000000000
--- a/.agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-13-macos-hidden-titlebar-vibrancy.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.md
-/agent-note-macos-hidden-titlebar-with-vibrancy-sidebar:
- en: 1872fd56128fb565
- zh: dc7b04d80eda9880
-/agent-note-macos-hidden-titlebar-with-vibrancy-sidebar/problem:
- en: 199f00b0e7f3c09c
- zh: bb331fc8d7d46bbd
-/agent-note-macos-hidden-titlebar-with-vibrancy-sidebar/decision:
- en: f59c3d276d0fb5c0
- zh: 85509dca9810cd4d
-/agent-note-macos-hidden-titlebar-with-vibrancy-sidebar/alternatives-considered:
- en: 28d920253012bd11
- zh: ae6a27f959d5afe3
-/agent-note-macos-hidden-titlebar-with-vibrancy-sidebar/consequences:
- en: e08ce133c72863d8
- zh: e67b5c3bff579d86
-/agent-note-macos-hidden-titlebar-with-vibrancy-sidebar/testing:
- en: a075febd9b78dc5f
- zh: 7c59a9b7f0798dac
diff --git a/.agents/notes/implemented/feature/2026-09-13-mcp-resources-in-profiles.i18n.yaml b/.agents/notes/implemented/feature/2026-09-13-mcp-resources-in-profiles.i18n.yaml
deleted file mode 100644
index 854c136a37..0000000000
--- a/.agents/notes/implemented/feature/2026-09-13-mcp-resources-in-profiles.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-13-mcp-resources-in-profiles.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-13-mcp-resources-in-profiles.md
-/agent-note-mcp-resource-availability-follows-configured-servers:
- en: 2f520034ae7711ed
- zh: 0e76516042ef51c1
-/agent-note-mcp-resource-availability-follows-configured-servers/problem:
- en: 729c308d0bb4e142
- zh: 42df44189f83a701
-/agent-note-mcp-resource-availability-follows-configured-servers/decision:
- en: 6d79d22b7a2d118a
- zh: 9e7aaccbcb6535c0
-/agent-note-mcp-resource-availability-follows-configured-servers/alternatives-considered:
- en: e60cb2c45a8a8cf7
- zh: e74f3b9ca5157278
-/agent-note-mcp-resource-availability-follows-configured-servers/verification:
- en: d07e735ad317655c
- zh: c9419acac96f0740
-/agent-note-mcp-resource-availability-follows-configured-servers/consequences:
- en: 270341820e2713d4
- zh: d56cdd72625fd570
diff --git a/.agents/notes/implemented/feature/2026-09-14-composer-selection-keyboard.i18n.yaml b/.agents/notes/implemented/feature/2026-09-14-composer-selection-keyboard.i18n.yaml
deleted file mode 100644
index ce405a2db5..0000000000
--- a/.agents/notes/implemented/feature/2026-09-14-composer-selection-keyboard.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-14-composer-selection-keyboard.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-14-composer-selection-keyboard.md
-/agent-note-composer-selection-surfaces-mirror-the-composer-s-enter-and-escape-keys:
- en: d3af1337a24bd411
- zh: ebf464a7f3d9b5c3
-/agent-note-composer-selection-surfaces-mirror-the-composer-s-enter-and-escape-keys/problem:
- en: e5f4084d8eda4d0e
- zh: 4dc98999d008fecd
-/agent-note-composer-selection-surfaces-mirror-the-composer-s-enter-and-escape-keys/decision:
- en: d6a84d4b3d935fbb
- zh: b842b20d197fc1a6
-/agent-note-composer-selection-surfaces-mirror-the-composer-s-enter-and-escape-keys/alternatives-considered:
- en: f062131fb8b9cbcf
- zh: a14b718ed6381b3f
-/agent-note-composer-selection-surfaces-mirror-the-composer-s-enter-and-escape-keys/verification:
- en: 81508f6216c1cde0
- zh: 764a8cafea8594e5
-/agent-note-composer-selection-surfaces-mirror-the-composer-s-enter-and-escape-keys/consequences:
- en: 1310807e3a7a259d
- zh: c35aca580ee553b7
diff --git a/.agents/notes/implemented/feature/2026-09-14-desktop-primary-runtime.i18n.yaml b/.agents/notes/implemented/feature/2026-09-14-desktop-primary-runtime.i18n.yaml
index 683d995312..ba3e9c8d4d 100644
--- a/.agents/notes/implemented/feature/2026-09-14-desktop-primary-runtime.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-09-14-desktop-primary-runtime.i18n.yaml
@@ -9,8 +9,8 @@
en: 36bf235f0821ef6a
zh: a86bf07af03d54a3
/agent-note-desktop-primary-runtime/decision:
- en: 3d2241842f5a2a83
- zh: 8617717f0337d76c
+ en: 594ed7501283de88
+ zh: d2abc271a96a82d7
/agent-note-desktop-primary-runtime/alternatives-considered:
en: 566fd91c30cb0a0a
zh: 70758ae2617f6ebb
diff --git a/.agents/notes/implemented/feature/2026-09-14-desktop-primary-runtime.md b/.agents/notes/implemented/feature/2026-09-14-desktop-primary-runtime.md
index 9c961517b4..7778eee564 100644
--- a/.agents/notes/implemented/feature/2026-09-14-desktop-primary-runtime.md
+++ b/.agents/notes/implemented/feature/2026-09-14-desktop-primary-runtime.md
@@ -22,7 +22,7 @@ Windows signed packaging separates materialization from execution with supervise
Desktop ZIP extraction pins `extract-zip` to `yauzl` 3.4.0 through a scoped dependency override. The 2.x reader can leave large deflate entries unfinished on Node 26 ([upstream issue](https://github.com/thejoshwolfe/yauzl/issues/176)); retaining the existing extractor preserves its path validation and wheel-entry checks. The development launcher uses top-level await so unfinished preparation cannot exit successfully. A large compressed wheel regression checks the complete extracted bytes.
-The [shared-runtime decision](../architecture/2026-09-17-shared-office-runtime.md) owns builder, lock and query-package placement for Desktop and SDK carriers, including GNU/Linux x64 and Python-only payloads. Desktop retains the installation and signing behavior described here and requires the full Python, Node.js and pnpm payload.
+The [shared-runtime reference](../../../../packages/skill/tool-workspace-dependencies/README.md) owns builder, lock and query-package placement for Desktop and SDK carriers, including GNU/Linux x64 and Python-only payloads. Desktop retains the installation and signing behavior described here and requires the full Python, Node.js and pnpm payload.
## Alternatives considered
diff --git a/.agents/notes/implemented/feature/2026-09-14-desktop-primary-runtime.zh.md b/.agents/notes/implemented/feature/2026-09-14-desktop-primary-runtime.zh.md
index c2f1a4f105..05ad34b343 100644
--- a/.agents/notes/implemented/feature/2026-09-14-desktop-primary-runtime.zh.md
+++ b/.agents/notes/implemented/feature/2026-09-14-desktop-primary-runtime.zh.md
@@ -22,7 +22,7 @@ Windows 签名打包通过受监督的签名阶段覆盖第一方运行时和应
Desktop ZIP 解压通过定向依赖覆盖为 `extract-zip` 固定 `yauzl` 3.4.0。2.x 读取器在 Node 26 上可能无法完成较大 deflate 条目的读取（[上游问题](https://github.com/thejoshwolfe/yauzl/issues/176)）；保留现有解压器可保留其路径校验和 wheel 条目检查。开发启动器使用顶层 await，避免准备未完成却成功退出。大压缩 wheel 回归测试检查完整的解压字节。
-[共享运行时决策](../architecture/2026-09-17-shared-office-runtime.zh.md)持有 Desktop 与 SDK 载体的构建器、锁文件和查询包归属，覆盖 GNU/Linux x64 与 Python-only payload。Desktop 保留本文的安装与签名行为，并要求完整的 Python、Node.js 和 pnpm payload。
+[共享运行时参考](../../../../packages/skill/tool-workspace-dependencies/README.zh.md)持有 Desktop 与 SDK 载体的构建器、锁文件和查询包归属，覆盖 GNU/Linux x64 与 Python-only payload。Desktop 保留本文的安装与签名行为，并要求完整的 Python、Node.js 和 pnpm payload。
## Alternatives considered
diff --git a/.agents/notes/implemented/feature/2026-09-14-docs-mermaid-viewer.i18n.yaml b/.agents/notes/implemented/feature/2026-09-14-docs-mermaid-viewer.i18n.yaml
deleted file mode 100644
index f43d81c749..0000000000
--- a/.agents/notes/implemented/feature/2026-09-14-docs-mermaid-viewer.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-14-docs-mermaid-viewer.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-14-docs-mermaid-viewer.md
-/agent-note-documentation-diagram-and-image-viewer:
- en: c43de97ff7fbe82d
- zh: 5e2ecb9d39255ad7
-/agent-note-documentation-diagram-and-image-viewer/problem:
- en: 3630dd02a8e8dfdf
- zh: f25b00903e05bd05
-/agent-note-documentation-diagram-and-image-viewer/decision:
- en: e82d48a7ebee05c8
- zh: af5c517d1d728f07
-/agent-note-documentation-diagram-and-image-viewer/alternatives-considered:
- en: bdebec164a27c787
- zh: 8acb59417c96b807
-/agent-note-documentation-diagram-and-image-viewer/consequences:
- en: f7bc4c0588dda49d
- zh: 9261c0bde08031b1
diff --git a/.agents/notes/implemented/feature/2026-09-14-unattended-browser-terminal-reclamation.i18n.yaml b/.agents/notes/implemented/feature/2026-09-14-unattended-browser-terminal-reclamation.i18n.yaml
index 11e6f533a5..fb8f1db3e7 100644
--- a/.agents/notes/implemented/feature/2026-09-14-unattended-browser-terminal-reclamation.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-09-14-unattended-browser-terminal-reclamation.i18n.yaml
@@ -9,8 +9,8 @@
en: bd5cfc222df1a98c
zh: b58a3570a98298ee
/agent-note-two-hour-reclamation-of-unattended-browser-terminals/decision:
- en: 079c8a1e95099239
- zh: 613d888fd7bf6b61
+ en: b5ba6ad815f8255f
+ zh: 5da86fa7f2f26840
/agent-note-two-hour-reclamation-of-unattended-browser-terminals/alternatives-considered:
en: 165fedee22bdb52e
zh: 6b9b7054ddb2a3a9
diff --git a/.agents/notes/implemented/feature/2026-09-14-unattended-browser-terminal-reclamation.md b/.agents/notes/implemented/feature/2026-09-14-unattended-browser-terminal-reclamation.md
index 6eca6faa22..a249df0ef4 100644
--- a/.agents/notes/implemented/feature/2026-09-14-unattended-browser-terminal-reclamation.md
+++ b/.agents/notes/implemented/feature/2026-09-14-unattended-browser-terminal-reclamation.md
@@ -33,7 +33,7 @@ The Host [terminal controller](../../../../packages/api/terminal-controller/READ
Cleanup awaits provider quiescence and final screen output. Failure retains ownership, rejects new holders and schedules one retry without a new idle grace. Failed allocation cleanup follows the same retry policy. Owner disposal stops timers and streams and joins cleanup and observations before reporting failures, including when cleanup rejects before an observation settles. No Agent terminal tool, model input or Session event changes.
-Peer research on Codex thread unloading, OpenCode Location scopes and [VS Code PTY grace periods](https://github.com/microsoft/vscode/blob/main/src/vs/platform/terminal/node/ptyService.ts) informed separate references and delayed cleanup. The two-hour value is DSH product policy, not an industry default. The [browser-terminal decision](2026-09-09-web-sidebar-terminal.md) and [layout/provider recovery decision](../architecture/2026-09-14-sidebar-layout-provider-recovery.md) remain active because their resource ownership and persistence separation still apply.
+Peer research on Codex thread unloading, OpenCode Location scopes and [VS Code PTY grace periods](https://github.com/microsoft/vscode/blob/main/src/vs/platform/terminal/node/ptyService.ts) informed separate references and delayed cleanup. The two-hour value is DSH product policy, not an industry default. The [browser-terminal decision](2026-09-09-web-sidebar-terminal.md) and [layout/provider recovery reference](../../../../packages/client/ui-sidebar-right/README.md) define the resource ownership and persistence separation used here.
## Alternatives considered
diff --git a/.agents/notes/implemented/feature/2026-09-14-unattended-browser-terminal-reclamation.zh.md b/.agents/notes/implemented/feature/2026-09-14-unattended-browser-terminal-reclamation.zh.md
index 9065fe53a7..268709124c 100644
--- a/.agents/notes/implemented/feature/2026-09-14-unattended-browser-terminal-reclamation.zh.md
+++ b/.agents/notes/implemented/feature/2026-09-14-unattended-browser-terminal-reclamation.zh.md
@@ -33,7 +33,7 @@ Host [终端控制器](../../../../packages/api/terminal-controller/README.zh.md
清理等待 provider 范围完全停稳和最终屏幕输出排空。失败时保留所有权、拒绝新持有关系，并安排一次重试，不重新给予空闲宽限期。分配失败后的清理采用相同重试策略。owner 卸载会停止计时器和流，在清理与观察都结束后才报告失败，包括清理早于观察结束而拒绝的情况。Agent 终端工具、模型输入和 Session 事件均不改变。
-Codex 线程卸载、OpenCode Location scope 和 [VS Code PTY 宽限期](https://github.com/microsoft/vscode/blob/main/src/vs/platform/terminal/node/ptyService.ts) 的调研支持了独立引用和延迟清理的设计。两小时是 DSH 的产品策略，不是行业默认值。[浏览器终端决策](2026-09-09-web-sidebar-terminal.zh.md) 与[布局／provider 恢复决策](../architecture/2026-09-14-sidebar-layout-provider-recovery.zh.md) 继续有效，因为其资源所有权和持久化职责划分仍然适用。
+Codex 线程卸载、OpenCode Location scope 和 [VS Code PTY 宽限期](https://github.com/microsoft/vscode/blob/main/src/vs/platform/terminal/node/ptyService.ts) 的调研支持了独立引用和延迟清理的设计。两小时是 DSH 的产品策略，不是行业默认值。[浏览器终端决策](2026-09-09-web-sidebar-terminal.zh.md) 与[布局／provider 恢复参考](../../../../packages/client/ui-sidebar-right/README.zh.md) 定义此处沿用的资源所有权和持久化职责划分。
## 考虑过的替代方案
diff --git a/.agents/notes/implemented/feature/2026-09-15-bundled-office-skills.i18n.yaml b/.agents/notes/implemented/feature/2026-09-15-bundled-office-skills.i18n.yaml
deleted file mode 100644
index d220a04f6f..0000000000
--- a/.agents/notes/implemented/feature/2026-09-15-bundled-office-skills.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-15-bundled-office-skills.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-15-bundled-office-skills.md
-/agent-note-bundled-office-skills-with-structural-verification:
- en: 8cc7012d7343c387
- zh: 8565543be5d94a56
-/agent-note-bundled-office-skills-with-structural-verification/problem:
- en: d1e1e74b0fa286de
- zh: 61ce855e4726d4a3
-/agent-note-bundled-office-skills-with-structural-verification/decision:
- en: 486c2b40a0a4fe3c
- zh: 317f47318b27e8f8
-/agent-note-bundled-office-skills-with-structural-verification/alternatives-considered:
- en: c5389aef638deb0c
- zh: a11a99a269e81c6a
-/agent-note-bundled-office-skills-with-structural-verification/consequences:
- en: a6035aefa4443df3
- zh: f87c6f099e4f3c7d
diff --git a/.agents/notes/implemented/feature/2026-09-15-changed-file-diff-preview.i18n.yaml b/.agents/notes/implemented/feature/2026-09-15-changed-file-diff-preview.i18n.yaml
deleted file mode 100644
index b52514834c..0000000000
--- a/.agents/notes/implemented/feature/2026-09-15-changed-file-diff-preview.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-15-changed-file-diff-preview.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-15-changed-file-diff-preview.md
-/agent-note-turn-review-tab:
- en: cdcf921443075122
- zh: 177609e61939922a
-/agent-note-turn-review-tab/problem:
- en: 91d904d836519a4b
- zh: c0aec4e184ff924b
-/agent-note-turn-review-tab/decision:
- en: 8169e63f8bf8416d
- zh: 24c1e3fb394983e3
-/agent-note-turn-review-tab/alternatives-considered:
- en: e648f82b78a2c0d3
- zh: f4e6511766ace168
-/agent-note-turn-review-tab/consequences:
- en: 2147596d8c6574da
- zh: db8b2e1ce86465df
diff --git a/.agents/notes/implemented/feature/2026-09-15-continuable-activation-capacity.i18n.yaml b/.agents/notes/implemented/feature/2026-09-15-continuable-activation-capacity.i18n.yaml
deleted file mode 100644
index a373848ad2..0000000000
--- a/.agents/notes/implemented/feature/2026-09-15-continuable-activation-capacity.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-15-continuable-activation-capacity.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-15-continuable-activation-capacity.md
-/agent-note-shared-continuable-activation-capacity:
- en: 56a51d29c97b2c8e
- zh: c99085a3b2deb97c
-/agent-note-shared-continuable-activation-capacity/problem:
- en: f940cc05cf90362d
- zh: 1cdb4281d845c0da
-/agent-note-shared-continuable-activation-capacity/decision:
- en: e03ae0d516885585
- zh: bd81d197e097b1ee
-/agent-note-shared-continuable-activation-capacity/alternatives-considered:
- en: 54aefa812e00ce1e
- zh: 08251d541b7991df
-/agent-note-shared-continuable-activation-capacity/consequences:
- en: 4792e84eeaac32ee
- zh: 4c941792d03130a0
-/agent-note-shared-continuable-activation-capacity/verification:
- en: f599edb8fb0112af
- zh: a66f9102a79234f0
diff --git a/.agents/notes/implemented/feature/2026-09-15-docs-page-markdown-actions.i18n.yaml b/.agents/notes/implemented/feature/2026-09-15-docs-page-markdown-actions.i18n.yaml
deleted file mode 100644
index 87e8807409..0000000000
--- a/.agents/notes/implemented/feature/2026-09-15-docs-page-markdown-actions.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-15-docs-page-markdown-actions.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-15-docs-page-markdown-actions.md
-/agent-note-page-markdown-actions-in-the-documentation-site:
- en: 135670d1e466e923
- zh: b071c98c104c6aa5
-/agent-note-page-markdown-actions-in-the-documentation-site/problem:
- en: d8c4d91741fe4a3f
- zh: 0dae755314b52d9d
-/agent-note-page-markdown-actions-in-the-documentation-site/decision:
- en: b02d9faf0f2dfa91
- zh: 994a9755e0ddf16c
-/agent-note-page-markdown-actions-in-the-documentation-site/alternatives-considered:
- en: 96b23eb170e4edf2
- zh: 63e91e6c425afe1b
-/agent-note-page-markdown-actions-in-the-documentation-site/consequences:
- en: 57a6d0707d1793cd
- zh: b63d4f3f82f8c38f
diff --git a/.agents/notes/implemented/feature/2026-09-15-docs-platform-command-tabs.i18n.yaml b/.agents/notes/implemented/feature/2026-09-15-docs-platform-command-tabs.i18n.yaml
deleted file mode 100644
index ceadaacf73..0000000000
--- a/.agents/notes/implemented/feature/2026-09-15-docs-platform-command-tabs.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-15-docs-platform-command-tabs.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-15-docs-platform-command-tabs.md
-/agent-note-platform-command-tabs-in-the-python-sdk-guide:
- en: 3d96f04869d2a2fb
- zh: 4a6ebfb3ccf9c69d
-/agent-note-platform-command-tabs-in-the-python-sdk-guide/problem:
- en: 8fb6ad2440352a06
- zh: 0809a5c9866e52ee
-/agent-note-platform-command-tabs-in-the-python-sdk-guide/decision:
- en: 0ec36e0eccea6209
- zh: 5df6069c60a55f31
-/agent-note-platform-command-tabs-in-the-python-sdk-guide/alternatives-considered:
- en: a98aa2b8d03f11aa
- zh: 0aefaa161a20a24e
-/agent-note-platform-command-tabs-in-the-python-sdk-guide/consequences:
- en: f3af5502a73e7725
- zh: 4ca34dfd993fcc21
diff --git a/.agents/notes/implemented/feature/2026-09-15-docs-platform-command-tabs.md b/.agents/notes/implemented/feature/2026-09-15-docs-platform-command-tabs.md
deleted file mode 100644
index 4d44d1191a..0000000000
--- a/.agents/notes/implemented/feature/2026-09-15-docs-platform-command-tabs.md
+++ /dev/null
@@ -1,31 +0,0 @@
-# Agent Note: Platform command tabs in the Python SDK guide
-
-Status: implemented
-
-English | [中文](2026-09-15-docs-platform-command-tabs.zh.md)
-
-## Problem
-
-The [Python SDK guide](../../../../docs/user/guide/python-sdk.md) gives different commands for POSIX shells and Windows PowerShell. Showing both versions in sequence makes readers skip an alternative at each step and can make alternative commands look cumulative.
-
-## Decision
-
-Each of the four platform-dependent steps uses VitePress's native `code-group`: Linux/macOS first, Windows PowerShell second. Each group selects independently and starts on Linux/macOS. Credential setup and running the example remain separate sequential steps. Shared Python and YAML examples stay directly visible.
-
-Both languages retain every command in canonical Markdown. The documentation projector preserves the groups and their code in the website's raw Markdown. Explicit anchors before each group preserve the former platform heading targets; following a platform anchor locates the group without selecting a tab.
-
-The theme adds a visible keyboard focus outline to native radio labels and displays both command blocks in search excerpts, whose tab controls are unavailable. A Markdown renderer adapter makes each native tab strip a form with submission prevented. Local search copies a section's rendered HTML, including radio names; separate form owners stop those copies from clearing the page's selection. VitePress owns selection, syntax highlighting, and copying the active code block. MPA builds omit those client handlers, so build-only styles display both command blocks and hide the tab strip and copy buttons. There is no shared selection state or stored preference.
-
-## Alternatives considered
-
-**Keep vertically repeated platform sections.** Both versions are immediately visible, but the repeated alternatives interrupt the guide's ordered steps.
-
-**Build a custom tab component with shared or persistent selection.** A Windows reader could select once, but shared state couples independent examples and introduces selection and lifecycle code beyond the required presentation. Native groups keep the interaction local.
-
-## Consequences
-
-SPA readers see one command version per step while MPA, repository, and raw-Markdown readers retain both. Windows readers select PowerShell in each group. Existing platform links still reach the corresponding step, although the platform names leave the page outline.
-
-Verification covers command preservation, bilingual pairing, projected and raw Markdown, and actual browser switching, copying, keyboard focus, search, themes, and narrow layouts. Framework-owned interaction is exercised on the running site; session replay is inapplicable to this documentation-only presentation.
-
-The focused renderer regression checks radio ownership when local search duplicates a section. The adapter depends on VitePress's native tab-strip markup and fails the build if that markup changes; a framework upgrade must retain the search isolation and browser checks.
diff --git a/.agents/notes/implemented/feature/2026-09-15-docs-platform-command-tabs.zh.md b/.agents/notes/implemented/feature/2026-09-15-docs-platform-command-tabs.zh.md
deleted file mode 100644
index 450765b52d..0000000000
--- a/.agents/notes/implemented/feature/2026-09-15-docs-platform-command-tabs.zh.md
+++ /dev/null
@@ -1,31 +0,0 @@
-# Agent Note: Python SDK 指南的平台命令标签
-
-Status: implemented
-
-[English](2026-09-15-docs-platform-command-tabs.md) | 中文
-
-## 问题
-
-[Python SDK 指南](../../../../docs/user/guide/python-sdk.zh.md)分别提供 POSIX shell 和 Windows PowerShell 命令。连续显示两个版本使读者在每一步都要跳过另一平台，也容易把二选一的命令理解为需要依次执行。
-
-## 决策
-
-四个平台相关步骤分别使用 VitePress 原生 `code-group`：Linux/macOS 在前，Windows PowerShell 在后。各组独立选择，初始均显示 Linux/macOS。配置凭据和运行示例仍是两个顺序步骤。共用的 Python 和 YAML 示例保持直接可见。
-
-两种语言均在规范 Markdown 中保留每条命令。文档投影器在网站原始 Markdown 中保留分组及代码。各组前的显式锚点保留原有平台标题的链接目标；平台锚点定位到分组，但不选择标签。
-
-主题为原生单选按钮标签补充可见的键盘焦点轮廓，并在无法操作标签的搜索摘要中显示两个命令块。Markdown 渲染适配器将各原生标签栏设为禁止提交的表单。本地搜索会复制章节渲染后的 HTML，其中包含单选按钮名称；独立的所属表单可避免副本清除页面的选择。VitePress 负责选择、语法高亮和复制当前代码块。MPA 构建不包含这些客户端处理器，因此构建专用样式显示两个命令块，并隐藏标签栏与复制按钮。不引入共享选择状态或持久化偏好。
-
-## 考虑过的替代方案
-
-**保留纵向重复的平台章节。** 两个版本都立即可见，但重复的备选命令会打断指南的顺序步骤。
-
-**自建标签组件并共享或持久化选择。** Windows 读者只需选择一次，但共享状态会耦合独立示例，并引入超出所需展示功能的选择与生命周期代码。原生分组将交互限定在各组内。
-
-## 影响
-
-SPA 读者每一步只看到一个命令版本，MPA、仓库和原始 Markdown 读者仍能获取两个版本。Windows 读者需要在各组中选择 PowerShell。原有平台链接仍到达对应步骤，但平台名称不再出现在页面大纲中。
-
-验证覆盖命令保留、双语配对、投影和原始 Markdown，以及真实浏览器中的切换、复制、键盘焦点、搜索、主题和窄屏布局。框架负责的交互在运行中的站点验收；会话回放不适用于这项纯文档展示变更。
-
-聚焦的渲染回归验证本地搜索复制章节时的单选按钮归属。适配器依赖 VitePress 原生标签栏的 HTML，结构变化时会使构建失败；框架升级必须保留搜索隔离和浏览器检查。
diff --git a/.agents/notes/implemented/feature/2026-09-15-markdown-file-preview-links.i18n.yaml b/.agents/notes/implemented/feature/2026-09-15-markdown-file-preview-links.i18n.yaml
deleted file mode 100644
index 43efd357fe..0000000000
--- a/.agents/notes/implemented/feature/2026-09-15-markdown-file-preview-links.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-15-markdown-file-preview-links.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-15-markdown-file-preview-links.md
-/agent-note-markdown-file-preview-links:
- en: 98c528496f33598e
- zh: 640619a2dfa0255e
-/agent-note-markdown-file-preview-links/problem:
- en: ba7789f83fadbe95
- zh: 34bcaa0aed5f5c3b
-/agent-note-markdown-file-preview-links/decision:
- en: b986fe2640c2ebf4
- zh: e69700b233e7bd69
-/agent-note-markdown-file-preview-links/alternatives-considered:
- en: d8a4d6ab17eb2880
- zh: 089419d53f71305a
-/agent-note-markdown-file-preview-links/consequences:
- en: c0fc2dd3d860edfa
- zh: 129aa543b4a39e10
diff --git a/.agents/notes/implemented/feature/2026-09-15-profile-command-shorthand.i18n.yaml b/.agents/notes/implemented/feature/2026-09-15-profile-command-shorthand.i18n.yaml
deleted file mode 100644
index 5665220ce2..0000000000
--- a/.agents/notes/implemented/feature/2026-09-15-profile-command-shorthand.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-15-profile-command-shorthand.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-15-profile-command-shorthand.md
-/agent-note-profile-command-shorthand:
- en: 35f20a1162b8407f
- zh: 33d263d534df0b1d
-/agent-note-profile-command-shorthand/problem:
- en: b5c950343e5fbe8c
- zh: df2a055d2c0b3f53
-/agent-note-profile-command-shorthand/decision:
- en: cc8d5ebd595fee34
- zh: 99cb3ade0f17fb7b
-/agent-note-profile-command-shorthand/alternatives-considered:
- en: 8d10eee94348e187
- zh: 5930dee3861058e1
-/agent-note-profile-command-shorthand/consequences:
- en: bbfeb6e59bb8ba55
- zh: fc33289f717cb805
diff --git a/.agents/notes/implemented/feature/2026-09-15-sidebar-workspace-hierarchy.i18n.yaml b/.agents/notes/implemented/feature/2026-09-15-sidebar-workspace-hierarchy.i18n.yaml
deleted file mode 100644
index 5f0daf0064..0000000000
--- a/.agents/notes/implemented/feature/2026-09-15-sidebar-workspace-hierarchy.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-15-sidebar-workspace-hierarchy.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-15-sidebar-workspace-hierarchy.md
-/agent-note-sidebar-workspace-hierarchy:
- en: 6be9fd74b0422158
- zh: ba6dbc81479b75b5
-/agent-note-sidebar-workspace-hierarchy/problem:
- en: dc209dd9d8c73af4
- zh: cc5384ba15ea0be0
-/agent-note-sidebar-workspace-hierarchy/decision:
- en: 9f34c1e903475d25
- zh: 6b22b19f6da3d390
-/agent-note-sidebar-workspace-hierarchy/alternatives-considered:
- en: b30322d71fc7c464
- zh: 36b218a82690cd19
-/agent-note-sidebar-workspace-hierarchy/consequences:
- en: bf890a80351fa883
- zh: 05da81c7026a5204
diff --git a/.agents/notes/implemented/feature/2026-09-15-sidebar-workspace-hierarchy.md b/.agents/notes/implemented/feature/2026-09-15-sidebar-workspace-hierarchy.md
deleted file mode 100644
index 82e63684ec..0000000000
--- a/.agents/notes/implemented/feature/2026-09-15-sidebar-workspace-hierarchy.md
+++ /dev/null
@@ -1,31 +0,0 @@
-# Agent Note: Sidebar Workspace Hierarchy
-
-Status: implemented
-
-English | [中文](2026-09-15-sidebar-workspace-hierarchy.zh.md)
-
-## Problem
-
-A flat Workspace list makes related projects hard to browse when many directories share one parent. Treating that parent as the owner of every descendant Session would conflict with the Workspace requirement that a member Session's canonical working directory equals the registered path.
-
-## Decision
-
-The sidebar defaults to sibling Workspace sections. Selecting **Workspace Tree** in **View options → Group by** derives a recursive hierarchy from registered Workspace paths. The selected mode persists in the existing browser-local viewing store. Each Workspace appears under its nearest strict ancestor; path equality never creates a self-parent. Comparison respects directory separators and Host case spelling, without resolving symlink aliases. Siblings retain their Host order.
-
-Adding a directory registers a normal Workspace and opens its Session directly. Parent Workspaces retain their own Sessions and standard row actions, with child Workspaces preceding their own Sessions. The existing browser-local expansion state controls both child Workspaces and the parent's Session rows; ancestors default to expanded when no explicit preference exists. Explicit collapse also hides the current Session, while ancestor folder icons identify its containing subtree. All rows have equal-width fills and hit targets, with content indentation per level. Workspace drag stays among siblings; descendant drop targets delegate to the nearest compatible ancestor, and unchanged sibling positions do not write Host order. Search navigation expands every ancestor.
-
-## Alternatives considered
-
-**Tree grouping by default:** this hides projects under ancestors even when users want to browse every Workspace directly. An explicit viewing mode preserves the default layout without adding a confirmation to directory adoption.
-
-**Recursive Workspace membership:** this changes the working-directory invariant and makes a Session eligible for multiple accounts. Display nesting needs neither change.
-
-**Separate parent-folder records and an add-time choice:** this duplicates directories already represented by Workspaces and adds a confirmation to ordinary addition. Deriving hierarchy from the registry preserves one add flow and lets every directory own Sessions.
-
-**Automatic directory discovery:** this could show unregistered projects, but requires filesystem listing, refresh, and adoption behavior. The sidebar consumes the current Workspace list only.
-
-## Consequences
-
-Users can collapse related projects without changing Session ownership. Deleting an ancestor preserves child registrations; the independent [Workspace deletion semantics](2026-07-27-workspace-registration-deletion.md) still govern the deleted Workspace's own Sessions. That decision remains active. Browser-local collapse preferences do not synchronize, and registered path spelling after separator normalization determines nesting.
-
-Pure path tests cover strict ancestry, segment boundaries, POSIX backslashes, and Windows separators. Component and browser scenarios exercise default sibling grouping, tree-mode selection and restoration, direct addition, later registrations, independent parent Sessions, collapse restoration, search revelation, sibling sorting through descendant targets, parent-subtree moves, collapsed-current hints, and equal-width rows.
diff --git a/.agents/notes/implemented/feature/2026-09-15-sidebar-workspace-hierarchy.zh.md b/.agents/notes/implemented/feature/2026-09-15-sidebar-workspace-hierarchy.zh.md
deleted file mode 100644
index 07f9ff89b6..0000000000
--- a/.agents/notes/implemented/feature/2026-09-15-sidebar-workspace-hierarchy.zh.md
+++ /dev/null
@@ -1,31 +0,0 @@
-# Agent Note: 侧栏工作区层级
-
-Status: implemented
-
-[English](2026-09-15-sidebar-workspace-hierarchy.md) | 中文
-
-## 问题
-
-许多目录共享同一父目录时，平铺的 Workspace 列表不便浏览相关项目。若让父目录拥有所有后代 Session，则会违背 Workspace 成员 Session 的规范工作目录必须等于注册路径这一要求。
-
-## 决策
-
-侧栏默认将 Workspace 显示为同级分组。在**视图选项 → 分组方式**中选择**按工作区树**后，侧栏从已注册的 Workspace 路径派生递归层级。所选模式保存在现有的浏览器本地视图存储中。每个 Workspace 位于最近的严格祖先下；相同路径不会成为自己的父级。比较遵循目录分隔符和 Host 的大小写拼写，不解析符号链接别名。同级项目保留 Host 顺序。
-
-添加目录会直接注册普通 Workspace 并打开其 Session。父 Workspace 保留自己的 Session 和标准行操作，子 Workspace 位于父级自己的 Session 之前。现有的浏览器本地展开状态同时控制子 Workspace 和父级自己的 Session 行；没有显式偏好时，祖先默认展开。显式折叠也会隐藏当前 Session，但祖先文件夹图标会标识它所在的子树。所有行的高亮与点击区域等宽，内容按层级缩进。Workspace 拖拽限制在同级之间；后代落点交给最近的兼容祖先，同级位置未变时不写入 Host 顺序，搜索导航会展开全部祖先。
-
-## 考虑过的替代方案
-
-**默认采用树形分组：**这会把项目隐藏在祖先之下，即使用户希望直接浏览全部 Workspace。显式视图模式保留默认布局，也不为目录添加流程增加确认。
-
-**递归 Workspace 成员关系：**这会改变工作目录不变量，并让一个 Session 同时符合多个记账。展示嵌套不需要这两项改变。
-
-**独立父目录记录与添加时选择：**这会重复表示已有 Workspace 目录，并为普通添加增加确认。根据注册表派生层级可保留单一添加流程，并让每个目录都能拥有 Session。
-
-**自动发现目录：**这能展示尚未注册的项目，但需要文件系统列举、刷新和采用行为。侧栏仅使用当前 Workspace 列表。
-
-## 结果
-
-用户可以折叠相关项目，而不改变 Session 归属。删除祖先会保留子工作区注册；独立的 [Workspace 删除语义](2026-07-27-workspace-registration-deletion.zh.md)仍决定被删除 Workspace 自身 Session 的处理，该决策继续有效。浏览器本地折叠偏好不跨浏览器同步，嵌套取决于分隔符归一化后的注册路径拼写。
-
-纯路径测试覆盖严格祖先关系、路径段边界、POSIX 反斜杠和 Windows 分隔符。组件与浏览器场景覆盖默认同级分组、树形模式选择与恢复、直接添加、后续注册、父级独立 Session、折叠恢复、搜索展开、通过后代落点进行同级排序、父级子树移动、折叠当前会话提示及整行等宽。
diff --git a/.agents/notes/implemented/feature/2026-09-16-browser-excel-preview.i18n.yaml b/.agents/notes/implemented/feature/2026-09-16-browser-excel-preview.i18n.yaml
index caa8355929..6646c5a4a1 100644
--- a/.agents/notes/implemented/feature/2026-09-16-browser-excel-preview.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-09-16-browser-excel-preview.i18n.yaml
@@ -12,8 +12,8 @@
en: f962826fcf5e3949
zh: 8a9932d86332fb47
/agent-note-browser-excel-preview-with-saved-formula-results/alternatives-considered:
- en: 8d7ac06eaa3ba42c
- zh: b6e43ae09e4df4fa
+ en: 0747bca32af26bfc
+ zh: 1d2739208e7c7d7c
/agent-note-browser-excel-preview-with-saved-formula-results/consequences:
en: 62595b9a9b948422
zh: 0618904d9ebfa7fc
diff --git a/.agents/notes/implemented/feature/2026-09-16-browser-excel-preview.md b/.agents/notes/implemented/feature/2026-09-16-browser-excel-preview.md
index 8a4bbd5dc8..435d7e4f46 100644
--- a/.agents/notes/implemented/feature/2026-09-16-browser-excel-preview.md
+++ b/.agents/notes/implemented/feature/2026-09-16-browser-excel-preview.md
@@ -36,7 +36,7 @@ The core patch also skips drawing freeze dividers when `allowEdit === false`, re
**Replace ExcelJS or require users to rewrite their files.** A parser replacement puts retained fonts, borders, merges, and frozen panes at risk. Rewriting a source file makes a viewer defect the user's responsibility. A temporary preview copy preserves both the existing adapter and the user's file.
-**Keep PDF as an Excel fallback or calculate every formula on import.** PDF retains neither spreadsheet interaction nor formula inspection, while recalculation can change saved results. The [Office engine decision](../architecture/2026-09-11-node-office-kit.md) remains applicable to Word/PowerPoint previews and independent conversion consumers; its conversion capability still supports spreadsheets.
+**Keep PDF as an Excel fallback or calculate every formula on import.** PDF retains neither spreadsheet interaction nor formula inspection, while recalculation can change saved results. The [Office engine reference](../../../../packages/document/office-to-pdf/README.md) remains applicable to Word/PowerPoint previews and independent conversion consumers; its conversion capability still supports spreadsheets.
## Consequences
diff --git a/.agents/notes/implemented/feature/2026-09-16-browser-excel-preview.zh.md b/.agents/notes/implemented/feature/2026-09-16-browser-excel-preview.zh.md
index f04170b28f..e4dbd8843a 100644
--- a/.agents/notes/implemented/feature/2026-09-16-browser-excel-preview.zh.md
+++ b/.agents/notes/implemented/feature/2026-09-16-browser-excel-preview.zh.md
@@ -36,7 +36,7 @@ core 补丁还在 `allowEdit === false` 时跳过冻结分隔线的绘制，保
**替换 ExcelJS 或要求用户重写文件。** 更换解析器会使现有字体、边框、合并及冻结窗格的保留面临风险。重写源文件则把查看器缺陷交给用户处理。临时预览副本同时保留现有适配器和用户文件。
-**保留 PDF 作为 Excel 兜底，或在导入时计算所有公式。** PDF 无法保留表格交互与公式查看，而重新计算可能改变已保存结果。[Office 引擎决策](../architecture/2026-09-11-node-office-kit.zh.md)仍适用于 Word/PowerPoint 预览与独立转换使用方；转换能力仍支持表格。
+**保留 PDF 作为 Excel 兜底，或在导入时计算所有公式。** PDF 无法保留表格交互与公式查看，而重新计算可能改变已保存结果。[Office 引擎参考](../../../../packages/document/office-to-pdf/README.zh.md)仍适用于 Word/PowerPoint 预览与独立转换使用方；转换能力仍支持表格。
## 影响
diff --git a/.agents/notes/implemented/feature/2026-09-16-desktop-onboarding.i18n.yaml b/.agents/notes/implemented/feature/2026-09-16-desktop-onboarding.i18n.yaml
deleted file mode 100644
index 636682a60e..0000000000
--- a/.agents/notes/implemented/feature/2026-09-16-desktop-onboarding.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-16-desktop-onboarding.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-16-desktop-onboarding.md
-/agent-note-device-local-desktop-onboarding:
- en: 84a5519665d72899
- zh: beaadffa0e139459
-/agent-note-device-local-desktop-onboarding/problem:
- en: 50c7c883a2115b7e
- zh: 60533d618a3b2da7
-/agent-note-device-local-desktop-onboarding/decision:
- en: e228d2a308f8ad8a
- zh: c5eee26119226f32
-/agent-note-device-local-desktop-onboarding/alternatives-considered:
- en: 82debfeba02ecfdb
- zh: c15d8fcc012058e3
-/agent-note-device-local-desktop-onboarding/consequences:
- en: 65d1dbaf6b39d57a
- zh: fa5b562c059b3203
diff --git a/.agents/notes/implemented/feature/2026-09-16-open-in-default-app-for-sidebar-files.i18n.yaml b/.agents/notes/implemented/feature/2026-09-16-open-in-default-app-for-sidebar-files.i18n.yaml
deleted file mode 100644
index e3f4c53695..0000000000
--- a/.agents/notes/implemented/feature/2026-09-16-open-in-default-app-for-sidebar-files.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-16-open-in-default-app-for-sidebar-files.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-16-open-in-default-app-for-sidebar-files.md
-/agent-note-open-sidebar-previewed-files-in-the-default-application:
- en: 948e52b8edac6120
- zh: 0898da7049f15ca5
-/agent-note-open-sidebar-previewed-files-in-the-default-application/problem:
- en: 6caae0cf235cdb1d
- zh: e80f02c05d65598a
-/agent-note-open-sidebar-previewed-files-in-the-default-application/decision:
- en: ebd2273122d077db
- zh: 8a596d0a49fb4e4e
-/agent-note-open-sidebar-previewed-files-in-the-default-application/alternatives-considered:
- en: f42e5763bf52e401
- zh: 4b2d954904505fc9
-/agent-note-open-sidebar-previewed-files-in-the-default-application/consequences:
- en: 618062f56d294415
- zh: 5eb57d17854fa805
diff --git a/.agents/notes/implemented/feature/2026-09-16-performance-usage-preference.i18n.yaml b/.agents/notes/implemented/feature/2026-09-16-performance-usage-preference.i18n.yaml
deleted file mode 100644
index 369511d545..0000000000
--- a/.agents/notes/implemented/feature/2026-09-16-performance-usage-preference.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-16-performance-usage-preference.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-16-performance-usage-preference.md
-/agent-note-performance-and-usage-detail-preference:
- en: 6179732355b5c019
- zh: 3a620cf25a5580c4
-/agent-note-performance-and-usage-detail-preference/problem:
- en: 3b420f5fb2952b3e
- zh: 6fa1ef1090e595ec
-/agent-note-performance-and-usage-detail-preference/decision:
- en: 953b5fcaed000c9e
- zh: 2ff9d6ff0535d846
-/agent-note-performance-and-usage-detail-preference/alternatives-considered:
- en: 7c676c0b192d03eb
- zh: 2e994f30fc99c5d4
-/agent-note-performance-and-usage-detail-preference/consequences:
- en: 2bc7b780efbae1e9
- zh: c7ecaffd29dfbbff
diff --git a/.agents/notes/implemented/feature/2026-09-16-performance-usage-preference.md b/.agents/notes/implemented/feature/2026-09-16-performance-usage-preference.md
deleted file mode 100644
index 36ab30561f..0000000000
--- a/.agents/notes/implemented/feature/2026-09-16-performance-usage-preference.md
+++ /dev/null
@@ -1,31 +0,0 @@
-# Agent Note: Performance and usage detail preference
-
-Status: implemented
-
-English | [中文](2026-09-16-performance-usage-preference.zh.md)
-
-## Problem
-
-Always-visible counts and accounting controls add density to Chat even when readers only need output speed and cache effectiveness.
-
-## Decision
-
-Chat owns `ui-chat.performanceUsage` in its existing settings namespace. General Settings offers Compact and Detailed, with Detailed as the default to preserve access to accounting. Both the composer and turn-tail renderer consume the same accepted settings source through framework-bound hooks. Host settings own persistence, validation, and failed-write recovery.
-
-Compact retains only available output speed and cache-hit percentage under the composer. These readings are plain text with no statistics dialog. Detailed retains session statistic dialogs and per-Turn usage. Neither mode renders the elapsed-time action in the completed-turn footer. This preference changes presentation, never telemetry collection, accounting, or Session events.
-
-The [composer statistics decision](2026-09-07-composer-session-stats-pills.md) remains authoritative for accounting sources, dialog exclusivity, and composer spacing in Detailed mode.
-
-The requested footer design prioritizes message actions and token accounting in both modes. Completed turns therefore expose no per-turn elapsed-time control; Detailed restores accounting detail, not that control. The running clock and session-wide timing statistics remain independent of this choice.
-
-## Alternatives considered
-
-**Default to Compact.** This would hide accounting controls for existing users without an explicit choice. The request defines both modes but no default, so Detailed preserves their access.
-
-**Filter telemetry when Compact is selected.** This would discard information needed after switching to Detailed or reopening history. A display preference must not change recorded data.
-
-## Consequences
-
-Unavailable speed or cache-hit data is omitted rather than replaced with invented values. The settings scope provides one accepted value to all consumers without duplicating subscription state. Component coverage checks mode-specific visibility; the [recorded-session browser scenario](../../../../apps/web/tests/message-actions.e2e.ts) exercises selection, reload persistence, and Compact output.
-
-On non-loopback browsers, the preference remains process-local because the settings scope cannot persist writes. Explicit selections update every consumer immediately; accepted Host settings reconcile the live value on loopback browsers.
diff --git a/.agents/notes/implemented/feature/2026-09-16-performance-usage-preference.zh.md b/.agents/notes/implemented/feature/2026-09-16-performance-usage-preference.zh.md
deleted file mode 100644
index ecfd19c41c..0000000000
--- a/.agents/notes/implemented/feature/2026-09-16-performance-usage-preference.zh.md
+++ /dev/null
@@ -1,31 +0,0 @@
-# Agent Note：性能与用量详细程度偏好
-
-Status: implemented
-
-[English](2026-09-16-performance-usage-preference.md) | 中文
-
-## Problem
-
-当读者只需要输出速度和缓存效果时，始终显示的计数和记账控件会增加聊天界面的密度。
-
-## Decision
-
-Chat 在既有设置命名空间中拥有 `ui-chat.performanceUsage`。通用设置提供简洁和详细选项，默认详细以保留记账入口。输入框和轮次页脚渲染器通过框架绑定的 Hook 消费同一个已接受设置源。Host 设置负责持久化、校验和写入失败恢复。
-
-简洁模式仅在输入框下方保留可用的输出速度和缓存命中率。这些读数为纯文本，不提供统计卡片。详细模式保留会话统计卡片和每轮用量。两种模式均不渲染已完成轮次页脚中的耗时操作。该偏好只改变展示，不改变遥测收集、记账或 Session 事件。
-
-[输入框统计决策](2026-09-07-composer-session-stats-pills.zh.md)仍负责详细模式中的记账来源、卡片互斥和输入框间距。
-
-所要求的页脚设计在两种模式下均优先展示消息操作和 token 记账。因此，已完成轮次不提供单轮耗时控件；详细模式恢复记账详情，不恢复该控件。运行中的时钟和会话级计时统计独立于此选择。
-
-## Alternatives considered
-
-**默认简洁。** 这会在已有用户未明确选择时隐藏记账控件。需求定义了两种模式但未指定默认值，因此详细模式保留既有入口。
-
-**选择简洁时过滤遥测。** 这会丢弃切换回详细模式或重新打开历史时需要的信息。展示偏好不能改变记录数据。
-
-## Consequences
-
-不可用的速度或缓存命中数据会被省略，不填入虚构值。设置作用域为所有消费者提供同一个已接受值，无需复制订阅状态。组件覆盖检查不同模式的可见性；[录制会话浏览器场景](../../../../apps/web/tests/message-actions.e2e.ts)验证选择、刷新持久化和简洁模式输出。
-
-在非回环地址浏览器中，设置作用域无法持久化写入，因此该偏好仅在当前进程内生效。明确选择会立即更新所有使用方；回环地址浏览器收到 Host 已接受的设置后会同步当前值。
diff --git a/.agents/notes/implemented/feature/2026-09-16-sandbox-same-mode.i18n.yaml b/.agents/notes/implemented/feature/2026-09-16-sandbox-same-mode.i18n.yaml
deleted file mode 100644
index dfc86aee32..0000000000
--- a/.agents/notes/implemented/feature/2026-09-16-sandbox-same-mode.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-16-sandbox-same-mode.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-16-sandbox-same-mode.md
-/agent-note-repeated-sandbox-modes-need-no-approval:
- en: 85325770757063d8
- zh: 9c55052551299ddf
-/agent-note-repeated-sandbox-modes-need-no-approval/problem:
- en: 0d5832fd63b9cd7b
- zh: f07b20a91b92de25
-/agent-note-repeated-sandbox-modes-need-no-approval/decision:
- en: b102948c4acbdd96
- zh: 7220f043716d571c
-/agent-note-repeated-sandbox-modes-need-no-approval/alternatives-considered:
- en: fb337915525ed95c
- zh: d0584f998f0a3b8f
-/agent-note-repeated-sandbox-modes-need-no-approval/consequences:
- en: bde9f3b22f5159c2
- zh: 105c24546f0943bb
diff --git a/.agents/notes/implemented/feature/2026-09-16-shared-subagent-settings-card.i18n.yaml b/.agents/notes/implemented/feature/2026-09-16-shared-subagent-settings-card.i18n.yaml
deleted file mode 100644
index eab4632401..0000000000
--- a/.agents/notes/implemented/feature/2026-09-16-shared-subagent-settings-card.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-16-shared-subagent-settings-card.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-16-shared-subagent-settings-card.md
-/agent-note-shared-subagent-settings-card:
- en: 63fcf9d6ab8a601d
- zh: 0f824893329679f2
-/agent-note-shared-subagent-settings-card/problem:
- en: a63f47c29f3a6305
- zh: 9f2150e9a9c5bc4b
-/agent-note-shared-subagent-settings-card/decision:
- en: 2c4056b23e053d3a
- zh: d46c391f9b5be135
-/agent-note-shared-subagent-settings-card/alternatives-considered:
- en: 8674979fbd8197f1
- zh: 6c2169803839f70b
-/agent-note-shared-subagent-settings-card/consequences:
- en: 4a3671620dfa64b6
- zh: eb6eb20e864f77a1
-/agent-note-shared-subagent-settings-card/verification:
- en: 8d9956c13fb6658b
- zh: 3d95564e51595bca
diff --git a/.agents/notes/implemented/feature/2026-09-16-shared-subagent-settings-card.md b/.agents/notes/implemented/feature/2026-09-16-shared-subagent-settings-card.md
deleted file mode 100644
index d9457b3e9b..0000000000
--- a/.agents/notes/implemented/feature/2026-09-16-shared-subagent-settings-card.md
+++ /dev/null
@@ -1,29 +0,0 @@
-# Agent Note: Shared Subagent settings card
-
-Status: implemented
-
-English | [中文](2026-09-16-shared-subagent-settings-card.zh.md)
-
-## Problem
-
-Delegation limits and model authorization describe the same Subagent workflow, but separate settings cards make users locate and save them independently.
-
-## Decision
-
-One Subagent page groups delegation limits and model selection, with one save button. Leaving the page discards both drafts. Both existing controllers retain ownership of their drafts, validation and namespace writes. The card blocks saving if either draft is invalid or conflicted, disables both sections during saving, and stays open after both settle successfully. A failed section retains its draft for retry. Limit explanations stay behind information buttons beside the field labels, with concrete depth examples and counting rules. Validation errors remain visible so disclosure does not hide a blocked save.
-
-The plugin registers one `plugins.item` entry while either namespace is served. Its component renders only the available sections, preserving limits-only and model-only deployments without teaching the Plugins page about Subagent grouping.
-
-## Alternatives considered
-
-**Keep separate cards.** Independent controls obscure the relationship between delegation policy and model authorization and require separate save gestures.
-
-**Merge Host namespaces.** UI grouping needs no change to persisted settings, namespace revisions or the different times these policies take effect. The existing namespace controllers preserve those contracts.
-
-## Consequences
-
-The user reviews both sections in one place. A save remains separate namespace writes, so partial success is possible; successful drafts clear while rejected drafts remain visible and retryable. Model authorization still writes its switch and routes atomically within its own namespace. The [package reference](../../../../packages/client/ui-settings-plugins/README.md) describes the controls and their applicability.
-
-## Verification
-
-Focused component and controller tests cover shared validation, save, discard on leaving, pending writes, partial failure and deployments serving either namespace. The assembled Web scenario saves both sections through one button and reads back the settings document.
diff --git a/.agents/notes/implemented/feature/2026-09-16-shared-subagent-settings-card.zh.md b/.agents/notes/implemented/feature/2026-09-16-shared-subagent-settings-card.zh.md
deleted file mode 100644
index ccde0c97df..0000000000
--- a/.agents/notes/implemented/feature/2026-09-16-shared-subagent-settings-card.zh.md
+++ /dev/null
@@ -1,29 +0,0 @@
-# Agent Note: 统一 Subagent 设置卡片
-
-Status: implemented
-
-[English](2026-09-16-shared-subagent-settings-card.md) | 中文
-
-## Problem
-
-委派限制与模型授权描述的是同一套 Subagent 工作流程，但分开的设置卡片让用户必须分别查找和保存。
-
-## Decision
-
-一个 Subagent 页面组织委派限制与模型选择，共用一个保存按钮。离开页面会丢弃两个草稿。两个现有控制器仍各自拥有草稿、校验和命名空间写入。任一草稿无效或冲突时，卡片禁止保存；保存期间禁用两个分区；两者均成功完成后仍保持打开。失败的分区保留草稿以供重试。限制说明通过字段名旁的信息按钮按需展开，使用具体层级示例和计数规则。校验错误仍直接显示，避免折叠说明后隐藏阻止保存的原因。
-
-插件在任一命名空间可用时注册一个 `plugins.item` 条目。组件仅呈现可用的分区，既保留只提供限制或模型设置的部署，也无需让插件页了解 Subagent 分组。
-
-## Alternatives considered
-
-**保留分开的卡片。** 独立控件使委派策略与模型授权之间的关系不够清晰，也需要分别保存。
-
-**合并 Host 命名空间。** UI 分组不需要改变持久化设置、命名空间 revision 或两项策略不同的生效时机。现有命名空间控制器保留这些约定。
-
-## Consequences
-
-用户可以在同一处检查两个分区。保存仍分别写入各自的命名空间，因此可能部分成功；成功的草稿清除，被拒绝的草稿保持可见并可重试。模型授权仍在自己的命名空间内原子写入开关与路由。[包参考文档](../../../../packages/client/ui-settings-plugins/README.zh.md) 描述控件及其生效范围。
-
-## Verification
-
-聚焦的组件和控制器测试覆盖共同校验、保存、离开时丢弃草稿、进行中的写入、部分失败，以及仅提供任一命名空间的部署。组装后的 Web 场景通过一个按钮保存两个分区，并回读设置文档。
diff --git a/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.i18n.yaml b/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.i18n.yaml
index 70686c479d..6e9266fa39 100644
--- a/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.i18n.yaml
@@ -9,8 +9,8 @@
en: 5236141e90e42b81
zh: 1af6306b20797603
/agent-note-sandboxed-sidebar-browser/decision:
- en: 9e89a0fe77cd8b9f
- zh: 7aba8507320cf504
+ en: 123077d0c519f6c9
+ zh: fc447d313dc72e0c
/agent-note-sandboxed-sidebar-browser/web-navigation-states:
en: 6aec277c70600c7d
zh: e2b53f01072b2423
diff --git a/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.md b/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.md
index eff143cc04..6f8fb00fc8 100644
--- a/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.md
+++ b/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.md
@@ -28,7 +28,7 @@ A controller created from a saved checkpoint offers its last title and URL with
Occurrence cancellation releases the controller. It removes the saved checkpoint only when the Sidebar's authoritative `openTabs` inventory no longer contains that tab. The inventory publishes layout removal before `TabDomain` aborts its occurrence; plugin unload also aborts occurrences but leaves saved tab membership intact. Cleanup therefore does not interpret plugin unload as a request to erase recovery data.
-Browser state is presentation state. It does not enter the Session log, model request, resource model, or DockKit layout operations. The existing [right Sidebar infrastructure](2026-09-04-right-sidebar-docking-infrastructure.md), [tab type contract](../architecture/2026-09-05-sidebar-tab-types-and-navigation.md), [resource model](../architecture/2026-09-05-client-resource-model.md), and [Document Preview operations](../architecture/2026-09-08-document-preview-operations.md) retain their existing responsibilities.
+Browser state is presentation state. It does not enter the Session log, model request, resource model, or DockKit layout operations. The existing [right Sidebar infrastructure](2026-09-04-right-sidebar-docking-infrastructure.md), [tab type contract](../../../../packages/client/ui-sidebar-right/README.md), [resource model](../architecture/2026-09-05-client-resource-model.md), and [Document Preview operations](../architecture/2026-09-08-document-preview-operations.md) retain their existing responsibilities.
## Web navigation states
diff --git a/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.zh.md b/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.zh.md
index a037c2fb54..1fcbcccc95 100644
--- a/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.zh.md
+++ b/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.zh.md
@@ -28,7 +28,7 @@ Web 使用 iframe 载体；Desktop 使用[保持页面实例的 webview 载体](
occurrence 取消会释放控制器。只有 Sidebar 的权威 `openTabs` 清单已不再包含该 Tab 时，才删除保存的检查点。清单先发布布局中的 Tab 移除，再由 `TabDomain` abort 对应 occurrence；插件卸载也会 abort occurrence，但仍保留已保存的 Tab 成员信息。因此清理不会把插件卸载当成删除恢复数据的请求。
-Browser 状态只属于呈现层，不进入 Session log、模型请求、resource model 或 DockKit layout operation。现有的[右侧 Sidebar 基础设施](2026-09-04-right-sidebar-docking-infrastructure.zh.md)、[tab 类型契约](../architecture/2026-09-05-sidebar-tab-types-and-navigation.zh.md)、[resource model](../architecture/2026-09-05-client-resource-model.zh.md)和[文档预览操作](../architecture/2026-09-08-document-preview-operations.zh.md)继续负责各自现有职责。
+Browser 状态只属于呈现层，不进入 Session log、模型请求、resource model 或 DockKit layout operation。现有的[右侧 Sidebar 基础设施](2026-09-04-right-sidebar-docking-infrastructure.zh.md)、[tab 类型契约](../../../../packages/client/ui-sidebar-right/README.zh.md)、[resource model](../architecture/2026-09-05-client-resource-model.zh.md)和[文档预览操作](../architecture/2026-09-08-document-preview-operations.zh.md)继续负责各自现有职责。
## Web 导航状态
diff --git a/.agents/notes/implemented/feature/2026-09-16-unified-model-input-controls.i18n.yaml b/.agents/notes/implemented/feature/2026-09-16-unified-model-input-controls.i18n.yaml
deleted file mode 100644
index 4a74dfb669..0000000000
--- a/.agents/notes/implemented/feature/2026-09-16-unified-model-input-controls.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-16-unified-model-input-controls.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-16-unified-model-input-controls.md
-/agent-note-unified-model-input-controls:
- en: a22f2dd1b73eb314
- zh: 1f43526fa6af593a
-/agent-note-unified-model-input-controls/problem:
- en: e28035e73033057d
- zh: 262cf7551cdb783a
-/agent-note-unified-model-input-controls/decision:
- en: 6b4872a76d480c8a
- zh: f833a14a48d2e9d7
-/agent-note-unified-model-input-controls/alternatives-considered:
- en: 83f8ffa39259a9f4
- zh: e158cb5868c82d74
-/agent-note-unified-model-input-controls/consequences:
- en: 768bb77e3a4d72be
- zh: 81080b075b0cc26c
diff --git a/.agents/notes/implemented/feature/2026-09-16-windows-desktop-titlebar.i18n.yaml b/.agents/notes/implemented/feature/2026-09-16-windows-desktop-titlebar.i18n.yaml
deleted file mode 100644
index 6c3b3ddfe0..0000000000
--- a/.agents/notes/implemented/feature/2026-09-16-windows-desktop-titlebar.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-16-windows-desktop-titlebar.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-16-windows-desktop-titlebar.md
-/agent-note-windows-desktop-caption-and-application-menus:
- en: 4220f3c0d8058ca7
- zh: 4751c2cffb9b8e2a
-/agent-note-windows-desktop-caption-and-application-menus/problem:
- en: 9a3d1b6d02197c6b
- zh: 5eba9f9bf6928430
-/agent-note-windows-desktop-caption-and-application-menus/decision:
- en: be4b50d09caa5d46
- zh: 20b0572be5941b0c
-/agent-note-windows-desktop-caption-and-application-menus/alternatives-considered:
- en: db7703a7a37ac5da
- zh: 704a2a289b8f7cb0
-/agent-note-windows-desktop-caption-and-application-menus/consequences:
- en: a52bfa0c00b4e26d
- zh: c479cc99fd1bff03
-/agent-note-windows-desktop-caption-and-application-menus/testing:
- en: d72a6473a7d385cf
- zh: ededb7391908db38
diff --git a/.agents/notes/implemented/feature/2026-09-17-compact-translucent-menu-surfaces.i18n.yaml b/.agents/notes/implemented/feature/2026-09-17-compact-translucent-menu-surfaces.i18n.yaml
deleted file mode 100644
index 101417360a..0000000000
--- a/.agents/notes/implemented/feature/2026-09-17-compact-translucent-menu-surfaces.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-17-compact-translucent-menu-surfaces.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-17-compact-translucent-menu-surfaces.md
-/agent-note-compact-translucent-menu-surfaces:
- en: 629cdf857a84d1f3
- zh: 676a34bac03903be
-/agent-note-compact-translucent-menu-surfaces/problem:
- en: f1ff5b408b409003
- zh: 1f548352bc075cc4
-/agent-note-compact-translucent-menu-surfaces/decision:
- en: 30cbe72206e81f96
- zh: 21cb393871fe6420
-/agent-note-compact-translucent-menu-surfaces/alternatives-considered:
- en: f06228674ee82029
- zh: 385603bebcd17d5f
-/agent-note-compact-translucent-menu-surfaces/consequences:
- en: e76746c0b95549df
- zh: 9ff34644703d565c
diff --git a/.agents/notes/implemented/feature/2026-09-17-compact-translucent-menu-surfaces.md b/.agents/notes/implemented/feature/2026-09-17-compact-translucent-menu-surfaces.md
deleted file mode 100644
index 08fcb2d851..0000000000
--- a/.agents/notes/implemented/feature/2026-09-17-compact-translucent-menu-surfaces.md
+++ /dev/null
@@ -1,29 +0,0 @@
-# Agent Note: Compact translucent menu surfaces
-
-Status: implemented
-
-English | [中文](2026-09-17-compact-translucent-menu-surfaces.zh.md)
-
-## Problem
-
-Shared dropdowns and feature-owned menu panels used the same elevated color token but retained unrelated padding, row height, corner radius, and scrollbar geometry. The opaque menu fill also made nested and portalled surfaces read as solid cards rather than one elevation family, while narrowing individual menus locally would keep those differences distributed across packages.
-
-## Decision
-
-`ui-theme` defines `--dsw-specific-menu` as a translucent light or dark fill and defines `--dsw-menu-backdrop-filter` as `blur(40px) saturate(150%)`. Every elevated package surface that paints the menu fill also applies that backdrop filter, uses `border: 0`, and takes an elevation shadow with its rebindable hairline stroke. A surface containing fixed-position overlays paints the fill and filter on an isolated background pseudo-element, because a filtered ancestor would otherwise change those overlays' containing block. Descendant sticky rows may repaint the inherited fill without another filter. Browsers without backdrop filtering still render the theme-owned translucent fill.
-
-The shared `Menu` and the composer input-trigger menu use the same compact baseline: a 16px outer radius, 3px frame padding, 34px ordinary rows, 13px primary text on a 20px line, 6px icon/text gaps, and 8px row radii. Dense and compact variants reduce from that baseline instead of retaining the former ordinary geometry. The composer menu keeps its feature-owned grouping and 400px height cap; its aliases and descriptions use 12px text on an 18px line.
-
-The global WebKit scrollbar width is 5px. The composer menu overrides it with a 6px draggable rail and a 2px visible thumb through the existing scrollbar geometry variables; Firefox continues to use its standard thin scrollbar path. Track insets and elevated l2 thumb colors remain surface-owned rebindings.
-
-## Alternatives considered
-
-**Keep an opaque shared menu fill.** Rejected because every consumer would need a separate translucent override to share one material, recreating the theme branch outside `ui-theme`.
-
-**Compact only the composer command menu.** Rejected because the shared `Menu` renders the same action, settings, and navigation vocabulary; keeping its former 40px rows would preserve two densities for the same control family.
-
-**Use the 6px padded rail for every scrollbar.** Rejected because ordinary scroll regions need the direct 5px thumb, while the command menu needs a wider hit area around a visually quieter thumb. The existing geometry variables express that difference without another scrollbar implementation.
-
-## Consequences
-
-Elevated menu-fill consumers must pair the fill and backdrop-filter tokens in the same rule, either on the surface or on its isolated background pseudo-element; the stylesheet gate rejects a material layer that omits the filter. Shared menu geometry changes affect every `Menu` render site, while the composer menu retains its own content and interaction rules. Browser and component snapshots cover assembled structure, and theme specs pin the tokens, compact metrics, scrollbar geometry, and complete menu-filter pairing.
diff --git a/.agents/notes/implemented/feature/2026-09-17-compact-translucent-menu-surfaces.zh.md b/.agents/notes/implemented/feature/2026-09-17-compact-translucent-menu-surfaces.zh.md
deleted file mode 100644
index 8e13634995..0000000000
--- a/.agents/notes/implemented/feature/2026-09-17-compact-translucent-menu-surfaces.zh.md
+++ /dev/null
@@ -1,29 +0,0 @@
-# Agent Note: 紧凑半透明菜单表面
-
-Status: implemented
-
-[English](2026-09-17-compact-translucent-menu-surfaces.md) | 中文
-
-## Problem
-
-共享下拉菜单与功能包自有菜单面板使用同一个高层级颜色 token，却保留了不同的内边距、行高、圆角和滚动条几何。不透明菜单填充也让嵌套与 portal 表面像彼此独立的实色卡片；如果只在各功能菜单中局部收紧尺寸，这些差异仍会分散在多个包中。
-
-## Decision
-
-`ui-theme` 将 `--dsw-specific-menu` 定义为明暗主题各自的半透明填充，并将 `--dsw-menu-backdrop-filter` 定义为 `blur(40px) saturate(150%)`。每个绘制菜单填充的包级高层级表面同时应用该 backdrop filter、设置 `border: 0`，并使用带可重绑发丝描边的 elevation 投影。包含 fixed 定位浮层的表面把填充与滤镜绘制在隔离的背景伪元素上，因为带滤镜的祖先会改变这些浮层的包含块。后代 sticky 行可以再次绘制继承的填充，无需重复 filter。不支持 backdrop filtering 的浏览器仍渲染主题持有的半透明填充。
-
-共享 `Menu` 与 composer 输入触发菜单使用同一套紧凑基准：16px 外圆角、3px 边框内距、34px 普通行、13px 主文字配 20px 行高、6px 图文间距，以及 8px 行圆角。dense 与 compact 变体在该基准上继续缩小，不再保留旧的普通几何。composer 菜单保留其功能包持有的分组与 400px 高度上限；别名和说明使用 12px 字号与 18px 行高。
-
-WebKit 系全局滚动条宽度为 5px。composer 菜单通过既有滚动条几何变量覆盖为 6px 可拖动轨道与 2px 可见滑块；Firefox 继续走标准 thin scrollbar 路径。轨道内缩与高层级 l2 滑块颜色仍由表面自行重绑。
-
-## Alternatives considered
-
-**保留不透明的共享菜单填充。** 否决，因为每个消费方都需要单独覆盖成半透明，导致同一种材质再次在 `ui-theme` 之外分叉。
-
-**只收紧 composer 指令菜单。** 否决，因为共享 `Menu` 渲染的是同一套操作、设置与导航词汇；保留原 40px 行会让同一个控件家族继续存在两种密度。
-
-**所有滚动条都使用 6px 带内边距轨道。** 否决，因为普通滚动区域需要直接的 5px 滑块，而指令菜单需要在更安静的可见滑块外保留更宽点击区域。现有几何变量可以表达该差异，无需第二套滚动条实现。
-
-## Consequences
-
-高层级菜单填充消费方必须在同一规则中同时使用填充与 backdrop-filter token，规则可以属于表面本身，也可以属于其隔离的背景伪元素；样式表门禁会拒绝漏掉 filter 的材质层。共享菜单几何影响每个 `Menu` 渲染点，composer 菜单仍保留自身内容与交互规则。浏览器与组件快照覆盖装配结构，主题测试固定 token、紧凑尺寸、滚动条几何与完整的菜单 filter 配对。
diff --git a/.agents/notes/implemented/feature/2026-09-17-developer-tools-settings.i18n.yaml b/.agents/notes/implemented/feature/2026-09-17-developer-tools-settings.i18n.yaml
deleted file mode 100644
index e32c9f6b23..0000000000
--- a/.agents/notes/implemented/feature/2026-09-17-developer-tools-settings.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-17-developer-tools-settings.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-17-developer-tools-settings.md
-/agent-note-shared-developer-tool-settings:
- en: 353fa09368362d0f
- zh: b36c06c8b49833b1
-/agent-note-shared-developer-tool-settings/problem:
- en: e22ee243b1503319
- zh: b53c1a932d547f55
-/agent-note-shared-developer-tool-settings/decision:
- en: b579ed62e2846939
- zh: 4d5c121599413807
-/agent-note-shared-developer-tool-settings/alternatives-considered:
- en: df1b80e5b8d2a178
- zh: 0136d16fc44d57bf
-/agent-note-shared-developer-tool-settings/consequences:
- en: 3f50fdc4b4233266
- zh: 8647e00b474da639
diff --git a/.agents/notes/implemented/feature/2026-09-17-persistent-plan-cards.i18n.yaml b/.agents/notes/implemented/feature/2026-09-17-persistent-plan-cards.i18n.yaml
deleted file mode 100644
index bc17196684..0000000000
--- a/.agents/notes/implemented/feature/2026-09-17-persistent-plan-cards.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-17-persistent-plan-cards.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-17-persistent-plan-cards.md
-/agent-note-persistent-plan-cards-and-sidebar-reading:
- en: e84bc0e16f40cafb
- zh: b11a06e7800e3f9a
-/agent-note-persistent-plan-cards-and-sidebar-reading/problem:
- en: 273400b515da3a1d
- zh: 13b508617f08c6d0
-/agent-note-persistent-plan-cards-and-sidebar-reading/decision:
- en: 243abb4fe9944c97
- zh: 6e66ddceb9c89aee
-/agent-note-persistent-plan-cards-and-sidebar-reading/alternatives-considered:
- en: f1f8dbe0f29b89cd
- zh: 4fc73f1f4b4bcbae
-/agent-note-persistent-plan-cards-and-sidebar-reading/consequences:
- en: 4d1740b16711041d
- zh: 412ac19a3705045e
diff --git a/.agents/notes/implemented/feature/2026-09-17-sidebar-file-and-directory-auto-refresh.i18n.yaml b/.agents/notes/implemented/feature/2026-09-17-sidebar-file-and-directory-auto-refresh.i18n.yaml
index f8fc347f32..368a5a645b 100644
--- a/.agents/notes/implemented/feature/2026-09-17-sidebar-file-and-directory-auto-refresh.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-09-17-sidebar-file-and-directory-auto-refresh.i18n.yaml
@@ -69,5 +69,5 @@
en: 8faa05de777dea21
zh: 2f0b1ff65bdba75b
/agent-note-on-demand-watching-and-automatic-refresh-for-sidebar-previews-and-file-trees/relationship-to-existing-agent-notes:
- en: 8ddc059f64cb3b1c
- zh: f6d6836458ef9522
+ en: b397ea36155793e9
+ zh: bfe74e82b0256cfa
diff --git a/.agents/notes/implemented/feature/2026-09-17-sidebar-file-and-directory-auto-refresh.md b/.agents/notes/implemented/feature/2026-09-17-sidebar-file-and-directory-auto-refresh.md
index f509a8cf26..99639db2e5 100644
--- a/.agents/notes/implemented/feature/2026-09-17-sidebar-file-and-directory-auto-refresh.md
+++ b/.agents/notes/implemented/feature/2026-09-17-sidebar-file-and-directory-auto-refresh.md
@@ -342,4 +342,4 @@ Automatic refresh and OS watching retain the Resource model, file-read authoriza
- [Workspace file service](../../implemented/architecture/2026-09-05-workspace-files-service.md): read and listing responsibilities remain; target-scoped OS observation replaces the Session-scoped operation-only stream.
- [Document preview operations](../../implemented/architecture/2026-09-08-document-preview-operations.md): content-loading ownership and all three modes remain; automatic refresh uses their existing reload paths.
- [Workspace file-read authority](../../implemented/architecture/2026-09-09-workspace-file-read-authority.md): retain distinct access scopes for file reading and directory browsing; target watches follow their respective rules.
-- [Sidebar text preview and file tree](../../implemented/feature/2026-09-05-sidebar-text-preview-and-file-tree.md): per-Tab expansion, navigation, and scrolling remain; open nodes own automatic directory invalidation and watching.
+- [Sidebar text preview and file tree](../../../../packages/client/ui-sidebar-files/README.md): per-Tab expansion, navigation, and scrolling remain; open nodes own automatic directory invalidation and watching.
diff --git a/.agents/notes/implemented/feature/2026-09-17-sidebar-file-and-directory-auto-refresh.zh.md b/.agents/notes/implemented/feature/2026-09-17-sidebar-file-and-directory-auto-refresh.zh.md
index ff7a950aa8..5d11041a5c 100644
--- a/.agents/notes/implemented/feature/2026-09-17-sidebar-file-and-directory-auto-refresh.zh.md
+++ b/.agents/notes/implemented/feature/2026-09-17-sidebar-file-and-directory-auto-refresh.zh.md
@@ -342,4 +342,4 @@ FS、Workspace API、预览和 Files 各自的测试覆盖监听生命周期、
- [Workspace 文件服务](../../implemented/architecture/2026-09-05-workspace-files-service.zh.md)：读取与列表接口职责不变；目标级系统监听替代仅转发操作观察的 Session 流。
- [文档预览操作](../../implemented/architecture/2026-09-08-document-preview-operations.zh.md)：正文加载所有权和三种加载方式不变；自动刷新使用其现有 reload 路径。
- [Workspace 文件读取授权](../../implemented/architecture/2026-09-09-workspace-file-read-authority.zh.md)：保留文件读取与目录浏览的不同访问范围；目标 watch 分别遵循对应规则。
-- [Sidebar 文本预览与文件树](../../implemented/feature/2026-09-05-sidebar-text-preview-and-file-tree.zh.md)：按 Tab 的展开、导航和滚动状态不变；已打开节点负责目录自动失效与监听。
+- [Sidebar 文本预览与文件树](../../../../packages/client/ui-sidebar-files/README.zh.md)：按 Tab 的展开、导航和滚动状态不变；已打开节点负责目录自动失效与监听。
diff --git a/.agents/notes/implemented/feature/2026-09-17-state-dot-visual-language.i18n.yaml b/.agents/notes/implemented/feature/2026-09-17-state-dot-visual-language.i18n.yaml
deleted file mode 100644
index 711a40b14b..0000000000
--- a/.agents/notes/implemented/feature/2026-09-17-state-dot-visual-language.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-17-state-dot-visual-language.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-17-state-dot-visual-language.md
-/agent-note-statedot-solid-marks-and-loading-spinner:
- en: 74ca1dda90213e27
- zh: 14851ca8d3d4617d
-/agent-note-statedot-solid-marks-and-loading-spinner/problem:
- en: 4739e4079e950c72
- zh: 4633fc299da13565
-/agent-note-statedot-solid-marks-and-loading-spinner/decision:
- en: 98dd1c4ac95913b9
- zh: c3c53bae1ffc430a
-/agent-note-statedot-solid-marks-and-loading-spinner/alternatives-considered:
- en: 962827b807ebf026
- zh: dfe83e98956dd2cd
-/agent-note-statedot-solid-marks-and-loading-spinner/testing:
- en: 9d5f7bfb69b7bded
- zh: 281db4c0e7ddd8c2
-/agent-note-statedot-solid-marks-and-loading-spinner/consequences:
- en: 17a7a8d9c3923666
- zh: 84d941223b079f2b
diff --git a/.agents/notes/implemented/feature/2026-09-17-state-dot-visual-language.md b/.agents/notes/implemented/feature/2026-09-17-state-dot-visual-language.md
deleted file mode 100644
index 751abbaa33..0000000000
--- a/.agents/notes/implemented/feature/2026-09-17-state-dot-visual-language.md
+++ /dev/null
@@ -1,31 +0,0 @@
-# Agent Note: StateDot solid marks and loading spinner
-
-Status: implemented
-
-English | [中文](2026-09-17-state-dot-visual-language.zh.md)
-
-## Problem
-
-`StateDot` mixed two drawing languages: settled states used a translucent halo around a solid core, while `ongoing` used an eight-cell pixel chase.
-
-## Decision
-
-`idle`, `done`, `warning`, and `error` render as one solid 6px circle inside the existing 10px layout slot, with no halo. `idle` uses the neutral `--dsw-alias-state-idle-primary` token, `done` remains success green, `warning` remains amber, and `error` remains red.
-
-`ongoing` is the sole non-dot member. Its default edge is 14px, while solid states retain their 10px layout slot. It renders a 25%-opacity complete ring behind a grey arc using the tertiary label token. The glyph rotates continuously over 1.5 seconds while the arc grows from 12 to 24 dash units around its center and returns to 12; the arc offset is zero at both ends, so the browser does not reset a second circular movement at the loop boundary. Reduced-motion environments retain an intermediate static arc. The explicit size override, `data-state`, and `aria-hidden` behavior do not change.
-
-Converted compact status-only presentations use this shared mapping instead of local dots or spinners: waiting or blocked is `warning`, active work is `ongoing`, successful completion is `done`, failure is `error`, and inactive or not-yet-started work is `idle`. Tool rows whose leading slot is a business icon retain the ordinary glyph in every lifecycle state; their collapsed summary turns red for failure and amber for `stopped`, preserving any tool-specific interruption text. The framework-free boot page remains separate because its arc reports aggregate loader progress before React and the shared primitive are available.
-
-## Alternatives considered
-
-**Keep the pixel chase.** Rejected because its block animation did not share the circular language of the settled markers and read as a decorative activity glyph rather than a conventional loading state.
-
-**Fill the complete 10px slot.** Rejected because the former visible core was 6px; retaining that diameter preserves row density while removing only the halo.
-
-## Testing
-
-The component specs pin the four solid-state elements, the two-circle loading artwork, both animation tracks, both size paths, the no-halo stylesheet, and every state token. Tool, Bash, and Skill row specs pin the retained business glyph plus visible red failure and amber interruption summaries. Workspace, Job, Workflow, Subagent, Deliverables, terminal, plugin, Schedule, Todo, Team, approval, document-preview, Trajectory, and connection suites pin their state mappings and accessible labels.
-
-## Consequences
-
-Consumers keep their accessibility labels while status-only presentations share one visual vocabulary. Every settled marker becomes visually quieter and more compact, completion remains green, and every active marker uses the same tertiary-grey rotating loader. Action glyphs such as reconnect and business glyphs such as file or tool types remain available when the icon itself communicates the operation rather than only its state.
diff --git a/.agents/notes/implemented/feature/2026-09-17-state-dot-visual-language.zh.md b/.agents/notes/implemented/feature/2026-09-17-state-dot-visual-language.zh.md
deleted file mode 100644
index 9746ec9af7..0000000000
--- a/.agents/notes/implemented/feature/2026-09-17-state-dot-visual-language.zh.md
+++ /dev/null
@@ -1,31 +0,0 @@
-# Agent Note: StateDot 纯色标记与旋转 loading
-
-Status: implemented
-
-[English](2026-09-17-state-dot-visual-language.md) | 中文
-
-## 问题
-
-`StateDot` 混用了两套绘制语言：已结算状态在实心核外带半透明光晕，`ongoing` 则使用八格像素追逐动画。
-
-## 决策
-
-`idle`、`done`、`warning` 与 `error` 在既有 10px 布局槽内渲染一个 6px 纯色圆点，不再带光晕。`idle` 使用中性的 `--dsw-alias-state-idle-primary` token，`done` 保持成功绿色，`warning` 保持琥珀色，`error` 保持红色。
-
-`ongoing` 是唯一不是圆点的成员。它的默认边长为 14px，纯色状态仍保留 10px 布局槽。它在透明度为 25% 的完整圆环上方，使用 tertiary label token 渲染灰色圆弧。图形以 1.5 秒周期持续旋转，圆弧围绕中心从 12 个 dash 单位增长到 24 个、再回到 12 个；圆弧偏移在首尾都为零，因此浏览器不会在循环边界重置第二段圆周运动。减少动态效果的环境保留中间长度的静态圆弧。显式 size 覆盖、`data-state` 与 `aria-hidden` 行为均不改变。
-
-已转换的紧凑纯状态展示使用这套共享映射，不再自绘圆点或 spinner：等待或阻塞为 `warning`，活动工作为 `ongoing`，成功完成为 `done`，失败为 `error`，未活动或尚未开始为 `idle`。前置槽为业务图标的工具行在所有生命周期状态中都保留普通图标；收起摘要在失败时变红，在 `stopped` 时变为琥珀色并保留工具自有的中断文本。无框架的启动页保持独立，因为它会在 React 与共享原语可用前用圆弧表达 Loader 总体进度。
-
-## 考虑过的替代方案
-
-**保留像素追逐动画。** 否决，因为方块动画没有沿用已结算标记的圆形语言，看起来更像装饰性活动图形，而不是常规 loading 状态。
-
-**填满完整 10px 槽位。** 否决，因为原来的可见实心核就是 6px；保留该直径只移除光晕，同时维持行密度。
-
-## 测试
-
-组件测试固定四种纯色状态元素、双圆环 loading 图稿、两条动画轨道、两条尺寸路径、无光晕样式和每个状态 token。Tool、Bash 与 Skill 行测试固定保留的业务图形，以及可见的红色失败摘要与琥珀色中断摘要。Workspace、Job、Workflow、Subagent、Deliverables、终端、插件、Schedule、Todo、Team、审批、文档预览、Trajectory 与连接测试固定各自的状态映射和无障碍 label。
-
-## 后果
-
-消费方保留无障碍 label，纯状态展示共享同一套视觉词汇。所有已结算标记在视觉上更安静、更紧凑，完成态保持绿色，所有活动态使用同一种 tertiary 灰色旋转 loading。重连等动作图标和文件或工具类型等业务图标在图形本身表达操作而不只表达状态时继续保留。
diff --git a/.agents/notes/implemented/feature/2026-09-18-account-quota-top-up.i18n.yaml b/.agents/notes/implemented/feature/2026-09-18-account-quota-top-up.i18n.yaml
deleted file mode 100644
index daa3d1e95a..0000000000
--- a/.agents/notes/implemented/feature/2026-09-18-account-quota-top-up.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-18-account-quota-top-up.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-18-account-quota-top-up.md
-/agent-note-account-quota-top-up-action:
- en: c9f0d30bc28f815c
- zh: 472505b18ee2e669
-/agent-note-account-quota-top-up-action/problem:
- en: 4c0caf28d02faec2
- zh: a6cc3e175a2f9f4a
-/agent-note-account-quota-top-up-action/decision:
- en: d8046306e6488932
- zh: a0d29f3949c96955
-/agent-note-account-quota-top-up-action/alternatives-considered:
- en: ec6731c63d9c42ee
- zh: 535b67062ce0269b
-/agent-note-account-quota-top-up-action/consequences:
- en: 72febb3835a50018
- zh: 0125b875f35b829e
diff --git a/.agents/notes/implemented/feature/2026-09-18-session-pin-and-sidebar-archive.i18n.yaml b/.agents/notes/implemented/feature/2026-09-18-session-pin-and-sidebar-archive.i18n.yaml
deleted file mode 100644
index a74636286a..0000000000
--- a/.agents/notes/implemented/feature/2026-09-18-session-pin-and-sidebar-archive.i18n.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-18-session-pin-and-sidebar-archive.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-18-session-pin-and-sidebar-archive.md
-/agent-note-session-pinning-and-the-sidebar-archived-filter:
- en: f21362fdb86cdb6c
- zh: b14889b8b7a717a3
-/agent-note-session-pinning-and-the-sidebar-archived-filter/problem:
- en: 8a33826809d1dd8f
- zh: b37aa33a8e2ed8d8
-/agent-note-session-pinning-and-the-sidebar-archived-filter/decision:
- en: c483432158826f12
- zh: 2fc1e96f276420a7
-/agent-note-session-pinning-and-the-sidebar-archived-filter/decision/complete-session-order:
- en: 321a47984818bbb9
- zh: a55d22a44e7b7155
-/agent-note-session-pinning-and-the-sidebar-archived-filter/decision/archive-restoration:
- en: 0e16cb25af1f2bb1
- zh: 026fdf7bfa1c104c
-/agent-note-session-pinning-and-the-sidebar-archived-filter/decision/archived-visibility-and-row-motion:
- en: 83dd778a865f2cf5
- zh: 7636166749f63633
-/agent-note-session-pinning-and-the-sidebar-archived-filter/decision/persistence:
- en: 4bcb0398b47334aa
- zh: fa386724afa99a77
-/agent-note-session-pinning-and-the-sidebar-archived-filter/alternatives-considered:
- en: 3bf6fc0c22b17377
- zh: 0fc64131ee8be859
-/agent-note-session-pinning-and-the-sidebar-archived-filter/consequences:
- en: a487faf9af215726
- zh: a92cae8b15fba541
-/agent-note-session-pinning-and-the-sidebar-archived-filter/related:
- en: 6c67f3a071f80c15
- zh: e0455cddc9c4bea9
diff --git a/.agents/notes/implemented/feature/2026-09-19-windows-acl-mandatory-integrity-confinement.i18n.yaml b/.agents/notes/implemented/feature/2026-09-19-windows-acl-mandatory-integrity-confinement.i18n.yaml
index 5058cd26a1..3678ffb912 100644
--- a/.agents/notes/implemented/feature/2026-09-19-windows-acl-mandatory-integrity-confinement.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-09-19-windows-acl-mandatory-integrity-confinement.i18n.yaml
@@ -36,5 +36,5 @@
en: 6c1deeacdbff418d
zh: 4d7c546e19da5e53
/agent-note-windows-sandbox-delete-confinement-mandatory-integrity-plus-an-ambient-delete-deny/related:
- en: e4b631df90dd1efa
- zh: abc66bfbf8ea2c52
+ en: 7bcd65866358de4a
+ zh: a0fbb85274736365
diff --git a/.agents/notes/implemented/feature/2026-09-19-windows-acl-mandatory-integrity-confinement.md b/.agents/notes/implemented/feature/2026-09-19-windows-acl-mandatory-integrity-confinement.md
index f53765f34a..ffbdc1197a 100644
--- a/.agents/notes/implemented/feature/2026-09-19-windows-acl-mandatory-integrity-confinement.md
+++ b/.agents/notes/implemented/feature/2026-09-19-windows-acl-mandatory-integrity-confinement.md
@@ -53,4 +53,4 @@ Bought: deletes confined through every authority Windows accepts AND confined to
## Related
- [Windows sandbox rung: raw ACL restricted tokens](2026-08-08-windows-acl-restricted-token-sandbox.md) — the rung this change extends (kept active; this note supersedes only its delete-route boundary).
-- [Sandbox decision](2026-07-06-sandbox.md) — the platform chains and the `partial` enforcement vocabulary.
+- [Sandbox reference](../../../../packages/sandbox/sandbox-local/README.md) — the platform chains and the `partial` enforcement vocabulary.
diff --git a/.agents/notes/implemented/feature/2026-09-19-windows-acl-mandatory-integrity-confinement.zh.md b/.agents/notes/implemented/feature/2026-09-19-windows-acl-mandatory-integrity-confinement.zh.md
index a963fd7f54..0cb60d7bf5 100644
--- a/.agents/notes/implemented/feature/2026-09-19-windows-acl-mandatory-integrity-confinement.zh.md
+++ b/.agents/notes/implemented/feature/2026-09-19-windows-acl-mandatory-integrity-confinement.zh.md
@@ -53,4 +53,4 @@ Status: implemented
## 相关
- [Windows sandbox 档：原始 ACL 受限令牌](2026-08-08-windows-acl-restricted-token-sandbox.zh.md)——本次改动所扩展的档（保持 active；本笔记只取代其删除路径边界）。
-- [沙箱决策](2026-07-06-sandbox.zh.md)——平台链与 `partial` 强制执行词汇。
+- [沙箱参考](../../../../packages/sandbox/sandbox-local/README.zh.md)——平台链与 `partial` 强制执行词汇。
diff --git a/.agents/notes/implemented/feature/2026-09-20-default-workspace.i18n.yaml b/.agents/notes/implemented/feature/2026-09-20-default-workspace.i18n.yaml
deleted file mode 100644
index bfc8acd582..0000000000
--- a/.agents/notes/implemented/feature/2026-09-20-default-workspace.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-20-default-workspace.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-20-default-workspace.md
-/agent-note-first-use-default-workspace:
- en: cf68fedc85ef73ad
- zh: a48dfa96ac11585a
-/agent-note-first-use-default-workspace/problem:
- en: 952ca70e83872f88
- zh: 471b4e39dba2039a
-/agent-note-first-use-default-workspace/decision:
- en: 5f70a77db26ed9e2
- zh: 8f6bfb84385315d4
-/agent-note-first-use-default-workspace/alternatives-considered:
- en: 58523eb415e53e2a
- zh: 714ddd81ef7d3262
-/agent-note-first-use-default-workspace/consequences:
- en: ab39d4e9302a2641
- zh: 8921bb8451ef2d0e
diff --git a/.agents/notes/implemented/feature/2026-09-20-developer-tools-default-on.i18n.yaml b/.agents/notes/implemented/feature/2026-09-20-developer-tools-default-on.i18n.yaml
deleted file mode 100644
index 7467604771..0000000000
--- a/.agents/notes/implemented/feature/2026-09-20-developer-tools-default-on.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-20-developer-tools-default-on.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-20-developer-tools-default-on.md
-/agent-note-developer-tools-default-on-after-preference-resolution:
- en: 9e6062c94dd70c14
- zh: 3c04f278da2016a5
-/agent-note-developer-tools-default-on-after-preference-resolution/problem:
- en: 81d08fb192b8e83b
- zh: 90a841219f86bc12
-/agent-note-developer-tools-default-on-after-preference-resolution/decision:
- en: 8a3fbb5281d1b313
- zh: 320b845842676375
-/agent-note-developer-tools-default-on-after-preference-resolution/alternatives-considered:
- en: 7d9ecd04554103c4
- zh: 2706bb78fcc6072d
-/agent-note-developer-tools-default-on-after-preference-resolution/consequences:
- en: 54622ff5338afba9
- zh: 494d55213b2751a0
diff --git a/.agents/notes/implemented/feature/2026-09-20-focus-ring-brand-primary.i18n.yaml b/.agents/notes/implemented/feature/2026-09-20-focus-ring-brand-primary.i18n.yaml
deleted file mode 100644
index 0e8511d871..0000000000
--- a/.agents/notes/implemented/feature/2026-09-20-focus-ring-brand-primary.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-20-focus-ring-brand-primary.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-20-focus-ring-brand-primary.md
-/agent-note-one-keyboard-focus-colour-for-every-control:
- en: 967e19daff3df9bc
- zh: 81e1a21d4204eb8a
-/agent-note-one-keyboard-focus-colour-for-every-control/problem:
- en: 2f3f77b1de539959
- zh: a4fa146b1d9ddecf
-/agent-note-one-keyboard-focus-colour-for-every-control/decision:
- en: 613ec184df6bf5d5
- zh: e4b3f95f4d33a54c
-/agent-note-one-keyboard-focus-colour-for-every-control/alternatives-considered:
- en: 392968102d520d1d
- zh: e7b7b68f145cf3d3
-/agent-note-one-keyboard-focus-colour-for-every-control/consequences:
- en: 25b9933c3d43ad76
- zh: 75d374ce3b7ec2eb
diff --git a/.agents/notes/implemented/feature/2026-09-22-unbounded-completion-wakes-by-default.i18n.yaml b/.agents/notes/implemented/feature/2026-09-22-unbounded-completion-wakes-by-default.i18n.yaml
deleted file mode 100644
index a107523e07..0000000000
--- a/.agents/notes/implemented/feature/2026-09-22-unbounded-completion-wakes-by-default.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-22-unbounded-completion-wakes-by-default.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-22-unbounded-completion-wakes-by-default.md
-/agent-note-background-job-completion-wakes-are-unbounded-by-default:
- en: 5c8e5c0ff2d19ab9
- zh: a046e3297aba3904
-/agent-note-background-job-completion-wakes-are-unbounded-by-default/problem:
- en: 32fdd5fa938fc279
- zh: f8f97f806157eea1
-/agent-note-background-job-completion-wakes-are-unbounded-by-default/decision:
- en: 7e4ee951808e1860
- zh: 8dad4884d259cdc3
-/agent-note-background-job-completion-wakes-are-unbounded-by-default/alternatives-considered:
- en: 62630b7ec477bf7b
- zh: 0640a01ac9d22722
-/agent-note-background-job-completion-wakes-are-unbounded-by-default/consequences:
- en: ba000076db02ccb7
- zh: 1aa1e7d45d6512fe
diff --git a/.agents/notes/implemented/feature/2026-09-23-language-neutral-default-workspace-naming.i18n.yaml b/.agents/notes/implemented/feature/2026-09-23-language-neutral-default-workspace-naming.i18n.yaml
deleted file mode 100644
index 3a51c979a3..0000000000
--- a/.agents/notes/implemented/feature/2026-09-23-language-neutral-default-workspace-naming.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-23-language-neutral-default-workspace-naming.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-23-language-neutral-default-workspace-naming.md
-/agent-note-language-neutral-default-workspace-naming:
- en: f9065db27c1cd7f9
- zh: 3dd1a223a6fcc6c6
-/agent-note-language-neutral-default-workspace-naming/problem:
- en: 35967bed9e895460
- zh: 9cf4da88466ff37c
-/agent-note-language-neutral-default-workspace-naming/decision:
- en: 72fd5b65bbee5434
- zh: 08a4967a1530e686
-/agent-note-language-neutral-default-workspace-naming/alternatives-considered:
- en: 556df0ed81444162
- zh: 5eee5029659419c3
-/agent-note-language-neutral-default-workspace-naming/consequences:
- en: 5f710ca9cf60d514
- zh: 9ea7bdaf8925fd44
diff --git a/.agents/notes/implemented/feature/2026-09-24-auto-review-user-approval-fallback.i18n.yaml b/.agents/notes/implemented/feature/2026-09-24-auto-review-user-approval-fallback.i18n.yaml
index 21a2a83f53..9ab5b64bd8 100644
--- a/.agents/notes/implemented/feature/2026-09-24-auto-review-user-approval-fallback.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-09-24-auto-review-user-approval-fallback.i18n.yaml
@@ -9,8 +9,8 @@
en: ed725dff16cd2339
zh: 555d4ba70af96790
/agent-note-auto-review-asks-the-user-after-a-denial/decision:
- en: 4782a7609717bac3
- zh: f3ebb3581b807f3f
+ en: f5ec55bcfe5e9a9a
+ zh: 1b7462f8f06320e9
/agent-note-auto-review-asks-the-user-after-a-denial/alternatives-considered:
en: 01f71dd10849f925
zh: 8b79a7e149a9a60c
diff --git a/.agents/notes/implemented/feature/2026-09-24-auto-review-user-approval-fallback.md b/.agents/notes/implemented/feature/2026-09-24-auto-review-user-approval-fallback.md
index c9d4cda11b..73f8e6f3b1 100644
--- a/.agents/notes/implemented/feature/2026-09-24-auto-review-user-approval-fallback.md
+++ b/.agents/notes/implemented/feature/2026-09-24-auto-review-user-approval-fallback.md
@@ -12,7 +12,7 @@ English | [中文](2026-09-24-auto-review-user-approval-fallback.zh.md)
A reviewer denial returns the tools pipeline's existing `ask` decision when the Session's approval policy is `ask`. `ToolRuntime` sends it through the approval service with the reason `Auto review denied tool ""`, followed by `: ` when the reviewer gave one. `allowed-once` executes the call; `rejected`, `cancelled`, and `unavailable` deny it through the approval service's ordinary messages, and the body does not run. The listener asks only after later `tools/pre-execute` listeners allow the call, so a downstream denial or cancellation wins without prompting.
-Selecting Auto writes `danger-full-access` with the `ask` approval policy. A recorded Auto selection also matches the `never` policy. A [delegated in-process child pins `never`](2026-08-10-subagent-approval-pinned-never.md), so a child Auto keeps the final `AutoReviewDeniedError` denial and its reason, and a Session recorded under the earlier `never` bundle still resolves to Auto instead of Full access. Selecting Auto again writes `ask`.
+Selecting Auto writes `danger-full-access` with the `ask` approval policy. A recorded Auto selection also matches the `never` policy. A [delegated in-process child pins `never`](../../../../packages/subagent/subagent/README.md), so a child Auto keeps the final `AutoReviewDeniedError` denial and its reason, and a Session recorded under the earlier `never` bundle still resolves to Auto instead of Full access. Selecting Auto again writes `ask`.
A reviewer failure denies the call with `Auto review of tool "" failed; its body was not executed: ` and no structured error info. A provider failure's message carries the finish kind, failure code, and provider message, so the model and the generic tool card show the actual cause.
diff --git a/.agents/notes/implemented/feature/2026-09-24-auto-review-user-approval-fallback.zh.md b/.agents/notes/implemented/feature/2026-09-24-auto-review-user-approval-fallback.zh.md
index 7d901b75fb..a215f09e3d 100644
--- a/.agents/notes/implemented/feature/2026-09-24-auto-review-user-approval-fallback.zh.md
+++ b/.agents/notes/implemented/feature/2026-09-24-auto-review-user-approval-fallback.zh.md
@@ -12,7 +12,7 @@ Status: implemented
当 Session 的审批策略为 `ask` 时，reviewer 拒绝返回 tools 流水线既有的 `ask` 决定。`ToolRuntime` 通过审批服务发送该请求，理由为 `Auto review denied tool ""`；reviewer 给出理由时再追加 `: `。`allowed-once` 执行调用；`rejected`、`cancelled` 与 `unavailable` 通过审批服务的普通消息拒绝调用，body 不执行。只有后续 `tools/pre-execute` listener 放行调用后，listener 才请求审批，因此下游拒绝或取消优先且不弹出审批。
-选择 Auto 会写入 `danger-full-access` 与 `ask` 审批策略。已记录的 Auto 选择也匹配 `never` 策略。[进程内委派 child 固定 `never`](2026-08-10-subagent-approval-pinned-never.zh.md)，因此 child 的 Auto 保留最终的 `AutoReviewDeniedError` 拒绝及其理由；按先前 `never` 组合记录的 Session 仍解析为 Auto，而不是 Full access。再次选择 Auto 会写入 `ask`。
+选择 Auto 会写入 `danger-full-access` 与 `ask` 审批策略。已记录的 Auto 选择也匹配 `never` 策略。[进程内委派 child 固定 `never`](../../../../packages/subagent/subagent/README.zh.md)，因此 child 的 Auto 保留最终的 `AutoReviewDeniedError` 拒绝及其理由；按先前 `never` 组合记录的 Session 仍解析为 Auto，而不是 Full access。再次选择 Auto 会写入 `ask`。
Reviewer 失败以 `Auto review of tool "" failed; its body was not executed: ` 拒绝调用，不带结构化错误信息。Provider 失败消息包含 finish 类型、失败代码与 provider 消息，因此模型与通用工具卡片显示实际原因。
diff --git a/.agents/notes/implemented/feature/2026-09-24-fixed-rate-floor-one-minute.i18n.yaml b/.agents/notes/implemented/feature/2026-09-24-fixed-rate-floor-one-minute.i18n.yaml
deleted file mode 100644
index 7ed8eaaa55..0000000000
--- a/.agents/notes/implemented/feature/2026-09-24-fixed-rate-floor-one-minute.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-24-fixed-rate-floor-one-minute.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-24-fixed-rate-floor-one-minute.md
-/agent-note-one-minute-fixed-rate-floor:
- en: d74434992e0ca252
- zh: cae88d61368d5555
-/agent-note-one-minute-fixed-rate-floor/problem:
- en: a16373df16ee9126
- zh: 10e86f4cfe0e9a11
-/agent-note-one-minute-fixed-rate-floor/decision:
- en: fb49d104c6539934
- zh: 04655695ccbb58c6
-/agent-note-one-minute-fixed-rate-floor/alternatives-considered:
- en: 080ae22387dd35b7
- zh: 8247747dc444d7a4
-/agent-note-one-minute-fixed-rate-floor/consequences:
- en: c11eac4968a2a707
- zh: c4a02ddeef3a5dff
diff --git a/.agents/notes/implemented/feature/2026-09-24-session-inspector.i18n.yaml b/.agents/notes/implemented/feature/2026-09-24-session-inspector.i18n.yaml
new file mode 100644
index 0000000000..e7c8e935b9
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-09-24-session-inspector.i18n.yaml
@@ -0,0 +1,25 @@
+# Bilingual-pair consistency record for 2026-09-24-session-inspector.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-24-session-inspector.md
+/agent-note-session-inspector-data-ownership-and-navigation:
+ en: bf781f92c7d025d3
+ zh: bff723de610cadfb
+/agent-note-session-inspector-data-ownership-and-navigation/problem:
+ en: 701a51da8516dda5
+ zh: 5c816c6d0123e332
+/agent-note-session-inspector-data-ownership-and-navigation/decision:
+ en: 3cce35b9d81d0639
+ zh: cffb09878c9a50b4
+/agent-note-session-inspector-data-ownership-and-navigation/runtime-diagnostics:
+ en: 3a31de3a4ec96a1d
+ zh: d231917978c34ef6
+/agent-note-session-inspector-data-ownership-and-navigation/alternatives-considered:
+ en: 64658e4c356224cb
+ zh: ceabef316dca2457
+/agent-note-session-inspector-data-ownership-and-navigation/consequences:
+ en: a19bcffa41bcbf4d
+ zh: e6eb665efc5e838b
+/agent-note-session-inspector-data-ownership-and-navigation/testing:
+ en: ff09aac1983cef78
+ zh: c3b5669826b5777b
diff --git a/.agents/notes/implemented/feature/2026-09-24-session-inspector.md b/.agents/notes/implemented/feature/2026-09-24-session-inspector.md
new file mode 100644
index 0000000000..c9006347d0
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-09-24-session-inspector.md
@@ -0,0 +1,58 @@
+# Agent Note: Session Inspector data ownership and navigation
+
+Status: implemented
+
+English | [中文](2026-09-24-session-inspector.zh.md)
+
+## Problem
+
+Debugging a Session requires its raw log, Chat structures, and rendered conversation side by side. Runtime objects share Node, Turn, and Step identities and contain cycles, so JSON alone cannot support reference navigation. The Inspector needs an independent entry without making every Conversation View a Sidebar resource.
+
+## Decision
+
+`experimental/session-inspector` registers the `session-inspector-log` Sidebar page and its Session-scoped body. The existing Sidebar owns the Session reference. The Inspector adds no resource provider, Conversation header slot, composer, or product-package navigation API. The [Session Inspector README](../../../../packages/experimental/session-inspector/README.md) owns the table controls and presentation behavior.
+
+- Session Controller and Chat retain ownership of the data. Only the selected table subscribes; the log uses the existing loaded window and pagination, without another Session stream or persistence format.
+- The virtual table groups Turn → Step → event → Assistant block/delta. Open blocks expand and closed blocks fold. Automatic folding preserves the visible row or retained ancestor through trailing space; manual folding anchors the clicked header and pauses following. Sticky ancestors are chosen below the table header and earlier sticky rows.
+- Chat keeps its actual root order and group membership. Materialized nodes outside visible groups are inserted by event anchor, not appended after the final Turn. Content changes retain row identities.
+- WeakMap references identify Node, Group, their Data roots, and Turn/Step locations and Data readers. Breadcrumbs retain readers rather than copies. Node Data can expand inline; named references and ancestor detection stop recursive expansion.
+- Object fields are read lazily in pages of 50 entries. Conversation publications invalidate expanded-field caches because Location Data readers can mutate without changing identity. UI-only renders reuse cached fields. Getters never run automatically, and weak collections remain opaque.
+- Navigation stays in the experimental package. It uses existing Slot/Chat data attributes and the current UI Session to find the main Chat, excluding Sidebar, hidden views, and nested conversations. Searchable folded ancestors receive `beforematch`; the Inspector does not write Chat's fold state.
+- Visible targets only flash. Offscreen targets use native smooth scrolling before a body-level clipped overlay flashes. User interruption, replacement, mode changes, or disposal cancel pending work. Log rows may map approximately to a nearby loaded Node, Group, or Turn; navigation never switches the main View or loads history.
+- Picking uses a real click-catching mask over Chat. `elementsFromPoint()` and the isolated matching functions resolve the underlying record; the mask prevents its click action and forwards wheel movement to existing scrollports. Cancellation removes the mask, overlays, and listeners.
+
+## Runtime diagnostics
+
+The default-off `inspector-profile` optional bundle enables Session inspection and the NodeJS debugging Worker with unredacted Host fetch capture. Enabling the bundle requires no debugging argument or user override. The implementation and explicit source/built overlays remain available; Web startup accepts no new argument and Settings gains no debugging button.
+
+The Host owns the debugging URL, Worker, and capture lifetime. When the composition supplies `--inspect`, the Host attempts to open Chrome; failure leaves the printed link usable. Closing the debugging window does not stop capture. Explicit activation permits local code execution and unredacted network capture, as disclosed in the [Inspector security section](../../../../packages/experimental/inspector/README.md#security).
+
+A Client loaded after the page obtains current ingest parameters through an authenticated document-relative Connection route. Initial injection still supports early connections. Connection resets refresh parameters; replacement releases the previous source, and disposal aborts and waits for outstanding work. The Client never receives or launches the debugging URL.
+
+## Alternatives considered
+
+**Generic Conversation View resources and header labels.** They require address validation, separate Session references, unavailable-view recovery, and composer options for a single consumer. An existing Sidebar page type is sufficient; a generic protocol needs independent consumers before reconsideration.
+
+**Sidebar registration in `ui-conversation`, including split header exports.** Sidebar already consumes Conversation headers. Reversing that dependency creates a TypeScript project-reference cycle that optional runtime injection and type-only imports cannot remove. The experimental consumer depends on both packages through their normal `/client` entries.
+
+**Reuse `subagentchat`.** It owns a complete subagent conversation and composer, not raw inspection. A dedicated page leaves ordinary and subagent Chat behavior unchanged.
+
+**Target-owned navigation through generic events.** This isolates DOM implementation but adds request types, routing, acknowledgements, and lifecycle code to product packages for an experimental consumer. Inspector-owned DOM adaptation accepts maintenance when existing attributes or layout change.
+
+**Serialize all Chat objects as JSON.** Shared identities, cycles, and Map keys would lose interactive structure. Weak references and a lazy object tree preserve navigation without retaining replaced snapshots.
+
+**Shrink the list immediately after a stream closes.** A long block's collapse changes the viewport. Trailing space preserves the anchor and is consumed by new rows; Follow Latest clears it.
+
+**Read initial page injection only.** Late plugin activation has no initial injection. Fetching the current bootstrap decouples connection from page-load timing.
+
+**Let the Client open the debugging URL.** The browser page does not own Host application startup. Host-side launch keeps URL handling and process lifetime together without another launch service.
+
+## Consequences
+
+The Inspector owns local filters, disclosures, selection, breadcrumbs, and highlights, not Chat business state. It can only inspect loaded history and mounted main-Chat content. Projection control-stream updates are not displayed. The Session Inspector plugin alone starts no debugging endpoint or request capture; enabling the optional bundle also enables NodeJS Inspector and fetch capture.
+
+The earlier [optional-bundle decision](../architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md) continues to own installation and provider-runtime trade-offs. This feature adds the Inspector profile to that list rather than making all experimental providers optional bundles.
+
+## Testing
+
+Package tests exercise registration disposal, hierarchy and folding anchors, hidden-node ordering, filters, object navigation and cache invalidation, DOM scope, smooth scrolling, picking, and cancellation. Work-count regressions bound indexed first-page reads and prevent historical regrouping during append. Diagnostic tests cover Loader activation, injected and fetched bootstrap failures, reconnect recovery, registration rollback, failed window launch, and joined disposal. The Web scenario in `snapshots/web/session-inspector` replays a recorded Session through the optional bundle and checks log filtering, object details, and Chat Group order.
diff --git a/.agents/notes/implemented/feature/2026-09-24-session-inspector.zh.md b/.agents/notes/implemented/feature/2026-09-24-session-inspector.zh.md
new file mode 100644
index 0000000000..d619fe182f
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-09-24-session-inspector.zh.md
@@ -0,0 +1,58 @@
+# Agent Note: Session Inspector 数据所有权与导航
+
+Status: implemented
+
+[English](2026-09-24-session-inspector.md) | 中文
+
+## 问题
+
+调试 Session 需要并排查看原始日志、Chat 结构和会话内容。运行时对象共享 Node、Turn、Step 身份并包含循环引用，只显示 JSON 无法支持引用导航。检查器需要独立入口，但不需要把所有 Conversation View 变成 Sidebar 资源。
+
+## 决策
+
+`experimental/session-inspector` 注册 `session-inspector-log` Sidebar 页面及其 Session 作用域正文。已有 Sidebar 管理 Session 引用。检查器不增加资源提供方、Conversation header slot、composer 或产品包导航 API。[Session Inspector README](../../../../packages/experimental/session-inspector/README.zh.md) 描述表格操作与展示行为。
+
+- Session Controller 和 Chat 保留数据所有权。只有当前选中的表格订阅；日志使用现有已加载窗口和分页，不增加 Session 流或持久化格式。
+- 虚拟表格按 Turn → Step → 事件 → Assistant block/delta 分组。未闭合 block 展开，闭合后折叠。自动折叠通过尾部留白保留可见行或仍存在的祖先位置；手动折叠锚定被点击组头并暂停跟随。吸顶祖先在表头和前面吸顶行之下选择。
+- Chat 保留真实根顺序和分组成员关系。未进入可见分组的已物化节点按事件锚点插回，不追加到最后一个 Turn 之后。内容更新保留行身份。
+- WeakMap 引用标记 Node、Group、各自 Data 根对象、Turn/Step 位置及 Data reader。面包屑保存 reader 而非副本。Node Data 可原地展开；具名引用和祖先检测阻止循环展开。
+- 对象字段按需读取，每页 50 项。Location Data reader 可以原地变化而保留身份，因此 Conversation 发布会使展开字段缓存失效。纯 UI 重渲染复用缓存。Getter 不自动执行，弱集合内容保持不透明。
+- 导航逻辑留在实验包内。检查器通过已有 Slot/Chat data 属性和当前 UI Session 查找主 Chat，排除 Sidebar、隐藏视图与嵌套会话。可搜索的折叠祖先接收 `beforematch`；检查器不写入 Chat 的折叠状态。
+- 已可见目标只闪烁。屏外目标先使用原生平滑滚动，再在 body 层通过裁剪浮层闪烁。用户打断、替换请求、切换模式或释放会取消未完成操作。日志行允许近似映射到附近已加载 Node、Group 或 Turn；定位不切换主 View，也不加载历史。
+- 反向点选通过主 Chat 上的真实点击蒙层完成。`elementsFromPoint()` 和独立匹配函数反查底下记录；蒙层拦截底下控件的点击，并把滚轮交给已有滚动区域。取消会移除蒙层、浮层与监听。
+
+## 运行时诊断
+
+默认关闭的可选组合包 `inspector-profile` 启用会话检查能力、NodeJS 调试 Worker 和未脱敏的 Host fetch 采集。启用组合包不需要调试参数或用户覆盖配置。实现及显式源码／构建产物 overlay 保持可用；Web startup 不接受新参数，设置区不增加调试按钮。
+
+Host 管理调试 URL、Worker 和采集生命周期。组合配置提供 `--inspect` 时，Host 尝试打开 Chrome；打开失败后打印的链接仍可使用。关闭调试窗口不会停止采集。显式启用允许执行本地代码并采集未脱敏网络数据，风险说明见 [Inspector 安全部分](../../../../packages/experimental/inspector/README.zh.md#security)。
+
+页面加载后启用的 Client 通过已鉴权、文档相对的 Connection 路由获取当前 ingest 参数。初始注入仍支持早期建联。连接重置会刷新参数；替换先释放旧 source，卸载会取消并等待未完成操作。Client 不接收也不打开调试 URL。
+
+## 考虑过的替代方案
+
+**通用 Conversation View 资源与 header label。** 这需要为一个消费者增加地址校验、独立 Session 引用、视图不可用恢复和 composer 选项。已有 Sidebar 页面类型足够；通用协议应等独立消费者出现后再评审。
+
+**在 `ui-conversation` 注册 Sidebar，包括细分 header 导出。** Sidebar 已消费 Conversation header。反向依赖形成 TypeScript project-reference 环，运行时弱注入和仅类型导入不能消除。实验消费者通过正常 `/client` 入口同时依赖两包。
+
+**复用 `subagentchat`。** 它承载完整 subagent 会话与 composer，而不是原始数据检查。独立页面不改变普通会话和 subagent Chat 行为。
+
+**通过通用事件实现目标 View 定位。** 这能隔离 DOM 实现，但需要为实验消费者在产品包增加请求类型、路由、确认和生命周期代码。Inspector 自持 DOM 适配，接受已有属性或布局变化时同步维护的代价。
+
+**把所有 Chat 对象序列化为 JSON。** 共享身份、循环引用和 Map key 会失去交互结构。弱引用与按需对象树保留导航，也不持有被替换的快照。
+
+**流结束后立即缩短列表。** 长 block 折叠会改变视口。尾部留白保留锚点，并由新行逐渐填充；跟踪最新会清除留白。
+
+**只读取页面初始注入。** 后启用插件没有初始注入。获取当前 bootstrap 可以让建联不依赖页面加载时机。
+
+**让 Client 打开调试 URL。** 浏览器页面不管理 Host 应用启动。由 Host 启动可以统一 URL 处理与进程生命周期，不增加启动服务。
+
+## 后果
+
+检查器管理局部筛选、折叠、选中、面包屑和高亮，不拥有 Chat 业务状态。它只检查已加载历史和主 Chat 中已挂载内容，不展示 Projection 控制流更新。单独启用 Session Inspector 插件不会启动调试端口或请求采集；启用可选组合包也会启用 NodeJS Inspector 和 fetch 采集。
+
+此前的[可选组合包决策](../architecture/2026-09-21-experimental-capabilities-as-optional-bundles.zh.md) 继续管理安装与提供方运行时的取舍。本功能向名单增加 Inspector profile，而不是把所有实验提供方都做成可选组合包。
+
+## 测试
+
+包级测试覆盖注册释放、层级与折叠锚点、隐藏节点顺序、筛选、对象导航与缓存失效、DOM 范围、平滑滚动、点选和取消。工作量回归限制索引集合的首屏读取量，并防止追加时重新分组历史行。诊断测试覆盖 Loader 启用、注入和主动获取 bootstrap 的失败、重连恢复、注册回滚、打开窗口失败与等待释放完成。`snapshots/web/session-inspector` 中的 Web 场景通过可选组合包重放录制 Session，检查日志筛选、对象详情和 Chat Group 顺序。
diff --git a/.agents/notes/implemented/feature/2026-09-27-desktop-cli-runtime.i18n.yaml b/.agents/notes/implemented/feature/2026-09-27-desktop-cli-runtime.i18n.yaml
deleted file mode 100644
index e1dbd577a9..0000000000
--- a/.agents/notes/implemented/feature/2026-09-27-desktop-cli-runtime.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-27-desktop-cli-runtime.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-27-desktop-cli-runtime.md
-/agent-note-desktop-installed-cli-runtime:
- en: 0527f32e8a3c13eb
- zh: 77dde6e91fc1a636
-/agent-note-desktop-installed-cli-runtime/problem:
- en: fb07307392d14fd9
- zh: a334f905b26eef98
-/agent-note-desktop-installed-cli-runtime/decision:
- en: 163c098af7ce6b7b
- zh: 0c142db0f173f761
-/agent-note-desktop-installed-cli-runtime/consequences:
- en: 1dfe287934c9f4bc
- zh: 138f226ec7409a1f
-/agent-note-desktop-installed-cli-runtime/command-registration:
- en: 75ff35db64138e9a
- zh: a8f799c2d568fa8b
-/agent-note-desktop-installed-cli-runtime/alternatives-considered:
- en: 91974c10416cf0fd
- zh: fe26c0b4f5f37e98
diff --git a/.agents/notes/implemented/feature/2026-09-28-desktop-login-shell-environment.i18n.yaml b/.agents/notes/implemented/feature/2026-09-28-desktop-login-shell-environment.i18n.yaml
deleted file mode 100644
index 24c40aec52..0000000000
--- a/.agents/notes/implemented/feature/2026-09-28-desktop-login-shell-environment.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-28-desktop-login-shell-environment.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-28-desktop-login-shell-environment.md
-/agent-note-desktop-reads-the-login-shell-environment-once:
- en: f3d08cb5b03f7032
- zh: 2f117f42aed85bc3
-/agent-note-desktop-reads-the-login-shell-environment-once/problem:
- en: 3a4b92c977e42f45
- zh: 575d92a41e29ae7a
-/agent-note-desktop-reads-the-login-shell-environment-once/decision:
- en: d2af1761d96c498a
- zh: 8419dea042446494
-/agent-note-desktop-reads-the-login-shell-environment-once/alternatives-considered:
- en: ed9ed8bb06a19d7f
- zh: 52ceb0d70f0d05a7
-/agent-note-desktop-reads-the-login-shell-environment-once/consequences:
- en: f3cd204ab6691f1d
- zh: 00c9ae619065b4c3
diff --git a/.agents/notes/implemented/process/2026-06-11-quality-gates.i18n.yaml b/.agents/notes/implemented/process/2026-06-11-quality-gates.i18n.yaml
deleted file mode 100644
index 515c9508fd..0000000000
--- a/.agents/notes/implemented/process/2026-06-11-quality-gates.i18n.yaml
+++ /dev/null
@@ -1,16 +0,0 @@
-# Bilingual-pair consistency record for 2026-06-11-quality-gates.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-06-11-quality-gates.md
-/agent-note-mechanical-quality-gates-over-prose-guidelines:
- en: ee219fd65689e5ea
- zh: a5eb719557f02ad6
-/agent-note-mechanical-quality-gates-over-prose-guidelines/problem:
- en: 526b060333ea2457
- zh: 182f46699589aff5
-/agent-note-mechanical-quality-gates-over-prose-guidelines/decision:
- en: c6d1551e56d22b99
- zh: 6b7efc184274b7ac
-/agent-note-mechanical-quality-gates-over-prose-guidelines/consequences:
- en: 7bf0c081f242501e
- zh: 30f892fbd982f1b2
diff --git a/.agents/notes/implemented/process/2026-06-16-pnpm-over-yarn.i18n.yaml b/.agents/notes/implemented/process/2026-06-16-pnpm-over-yarn.i18n.yaml
deleted file mode 100644
index d4354efa31..0000000000
--- a/.agents/notes/implemented/process/2026-06-16-pnpm-over-yarn.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-06-16-pnpm-over-yarn.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-06-16-pnpm-over-yarn.md
-/agent-note-pnpm-as-the-package-manager-instead-of-yarn-4:
- en: 2c8be5b7d3dae8c7
- zh: e6d4d5dc41455f52
-/agent-note-pnpm-as-the-package-manager-instead-of-yarn-4/problem:
- en: a397e5f0a83c3306
- zh: 5ced99f94dae9e30
-/agent-note-pnpm-as-the-package-manager-instead-of-yarn-4/decision:
- en: cadbbd8b1bab85ef
- zh: 31fcb11ddbcb79c3
-/agent-note-pnpm-as-the-package-manager-instead-of-yarn-4/alternatives-considered:
- en: 20e2ebed65f92625
- zh: f1717d69d271fb43
-/agent-note-pnpm-as-the-package-manager-instead-of-yarn-4/consequences:
- en: 024fefe88e8bbc95
- zh: 018dc287c07d6483
diff --git a/.agents/notes/implemented/process/2026-06-17-ts-build-config.i18n.yaml b/.agents/notes/implemented/process/2026-06-17-ts-build-config.i18n.yaml
deleted file mode 100644
index 3d3e5e065d..0000000000
--- a/.agents/notes/implemented/process/2026-06-17-ts-build-config.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-06-17-ts-build-config.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-06-17-ts-build-config.md
-/agent-note-tsc-first-build-and-one-compiler-ownership:
- en: 98c341593a211f00
- zh: 5c051e3aaff4847e
-/agent-note-tsc-first-build-and-one-compiler-ownership/problem:
- en: 62307ddfb9e110cb
- zh: 236bdad7df92a028
-/agent-note-tsc-first-build-and-one-compiler-ownership/decision:
- en: e2b61f1e0549117d
- zh: 596ca8cf8207f2b5
-/agent-note-tsc-first-build-and-one-compiler-ownership/alternatives-considered:
- en: 9b143ba610f06e2f
- zh: 7832be7816aec7e6
-/agent-note-tsc-first-build-and-one-compiler-ownership/consequences:
- en: 05b0f4a3a96e9435
- zh: 2903da5edbaf3cb7
diff --git a/.agents/notes/implemented/process/2026-07-02-bilingual-docs-and-pairing-gate.i18n.yaml b/.agents/notes/implemented/process/2026-07-02-bilingual-docs-and-pairing-gate.i18n.yaml
deleted file mode 100644
index 59b17b44ff..0000000000
--- a/.agents/notes/implemented/process/2026-07-02-bilingual-docs-and-pairing-gate.i18n.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-02-bilingual-docs-and-pairing-gate.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-07-02-bilingual-docs-and-pairing-gate.md
-/agent-note-bilingual-documentation-via-paired-sibling-files-and-a-pairing-gate:
- en: 04529b9cc16be36d
- zh: 5fb4377453231503
-/agent-note-bilingual-documentation-via-paired-sibling-files-and-a-pairing-gate/problem:
- en: 0ca5c6556229e3ee
- zh: 6dacd60a7dc4bff4
-/agent-note-bilingual-documentation-via-paired-sibling-files-and-a-pairing-gate/decision:
- en: 46b0ca2b0f45eb6c
- zh: 3ddcd36e9ef8d134
-/agent-note-bilingual-documentation-via-paired-sibling-files-and-a-pairing-gate/verification:
- en: 8fbf681b863a831c
- zh: e5ba11a549a92612
-/agent-note-bilingual-documentation-via-paired-sibling-files-and-a-pairing-gate/alternatives-considered:
- en: 995a746c59ea7b6c
- zh: 04a248329dc0d04b
-/agent-note-bilingual-documentation-via-paired-sibling-files-and-a-pairing-gate/industry-precedent:
- en: 6b5d62086bfd3868
- zh: 219dad72943f590a
-/agent-note-bilingual-documentation-via-paired-sibling-files-and-a-pairing-gate/consequences:
- en: 65f9f024d99d438f
- zh: ff624c8be88c5830
diff --git a/.agents/notes/implemented/process/2026-07-04-doc-tiers-and-budgets.i18n.yaml b/.agents/notes/implemented/process/2026-07-04-doc-tiers-and-budgets.i18n.yaml
deleted file mode 100644
index e72a4d0af7..0000000000
--- a/.agents/notes/implemented/process/2026-07-04-doc-tiers-and-budgets.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-04-doc-tiers-and-budgets.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-07-04-doc-tiers-and-budgets.md
-/agent-note-documentation-structure-tiers-and-budgets:
- en: f2add84f6fdb18d0
- zh: 7f97fab8f9234bb9
-/agent-note-documentation-structure-tiers-and-budgets/problem:
- en: 6ecec6cc312745dd
- zh: ac1244b6113b89da
-/agent-note-documentation-structure-tiers-and-budgets/decision:
- en: 8a3a2e086af59a6c
- zh: d1d45a4a108031a2
-/agent-note-documentation-structure-tiers-and-budgets/alternatives-considered:
- en: 8275e8f6ffe18def
- zh: 06a5af3e5581f45b
-/agent-note-documentation-structure-tiers-and-budgets/consequences:
- en: 76c254b56618cef6
- zh: 1f1264d6879df20c
diff --git a/.agents/notes/implemented/process/2026-07-05-uniform-agent-note-format.i18n.yaml b/.agents/notes/implemented/process/2026-07-05-uniform-agent-note-format.i18n.yaml
deleted file mode 100644
index c860b4f1d3..0000000000
--- a/.agents/notes/implemented/process/2026-07-05-uniform-agent-note-format.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-05-uniform-agent-note-format.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-07-05-uniform-agent-note-format.md
-/agent-note-one-gated-in-file-format-for-agent-notes:
- en: 1d02708a467f4a07
- zh: 3c924198ec72c881
-/agent-note-one-gated-in-file-format-for-agent-notes/problem:
- en: 71bd2d16e40c3ed7
- zh: 485862218afcdc00
-/agent-note-one-gated-in-file-format-for-agent-notes/decision:
- en: 246ec96b0c1da90d
- zh: 12a06608ffdf28f8
-/agent-note-one-gated-in-file-format-for-agent-notes/alternatives-considered:
- en: 330044b841da3ab9
- zh: e909207cbcbc5edb
-/agent-note-one-gated-in-file-format-for-agent-notes/consequences:
- en: 345e6318b76b1a06
- zh: 63cef25e59d91654
diff --git a/.agents/notes/implemented/process/2026-07-06-parallel-pre-push-gates.i18n.yaml b/.agents/notes/implemented/process/2026-07-06-parallel-pre-push-gates.i18n.yaml
deleted file mode 100644
index 60dff04b5b..0000000000
--- a/.agents/notes/implemented/process/2026-07-06-parallel-pre-push-gates.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-06-parallel-pre-push-gates.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-07-06-parallel-pre-push-gates.md
-/agent-note-parallel-pre-push-gates:
- en: d5ee83ee15159e15
- zh: 07a6599af21d98a9
-/agent-note-parallel-pre-push-gates/problem:
- en: 896ffdae7d51cc19
- zh: eed0d7e80456bd8e
-/agent-note-parallel-pre-push-gates/decision:
- en: c95d213689164ad6
- zh: da85165d13b26d58
-/agent-note-parallel-pre-push-gates/verification:
- en: c7124c68afb12a8e
- zh: 0a0269476ae353f3
-/agent-note-parallel-pre-push-gates/alternatives-considered:
- en: d54f4ed806116b2e
- zh: 38725684130bb843
-/agent-note-parallel-pre-push-gates/consequences:
- en: 5d22505a7c041e41
- zh: ba1010f18d3e8302
diff --git a/.agents/notes/implemented/process/2026-07-12-package-model-experience-contract.i18n.yaml b/.agents/notes/implemented/process/2026-07-12-package-model-experience-contract.i18n.yaml
deleted file mode 100644
index 0496ff4408..0000000000
--- a/.agents/notes/implemented/process/2026-07-12-package-model-experience-contract.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-12-package-model-experience-contract.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-07-12-package-model-experience-contract.md
-/agent-note-package-model-experience-contract:
- en: c14f97f66251831b
- zh: a7ef93d593a72215
-/agent-note-package-model-experience-contract/problem:
- en: 69034b9a9ba40d49
- zh: 016b64cb54c4c873
-/agent-note-package-model-experience-contract/decision:
- en: f67c13ad41004520
- zh: 28cf10f7d217f626
-/agent-note-package-model-experience-contract/alternatives-considered:
- en: 206bc943c04313b1
- zh: 6d295d9da6675854
-/agent-note-package-model-experience-contract/consequences:
- en: dc6057b8836bb3fc
- zh: 6e41a27a99ae0339
diff --git a/.agents/notes/implemented/process/2026-07-19-remove-generated-agent-note-index.i18n.yaml b/.agents/notes/implemented/process/2026-07-19-remove-generated-agent-note-index.i18n.yaml
deleted file mode 100644
index 42524fde30..0000000000
--- a/.agents/notes/implemented/process/2026-07-19-remove-generated-agent-note-index.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-19-remove-generated-agent-note-index.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-07-19-remove-generated-agent-note-index.md
-/agent-note-keep-agent-notes-discoverable-without-a-generated-index:
- en: aedcead60a29472a
- zh: 0b17ad37acb4a92e
-/agent-note-keep-agent-notes-discoverable-without-a-generated-index/problem:
- en: 8a66ca1096aab8f4
- zh: f9774f5f3e7d0a31
-/agent-note-keep-agent-notes-discoverable-without-a-generated-index/decision:
- en: 2b02e79f20d9be1b
- zh: 5dec073afcee9c2e
-/agent-note-keep-agent-notes-discoverable-without-a-generated-index/alternatives-considered:
- en: 0317d3d10b97f004
- zh: 9315c31a17f7057a
-/agent-note-keep-agent-notes-discoverable-without-a-generated-index/consequences:
- en: 631728aa0d482555
- zh: 910a749ae88d4c83
diff --git a/.agents/notes/implemented/process/2026-07-19-web-styling-system.i18n.yaml b/.agents/notes/implemented/process/2026-07-19-web-styling-system.i18n.yaml
deleted file mode 100644
index 7889068a5c..0000000000
--- a/.agents/notes/implemented/process/2026-07-19-web-styling-system.i18n.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-19-web-styling-system.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-07-19-web-styling-system.md
-/agent-note-web-styling-system-the-token-framework-and-engineering-constraints:
- en: 60e793c38185c08c
- zh: 8f4d4644e3502c31
-/agent-note-web-styling-system-the-token-framework-and-engineering-constraints/problem:
- en: aa546850f8c51cd1
- zh: bba14f66aaf1e06a
-/agent-note-web-styling-system-the-token-framework-and-engineering-constraints/decision:
- en: 72a1d3545d1ebd6d
- zh: f2fdc9006468aa72
-/agent-note-web-styling-system-the-token-framework-and-engineering-constraints/engineering-constraints:
- en: 39f1984d96e609ed
- zh: 14eda6caf43c5514
-/agent-note-web-styling-system-the-token-framework-and-engineering-constraints/the-execution-shape-for-agents:
- en: 10342491b9dcc1a7
- zh: cd23d8c2f8ef3d26
-/agent-note-web-styling-system-the-token-framework-and-engineering-constraints/division-of-labor-with-web-styling-md:
- en: 91e06333e11b1417
- zh: c743f392dbd9391f
-/agent-note-web-styling-system-the-token-framework-and-engineering-constraints/consequences:
- en: 128333a6495cbfa0
- zh: f165ef2f3d76f216
-/agent-note-web-styling-system-the-token-framework-and-engineering-constraints/alternatives-considered:
- en: 6579ca659b112618
- zh: f1a650f4af1b8cc2
diff --git a/.agents/notes/implemented/process/2026-07-20-gui-testing-system.i18n.yaml b/.agents/notes/implemented/process/2026-07-20-gui-testing-system.i18n.yaml
deleted file mode 100644
index d91e7a4590..0000000000
--- a/.agents/notes/implemented/process/2026-07-20-gui-testing-system.i18n.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-20-gui-testing-system.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-07-20-gui-testing-system.md
-/agent-note-gui-testing-system-the-three-tier-structure:
- en: 66959d1c7c3cad28
- zh: 1e29f27d36c45909
-/agent-note-gui-testing-system-the-three-tier-structure/problem:
- en: 1c54e58ea993ef6a
- zh: 73108687fa58a6f2
-/agent-note-gui-testing-system-the-three-tier-structure/decision:
- en: 4c6e52549113c2c7
- zh: 586175edee8b128c
-/agent-note-gui-testing-system-the-three-tier-structure/lane-map:
- en: 81d53390f31e540e
- zh: 272a2b2b93269c45
-/agent-note-gui-testing-system-the-three-tier-structure/anti-regression-discipline:
- en: 80fe1589a6236740
- zh: 30e1911d37865c49
-/agent-note-gui-testing-system-the-three-tier-structure/consequences:
- en: 22f2475a438c639c
- zh: aafab5ff60b7c644
-/agent-note-gui-testing-system-the-three-tier-structure/alternatives-considered:
- en: 19e29023b70018b0
- zh: d47ff8e62a0befb6
diff --git a/.agents/notes/implemented/process/2026-07-21-serial-cross-platform-ci-reference.i18n.yaml b/.agents/notes/implemented/process/2026-07-21-serial-cross-platform-ci-reference.i18n.yaml
index c8afbe8e53..c1501b5647 100644
--- a/.agents/notes/implemented/process/2026-07-21-serial-cross-platform-ci-reference.i18n.yaml
+++ b/.agents/notes/implemented/process/2026-07-21-serial-cross-platform-ci-reference.i18n.yaml
@@ -9,8 +9,8 @@
en: 4fb1c27a631b32d3
zh: 9dbe9a4b9aadfca9
/agent-note-serial-cross-platform-ci-reference/decision:
- en: 6c682d0b7b2a03ca
- zh: b75950853f45cccf
+ en: c88f606c0749bd67
+ zh: b2038b0d92fd8890
/agent-note-serial-cross-platform-ci-reference/alternatives-considered:
en: 3610152c5c4e93af
zh: f4c09d327716f750
diff --git a/.agents/notes/implemented/process/2026-07-21-serial-cross-platform-ci-reference.md b/.agents/notes/implemented/process/2026-07-21-serial-cross-platform-ci-reference.md
index abe34e58a4..35fa389802 100644
--- a/.agents/notes/implemented/process/2026-07-21-serial-cross-platform-ci-reference.md
+++ b/.agents/notes/implemented/process/2026-07-21-serial-cross-platform-ci-reference.md
@@ -16,7 +16,7 @@ Real-kernel sandbox proofs require specific hosted operating systems and archite
## Decision
-[CI](../../../../.github/workflows/ci.yml) (pull-request-only) and [CI master](../../../../.github/workflows/ci-master.yml) (master-push + workflow_dispatch) give pull-request and master-push events complementary responsibilities. Pull requests run Linux, native Windows, [Node compatibility with self-hosted routing under the Linux variable and trust conditions](2026-09-06-node-compatibility-selfhosted.md), and Python checks; [platform scheduling](2026-09-06-master-only-platform-ci.md) assigns Wine and three Python runtime carriers to master pushes. On a push to `master`, the active references are `serial / linux (self-hosted standby)` on the in-house `vm-backup` pool and `serial / windows (self-hosted standby)` on the in-house `dsh-win-ci` pool — the hot-standby drills that continuously re-prove the failover targets described in the [failover runbook](2026-07-26-ci-failover-runbook.md). There is no standard-hosted `serial / linux` definition; the standard-hosted `serial / macos` remains disabled under `TODO(hosted-serial-ci)` until its portable capacity can be restored. The current `serial / windows` definition is the in-house `dsh-win-ci` standby. The separate job definitions intentionally keep their short checkout, runtime setup, and immutable install sequences visible instead of hiding operating systems behind a matrix or reusable workflow. `workflow_dispatch` is reserved for runner benchmarks.
+[CI](../../../../.github/workflows/ci.yml) (pull-request-only) and [CI master](../../../../.github/workflows/ci-master.yml) (master-push + workflow_dispatch) give pull-request and master-push events complementary responsibilities. Pull requests run Linux, native Windows, [Node compatibility with self-hosted routing under the Linux variable and trust conditions](../../../../.github/workflows/ci.yml), and Python checks; [platform scheduling](../../../../.github/workflows/ci-master.yml) assigns Wine and three Python runtime carriers to master pushes. On a push to `master`, the active references are `serial / linux (self-hosted standby)` on the in-house `vm-backup` pool and `serial / windows (self-hosted standby)` on the in-house `dsh-win-ci` pool — the hot-standby drills that continuously re-prove the failover targets described in the [failover runbook](2026-07-26-ci-failover-runbook.md). There is no standard-hosted `serial / linux` definition; the standard-hosted `serial / macos` remains disabled under `TODO(hosted-serial-ci)` until its portable capacity can be restored. The current `serial / windows` definition is the in-house `dsh-win-ci` standby. The separate job definitions intentionally keep their short checkout, runtime setup, and immutable install sequences visible instead of hiding operating systems behind a matrix or reusable workflow. `workflow_dispatch` is reserved for runner benchmarks.
Each reference job runs `pnpm run check:ci` without any shard selector. `DSH_GATE_CONCURRENCY=1` makes the top-level aggregate execute one ready gate at a time; coverage, snapshot replay, built-bin smoke, and publication validation also receive worker counts of one. The reference jobs may run beside one another, but each host's repository gates are serial and complete. Linux installs bubblewrap before replaying snapshots, and Windows enables Developer Mode before installing the symlinked workspace.
diff --git a/.agents/notes/implemented/process/2026-07-21-serial-cross-platform-ci-reference.zh.md b/.agents/notes/implemented/process/2026-07-21-serial-cross-platform-ci-reference.zh.md
index 832af4e655..98ab14a3e1 100644
--- a/.agents/notes/implemented/process/2026-07-21-serial-cross-platform-ci-reference.zh.md
+++ b/.agents/notes/implemented/process/2026-07-21-serial-cross-platform-ci-reference.zh.md
@@ -16,7 +16,7 @@ Status: implemented
## 决策
-[CI](../../../../.github/workflows/ci.yml)（仅 pull request）与 [CI master](../../../../.github/workflows/ci-master.yml)（master 推送 + `workflow_dispatch`）为拉取请求事件与 master 推送事件赋予互补的职责。拉取请求运行 Linux、原生 Windows、[仅在 Linux 变量与信任条件满足时使用自托管路由的 Node 兼容性](2026-09-06-node-compatibility-selfhosted.zh.md)与 Python 检查；[平台调度](2026-09-06-master-only-platform-ci.zh.md)将 Wine 与三个 Python 运行时载体分配给 master 推送。向 `master` 推送时，当前启用的参考作业是公司自有 `vm-backup` 池上的 `serial / linux (self-hosted standby)` 和 `dsh-win-ci` 池上的 `serial / windows (self-hosted standby)`——这些热备演练持续验证[故障切换手册](2026-07-26-ci-failover-runbook.zh.md)所描述的切换目标。不存在标准托管的 `serial / linux` 定义；标准托管的 `serial / macos` 仍处于禁用状态，并由 `TODO(hosted-serial-ci)` 标记，直到其可移植容量恢复。当前 `serial / windows` 定义是公司自有 `dsh-win-ci` 池的 standby。各自独立的作业定义有意显式保留简短的代码检出、运行时设置和依赖锁定的安装步骤，而不是用矩阵或可复用工作流隐藏操作系统差异。`workflow_dispatch` 仅用于运行器基准测试。
+[CI](../../../../.github/workflows/ci.yml)（仅 pull request）与 [CI master](../../../../.github/workflows/ci-master.yml)（master 推送 + `workflow_dispatch`）为拉取请求事件与 master 推送事件赋予互补的职责。拉取请求运行 Linux、原生 Windows、[仅在 Linux 变量与信任条件满足时使用自托管路由的 Node 兼容性](../../../../.github/workflows/ci.yml)与 Python 检查；[平台调度](../../../../.github/workflows/ci-master.yml)将 Wine 与三个 Python 运行时载体分配给 master 推送。向 `master` 推送时，当前启用的参考作业是公司自有 `vm-backup` 池上的 `serial / linux (self-hosted standby)` 和 `dsh-win-ci` 池上的 `serial / windows (self-hosted standby)`——这些热备演练持续验证[故障切换手册](2026-07-26-ci-failover-runbook.zh.md)所描述的切换目标。不存在标准托管的 `serial / linux` 定义；标准托管的 `serial / macos` 仍处于禁用状态，并由 `TODO(hosted-serial-ci)` 标记，直到其可移植容量恢复。当前 `serial / windows` 定义是公司自有 `dsh-win-ci` 池的 standby。各自独立的作业定义有意显式保留简短的代码检出、运行时设置和依赖锁定的安装步骤，而不是用矩阵或可复用工作流隐藏操作系统差异。`workflow_dispatch` 仅用于运行器基准测试。
每个参考作业均在不设置任何分片选择器的情况下运行 `pnpm run check:ci`。`DSH_GATE_CONCURRENCY=1` 使顶层聚合每次只执行一个已经就绪的门禁；覆盖率、快照回放、built-bin 冒烟测试和发布验证的 worker 数量也设为 1。各参考作业可以彼此并行，但每台主机上的仓库门禁都串行运行且完整执行。Linux 在回放快照前安装 bubblewrap，Windows 则在安装采用符号链接的工作区前启用开发人员模式。
diff --git a/.agents/notes/implemented/process/2026-07-26-ci-failover-runbook.i18n.yaml b/.agents/notes/implemented/process/2026-07-26-ci-failover-runbook.i18n.yaml
index 14ae915151..de88f44003 100644
--- a/.agents/notes/implemented/process/2026-07-26-ci-failover-runbook.i18n.yaml
+++ b/.agents/notes/implemented/process/2026-07-26-ci-failover-runbook.i18n.yaml
@@ -6,14 +6,14 @@
en: 677b522817e84e2f
zh: f8518a7033b0fd54
/agent-note-ci-failover-runbook-hosted-pools-in-house-pool/problem:
- en: 317fafe666a76953
- zh: c886a5a4bccceda0
+ en: 3ecedc74cceced3b
+ zh: f4708f1887d42c61
/agent-note-ci-failover-runbook-hosted-pools-in-house-pool/decision:
- en: 2520d6c0d2bfe1a6
- zh: 616c70b8b1026109
+ en: fbc8d8ef03350ac9
+ zh: 7fc81bf75eaab0b7
/agent-note-ci-failover-runbook-hosted-pools-in-house-pool/decision/release-rehearsals-share-the-linux-switch:
- en: 7fdad4f7d060d659
- zh: 6773db9b7d62cd0a
+ en: 01e74068e0a96375
+ zh: aa811861ce30cb47
/agent-note-ci-failover-runbook-hosted-pools-in-house-pool/decision/what-the-in-house-pool-is:
en: 00d8934ed30e838c
zh: bdb5584fbaf27c7d
@@ -24,8 +24,8 @@
en: 2e3829fd72d6b1b0
zh: 563f0abade7974f9
/agent-note-ci-failover-runbook-hosted-pools-in-house-pool/capacity-during-failover:
- en: 4095da1b492d7484
- zh: 0c0bb9c97e4af977
+ en: 22611ed4316adc7c
+ zh: 29acd02b4a07313d
/agent-note-ci-failover-runbook-hosted-pools-in-house-pool/capacity-during-failover/switch-back:
en: 63cf911019db8d2f
zh: 5eb3903b0ceb30db
@@ -36,5 +36,5 @@
en: e68b70d7caca52f1
zh: e6f0be792105a9e6
/agent-note-ci-failover-runbook-hosted-pools-in-house-pool/consequences:
- en: f66e0aa401136799
- zh: 657188692959955e
+ en: d6de79eb73b7a6a2
+ zh: 329d8ed8e3e02f7b
diff --git a/.agents/notes/implemented/process/2026-07-26-ci-failover-runbook.md b/.agents/notes/implemented/process/2026-07-26-ci-failover-runbook.md
index d46f9d1408..f745cb4e70 100644
--- a/.agents/notes/implemented/process/2026-07-26-ci-failover-runbook.md
+++ b/.agents/notes/implemented/process/2026-07-26-ci-failover-runbook.md
@@ -6,17 +6,17 @@ English | [中文](2026-07-26-ci-failover-runbook.zh.md)
## Problem
-The three required Linux worker jobs in [CI](../../../../.github/workflows/ci.yml) (`node 24 / static`, `node 24 / coverage`, `node 24 / snapshots and artifacts`) run on the hosted enterprise 32-core pools; the required verdict job that aggregates them (`all checks passed`) runs on standard `ubuntu-latest`; the [native Windows jobs](2026-08-08-native-windows-pull-request-ci.md) run on the hosted `dsh-windows-2025-16core` larger runner. When the enterprise pools degrade — jobs queue indefinitely or the enterprise labels vanish — every open pull request becomes unmergeable, and the ordinary recovery of merging a fix is itself deadlocked behind the very required checks that cannot run. **Scope: two independent switches, one per platform.** `DSH_CI_FAILOVER_LINUX` recovers an enterprise Linux-pool outage (the three required Linux workers plus the `all checks passed` verdict); `DSH_CI_FAILOVER_WINDOWS` recovers a hosted Windows-pool outage (the native Windows jobs). A Linux-pool outage need not retarget Windows jobs and vice versa. The [Node compatibility jobs](2026-09-06-node-compatibility-selfhosted.md) also follow the Linux switch with isolated setup; the verdict's `node-24-bench`, `python-sdk`, and `python-runtime` dependencies stay on standard hosted runners; in a broader GitHub-hosted capacity failure that also takes out the standard pools, those dependencies still block `all checks passed`. An outage therefore needs a switch any responder with repository write access can throw without merging anything.
+The three required Linux worker jobs in [CI](../../../../.github/workflows/ci.yml) (`node 24 / static`, `node 24 / coverage`, `node 24 / snapshots and artifacts`) run on the hosted enterprise 32-core pools; the required verdict job that aggregates them (`all checks passed`) runs on standard `ubuntu-latest`; the [native Windows jobs](2026-08-08-native-windows-pull-request-ci.md) run on the hosted `dsh-windows-2025-16core` larger runner. When the enterprise pools degrade — jobs queue indefinitely or the enterprise labels vanish — every open pull request becomes unmergeable, and the ordinary recovery of merging a fix is itself deadlocked behind the very required checks that cannot run. **Scope: two independent switches, one per platform.** `DSH_CI_FAILOVER_LINUX` recovers an enterprise Linux-pool outage (the three required Linux workers plus the `all checks passed` verdict); `DSH_CI_FAILOVER_WINDOWS` recovers a hosted Windows-pool outage (the native Windows jobs). A Linux-pool outage need not retarget Windows jobs and vice versa. The [Node compatibility jobs](../../../../.github/workflows/ci.yml) also follow the Linux switch with isolated setup; the verdict's `node-24-bench`, `python-sdk`, and `python-runtime` dependencies stay on standard hosted runners; in a broader GitHub-hosted capacity failure that also takes out the standard pools, those dependencies still block `all checks passed`. An outage therefore needs a switch any responder with repository write access can throw without merging anything.
## Decision
The three primary Linux jobs (`node-24`, `node-24-coverage`, `node-24-consumers`), the three `node-compat` matrix entries, and `all-checks-passed` resolve through `DSH_CI_FAILOVER_LINUX`; the native Windows jobs resolve through `DSH_CI_FAILOVER_WINDOWS`. A platform switch does not redirect the other platform. Set to `selfhosted` by a repository writer, the applicable trusted jobs select `vm-backup` or `dsh-win-ci`; the `blacksmith` value routes the participating jobs per the [blacksmith failover leg note](2026-09-09-blacksmith-failover-leg.md); unset or any other value retains the workflow-defined hosted fallbacks. Node compatibility jobs require a same-repository, non-fork head and a non-Dependabot author, use isolated runtime setup, and retain the `ubuntu-latest` fallback under unset and non-special values; the blacksmith branch carries none of those predicates. Under the `selfhosted` value, Linux failover bounds snapshot concurrency and skips hosted package-cache restores. The verdict follows its workers so it does not remain queued on an unavailable hosted pool. Each switch is writer-manageable repository state, not a merge, so it works while checks are red. The `serial / linux (self-hosted standby)` and `serial / windows (self-hosted standby)` lanes re-prove the complete unsharded aggregates on master pushes.
-The [superseded-CI cancellation policy](2026-09-09-cancel-superseded-ci.md) governs master pushes and manual runs in the same workflow/ref group, including standby drills. Rapid master updates can starve a drill before it reaches a verdict. Use the latest completed standby verdict and check its age and commit before treating it as readiness evidence; a cancelled or merely scheduled run is not proof of readiness.
+The [superseded-CI cancellation policy](../../../../.github/workflows/ci.yml) governs master pushes and manual runs in the same workflow/ref group, including standby drills. Rapid master updates can starve a drill before it reaches a verdict. Use the latest completed standby verdict and check its age and commit before treating it as readiness evidence; a cancelled or merely scheduled run is not proof of readiness.
### Release rehearsals share the Linux switch
-`DSH_CI_FAILOVER_LINUX=selfhosted` also routes the credential-free dependency-layout job and both dsh/vendor pack jobs onto `vm-backup` for eligible same-repository PRs and master pushes. Their [release rehearsal decision](2026-09-06-release-rehearsal-selfhosted.md) owns the stricter event eligibility and hosted manual dispatch. This coupling is intentional: keeping the variable set to save release minutes also keeps the eligible main-CI Linux jobs self-hosted. Clearing it returns both workloads to their hosted targets for subsequent runs; publication stays hosted regardless.
+`DSH_CI_FAILOVER_LINUX=selfhosted` also routes the credential-free dependency-layout job and both dsh/vendor pack jobs onto `vm-backup` for eligible same-repository PRs and master pushes. Their [release rehearsal reference](../../../../.github/workflows/release.yml) owns the stricter event eligibility and hosted manual dispatch. This coupling is intentional: keeping the variable set to save release minutes also keeps the eligible main-CI Linux jobs self-hosted. Clearing it returns both workloads to their hosted targets for subsequent runs; publication stays hosted regardless.
### What the in-house pool is
@@ -40,7 +40,7 @@ The two switches are independent: flip only the one whose platform is degraded.
## Capacity during failover
-Capacity includes the master standby, main-CI jobs, and three release-rehearsal jobs for each eligible PR or master push while the Linux switch is set. Each trusted PR also adds three Node compatibility jobs at gate concurrency one, including the build-backed Node 22 leg and cold temporary runtime downloads. The release rehearsal workflows cancel superseded runs within each workflow/ref group under the [cancellation policy](2026-09-09-cancel-superseded-ci.md); different refs can still add concurrent build, pack, and install load. Check current CPU, memory, disk, and queue pressure before extending self-hosted operation; extra registrations on this VM add scheduling slots, not machine resources. Do not infer spare capacity from the standby alone. When host resources permit extra registrations, use an org registration token (org Settings → Actions → Runners → New runner). Clone an existing runner directory **excluding its identity files** — `rsync -a --exclude '.runner*' --exclude '.credentials*' --exclude '_diag' --exclude '_work' / /` (the globs also catch `.runner_migrated`/`.credentials_migrated`, which GitHub writes on migrated runners and which equally trigger the already-configured refusal) — then run `config.sh` (copying `.runner`/`.credentials` verbatim makes it refuse with "already configured"), and **start the listener**: `sudo ./svc.sh install ubuntu && sudo ./svc.sh start`. Registration alone leaves the runner offline; a started service adds a scheduling slot, not CPU or memory.
+Capacity includes the master standby, main-CI jobs, and three release-rehearsal jobs for each eligible PR or master push while the Linux switch is set. Each trusted PR also adds three Node compatibility jobs at gate concurrency one, including the build-backed Node 22 leg and cold temporary runtime downloads. The release rehearsal workflows cancel superseded runs within each workflow/ref group under the [cancellation policy](../../../../.github/workflows/ci.yml); different refs can still add concurrent build, pack, and install load. Check current CPU, memory, disk, and queue pressure before extending self-hosted operation; extra registrations on this VM add scheduling slots, not machine resources. Do not infer spare capacity from the standby alone. When host resources permit extra registrations, use an org registration token (org Settings → Actions → Runners → New runner). Clone an existing runner directory **excluding its identity files** — `rsync -a --exclude '.runner*' --exclude '.credentials*' --exclude '_diag' --exclude '_work' / /` (the globs also catch `.runner_migrated`/`.credentials_migrated`, which GitHub writes on migrated runners and which equally trigger the already-configured refusal) — then run `config.sh` (copying `.runner`/`.credentials` verbatim makes it refuse with "already configured"), and **start the listener**: `sudo ./svc.sh install ubuntu && sudo ./svc.sh start`. Registration alone leaves the runner offline; a started service adds a scheduling slot, not CPU or memory.
### Switch back
@@ -59,4 +59,4 @@ The variables are writer-manageable repository state; a pull request event itsel
## Consequences
-Recovering from a hosted-pool outage is flipping the affected platform's variable (any writer) plus a re-run, with no merge on the critical path. The cost is a second runner topology per platform to keep working: master pushes schedule the standby lanes, but only completed verdicts establish readiness under the [cancellation policy](2026-09-09-cancel-superseded-ci.md), and the snapshot-concurrency and cache-restore branches in `ci.yml` carry a `selfhosted` leg (Linux only) that must stay in step with the hosted leg. Splitting the switch by platform adds one more variable to manage but bounds the blast radius of each switch to the jobs of a single platform.
+Recovering from a hosted-pool outage is flipping the affected platform's variable (any writer) plus a re-run, with no merge on the critical path. The cost is a second runner topology per platform to keep working: master pushes schedule the standby lanes, but only completed verdicts establish readiness under the [cancellation policy](../../../../.github/workflows/ci.yml), and the snapshot-concurrency and cache-restore branches in `ci.yml` carry a `selfhosted` leg (Linux only) that must stay in step with the hosted leg. Splitting the switch by platform adds one more variable to manage but bounds the blast radius of each switch to the jobs of a single platform.
diff --git a/.agents/notes/implemented/process/2026-07-26-ci-failover-runbook.zh.md b/.agents/notes/implemented/process/2026-07-26-ci-failover-runbook.zh.md
index a229d46f16..3e51f00298 100644
--- a/.agents/notes/implemented/process/2026-07-26-ci-failover-runbook.zh.md
+++ b/.agents/notes/implemented/process/2026-07-26-ci-failover-runbook.zh.md
@@ -6,17 +6,17 @@ Status: implemented
## 问题
-[CI](../../../../.github/workflows/ci.yml) 中三个必需的 Linux 工作作业（`node 24 / static`、`node 24 / coverage`、`node 24 / snapshots and artifacts`）运行在托管的企业级 32 核池上；聚合它们的必需判定作业（`all checks passed`）运行在标准 `ubuntu-latest` 上；[原生 Windows 作业](2026-08-08-native-windows-pull-request-ci.zh.md)运行在托管的 `dsh-windows-2025-16core` 大型运行器上。当企业池发生故障——作业无限排队或企业标签消失——所有开启的拉取请求都无法合并，而"合并一个修复"这一常规恢复手段本身正被那些无法运行的必需检查死锁。**适用范围：两个独立开关，每个平台一个。**`DSH_CI_FAILOVER_LINUX` 恢复企业级 Linux 池故障（三个必需的 Linux 工作作业加 `all checks passed` 判定作业）；`DSH_CI_FAILOVER_WINDOWS` 恢复托管 Windows 池故障（原生 Windows 作业）。Linux 池故障无需重定向 Windows 作业，反之亦然。[Node 兼容性作业](2026-09-06-node-compatibility-selfhosted.zh.md)也通过隔离设置跟随 Linux 开关；判定作业的 `node-24-bench`、`python-sdk` 和 `python-runtime` 依赖仍留在标准托管运行器上；若更大范围的 GitHub 托管容量故障连标准池一并击倒，这些依赖仍会阻塞 `all checks passed`。因此故障需要一个任何具备仓库写权限的响应者都能在不合并任何代码的情况下触发的开关。
+[CI](../../../../.github/workflows/ci.yml) 中三个必需的 Linux 工作作业（`node 24 / static`、`node 24 / coverage`、`node 24 / snapshots and artifacts`）运行在托管的企业级 32 核池上；聚合它们的必需判定作业（`all checks passed`）运行在标准 `ubuntu-latest` 上；[原生 Windows 作业](2026-08-08-native-windows-pull-request-ci.zh.md)运行在托管的 `dsh-windows-2025-16core` 大型运行器上。当企业池发生故障——作业无限排队或企业标签消失——所有开启的拉取请求都无法合并，而"合并一个修复"这一常规恢复手段本身正被那些无法运行的必需检查死锁。**适用范围：两个独立开关，每个平台一个。**`DSH_CI_FAILOVER_LINUX` 恢复企业级 Linux 池故障（三个必需的 Linux 工作作业加 `all checks passed` 判定作业）；`DSH_CI_FAILOVER_WINDOWS` 恢复托管 Windows 池故障（原生 Windows 作业）。Linux 池故障无需重定向 Windows 作业，反之亦然。[Node 兼容性作业](../../../../.github/workflows/ci.yml)也通过隔离设置跟随 Linux 开关；判定作业的 `node-24-bench`、`python-sdk` 和 `python-runtime` 依赖仍留在标准托管运行器上；若更大范围的 GitHub 托管容量故障连标准池一并击倒，这些依赖仍会阻塞 `all checks passed`。因此故障需要一个任何具备仓库写权限的响应者都能在不合并任何代码的情况下触发的开关。
## 决策
三个主要 Linux 作业（`node-24`、`node-24-coverage`、`node-24-consumers`）、三个 `node-compat` 矩阵条目和 `all-checks-passed` 通过 `DSH_CI_FAILOVER_LINUX` 解析；原生 Windows 作业通过 `DSH_CI_FAILOVER_WINDOWS` 解析。一个平台的开关不会重定向另一个平台。仓库写者将变量设为 `selfhosted` 时，适用的可信作业选择 `vm-backup` 或 `dsh-win-ci`；`blacksmith` 取值按 [blacksmith 故障切换支路笔记](2026-09-09-blacksmith-failover-leg.zh.md) 路由参与切换的作业；未设置或任何其它值保留工作流定义的托管回退。Node 兼容性作业要求同仓库且非 fork 的头部以及非 Dependabot 作者，使用隔离运行时设置，并在未设置与非特殊值下保留 `ubuntu-latest` 回退；blacksmith 分支不带上述任何条件。在 `selfhosted` 取值下，Linux 故障切换会限制快照并发，并跳过托管软件包缓存恢复。判定作业跟随工作作业，避免继续在不可用的托管池排队。每个开关都是写者可管理的仓库状态而非一次合并，因此在检查失败时仍然有效。`serial / linux (self-hosted standby)` 与 `serial / windows (self-hosted standby)` 通道在 master 推送上重新验证完整的未分片聚合流程。
-[被取代 CI 的取消策略](2026-09-09-cancel-superseded-ci.zh.md) 管理同一工作流/引用组内的 master 推送和手动运行，包括热备演练。master 快速更新可能让演练因反复被取消而始终无法得出结论。判断就绪状态时，使用最近一次已完成的热备结论，并核对其时间和提交；已取消或仅被调度的运行不构成就绪证据。
+[被取代 CI 的取消策略](../../../../.github/workflows/ci.yml) 管理同一工作流/引用组内的 master 推送和手动运行，包括热备演练。master 快速更新可能让演练因反复被取消而始终无法得出结论。判断就绪状态时，使用最近一次已完成的热备结论，并核对其时间和提交；已取消或仅被调度的运行不构成就绪证据。
### 发布演练共用 Linux 开关
-`DSH_CI_FAILOVER_LINUX=selfhosted` 还会将符合条件的同仓库 PR 和 master 推送中的无凭据依赖布局作业与 dsh/vendor 两个打包作业路由到 `vm-backup`。[发布演练决策](2026-09-06-release-rehearsal-selfhosted.zh.md) 负责更严格的事件准入规则及保留托管的手动触发。这种耦合是有意的：持续设置变量来节省发布分钟，也会让符合条件的主 CI Linux 作业持续使用自托管。清除变量会让两类负载的后续运行返回各自的托管目标；发布操作始终保留托管。
+`DSH_CI_FAILOVER_LINUX=selfhosted` 还会将符合条件的同仓库 PR 和 master 推送中的无凭据依赖布局作业与 dsh/vendor 两个打包作业路由到 `vm-backup`。[发布演练说明](../../../../.github/workflows/release.yml) 负责更严格的事件准入规则及保留托管的手动触发。这种耦合是有意的：持续设置变量来节省发布分钟，也会让符合条件的主 CI Linux 作业持续使用自托管。清除变量会让两类负载的后续运行返回各自的托管目标；发布操作始终保留托管。
### 自有池是什么
@@ -40,7 +40,7 @@ Status: implemented
## 切换期间的容量
-Linux 开关启用期间，容量需覆盖 master 热备、主 CI 作业，以及每个符合条件的 PR 或 master 推送的三个发布演练作业。每个可信 PR 还会增加三个门禁并发度为一的 Node 兼容性作业，包括需要构建的 Node 22 条目和冷临时运行时下载。发布演练工作流依据[取消策略](2026-09-09-cancel-superseded-ci.zh.md)取消各工作流/引用组内被取代的运行；不同引用仍可能增加并发构建、打包和安装负载。延长自托管运行前，检查当前 CPU、内存、磁盘和队列压力；同一虚拟机上新增注册只增加调度槽位，不增加机器资源。不能只依据热备负载推断空闲容量。主机资源允许增加注册实例时，使用组织级注册 token（组织 Settings → Actions → Runners → New runner）。复制现有 runner 目录时**必须排除身份文件**——`rsync -a --exclude '.runner*' --exclude '.credentials*' --exclude '_diag' --exclude '_work' / /`（通配同时排除 `.runner_migrated`/`.credentials_migrated`——GitHub 会在迁移过的运行器上写入这些文件，它们同样会触发 already-configured 拒绝）——再跑 `config.sh`（原样拷贝 `.runner`/`.credentials` 会使其以 "already configured" 拒绝），然后**启动监听器**：`sudo ./svc.sh install ubuntu && sudo ./svc.sh start`。仅注册不会上线；启动服务增加的是调度槽位，而非 CPU 或内存。
+Linux 开关启用期间，容量需覆盖 master 热备、主 CI 作业，以及每个符合条件的 PR 或 master 推送的三个发布演练作业。每个可信 PR 还会增加三个门禁并发度为一的 Node 兼容性作业，包括需要构建的 Node 22 条目和冷临时运行时下载。发布演练工作流依据[取消策略](../../../../.github/workflows/ci.yml)取消各工作流/引用组内被取代的运行；不同引用仍可能增加并发构建、打包和安装负载。延长自托管运行前，检查当前 CPU、内存、磁盘和队列压力；同一虚拟机上新增注册只增加调度槽位，不增加机器资源。不能只依据热备负载推断空闲容量。主机资源允许增加注册实例时，使用组织级注册 token（组织 Settings → Actions → Runners → New runner）。复制现有 runner 目录时**必须排除身份文件**——`rsync -a --exclude '.runner*' --exclude '.credentials*' --exclude '_diag' --exclude '_work' / /`（通配同时排除 `.runner_migrated`/`.credentials_migrated`——GitHub 会在迁移过的运行器上写入这些文件，它们同样会触发 already-configured 拒绝）——再跑 `config.sh`（原样拷贝 `.runner`/`.credentials` 会使其以 "already configured" 拒绝），然后**启动监听器**：`sudo ./svc.sh install ubuntu && sudo ./svc.sh start`。仅注册不会上线；启动服务增加的是调度槽位，而非 CPU 或内存。
### 切回
@@ -59,4 +59,4 @@ Linux 开关启用期间，容量需覆盖 master 热备、主 CI 作业，以
## 后果
-从托管池故障中恢复只需切换受影响平台的变量（任何写者可设）加一次重跑，关键路径上没有合并。代价是每个平台都要维护第二套运行器拓扑：master 推送会调度热备通道，但依据[取消策略](2026-09-09-cancel-superseded-ci.zh.md)，只有已完成的结论才能证明就绪状态；而 `ci.yml` 中的快照并发与缓存恢复分支带有一条 `selfhosted` 支路（仅 Linux），必须与托管支路保持同步。按平台拆分开关多了一个需要管理的变量，但把每个开关的影响范围限定在单个平台的作业上。
+从托管池故障中恢复只需切换受影响平台的变量（任何写者可设）加一次重跑，关键路径上没有合并。代价是每个平台都要维护第二套运行器拓扑：master 推送会调度热备通道，但依据[取消策略](../../../../.github/workflows/ci.yml)，只有已完成的结论才能证明就绪状态；而 `ci.yml` 中的快照并发与缓存恢复分支带有一条 `selfhosted` 支路（仅 Linux），必须与托管支路保持同步。按平台拆分开关多了一个需要管理的变量，但把每个开关的影响范围限定在单个平台的作业上。
diff --git a/.agents/notes/implemented/process/2026-07-30-generated-third-party-notices.i18n.yaml b/.agents/notes/implemented/process/2026-07-30-generated-third-party-notices.i18n.yaml
index 91cb4b1f67..67d1d90e9b 100644
--- a/.agents/notes/implemented/process/2026-07-30-generated-third-party-notices.i18n.yaml
+++ b/.agents/notes/implemented/process/2026-07-30-generated-third-party-notices.i18n.yaml
@@ -9,8 +9,8 @@
en: e6929494e60041a2
zh: 15bec8e8baabcab2
/agent-note-generated-third-party-notices/decision:
- en: 4d9ab23559067da3
- zh: 8de95de194393187
+ en: 11f3362b0f45debb
+ zh: 5953b0848b940b67
/agent-note-generated-third-party-notices/testing:
en: 194f87f780991068
zh: 58096d2339576d20
diff --git a/.agents/notes/implemented/process/2026-07-30-generated-third-party-notices.md b/.agents/notes/implemented/process/2026-07-30-generated-third-party-notices.md
index 71f1fd0a5b..0ebd540939 100644
--- a/.agents/notes/implemented/process/2026-07-30-generated-third-party-notices.md
+++ b/.agents/notes/implemented/process/2026-07-30-generated-third-party-notices.md
@@ -20,7 +20,7 @@ One trigger gap is accepted rather than worked around: lefthook inspects only fi
The file discloses **direct** dependencies by default; complete npm and Python SDK closures remain in their lock files. Two separately distributed payload sets receive explicit entries: the official Claude executable packages declared by `@anthropic-ai/claude-agent-sdk`, and every distribution in the shared runtime lock's `pythonPackages`. Bundled entries include normalized names, exact versions, and recorded license metadata; missing metadata, duplicate normalized names and conflicting normalized versions fail generation. The shared wheel set is independent of the `python/` manifests, so scanning only those manifests would omit the packaged Office libraries. Bundled distributions also pass the runtime license check, including the permissive `MIT-CMU` and `PSF-2.0` identifiers declared by Pillow and typing-extensions.
-**Tiering follows distribution, not manifest section.** Installed runtime libraries are identified by `dependencies` or `optionalDependencies` outside `DEV_ONLY_AREAS` — the root manifest, `packages/test-support/`, `packages/test-support/client-runtime/`, `website/`, `native/`. Browser inputs resolved by the shipping tsdown and Vite configurations also count as runtime, even in `devDependencies`; [browser third-party build inputs](2026-09-08-browser-third-party-build-inputs.md) owns that classification. Test-support dependencies do not ship merely because their manifest says `dependencies`, and the generator explicitly discloses `tsx` because source launches execute through its ESM hook.
+**Tiering follows distribution, not manifest section.** Installed runtime libraries are identified by `dependencies` or `optionalDependencies` outside `DEV_ONLY_AREAS` — the root manifest, `packages/test-support/`, `packages/test-support/client-runtime/`, `website/`, `native/`. Browser inputs resolved by the shipping tsdown and Vite configurations also count as runtime, even in `devDependencies`; [browser third-party build inputs](2026-08-26-published-dependency-faces.md) owns that classification. Test-support dependencies do not ship merely because their manifest says `dependencies`, and the generator explicitly discloses `tsx` because source launches execute through its ESM hook.
The runtime tier deliberately covers **every mountable plugin**, not just what the CLI, Web UI, and Python runtime load by default. Source execution can mount any plugin package from a user's `cordis.yml`; `@modelcontextprotocol/sdk` and the OpenTelemetry packages therefore reach real users even though no default assembly imports them. Under-disclosure is the costly direction for a legal notice.
diff --git a/.agents/notes/implemented/process/2026-07-30-generated-third-party-notices.zh.md b/.agents/notes/implemented/process/2026-07-30-generated-third-party-notices.zh.md
index e3adb43e4b..323ad8ea15 100644
--- a/.agents/notes/implemented/process/2026-07-30-generated-third-party-notices.zh.md
+++ b/.agents/notes/implemented/process/2026-07-30-generated-third-party-notices.zh.md
@@ -20,7 +20,7 @@ Status: implemented
文件默认只披露**直接**依赖；完整的 npm 与 Python SDK 闭包保留在各自锁文件中。两组独立分发的载荷会明确列出：`@anthropic-ai/claude-agent-sdk` 声明的官方 Claude 可执行包，以及共享运行时锁文件 `pythonPackages` 中的每个分发包。内置条目包含归一化名称、精确版本和已记录的许可证元数据；元数据缺失、归一化后名称重复或版本冲突都会使生成失败。共享 wheel 集合独立于 `python/` 下的 manifest，仅扫描后者会遗漏已打包的 Office 库。内置分发包同样通过运行时许可证检查，其中包括 Pillow 与 typing-extensions 声明的宽松许可证标识 `MIT-CMU` 和 `PSF-2.0`。
-**分层依据是分发内容，而非 manifest 字段名。** 安装的运行时库由 `DEV_ONLY_AREAS` 之外的 `dependencies` 或 `optionalDependencies` 识别；排除区域为根 manifest、`packages/test-support/`、`packages/test-support/client-runtime/`、`website/`、`native/`。发布所用的 tsdown 与 Vite 配置解析到的浏览器输入也属于运行时，即使它们位于 `devDependencies`；[浏览器第三方构建输入](2026-09-08-browser-third-party-build-inputs.zh.md)拥有这项分类。测试支撑依赖不会仅因字段写成 `dependencies` 就被交付，而生成器显式披露 `tsx`，因为源码启动通过其 ESM 钩子执行。
+**分层依据是分发内容，而非 manifest 字段名。** 安装的运行时库由 `DEV_ONLY_AREAS` 之外的 `dependencies` 或 `optionalDependencies` 识别；排除区域为根 manifest、`packages/test-support/`、`packages/test-support/client-runtime/`、`website/`、`native/`。发布所用的 tsdown 与 Vite 配置解析到的浏览器输入也属于运行时，即使它们位于 `devDependencies`；[浏览器第三方构建输入](2026-08-26-published-dependency-faces.zh.md)拥有这项分类。测试支撑依赖不会仅因字段写成 `dependencies` 就被交付，而生成器显式披露 `tsx`，因为源码启动通过其 ESM 钩子执行。
运行时层刻意覆盖**所有可挂载的插件**，而不止 CLI、Web UI 与 Python 运行时默认加载的那些。从源码运行时，用户可以通过 `cordis.yml` 挂载任何插件包；因此，`@modelcontextprotocol/sdk` 与 OpenTelemetry 系列即使没有任何默认装配引入，也会触达真实用户。对法务披露而言，披露不足才是代价更高的那个方向。
diff --git a/.agents/notes/implemented/process/2026-08-03-package-anchored-subsystem-pages.i18n.yaml b/.agents/notes/implemented/process/2026-08-03-package-anchored-subsystem-pages.i18n.yaml
deleted file mode 100644
index b427a1cc50..0000000000
--- a/.agents/notes/implemented/process/2026-08-03-package-anchored-subsystem-pages.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-03-package-anchored-subsystem-pages.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-08-03-package-anchored-subsystem-pages.md
-/agent-note-package-anchored-subsystem-pages-and-thin-group-readmes:
- en: 48a39166064d9f0d
- zh: c23ba48570aab506
-/agent-note-package-anchored-subsystem-pages-and-thin-group-readmes/problem:
- en: 244099e9da9c15ce
- zh: 72b5dd59abe0133a
-/agent-note-package-anchored-subsystem-pages-and-thin-group-readmes/decision:
- en: b8c1668317997b2c
- zh: 62d0ef605bfa3d3c
-/agent-note-package-anchored-subsystem-pages-and-thin-group-readmes/alternatives-considered:
- en: 07b4fc9048074b31
- zh: d14c862196f545fa
-/agent-note-package-anchored-subsystem-pages-and-thin-group-readmes/consequences:
- en: 9a6d02787410d14d
- zh: e63d7023f49d5750
diff --git a/.agents/notes/implemented/process/2026-08-08-browser-gif-evidence-chain.i18n.yaml b/.agents/notes/implemented/process/2026-08-08-browser-gif-evidence-chain.i18n.yaml
deleted file mode 100644
index 402eb36c98..0000000000
--- a/.agents/notes/implemented/process/2026-08-08-browser-gif-evidence-chain.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-08-browser-gif-evidence-chain.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-08-08-browser-gif-evidence-chain.md
-/agent-note-browser-gifs-preserve-one-evidence-chain:
- en: acd1abc5215025db
- zh: 13d04f81ebb47d18
-/agent-note-browser-gifs-preserve-one-evidence-chain/problem:
- en: 427edb924ca3106e
- zh: 2115278719f9fd25
-/agent-note-browser-gifs-preserve-one-evidence-chain/decision:
- en: 1a098893e7e55ff8
- zh: c2912855cfc4a2bb
-/agent-note-browser-gifs-preserve-one-evidence-chain/alternatives-considered:
- en: 7c8b16109ffaf01a
- zh: d978945c49912639
-/agent-note-browser-gifs-preserve-one-evidence-chain/consequences:
- en: 18e112842a2a0ac8
- zh: bb562ffcbd660b83
diff --git a/.agents/notes/implemented/process/2026-08-08-native-windows-pull-request-ci.i18n.yaml b/.agents/notes/implemented/process/2026-08-08-native-windows-pull-request-ci.i18n.yaml
index 8a421fe006..360ed3d315 100644
--- a/.agents/notes/implemented/process/2026-08-08-native-windows-pull-request-ci.i18n.yaml
+++ b/.agents/notes/implemented/process/2026-08-08-native-windows-pull-request-ci.i18n.yaml
@@ -9,8 +9,8 @@
en: 3e229ecf646af866
zh: d358507b1e1d381f
/agent-note-wine-and-native-windows-ci/decision:
- en: f557cb00e1b457c1
- zh: eeaec8412ddb315a
+ en: 5a74ef2d98f6b4cf
+ zh: 4a539303a3cd4ed8
/agent-note-wine-and-native-windows-ci/alternatives-considered:
en: f6c5e77fe3f05739
zh: 8de640d12d3a38c4
diff --git a/.agents/notes/implemented/process/2026-08-08-native-windows-pull-request-ci.md b/.agents/notes/implemented/process/2026-08-08-native-windows-pull-request-ci.md
index 64c4366ee8..478c5a8ba3 100644
--- a/.agents/notes/implemented/process/2026-08-08-native-windows-pull-request-ci.md
+++ b/.agents/notes/implemented/process/2026-08-08-native-windows-pull-request-ci.md
@@ -12,13 +12,13 @@ A coverage audit found that stale branch state had restored temporary exclusions
## Decision
-The master-only `windows` job in [ci-master.yml](../../../../.github/workflows/ci-master.yml) runs `windows node 24 / wine` on `ubuntu-latest`. It retains the checksum-verified Windows Node, Wine apt and pnpm caches, a hoisted install confined to a workspace snapshot, and the [shared Wine gate script](../../../../scripts/wine-windows-gates.sh) that runs the workspace build and production site. Node distribution transfers use bounded retries; when nodejs.org stalls on the large archive, a range-capable transport mirror resumes the same bytes, but nodejs.org remains the version and SHA-256 authority and the archive is never promoted before that checksum passes. Wine is outside the PR aggregate under the [master-only platform policy](2026-09-06-master-only-platform-ci.md). The [archived Wine experiment](../../archived/process/2026-07-27-wine-windows-gates-experiment.md) preserves its measured trade-offs, while this note owns the current dual topology.
+The master-only `windows` job in [ci-master.yml](../../../../.github/workflows/ci-master.yml) runs `windows node 24 / wine` on `ubuntu-latest`. It retains the checksum-verified Windows Node, Wine apt and pnpm caches, a hoisted install confined to a workspace snapshot, and the [shared Wine gate script](../../../../scripts/wine-windows-gates.sh) that runs the workspace build and production site. Node distribution transfers use bounded retries; when nodejs.org stalls on the large archive, a range-capable transport mirror resumes the same bytes, but nodejs.org remains the version and SHA-256 authority and the archive is never promoted before that checksum passes. Wine is outside the PR aggregate under the [master-only platform policy](../../../../.github/workflows/ci-master.yml). The [archived Wine experiment](../../archived/process/2026-07-27-wine-windows-gates-experiment.md) preserves its measured trade-offs, while this note owns the current dual topology.
Every pull request starts three native jobs: `windows-build`, `windows-coverage`, and `windows-native-tests`. Each job enables Developer Mode for workspace symlinks, provisions the repository-pinned pnpm through `pnpm/action-setup`, performs an immutable install without a transferred store archive, and runs its inventory under native PowerShell. The Windows failover variable (`DSH_CI_FAILOVER_WINDOWS`) selects the organization-owned `dsh-windows-2025-16core` runner by default, the in-house pool under `selfhosted`, or Blacksmith runners under `blacksmith` (see the [blacksmith failover leg note](2026-09-09-blacksmith-failover-leg.md)). Blacksmith build and coverage jobs request 16 vCPU; file-serial native tests request 2 vCPU. Per-job deadlines range from 60 to 120 minutes.
`windows-build` and `windows-native-tests` are dependencies of `all checks passed`; their workspace-build and targeted native-process results are blocking. After its blocking build and production-site checks succeed, `windows-build` runs `check:ci:windows-observational-ready` in the same workspace. This step uses `continue-on-error`, disables fail-fast, and has a 15-minute timeout; failures produce a workflow warning because Linux owns the blocking static, documentation, package, and built-artifact verdicts. The required verdict waits for the step to finish but does not require its diagnostics to pass. `windows-coverage` remains outside aggregate `needs`, so its 100%-per-file result stays red and visible without delaying the verdict.
-`windows-coverage` runs [in-job partitioned coverage](2026-08-18-in-job-partitioned-coverage.md) without a preceding build, matching the Linux coverage lane: four single-worker instrumented shards beside a two-worker exempt-heavy gate; workspace imports resolve to `src` through the tsconfig paths map, and the lib-consuming suites self-skip on unbuilt checkouts. Both coverage gates raise Vitest's per-test, expect.poll, and hook budgets through `DSH_COVERAGE_TEST_TIMEOUT_MS=90000`. The observational step reuses the successful build, retains the distinct MPA documentation build, starts independent static gates together, and uses CI worker defaults for `publint`, with an eight-worker override on shared self-hosted runners. Its built-bin smoke starts only after every other observational gate settles, including failed gates. The ready aggregate requires a successful prior workspace build; it removes only that build and its internal dependency edges from the shared internal inventory. This keeps bounded real-application startup measurements from competing with tool-catalog, NodeNext, package, and documentation processes. The script-only translation-pairing merge suite runs in the exempt-heavy gate because it imports only `scripts/` sources and child processes; V8 instrumentation contributes no threshold coverage there but magnifies Git-process latency. Lefthook concurrency fixtures retain their outcomes with 30-second case budgets and a 10-second process-ready probe, while the installer allows five seconds for a preempted lock owner to publish its record after exclusive creation. Directory-picker composition gives its debounced config write an explicit 15-second poll budget; workspace-context composition fixtures use a test-owned signal without an unrelated one-second deadline. The LSP sources and the ACL-sandbox sources remain in the Windows denominator: stub-based failure-path suites carry every in-process ACL-sandbox file to 100%, and only the runner entry stays excluded — it executes exclusively as a spawned child outside the instrumented run, its behavior pinned end-to-end by the runner suite. Narrow annotated V8 ignores cover only unreachable branches (peer-platform arms and lifecycle-unreachable guards), with their behavior tests retained on the owning platform.
+`windows-coverage` runs [in-job partitioned coverage](../../../../scripts/coverage-partitions.ts) without a preceding build, matching the Linux coverage lane: four single-worker instrumented shards beside a two-worker exempt-heavy gate; workspace imports resolve to `src` through the tsconfig paths map, and the lib-consuming suites self-skip on unbuilt checkouts. Both coverage gates raise Vitest's per-test, expect.poll, and hook budgets through `DSH_COVERAGE_TEST_TIMEOUT_MS=90000`. The observational step reuses the successful build, retains the distinct MPA documentation build, starts independent static gates together, and uses CI worker defaults for `publint`, with an eight-worker override on shared self-hosted runners. Its built-bin smoke starts only after every other observational gate settles, including failed gates. The ready aggregate requires a successful prior workspace build; it removes only that build and its internal dependency edges from the shared internal inventory. This keeps bounded real-application startup measurements from competing with tool-catalog, NodeNext, package, and documentation processes. The script-only translation-pairing merge suite runs in the exempt-heavy gate because it imports only `scripts/` sources and child processes; V8 instrumentation contributes no threshold coverage there but magnifies Git-process latency. Lefthook concurrency fixtures retain their outcomes with 30-second case budgets and a 10-second process-ready probe, while the installer allows five seconds for a preempted lock owner to publish its record after exclusive creation. Directory-picker composition gives its debounced config write an explicit 15-second poll budget; workspace-context composition fixtures use a test-owned signal without an unrelated one-second deadline. The LSP sources and the ACL-sandbox sources remain in the Windows denominator: stub-based failure-path suites carry every in-process ACL-sandbox file to 100%, and only the runner entry stays excluded — it executes exclusively as a spawned child outside the instrumented run, its behavior pinned end-to-end by the runner suite. Narrow annotated V8 ignores cover only unreachable branches (peer-platform arms and lifecycle-unreachable guards), with their behavior tests retained on the owning platform.
The 16-core allocation is the measured capacity point for this inventory. Six-worker coverage trials produced complete passes in 6 minutes 27 seconds and 7 minutes 50 seconds, while exact-head trials with four, three, and two concurrent workers inside one instrumented Vitest process exposed unreliable fixtures and worker exits. Separate single-worker child processes retain process isolation. Historical sixteen-shard samples reduced instrumented coverage to 112.66–122.01 seconds. The pull-request coverage job schedules four instrumented children plus two exempt workers without a preceding build, while the self-hosted complete reference runs its unsharded coverage gates serially with one worker. A six-partition pull-request profile creates enough process and type-aware lint contention to violate bounded test deadlines. Sixteen instrumented shards plus two exempt workers would exceed a 16-core allocation before system overhead. A 32-core comparison reduced aggregate gate time by only 1.47 seconds and still triggered the CJS-lexer fatal inside a fork worker, so additional cores did not provide a reliable wall-clock improvement.
@@ -30,7 +30,7 @@ Native watchers use `canonicalizeWatchPath()` to realpath the deepest existing a
Windows durable JSONL paths keep drive roots in native spelling and apply the extended-length namespace only to descendants and staging paths. The ACP teardown ladder uses real Node children, proves graceful and forced tiers with host-appropriate outcomes, and avoids claiming POSIX signal delivery on Windows. Executable fixtures provide `.cmd` shims and `PATHEXT` where the product accepts a bare command. Repository-cache helpers live inside the selected Git subpath so their declared `file:` dependencies expose command shims identically on Windows. The bundled installer exports pnpm's own workspace-ignore configuration, retains `PNPM_HOME` for pnpm data while removing that directory from lifecycle `PATH`, and prioritizes `.CMD` in `PATHEXT`; nested Git-package installation therefore cannot rejoin the enclosing workspace or let an inherited Windows pnpm executable outrank the transaction-owned wrapper.
-Post-boot profile watcher setup proceeds only while the root fiber and Loader are both live. A concurrent setup error is contained only when the same invocation's recorded signal already owns shutdown; unrelated HMR failures remain loud. The [process-shutdown controller](../bug-fix/2026-08-03-cli-signal-shutdown-escalation.md) lets a successful one-shot completion drain Node's remaining handles after root disposal, while teardown failure, deadline, and signal escalation retain forced exit. The vendored Include serializes debounced writes, retries only transient access or busy failures with bounded backoff, and observes every timer rejection. A terminal persistence failure remains on the queue and is rethrown to the teardown owner, while successful teardown drains the latest write.
+Post-boot profile watcher setup proceeds only while the root fiber and Loader are both live. A concurrent setup error is contained only when the same invocation's recorded signal already owns shutdown; unrelated HMR failures remain loud. The [process-shutdown controller](../../../../apps/cli/src/process-shutdown.ts) lets a successful one-shot completion drain Node's remaining handles after root disposal, while teardown failure, deadline, and signal escalation retain forced exit. The vendored Include serializes debounced writes, retries only transient access or busy failures with bounded backoff, and observes every timer rejection. A terminal persistence failure remains on the queue and is rethrown to the teardown owner, while successful teardown drains the latest write.
Shiki disables lazy TextMate-regex compilation and warms each boot grammar before user content enters the unchanged per-line tokenization budget, so scheduler contention cannot publish a partial highlighted stream. The Codex real-product fixture is pinned to stable 0.153.4 schemas and selects an actually advertised command tool and argument shape, preserving the provider-owned protocol while proving unattended rejection and whole-tree exit on each host.
diff --git a/.agents/notes/implemented/process/2026-08-08-native-windows-pull-request-ci.zh.md b/.agents/notes/implemented/process/2026-08-08-native-windows-pull-request-ci.zh.md
index 48725cdc58..f3c8dc5fff 100644
--- a/.agents/notes/implemented/process/2026-08-08-native-windows-pull-request-ci.zh.md
+++ b/.agents/notes/implemented/process/2026-08-08-native-windows-pull-request-ci.zh.md
@@ -12,13 +12,13 @@ Wine 在 Linux 内核与区分大小写的 ext4 之上采用 hoisted 依赖布
## 决策
-[ci-master.yml](../../../../.github/workflows/ci-master.yml) 中仅 master 触发的 `windows` 作业在 `ubuntu-latest` 上运行 `windows node 24 / wine`。它保留经过校验和验证的 Windows Node、Wine apt 与 pnpm 缓存、仅限工作区快照的 hoisted 安装，以及运行工作区构建与生产网站的[共享 Wine 门禁脚本](../../../../scripts/wine-windows-gates.sh)。Node 分发文件传输采用有界重试；nodejs.org 的大文件传输停滞时，由支持范围请求的传输镜像续传相同字节，但版本和 SHA-256 权威仍属于 nodejs.org，归档通过该校验前绝不会投入使用。根据[仅 master 平台策略](2026-09-06-master-only-platform-ci.zh.md)，Wine 不参与 PR 聚合。[已归档的 Wine 实验](../../archived/process/2026-07-27-wine-windows-gates-experiment.md)保留其实测取舍，而本文负责当前双通道拓扑。
+[ci-master.yml](../../../../.github/workflows/ci-master.yml) 中仅 master 触发的 `windows` 作业在 `ubuntu-latest` 上运行 `windows node 24 / wine`。它保留经过校验和验证的 Windows Node、Wine apt 与 pnpm 缓存、仅限工作区快照的 hoisted 安装，以及运行工作区构建与生产网站的[共享 Wine 门禁脚本](../../../../scripts/wine-windows-gates.sh)。Node 分发文件传输采用有界重试；nodejs.org 的大文件传输停滞时，由支持范围请求的传输镜像续传相同字节，但版本和 SHA-256 权威仍属于 nodejs.org，归档通过该校验前绝不会投入使用。根据[仅 master 平台策略](../../../../.github/workflows/ci-master.yml)，Wine 不参与 PR 聚合。[已归档的 Wine 实验](../../archived/process/2026-07-27-wine-windows-gates-experiment.md)保留其实测取舍，而本文负责当前双通道拓扑。
每个拉取请求都会启动三个原生作业：`windows-build`、`windows-coverage` 和 `windows-native-tests`。每个作业都会为 workspace 符号链接启用开发者模式，通过 `pnpm/action-setup` 提供仓库固定版本的 pnpm，在不传输 store 归档的情况下执行不可变安装，并在原生 PowerShell 下运行自己的清单。Windows 故障切换变量（`DSH_CI_FAILOVER_WINDOWS`）默认选择组织自有的 `dsh-windows-2025-16core` 运行器，在 `selfhosted` 下选择公司内部运行器池，在 `blacksmith` 下选择 Blacksmith 运行器（见 [blacksmith 故障切换支路笔记](2026-09-09-blacksmith-failover-leg.zh.md)）。Blacksmith 构建和覆盖率作业请求 16 vCPU；逐文件串行的原生测试请求 2 vCPU。各作业的截止时间为 60 至 120 分钟。
`windows-build` 与 `windows-native-tests` 是 `all checks passed` 的依赖项；其工作区构建和定向原生进程结果具有阻断性。阻断性构建和生产网站检查成功后，`windows-build` 在同一工作区运行 `check:ci:windows-observational-ready`。该步骤使用 `continue-on-error`、关闭 fail-fast，并设置 15 分钟超时；失败时会产生工作流警告，因为静态检查、文档、包与构建产物的阻断性判定由 Linux 负责。必需判定会等待该步骤结束，但不要求其诊断通过。`windows-coverage` 仍在聚合流程的 `needs` 之外，因此逐文件 100% 覆盖率结果会保持红灯并可见，却不会延迟判定。
-`windows-coverage` 与 Linux 覆盖率通道一致，不先构建工作区就运行[job 内分区覆盖率](2026-08-18-in-job-partitioned-coverage.zh.md)：4 个单 worker 插桩分片与一个双 worker 的豁免重型门禁并行运行；工作区导入通过 tsconfig paths 映射解析到 `src`，消费构建产物的套件在未构建的检出上会自跳。两项覆盖率门禁都通过 `DSH_COVERAGE_TEST_TIMEOUT_MS=90000` 提高 Vitest 的单测试、expect.poll 与 hook 预算。观测步骤复用成功的构建，保留独立的 MPA 文档构建，一起启动相互独立的静态门禁，并让 `publint` 使用 CI worker 默认值，在共享自托管运行器上覆盖为 8 个 worker。其 built-bin 冒烟测试只在其他所有观测性门禁结算后启动，包括失败的门禁。ready 聚合要求此前已成功构建工作区；它仅从内部共用清单中移除该构建及其内部依赖边。这可避免有界的真实应用启动测量与 tool-catalog、NodeNext、包及文档进程争抢资源。translation-pairing 合并套件只导入 `scripts/` 源码和子进程，因此放入豁免重型套件门禁；V8 插桩不会为它贡献任何阈值覆盖率，却会放大 Git 进程延迟。Lefthook 并发 fixture 保留原有结果，采用 30 秒单用例预算与 10 秒进程就绪探测；安装器则允许被抢占的 lock 持有者在独占创建后用 5 秒发布记录。directory-picker 组合为防抖配置写入提供显式的 15 秒轮询预算；workspace-context 组合 fixture 使用测试自有、没有无关 1 秒截止时间的信号。LSP 源码与 ACL 沙箱源码仍计入 Windows 分母：基于 stub 的失败路径套件把每个进程内 ACL 沙箱文件都带到 100%，只有 runner 入口保持排除——它只作为 spawn 出的子进程在插桩运行之外执行，其行为由 runner 套件端到端钉住。窄范围且带注释的 V8 ignore 只覆盖不可达分支（另一平台专属分支、生命周期内不可达的防御守卫），其行为测试仍保留在所属平台。
+`windows-coverage` 与 Linux 覆盖率通道一致，不先构建工作区就运行[job 内分区覆盖率](../../../../scripts/coverage-partitions.ts)：4 个单 worker 插桩分片与一个双 worker 的豁免重型门禁并行运行；工作区导入通过 tsconfig paths 映射解析到 `src`，消费构建产物的套件在未构建的检出上会自跳。两项覆盖率门禁都通过 `DSH_COVERAGE_TEST_TIMEOUT_MS=90000` 提高 Vitest 的单测试、expect.poll 与 hook 预算。观测步骤复用成功的构建，保留独立的 MPA 文档构建，一起启动相互独立的静态门禁，并让 `publint` 使用 CI worker 默认值，在共享自托管运行器上覆盖为 8 个 worker。其 built-bin 冒烟测试只在其他所有观测性门禁结算后启动，包括失败的门禁。ready 聚合要求此前已成功构建工作区；它仅从内部共用清单中移除该构建及其内部依赖边。这可避免有界的真实应用启动测量与 tool-catalog、NodeNext、包及文档进程争抢资源。translation-pairing 合并套件只导入 `scripts/` 源码和子进程，因此放入豁免重型套件门禁；V8 插桩不会为它贡献任何阈值覆盖率，却会放大 Git 进程延迟。Lefthook 并发 fixture 保留原有结果，采用 30 秒单用例预算与 10 秒进程就绪探测；安装器则允许被抢占的 lock 持有者在独占创建后用 5 秒发布记录。directory-picker 组合为防抖配置写入提供显式的 15 秒轮询预算；workspace-context 组合 fixture 使用测试自有、没有无关 1 秒截止时间的信号。LSP 源码与 ACL 沙箱源码仍计入 Windows 分母：基于 stub 的失败路径套件把每个进程内 ACL 沙箱文件都带到 100%，只有 runner 入口保持排除——它只作为 spawn 出的子进程在插桩运行之外执行，其行为由 runner 套件端到端钉住。窄范围且带注释的 V8 ignore 只覆盖不可达分支（另一平台专属分支、生命周期内不可达的防御守卫），其行为测试仍保留在所属平台。
16 核配置是这项清单经实测选定的容量规格。使用 6 个 coverage worker 的试验分别以 6 分 27 秒和 7 分 50 秒跑出完整通过结果，而在单个插桩 Vitest 进程内使用 4 个、3 个和 2 个并发 worker 的分支头精确试验暴露出不稳定的 fixture 与 worker 退出。相互独立的单 worker 子进程保留进程隔离。历史上的 16 分片样本把插桩覆盖率缩短到 112.66–122.01 秒。拉取请求覆盖率作业会在没有前置构建的情况下调度 4 个插桩子进程和 2 个豁免 worker，而自托管完整参考流程会用 1 个 worker 串行运行未分片的覆盖率门禁。拉取请求若采用 6 分片配置，就会产生足以违反有界测试截止时间的进程与类型感知 lint 争用。16 个插桩分片加 2 个豁免 worker 会在计入系统开销前就超过 16 核分配。32 核对比仅将聚合门禁时间缩短 1.47 秒，且仍在 fork worker 内触发 CJS lexer 致命故障，因此增加核心数没有带来可靠的墙钟时间改善。
@@ -30,7 +30,7 @@ Wine 在 Linux 内核与区分大小写的 ext4 之上采用 hoisted 依赖布
Windows 的持久 JSONL 路径会保留驱动器根目录的原生写法，并仅对后代路径与暂存路径应用扩展长度命名空间。ACP（Agent Client Protocol）拆卸阶梯使用真实 Node 子进程，以符合宿主语义的结果证明优雅终止与强制终止两个层级，并避免声称 Windows 会交付 POSIX 信号。产品接受裸命令时，可执行 fixture 会提供 `.cmd` 包装脚本与 `PATHEXT`。repository-cache 辅助包位于所选 Git 子路径内，因此它们声明的 `file:` 依赖会在 Windows 上以相同方式暴露命令包装脚本。随附的安装器会导出 pnpm 自有的 workspace-ignore 配置，保留 `PNPM_HOME` 作为 pnpm 数据配置，同时从生命周期 `PATH` 中移除该目录，并在 `PATHEXT` 中优先选择 `.CMD`；因此，嵌套 Git 包安装既不会重新加入外层 workspace，也不会让继承的 Windows pnpm 可执行文件抢在事务持有的 wrapper 之前。
-启动后，只有根 fiber 与 Loader 均处于活跃状态时，系统才会继续设置 profile watcher。只有当同一次调用所记录的信号已取得关闭流程所有权时，系统才会隔离并发设置错误；无关 HMR 故障仍会响亮失败。[进程关闭控制器](../bug-fix/2026-08-03-cli-signal-shutdown-escalation.zh.md)会在根级 dispose 成功后让单次任务的正常完成流程排空 Node 剩余句柄，同时让拆卸失败、截止时间到期和信号升级继续强制退出。vendored Include 会串行化防抖写入，只对瞬时访问或忙碌故障执行有界退避重试，并确保每个由计时器触发的拒绝都得到观察。持久化最终失败后，该故障会保留在队列中，并重新抛给拆卸责任方；成功拆卸则会排空最新写入。
+启动后，只有根 fiber 与 Loader 均处于活跃状态时，系统才会继续设置 profile watcher。只有当同一次调用所记录的信号已取得关闭流程所有权时，系统才会隔离并发设置错误；无关 HMR 故障仍会响亮失败。[进程关闭控制器](../../../../apps/cli/src/process-shutdown.ts)会在根级 dispose 成功后让单次任务的正常完成流程排空 Node 剩余句柄，同时让拆卸失败、截止时间到期和信号升级继续强制退出。vendored Include 会串行化防抖写入，只对瞬时访问或忙碌故障执行有界退避重试，并确保每个由计时器触发的拒绝都得到观察。持久化最终失败后，该故障会保留在队列中，并重新抛给拆卸责任方；成功拆卸则会排空最新写入。
Shiki 会禁用 TextMate 正则的延迟编译，并在用户内容进入保持不变的逐行 tokenization（词元化）预算前预热每种启动语法，从而避免调度器争用发布不完整的高亮流。Codex 真实产品 fixture 固定使用稳定版 0.153.4 schema，并选择实际提供的命令工具与对应参数形态；这样既保留由提供方负责的协议，也能在每种宿主上证明无人值守拒绝和整棵进程树退出。
diff --git a/.agents/notes/implemented/process/2026-08-09-committed-artifact-citations.i18n.yaml b/.agents/notes/implemented/process/2026-08-09-committed-artifact-citations.i18n.yaml
deleted file mode 100644
index e8b85c04de..0000000000
--- a/.agents/notes/implemented/process/2026-08-09-committed-artifact-citations.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-09-committed-artifact-citations.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-08-09-committed-artifact-citations.md
-/agent-note-cite-committed-artifacts-never-design-session-ordinals:
- en: c97b89961652ab9f
- zh: a2ecdc61c29652a6
-/agent-note-cite-committed-artifacts-never-design-session-ordinals/problem:
- en: 79dc8b3d2c600d91
- zh: e7b16c9e276e565f
-/agent-note-cite-committed-artifacts-never-design-session-ordinals/decision:
- en: 83f88200cfa66c98
- zh: 3db6822a92701d64
-/agent-note-cite-committed-artifacts-never-design-session-ordinals/alternatives-considered:
- en: cdf3ce2ccd530449
- zh: f24bb73190b4b22b
-/agent-note-cite-committed-artifacts-never-design-session-ordinals/verification:
- en: fb9ce345704f7da4
- zh: 3148c6bbf67ad87f
-/agent-note-cite-committed-artifacts-never-design-session-ordinals/consequences:
- en: 53fe33cd40aa7133
- zh: 4eaf89d5dea43c62
diff --git a/.agents/notes/implemented/process/2026-08-09-concrete-prose-names-actors-and-recorded-facts.i18n.yaml b/.agents/notes/implemented/process/2026-08-09-concrete-prose-names-actors-and-recorded-facts.i18n.yaml
deleted file mode 100644
index eb5e443f1b..0000000000
--- a/.agents/notes/implemented/process/2026-08-09-concrete-prose-names-actors-and-recorded-facts.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-09-concrete-prose-names-actors-and-recorded-facts.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-08-09-concrete-prose-names-actors-and-recorded-facts.md
-/agent-note-concrete-prose-names-actors-and-recorded-facts:
- en: fbfbd92c8f73d34c
- zh: fc48118b80f5dbb9
-/agent-note-concrete-prose-names-actors-and-recorded-facts/problem:
- en: f0228c15ff233209
- zh: b6183fdc8dd705a0
-/agent-note-concrete-prose-names-actors-and-recorded-facts/decision:
- en: 833658027dc8e2d7
- zh: a360c4aa7b4dde7f
-/agent-note-concrete-prose-names-actors-and-recorded-facts/alternatives-considered:
- en: 08a988b00edf03b2
- zh: 8614c5edbc46ca36
-/agent-note-concrete-prose-names-actors-and-recorded-facts/consequences:
- en: 18e6d0b597186220
- zh: 744ed1b795929bba
diff --git a/.agents/notes/implemented/process/2026-08-10-event-directed-pr-review-status.i18n.yaml b/.agents/notes/implemented/process/2026-08-10-event-directed-pr-review-status.i18n.yaml
index 6d96599459..5f1198581c 100644
--- a/.agents/notes/implemented/process/2026-08-10-event-directed-pr-review-status.i18n.yaml
+++ b/.agents/notes/implemented/process/2026-08-10-event-directed-pr-review-status.i18n.yaml
@@ -9,8 +9,8 @@
en: 3e00a9cb6c0e53ec
zh: 1bd27ceea8a424ce
/agent-note-event-directed-pr-review-status-commands/decision:
- en: 3b661de4e6fbf401
- zh: 2fb7f7adb4f846e4
+ en: f5d89f6df53c858e
+ zh: 795a430226b17390
/agent-note-event-directed-pr-review-status-commands/verification:
en: 46301d11d2f1c8df
zh: daa44a617912c315
diff --git a/.agents/notes/implemented/process/2026-08-10-event-directed-pr-review-status.md b/.agents/notes/implemented/process/2026-08-10-event-directed-pr-review-status.md
index 37b8086a08..ddb4e0867f 100644
--- a/.agents/notes/implemented/process/2026-08-10-event-directed-pr-review-status.md
+++ b/.agents/notes/implemented/process/2026-08-10-event-directed-pr-review-status.md
@@ -12,11 +12,11 @@ A monotonic projection also cannot return an automation-owned Issue from `In rev
## Decision
-The Issue lifecycle workflow treats review webhooks as commands. `pull_request.review_requested`, including a repeated request, targets `In review`. `pull_request_review.submitted` targets `In progress` only when `review.state` is `changes_requested`; the submitted event remains necessary because a reviewer can request changes without an earlier review-request event. Approved and commented submissions do not allocate a lifecycle runner, while dismissed reviews are not subscribed. [Selective policy evaluation](2026-09-07-selective-issue-policy-evaluation.md) owns lifecycle scheduling.
+The Issue lifecycle workflow treats review webhooks as commands. `pull_request.review_requested`, including a repeated request, targets `In review`. `pull_request_review.submitted` targets `In progress` only when `review.state` is `changes_requested`; the submitted event remains necessary because a reviewer can request changes without an earlier review-request event. Approved and commented submissions do not allocate a lifecycle runner, while dismissed reviews are not subscribed. [Selective policy evaluation](../../../../.github/issue-management/README.md) owns lifecycle scheduling.
Ordinary subscribed pull-request events remain forward-only implementation signals: they can move `Inbox`, `Backlog`, or `Ready` to `In progress`, but they cannot move `In review` backward. Review-request commands can move any earlier active status to `In review`. Changes-requested commands can move earlier active statuses forward to `In progress` and can move `In review` back only when the latest status event for the target Project was written by the configured lifecycle actor. A human or unknown latest actor preserves the current status.
-The status projection resolves only exact same-repository `Fixes`, `Closes`, or `Resolves` references. It does not alter terminal statuses, add an Issue with no Project status, depend on PR metadata validity, query `reviewDecision`, reconstruct review rounds, look up pull requests from Issues, or run a scheduled reconciler. [Project-local Issue planning fields](2026-09-02-project-local-issue-planning-fields.md) own the separate date initialization for every same-repository Issue reference.
+The status projection resolves only exact same-repository `Fixes`, `Closes`, or `Resolves` references. It does not alter terminal statuses, add an Issue with no Project status, depend on PR metadata validity, query `reviewDecision`, reconstruct review rounds, look up pull requests from Issues, or run a scheduled reconciler. [Project-local Issue planning fields](../../../../.github/issue-management/README.md) own the separate date initialization for every same-repository Issue reference.
[Issue lifecycle](../../../../.github/workflows/issue-lifecycle.yml) remains unsubscribed from `pull_request.ready_for_review`; neither event command depends on that action. [Issue policy](../../../../.github/workflows/issue-policy.yml) retains `ready_for_review` because it owns required-check enforcement when a human pull request enters review.
diff --git a/.agents/notes/implemented/process/2026-08-10-event-directed-pr-review-status.zh.md b/.agents/notes/implemented/process/2026-08-10-event-directed-pr-review-status.zh.md
index cc0dad8554..ff42c089d3 100644
--- a/.agents/notes/implemented/process/2026-08-10-event-directed-pr-review-status.zh.md
+++ b/.agents/notes/implemented/process/2026-08-10-event-directed-pr-review-status.zh.md
@@ -12,11 +12,11 @@ Issue 所在 Project 中的状态记录了解决工作的下一步由谁负责
## 决策
-Issue 生命周期工作流把评审 webhook 视为命令。`pull_request.review_requested`（包括重复请求）将目标状态指定为 `In review`。`pull_request_review.submitted` 将目标状态指定为 `In progress`，但仅在 `review.state` 为 `changes_requested` 时生效；submitted 事件仍不可省略，因为评审人即使没有先触发 review-request 事件，也可以直接提出修改要求。对于 approved 和 commented 提交，工作流不分配生命周期 runner；dismissed 评审则不在订阅范围内。[选择性策略求值](2026-09-07-selective-issue-policy-evaluation.zh.md)拥有生命周期调度规则。
+Issue 生命周期工作流把评审 webhook 视为命令。`pull_request.review_requested`（包括重复请求）将目标状态指定为 `In review`。`pull_request_review.submitted` 将目标状态指定为 `In progress`，但仅在 `review.state` 为 `changes_requested` 时生效；submitted 事件仍不可省略，因为评审人即使没有先触发 review-request 事件，也可以直接提出修改要求。对于 approved 和 commented 提交，工作流不分配生命周期 runner；dismissed 评审则不在订阅范围内。[选择性策略求值](../../../../.github/issue-management/README.zh.md)拥有生命周期调度规则。
工作流订阅的普通 PR 事件仍是只向前推进的实现信号：它们可以将 `Inbox`、`Backlog` 或 `Ready` 推进至 `In progress`，但不能让 `In review` 倒退。请求评审命令可将任意较早的活跃状态推进至 `In review`。请求修改命令可将较早的活跃状态推进至 `In progress`；它也可以让 `In review` 状态回退，但仅在目标 Project 的最新状态事件由配置的生命周期执行主体写入时进行。若最新状态事件的执行主体是人工用户或未知主体，则保留当前状态。
-状态投影仅解析同一仓库内严格匹配的 `Fixes`、`Closes` 或 `Resolves` 引用。它不会更改终态、将没有 Project 状态的 Issue 添加到 Project、依赖 PR 元数据是否有效、查询 `reviewDecision`、重建评审轮次、从 Issue 反向查找 PR，或运行定时协调器。独立的日期初始化由[Project 局部 Issue 规划字段](2026-09-02-project-local-issue-planning-fields.zh.md)负责，并处理每个同仓库 Issue 引用。
+状态投影仅解析同一仓库内严格匹配的 `Fixes`、`Closes` 或 `Resolves` 引用。它不会更改终态、将没有 Project 状态的 Issue 添加到 Project、依赖 PR 元数据是否有效、查询 `reviewDecision`、重建评审轮次、从 Issue 反向查找 PR，或运行定时协调器。独立的日期初始化由[Project 局部 Issue 规划字段](../../../../.github/issue-management/README.zh.md)负责，并处理每个同仓库 Issue 引用。
[Issue 生命周期](../../../../.github/workflows/issue-lifecycle.yml)仍不订阅 `pull_request.ready_for_review`；两条事件命令均不依赖该动作。[Issue 策略](../../../../.github/workflows/issue-policy.yml)保留 `ready_for_review`，因为人工提交的 PR 进入评审时，该工作流负责执行必需检查门禁。
diff --git a/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.i18n.yaml b/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.i18n.yaml
index 40e0e18b71..531b156371 100644
--- a/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.i18n.yaml
+++ b/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.i18n.yaml
@@ -12,20 +12,20 @@
en: a15c7c13f167e5ac
zh: 63bcc2ef60c2f344
/agent-note-private-npm-publication-as-three-independent-sequences/decision/three-independent-sequences:
- en: 6cd23b2407935500
- zh: 6d50f5f4fb867342
+ en: c1d7c618fa93ab10
+ zh: 887ad2a37ed18035
/agent-note-private-npm-publication-as-three-independent-sequences/decision/versions-land-in-the-repository-from-a-local-command-ci-only-checks-and-uploads:
en: 71d4cda384013bfb
zh: 909d853c18496925
-/agent-note-private-npm-publication-as-three-independent-sequences/decision/vendor-publish-what-changed-and-let-tags-be-the-ledger:
- en: 7f578bb18f7f8693
- zh: 49f25210f7c1a61f
+/agent-note-private-npm-publication-as-three-independent-sequences/decision/vendor-advance-the-complete-family-with-per-package-tags:
+ en: 321f48c7e4afac24
+ zh: 974a7fa1a75c810d
/agent-note-private-npm-publication-as-three-independent-sequences/decision/publication-runs-only-on-github-and-the-registry-decides-what-goes-out:
- en: 4f399390f58d7a34
- zh: 9df67248acfc61c8
+ en: 8c8cd90e6eabe07d
+ zh: 7035b71a6eeeb379
/agent-note-private-npm-publication-as-three-independent-sequences/decision/workspace-internal-references-use-the-workspace-protocol:
- en: 6cff087e7e2d0ac7
- zh: 5d45a3abdd960d9c
+ en: 82a7925d449fc283
+ zh: 653358a1ffbad80a
/agent-note-private-npm-publication-as-three-independent-sequences/decision/published-dependency-faces-use-an-explicit-policy:
en: 30a64e0e919a27c0
zh: 19729d7ebee35439
@@ -33,20 +33,17 @@
en: d83f6cf38529c5b5
zh: 4df5659b2154d3b7
/agent-note-private-npm-publication-as-three-independent-sequences/decision/release-family-objects:
- en: e8bb80d936e2cbbd
- zh: bc4ae297e98a5446
+ en: 5bc6a83d124b682d
+ zh: 17383ec5c3c7e0e5
/agent-note-private-npm-publication-as-three-independent-sequences/decision/workflow-shape-pack-on-pr-push-publish-from-a-manual-dispatch-workflow:
en: ea0acc6409da4d5c
zh: ac0bd2fe41f4fe67
/agent-note-private-npm-publication-as-three-independent-sequences/decision/repository-changes-this-carried:
en: c505237cad2c4128
zh: 55364ba462536680
-/agent-note-private-npm-publication-as-three-independent-sequences/decision/relationship-to-the-earlier-proposal:
- en: 298382a27013dcfb
- zh: ab89cf392232f9bb
/agent-note-private-npm-publication-as-three-independent-sequences/alternatives-considered:
- en: 11877d09e5a84f6e
- zh: ea372c779254be93
+ en: ed22fa8a47b5c4b6
+ zh: 7b367971a51a67ff
/agent-note-private-npm-publication-as-three-independent-sequences/consequences:
- en: f961ebb927e30b5c
- zh: 019f1628fb1f2c56
+ en: 46f82110175ea3f7
+ zh: 1cdd1c99bfb88440
diff --git a/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.md b/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.md
index 6a4f9d1ec2..8552232363 100644
--- a/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.md
+++ b/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.md
@@ -22,7 +22,7 @@ Two hard blockers sat in the way. All 217 workspace manifests set `private: true
| Sequence | Members | Version baseline | Tag | Workflow |
|---|---|---|---|---|
-| dsh | Publish set: public members of `packages/*/*` + `apps/*`, with [private experimental exceptions](2026-09-12-experimental-publication-denylist.md); private packages join only the shared version bump | one version for the publish set, private dsh packages, and workspace root, `0.0.x` | `dsh-v` | `release.yml` (pack) / `release-publish.yml` (publish) |
+| dsh | Publish set: public members of `packages/*/*` + `apps/*`, with [private experimental exceptions](../../../../packages/experimental/README.md); private packages join only the shared version bump | one version for the publish set, private dsh packages, and workspace root, `0.0.x` | `dsh-v` | `release.yml` (pack) / `release-publish.yml` (publish) |
| vendored framework | the nine `vendor/*` packages | each package on its own version line | `vendor--v` (one per package) | `release-vendor.yml` (pack) / `release-vendor-publish.yml` (publish) |
| native | `native/system/packages/*` | its own `0.0.x` | `node-addon-system-v` | `node-addon-system-release.yml` |
@@ -36,9 +36,9 @@ Each sequence has one bump-and-commit command: it derives the target version, wr
For equal release numbers, SemVer compares alphanumeric prerelease identifiers lexically: `alpha` is lower than `canary`, `canary` is lower than `rc`, and every prerelease is lower than the stable version. npm dist-tags are mutable aliases and do not participate in version precedence.
-### vendor: publish what changed, and let tags be the ledger
+### vendor: advance the complete family with per-package tags
-The vendored packages are decoupled from upstream by their scope but keep their own version lines. The published version is the higher of the manifest version and the last published version, with the patch incremented — which also drops an upstream prerelease segment. The first published versions:
+The vendored packages are decoupled from upstream by their scope but keep their own version lines. The next version uses the higher of the manifest version and the latest tagged version, incrementing the patch after a stable version. The first published versions:
| Package | Upstream version | First published version |
|---|---|---|
@@ -52,13 +52,13 @@ The vendored packages are decoupled from upstream by their scope but keep their
| `@deepseek-ai/cordis-plugin-group` | 1.0.0 | 1.0.1 |
| `@deepseek-ai/cordis-plugin-logger-console` | 1.0.0 | 1.0.1 |
-Taking the last published version as the baseline is what survives a re-sync: upstream restoring `4.0.0-rc.8` after this repository published `4.0.1` would otherwise compute `4.0.1` again and collide. `--prerelease rc.1` publishes a rehearsal instead, which takes `--tag next` and leaves the release numbers free: a prerelease has lower precedence than the release it precedes, so `4.0.1` still follows `4.0.1-rc.1`. That ordering is computed here rather than read from `git tag --sort=v:refname`, which places a prerelease above its release.
+Taking the latest tagged version as the baseline prevents reuse after a re-sync: upstream restoring `4.0.0-rc.8` after this repository tagged `4.0.1` would otherwise compute `4.0.1` again. `release:vendor --prerelease rc.1` or `--prerelease alpha.1` selects a prerelease, whose default npm dist-tag is `next`. Later prereleases and the stable release reuse its release numbers: `4.0.1` follows `4.0.1-rc.1`. The script compares SemVer precedence rather than using `git tag --sort=v:refname`, which places a prerelease above its release.
-Only changed packages publish, and the change judgement adds no state file: **each package has its own tag, and that tag records the commit it last published from**. For each package, bump reads the newest `vendor--v*` tag and diffs the package directory against it. A path counts when the manifest's `files` selects it, when npm publishes it regardless (`package.json`, `README*`, `LICENSE*`), or — for a package whose `files` selects `lib/` — when it is a build input (`src/**`, `tsconfig*.json`, a build config). That last rule exists because a built payload is not tracked by git: without it, a real source change reads as "nothing changed" and the next publication fails on a version whose bytes moved.
+Every vendor release advances all nine packages, each with its own version and `vendor--v` tag. Repacking from another repository state can change a member's dependency ranges or built payload even when its directory has no source changes. Advancing the complete family avoids reusing an existing version for those different bytes.
-A tag is a commit pointer, not proof of publication. Bump asks the registry whether the version its newest tag names exists and fails for a human to resolve when it does not, because a tag pushed for a publication that then failed would otherwise read as "already published" and skip the package indefinitely. Querying a private package needs credentials, so an unauthenticated machine reports the gap instead of failing.
+A tag reserves a package version and identifies its commit; it does not establish successful publication. Bump uses the latest tag even if its publication failed. The publisher checks registry versions and integrity, and the release manager verifies completion for the complete family.
-`vendor/cordis` publishes `src` as well. Its export map declares `"./src/*"`, so a tarball without those files points consumers at absent paths, and `files` selecting only build output left the change judgement with no tracked path to match.
+`vendor/cordis` publishes `src` as well. Its export map declares `"./src/*"`, so a tarball without those files points consumers at absent paths.
### Publication runs only on GitHub, and the registry decides what goes out
@@ -76,11 +76,15 @@ All three sequences decide this way, including the native one: it publishes thro
Two registry behaviours shape how a publish is attempted. Writes are spaced by at least two seconds and retried with a backoff, because publishing several packages back to back outruns the registry's own processing and earns `E409 Failed to save packument`. And every retry re-reads the registry first: a reported failure can answer a write that landed anyway, so a version that now exists with this tarball's integrity counts as published rather than as a version to place again.
+For dsh and vendor, `release:publish --dist-tag ` overrides the family's default publication channel. The vendor publish workflow accepts the optional `dist-tag` input; omitting it preserves the family default. An override must be a valid npm dist-tag. Before publishing any tarball, the publisher checks every packed member: the selected tag must already name the intended version, or both that tag and the version must be absent. A tag bound elsewhere, or an already published version without the selected tag, rejects the entire attempt before any upload. Existing integrity checks and retries still apply. Skipped versions are never retagged.
+
+The preflight does not reserve npm tags atomically. The release manager coordinates external publishers that could change a binding after the check. A dedicated dist-tag also does not exclude stable versions from existing dependency ranges: isolation requires prerelease versions and an audit of the actual packed dependency ranges.
+
### Workspace-internal references use the `workspace:` protocol
-Every reference to a workspace member uses the `workspace:` protocol. The [release-range policy](2026-09-22-workspace-release-ranges.md) requires exact `workspace:*` DSH references and `workspace:~` vendor/native references in every dependency section and consumer, including the native entry's optional platform packages. Local workspace linking is unchanged.
+Every reference to a workspace member uses the `workspace:` protocol. Every dependency section and consumer uses exact `workspace:*` DSH references and `workspace:~` vendor/native references, including the native entry's optional platform packages. Vendor and native patch releases must preserve consumer-facing APIs and binary interfaces. Local workspace linking is unchanged.
-`scripts/check-workspace-constraints.ts` reads every member declared in `pnpm-workspace.yaml` plus the root manifest and enforces ranges by dependency target, not consumer directory. The invariant-companion rule requires `workspace:*` for `@deepseek-ai/dsh-invariants`; the dependency repairer preserves vendor/native tilde ranges. Published DSH peers therefore require the matching release instead of admitting later compatible versions.
+`scripts/check-workspace-constraints.ts` reads every member declared in `pnpm-workspace.yaml` plus the root manifest and enforces ranges by dependency target, not consumer directory. The dependency repairer preserves vendor/native tilde ranges. Published DSH peers therefore require the matching release instead of admitting later compatible versions.
### Published dependency faces use an explicit policy
@@ -109,7 +113,7 @@ The entity in this domain is a **release family**: a set of packages sharing one
| `publishOrder` | topological order over the sections npm installs plus peer declarations, ties broken by package name; a cycle among installed dependencies is reported rather than resolved arbitrarily, and a peer edge no order can honour is dropped and named |
| `pack` | packs a whole family into one directory and records the upload order |
| `verify` | the family's version baseline, the publish order it prints in full, and — when publishing — that the run comes from that family's tag and its members are publishable |
-| `verify-packed-install` | installs the tarballs of one or more pack directories into a throwaway consumer and drives the installed executable |
+| `verify-packed-install` | installs the tarballs of one or more pack directories into a throwaway consumer with an [owned npm cache](../bug-fix/2026-09-06-packed-install-private-npm-cache.md) and drives the installed executable |
| `publish` | the three registry states above |
| `process` / `tarball` | the one home for spawning commands and for reading a packed tarball, including the entry guard that keeps every script importable |
@@ -138,10 +142,6 @@ The installed-consumer probe captures npm's HTTP diagnostics and includes them w
| `vendor/README.md` | records `src` joining `cordis`'s `files` as a local modification |
| the three native packages | `publishConfig.access: public`, and their workflow passes no `--access` |
-### Relationship to the earlier proposal
-
-This Agent Note replaces the version scheme and the release-set boundary in [artifact-first npm baseline publication](../../rejected/process/2026-08-04-artifact-first-npm-baseline-publication.md): its `--` prerelease versions and `dev-` dist-tag are not adopted, and vendor is not excluded from the release set. What both agree on stands: pack and publish are separate, publish consumes only verified tarballs, and the payload and installed-artifact probes are release gates.
-
## Alternatives considered
**A `--` version.** Planned for continuous dev publication. It conflicts with keeping the published version in the repository: the version embeds a commit SHA, and writing the version back produces a new commit, so the SHA can only name the parent commit that was published and the link needs a convention to explain it. With numbered versions, a prerelease such as `0.0.1-rc.1` already covers "verify first, then release".
@@ -150,9 +150,9 @@ This Agent Note replaces the version scheme and the release-set boundary in [art
**Event-level tags (`vendor-r1`, `vendor-r2`).** Prepared for one release event carrying several package versions. Once the registry decides what publishes, the workflow no longer infers the set from the tag, so per-package tags suffice — and each one names its own package's real version.
-**Putting the nine vendored packages on one `4.0.x` line.** It removes change detection, but cosmokit would jump from `1.8.1` to `4.0.1` and lose its upstream lineage; the upstream ranges inside the nine (`^1.8.1` and friends) would stop matching immediately, forcing a rewrite of the vendored manifests.
+**Putting the nine vendored packages on one `4.0.x` line.** Cosmokit would jump from `1.8.1` to `4.0.1` and lose its upstream lineage; the upstream ranges inside the nine (`^1.8.1` and friends) would stop matching immediately, forcing a rewrite of the vendored manifests.
-**Incrementing every vendored package on every vendor release, with no change detection.** The least machinery, at the cost of new version numbers for packages whose content is byte-identical to the previous release. Tags reduce change detection to reading one tag and running one diff, which is not worth trading for inflated version numbers.
+**Publishing only changed vendor directories.** A directory diff does not establish that repacking from another repository state produces identical bytes. Advancing all nine packages avoids integrity collisions for unchanged directories at the cost of additional versions.
**Deciding "already published" from the version alone, without comparing content.** The reference flow queries no registry: publish uploads each tarball and npm rejects a duplicate version. Skipping on the version alone misses code that changed without a bump, which is the only failure that quietly leaves stale bytes on the registry. The cost is a registry query and a dependency on reproducible builds.
@@ -170,14 +170,14 @@ This Agent Note replaces the version scheme and the release-set boundary in [art
## Consequences
-The release scripts are importable modules behind a guarded entry point, and their judgements carry unit tests: tag naming, publish order and cycle reporting, version-baseline arithmetic, the payload change judgement, and each family's payload policy. Two defects the first draft carried — a publish command that ran the pack command on import, and a change judgement blind to `vendor/cordis` source edits — are exactly what a test at that seam catches.
+The release scripts are importable modules behind a guarded entry point, and their judgements carry unit tests: tag naming, publish order and cycle reporting, version-baseline arithmetic, and each family's payload policy. The entry guard prevents an import from executing a release command.
A pull request runs the full pack for both sequences without credentials and installs the packed dsh tarballs into a throwaway consumer, where plain Node drives `dsh --version`. That probe is deliberately one command: it proves `files` selected a complete payload and that the published ranges resolve, and says nothing about interactive behavior.
What this costs:
-- **Tags can drift from the registry.** A tag pushed for a publication that then failed is caught by bump's registry check, but only where credentials exist; an unauthenticated machine reports the gap and continues.
-- **The change judgement depends on visible tags.** A shallow clone, or a checkout without tags, degrades the vendored judgement to "publish everything for the first time". `fetch-depth: 0` is a precondition, not an optimization.
+- **Tags can drift from the registry.** Tags reserve versions even when publication fails; the release manager verifies registry completion separately.
+- **The version baseline depends on visible tags.** A shallow clone or a checkout without tags can reuse a reserved vendor version. `fetch-depth: 0` is a precondition, not an optimization.
- **The protocol rewrite touched 1504 dependency declarations.** It does not change local resolution — pnpm already resolves from the workspace — but it changes the ranges that go out.
- **Private packages need credentials to install.** Every consumer — CI, sandbox e2e, outside users — needs scope credentials, including for the Landlock packages, which have never been published and so cut off no existing anonymous path.
- **`repository` names a different organization than the one running the workflows.** Token-based publication is unaffected; npm's OIDC attestation requires the two to agree, so adopting it means either repointing `repository` or publishing from the organization it names.
diff --git a/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.zh.md b/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.zh.md
index d33d48e445..9d130478e6 100644
--- a/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.zh.md
+++ b/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.zh.md
@@ -22,7 +22,7 @@ Status: implemented
| 序列 | 成员 | 版本基线 | tag | workflow |
|---|---|---|---|---|
-| dsh | 发布集：`packages/*/*` + `apps/*` 中的公开成员，保留[私有实验包例外](2026-09-12-experimental-publication-denylist.zh.md)；私有包仅加入共享版本 bump | 发布集、私有 dsh 包与 workspace 根共用一个 `0.0.x` | `dsh-v<版本>` | `release.yml`（pack）/ `release-publish.yml`（发布） |
+| dsh | 发布集：`packages/*/*` + `apps/*` 中的公开成员，保留[私有实验包例外](../../../../packages/experimental/README.zh.md)；私有包仅加入共享版本 bump | 发布集、私有 dsh 包与 workspace 根共用一个 `0.0.x` | `dsh-v<版本>` | `release.yml`（pack）/ `release-publish.yml`（发布） |
| vendored framework | `vendor/*` 九个包 | 每包各自一条版本线 | `vendor-<包名>-v<版本>`（每包一个） | `release-vendor.yml`（pack）/ `release-vendor-publish.yml`（发布） |
| native | `native/system/packages/*` | 自己的 `0.0.x` | `node-addon-system-v<版本>` | `node-addon-system-release.yml` |
@@ -36,9 +36,9 @@ Status: implemented
基础版本号相同时，SemVer 按字典序比较字母数字型预发布标识：`alpha` 小于 `canary`，`canary` 小于 `rc`，所有预发布版本都小于稳定版本。npm dist-tag 是可变别名，不参与版本优先级比较。
-### vendor：谁改了谁发版，tag 就是账本
+### vendor：整族递增，每包保留自己的 tag
-vendor 九包加了 scope 之后与上游脱钩，但保留各自的版本线。发布版本取「manifest 版本」与「上次发布版本」中较高的那个，再递增 patch——这一步同时去掉上游的预发布段。首发版本：
+vendor 九包加了 scope 之后与上游脱钩，但保留各自的版本线。下一版本取 manifest 版本与最新 tag 版本中较高的那个，稳定版本之后递增 patch。首发版本：
| 包 | 上游版本 | 首发版本 |
|---|---|---|
@@ -52,13 +52,13 @@ vendor 九包加了 scope 之后与上游脱钩，但保留各自的版本线。
| `@deepseek-ai/cordis-plugin-group` | 1.0.0 | 1.0.1 |
| `@deepseek-ai/cordis-plugin-logger-console` | 1.0.0 | 1.0.1 |
-以「上次发布版本」为基线才扛得住重同步：本仓发过 `4.0.1` 之后上游把版本恢复成 `4.0.0-rc.8`，只看 manifest 会再算出 `4.0.1` 并撞上已发版本。加 `--prerelease rc.1` 则发一次排练版：它进 `--tag next`，而且不占用那组数字——预发布的优先级低于它所先行的正式版，所以 `4.0.1` 仍然接在 `4.0.1-rc.1` 之后。这个次序由脚本自己算，不读 `git tag --sort=v:refname`——git 会把预发布排在正式版之前。
+以最新 tag 的版本为基线可避免重同步后复用版本：本仓标记 `4.0.1` 之后，上游若将版本恢复成 `4.0.0-rc.8`，只看 manifest 会再次算出 `4.0.1`。`release:vendor --prerelease rc.1` 或 `--prerelease alpha.1` 选择预发布版本，默认 npm dist-tag 为 `next`。后续预发布和稳定版本复用其基础版本号：`4.0.1` 接在 `4.0.1-rc.1` 之后。脚本按 SemVer 优先级比较，不使用会将预发布排在稳定版本之前的 `git tag --sort=v:refname`。
-只发改动过的包，而变更判据不引入新的状态文件：**每包一个 tag，tag 就是「上次发布到哪个 commit」的记录**。bump 对每个包取最新的 `vendor-<包名>-v*` tag，拿包目录与它做 diff。一条路径算命中的条件是：manifest 的 `files` 选中它，或 npm 无论如何都会发布它（`package.json`、`README*`、`LICENSE*`），或者——当该包的 `files` 选中 `lib/` 时——它是构建输入（`src/**`、`tsconfig*.json`、构建配置）。最后那条规则的存在理由是构建产物不在 git 里：没有它，真实的源码改动会读成「没变化」，而下一次发布会在一个字节已变的版本上失败。
+每次 vendor 发布都递增全部九个包，每包保留自己的版本和 `vendor--v` tag。即使包目录没有源码变更，从不同仓库状态重新打包也可能改变其依赖范围或构建产物。整族递增可避免为这些不同的字节复用已有版本。
-tag 只是 commit 指针，不是发布成功的证明。bump 会向 registry 核对「最新 tag 指向的版本是否真的存在」，不存在就明确失败交人处理——否则一个为失败发布而推的 tag 会被读成「已发布」，从此永远跳过该包。查询私有包需要凭据，因此未鉴权的机器只报告这道核对被跳过，不失败。
+tag 预留包版本并标识其 commit，不代表发布成功。即使对应发布失败，bump 仍使用最新 tag。publisher 核对 registry 中的版本和 integrity，发布负责人核实整族发布完成。
-`vendor/cordis` 现在也发布 `src`。它的 exports 声明了 `"./src/*"`，tarball 里没有这些文件就等于把消费方指向不存在的路径；而 `files` 只选构建产物，也让变更判据没有任何受 git 跟踪的路径可匹配。
+`vendor/cordis` 也发布 `src`。它的 exports 声明了 `"./src/*"`，tarball 中缺少这些文件就会将消费方指向不存在的路径。
### 发布只在 GitHub 执行，由 registry 状态决定发什么
@@ -76,11 +76,15 @@ tag 只是 commit 指针，不是发布成功的证明。bump 会向 registry
registry 的两个行为决定了「怎么尝试一次发布」。写入之间至少间隔两秒并带退避重试，因为连续背靠背发多个包会超出 registry 自身的处理速度，换来 `E409 Failed to save packument`。而每次重试都先重查 registry：报出来的失败可能对应一次其实已经落地的写入，所以「该版本现在存在且 integrity 与本 tarball 相同」算作已发布，而不是又一个待放置的版本。
+对 dsh 和 vendor，`release:publish --dist-tag ` 覆盖该族默认发布通道。vendor 发布 workflow 接受可选的 `dist-tag` 输入；省略时保留该族默认值。覆盖值必须是合法的 npm dist-tag。发布任何 tarball 前，publisher 检查每个打包成员：所选 tag 必须已指向预期版本，或者该 tag 和版本都不存在。tag 指向其他版本，或版本已经发布但缺少所选 tag，都会在上传前拒绝整次发布。原有 integrity 检查与重试继续生效。跳过的版本不会重新绑定 tag。
+
+预检不会原子性地预留 npm tag。发布负责人协调可能在检查后更改绑定的外部发布者。专用 dist-tag 也不会让稳定版本被已有依赖范围排除：隔离需要预发布版本，并核查实际打包产物中的依赖范围。
+
### workspace 内部引用走 `workspace:` 协议
-所有指向 workspace 成员的引用都用 `workspace:` 协议。[发布范围策略](2026-09-22-workspace-release-ranges.zh.md)要求每个消费者的所有依赖区段对 DSH 使用精确的 `workspace:*` 引用，对 vendor/native 使用 `workspace:~` 引用，包括原生入口的可选平台包。本地 workspace 链接方式不变。
+所有指向 workspace 成员的引用都用 `workspace:` 协议。每个消费者的所有依赖区段对 DSH 使用精确的 `workspace:*` 引用，对 vendor/native 使用 `workspace:~` 引用，包括原生入口的可选平台包。vendor 与 native 的补丁版本必须保持面向消费者的 API 和二进制接口兼容。本地 workspace 链接方式不变。
-`scripts/check-workspace-constraints.ts` 读取 `pnpm-workspace.yaml` 声明的全部成员及根清单，按依赖目标而非消费者目录校验范围。Invariant companion 规则要求 `@deepseek-ai/dsh-invariants` 使用 `workspace:*`；依赖修复器保留 vendor/native tilde 范围。因此，发布的 DSH peer 要求匹配的发布版本，而不接纳后续兼容版本。
+`scripts/check-workspace-constraints.ts` 读取 `pnpm-workspace.yaml` 声明的全部成员及根清单，按依赖目标而非消费者目录校验范围。依赖修复器保留 vendor/native tilde 范围。因此，发布的 DSH peer 要求匹配的发布版本，而不接纳后续兼容版本。
### 发布依赖门面使用显式策略
@@ -109,7 +113,7 @@ registry 的两个行为决定了「怎么尝试一次发布」。写入之间
| `publishOrder` | 按 npm 会安装的依赖段加 peer 声明做拓扑序，同层按包名排；安装依赖成环是报错而不是随意定序，任何排不进去的 peer 边被丢弃并点名 |
| `pack` | 把整族打进一个目录并记录上传顺序 |
| `verify` | 族的版本基线、完整打印出来的发布顺序；发布时还要求本次运行来自该族的 tag、且成员可发布 |
-| `verify-packed-install` | 把一个或多个 pack 目录的 tarball 装进一次性 consumer，并驱动已安装的可执行入口 |
+| `verify-packed-install` | 把一个或多个 pack 目录的 tarball 装进带[独立 npm 缓存](../bug-fix/2026-09-06-packed-install-private-npm-cache.zh.md)的一次性 consumer，并驱动已安装的可执行入口 |
| `publish` | 上面那三态 |
| `process` / `tarball` | 启动命令、读取打包 tarball 的唯一正家，其中的入口守卫让每个脚本都可被 import |
@@ -138,10 +142,6 @@ dsh 的验证会一并安装 vendored 族的 pack 产物。harness 的包把 ven
| `vendor/README.md` | 记录「`src` 加入 `cordis` 的 `files`」这条本地修改 |
| native 三包 | `publishConfig.access: public`，且其 workflow 不传 `--access` |
-### 与先前提案的关系
-
-本 Note 取代 [以产物为先的 NPM 基线发布](../../rejected/process/2026-08-04-artifact-first-npm-baseline-publication.zh.md) 中的版本方案与发布集边界：那篇的 `-<时间戳>-<短 SHA>` 预发布版本与 `dev-` dist-tag 不再采用，vendor 也不排除在发布集之外。两篇一致的部分保留：pack 与 publish 分离、publish 只消费已验证的 tarball、payload 与安装后探针作为发布门。
-
## 曾考虑的替代方案
**`-<时间戳>-<短 SHA>` 版本号。** 曾计划用于持续 dev 发布。它与「把发布版本留在仓库里」冲突：版本内嵌 commit SHA，而把版本写回会产生新的 commit，于是 SHA 只能指向被发布的父 commit，这条链要靠约定解释。改用数字版本后，`0.0.1-rc.1` 这类预发布号已经覆盖「先验证再正式发」。
@@ -150,9 +150,9 @@ dsh 的验证会一并安装 vendored 族的 pack 产物。harness 的包把 ven
**事件级 tag（`vendor-r1`、`vendor-r2`）。** 为「一次发布事件携带多个包版本」准备。既然由 registry 决定发什么，workflow 就不再从 tag 推断集合，per-package tag 够用，而且每个 tag 携带的是它自己那个包的真实版本。
-**把九个 vendored 包统一到一条 `4.0.x` 版本线。** 省掉变更检测，但 cosmokit 会从 `1.8.1` 跳到 `4.0.1`、丢失上游血缘；九包内部的上游范围（`^1.8.1` 之类）会立刻失配，必须改写 vendored manifest。
+**把九个 vendored 包统一到一条 `4.0.x` 版本线。** Cosmokit 会从 `1.8.1` 跳到 `4.0.1`、丢失上游血缘；九包内部的上游范围（`^1.8.1` 之类）会立刻失配，必须改写 vendored manifest。
-**每次 vendor 发布把九包全部 patch+1，不做变更检测。** 机制最少，代价是内容与上一版逐字节相同的包也拿到新版本号。tag 把变更检测的成本压到「读一个 tag、跑一次 diff」，不值得为省这点让版本号虚涨。
+**只发布目录有变更的 vendor 包。** 目录 diff 不能证明从不同仓库状态重新打包会产出相同字节。递增全部九个包可避免未改目录的 integrity 冲突，代价是增加版本号。
**只按版本号判断「是否已发布」，不比对内容。** 参照流程根本不查 registry：publish 逐个上传，重复版本由 npm 拒绝。只按版本号跳过会漏掉「改了代码没 bump」，而这是唯一会安静地把旧字节留在 registry 上的错误。代价是引入一次 registry 查询和对构建可复现性的依赖。
@@ -170,14 +170,14 @@ dsh 的验证会一并安装 vendored 族的 pack 产物。harness 的包把 ven
## 后果
-发布脚本是带入口守卫的可 import 模块，其判断都有单测覆盖：tag 命名、发布顺序与环报告、版本基线运算、payload 变更判据，以及各族的 payload 策略。第一版带过的两个缺陷——publish 命令在 import 时执行了 pack 命令、变更判据对 `vendor/cordis` 的源码改动失明——正是这类测试在对应接缝上能抓住的。
+发布脚本是带入口守卫的可 import 模块，其判断都有单测覆盖：tag 命名、发布顺序与环报告、版本基线运算，以及各族的 payload 策略。入口守卫阻止 import 执行发布命令。
一个 pull request 会为两条序列跑完整的 pack（无凭据），并把打包好的 dsh tarball 装进一次性 consumer，用普通 Node 驱动 `dsh --version`。这个探针刻意只有一条命令：它证明 `files` 选出了完整 payload、发布出去的范围可解析，不涉及任何交互行为。
代价：
-- **tag 可能与 registry 漂移。** 为失败发布而推的 tag 由 bump 的 registry 核对拦下，但只在有凭据的地方；未鉴权的机器只报告这道核对被跳过。
-- **变更判据依赖 tag 可见。** shallow clone 或未拉 tag 会把 vendored 族的判据退化成「全部首发」。`fetch-depth: 0` 是前提，不是优化。
+- **tag 可能与 registry 漂移。** 即使发布失败，tag 仍预留版本；发布负责人另行核实 registry 中的完成状态。
+- **版本基线依赖 tag 可见。** shallow clone 或未拉取 tag 的 checkout 可能复用已预留的 vendor 版本。`fetch-depth: 0` 是前提，不是优化。
- **协议改写触及 1504 处依赖声明。** 它不改变本机解析（pnpm 本来就从 workspace 解析），但改变了发布出去的范围写法。
- **私有包需要凭据才能安装。** 任何消费方——CI、沙箱 e2e、外部使用者——都要持有 scope 凭据，Landlock 三包也在其中；它们从未发布过，所以没有切断既有的匿名安装路径。
- **`repository` 指向的组织与运行 workflow 的组织不同。** 用 token 发布不受影响；npm 的 OIDC attestation 要求二者一致，届时要么把 `repository` 改指过去，要么从它指向的组织发布。
diff --git a/.agents/notes/implemented/process/2026-08-18-in-job-partitioned-coverage.i18n.yaml b/.agents/notes/implemented/process/2026-08-18-in-job-partitioned-coverage.i18n.yaml
deleted file mode 100644
index 47454c2346..0000000000
--- a/.agents/notes/implemented/process/2026-08-18-in-job-partitioned-coverage.i18n.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-18-in-job-partitioned-coverage.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-08-18-in-job-partitioned-coverage.md
-/agent-note-in-job-partitioned-coverage:
- en: eb25ff049a1ecc31
- zh: d7430b14ccea5707
-/agent-note-in-job-partitioned-coverage/problem:
- en: ab6dcac4ca2bbfb3
- zh: c754cc8077671b25
-/agent-note-in-job-partitioned-coverage/decision:
- en: ae23ea86587c23e8
- zh: b9868c5c76238d9a
-/agent-note-in-job-partitioned-coverage/failure-and-output-semantics:
- en: c73ddbc65107e34e
- zh: dbc7649637f8d1c0
-/agent-note-in-job-partitioned-coverage/verification:
- en: 81dcaebd4b96229c
- zh: 76b3332b183f6c44
-/agent-note-in-job-partitioned-coverage/alternatives-considered:
- en: 82f314bd434b0059
- zh: 7b64e90b74f428e5
-/agent-note-in-job-partitioned-coverage/consequences:
- en: 146e997017ee6e47
- zh: cd5e5d2d9b0b47b9
diff --git a/.agents/notes/implemented/process/2026-08-19-remove-knip.i18n.yaml b/.agents/notes/implemented/process/2026-08-19-remove-knip.i18n.yaml
deleted file mode 100644
index 1d76a326bd..0000000000
--- a/.agents/notes/implemented/process/2026-08-19-remove-knip.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-19-remove-knip.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-08-19-remove-knip.md
-/agent-note-remove-knip-from-repository-gates:
- en: adba00071ebc35c8
- zh: 44f778106e0b9965
-/agent-note-remove-knip-from-repository-gates/problem:
- en: 5b2ece5e6f3775e0
- zh: 4fbc60619afdb7e2
-/agent-note-remove-knip-from-repository-gates/decision:
- en: c5d7ae84ed863e29
- zh: 409dca40c2a63940
-/agent-note-remove-knip-from-repository-gates/alternatives-considered:
- en: 95363dbc293712f3
- zh: 9cbcb9937081f5f0
-/agent-note-remove-knip-from-repository-gates/consequences:
- en: 7466ca9e99d0bb27
- zh: 2ac417bc23865e14
diff --git a/.agents/notes/implemented/process/2026-08-26-ban-ambiguous-origin-label.i18n.yaml b/.agents/notes/implemented/process/2026-08-26-ban-ambiguous-origin-label.i18n.yaml
index 064bf1cbf2..f627f1c4d6 100644
--- a/.agents/notes/implemented/process/2026-08-26-ban-ambiguous-origin-label.i18n.yaml
+++ b/.agents/notes/implemented/process/2026-08-26-ban-ambiguous-origin-label.i18n.yaml
@@ -6,8 +6,8 @@
en: 98843ceb0ee72c06
zh: e4963bfe0e1b1314
/agent-note-ban-an-ambiguous-origin-label/problem:
- en: e3c5b3a689f7a3cc
- zh: 676620dfb5303bed
+ en: 1b3ff74fd7669a39
+ zh: f38776a677da81f8
/agent-note-ban-an-ambiguous-origin-label/decision:
en: bb8507460f159ad1
zh: 357b5e6065cf389c
diff --git a/.agents/notes/implemented/process/2026-08-26-ban-ambiguous-origin-label.md b/.agents/notes/implemented/process/2026-08-26-ban-ambiguous-origin-label.md
index b4c161a8a9..f0b547fbc6 100644
--- a/.agents/notes/implemented/process/2026-08-26-ban-ambiguous-origin-label.md
+++ b/.agents/notes/implemented/process/2026-08-26-ban-ambiguous-origin-label.md
@@ -8,7 +8,7 @@ English | [中文](2026-08-26-ban-ambiguous-origin-label.zh.md)
The case-insensitive ten-letter ASCII token formed by `prove` followed by `nance` had accumulated unrelated meanings across the repository. It named source-event references, provider and model metadata, context producers, installed artifact identity, configuration origins, browser-recording evidence, and release attestations. A reader could not determine the recorded fact from the label alone.
-The existing [concrete prose decision](2026-08-09-concrete-prose-names-actors-and-recorded-facts.md) required sentence-level classification and normally preserved identifiers. That policy improved individual sentences but allowed the same ambiguous label to remain in APIs, durable compatibility fixtures, filenames, generated catalogs, and new prose.
+The existing [concrete prose reference](../../../skills/dsh-prose-standard/SKILL.md) required sentence-level classification and normally preserved identifiers. That policy improved individual sentences but allowed the same ambiguous label to remain in APIs, durable compatibility fixtures, filenames, generated catalogs, and new prose.
## Decision
diff --git a/.agents/notes/implemented/process/2026-08-26-ban-ambiguous-origin-label.zh.md b/.agents/notes/implemented/process/2026-08-26-ban-ambiguous-origin-label.zh.md
index 2d592f4442..1f1c754af6 100644
--- a/.agents/notes/implemented/process/2026-08-26-ban-ambiguous-origin-label.zh.md
+++ b/.agents/notes/implemented/process/2026-08-26-ban-ambiguous-origin-label.zh.md
@@ -8,7 +8,7 @@ Status: implemented
由 `prove` 与 `nance` 拼成的十个 ASCII 字母术语不区分大小写时，在仓库中已经承载了互不相关的含义。它曾表示来源事件引用、提供方与模型元数据、上下文生产方、已安装产物身份、配置来源、浏览器录制证据和发布证明。读者无法仅凭该名称判断实际记录的事实。
-现有的[具体表述决策](2026-08-09-concrete-prose-names-actors-and-recorded-facts.zh.md)要求逐句分类，且通常保留标识符。该规则改善了各个句子，却仍允许同一个有歧义名称留在 API、持久化兼容 fixture、文件名、生成目录和新行文中。
+现有的[具体表述说明](../../../skills/dsh-prose-standard/SKILL.md)要求逐句分类，且通常保留标识符。该规则改善了各个句子，却仍允许同一个有歧义名称留在 API、持久化兼容 fixture、文件名、生成目录和新行文中。
## 决策
diff --git a/.agents/notes/implemented/process/2026-08-26-published-dependency-faces.i18n.yaml b/.agents/notes/implemented/process/2026-08-26-published-dependency-faces.i18n.yaml
index 19ca92d47b..e3b23f9d2c 100644
--- a/.agents/notes/implemented/process/2026-08-26-published-dependency-faces.i18n.yaml
+++ b/.agents/notes/implemented/process/2026-08-26-published-dependency-faces.i18n.yaml
@@ -15,8 +15,8 @@
en: 5ea13b09ae774437
zh: ef9dbccada39107a
/agent-note-published-dependency-faces-and-bounded-peer-relays/decision/dependency-sections:
- en: b1c3e9a87b8bb1ea
- zh: 5cfd8b4db39805b7
+ en: d34ebac6c1c7642b
+ zh: 2cf3a60df14b072a
/agent-note-published-dependency-faces-and-bounded-peer-relays/decision/maintainer-workflow:
en: 5983475fa551ca90
zh: a5519f4817f65e8c
diff --git a/.agents/notes/implemented/process/2026-08-26-published-dependency-faces.md b/.agents/notes/implemented/process/2026-08-26-published-dependency-faces.md
index f188ccc0fc..ac0550750f 100644
--- a/.agents/notes/implemented/process/2026-08-26-published-dependency-faces.md
+++ b/.agents/notes/implemented/process/2026-08-26-published-dependency-faces.md
@@ -28,7 +28,7 @@ A workspace package reached by a runtime value import from the Host entry closur
An export whose constructor identity or module state must be shared appears in `peerRequiredHostExports`; importing one such export keeps the whole package edge in matching `peerDependencies` and `devDependencies`. Each export-table key is an exact module specifier and each value is a reviewed export set. The verifier follows runtime local imports from the Host entry, records named and default imports and re-exports, and rejects exports covered by neither the package list nor an export table; namespace, dynamic, and side-effect imports remain unbounded unless the complete exact entry is package-classified.
-Workspace imports used by the Client bundle, type-only imports, module augmentations, `dsh.client.inject`, and existing metadata-only peers belong only in `devDependencies`. Host runtime imports, including additional Node entries, follow the Host classification. [Browser third-party build inputs](2026-09-08-browser-third-party-build-inputs.md) governs ordinary third-party declarations; it partially supersedes their preservation in this decision. [Release ranges](2026-09-22-workspace-release-ranges.md) require `workspace:*` for DSH and `workspace:~` for vendor/native references.
+Workspace imports used by the Client bundle, type-only imports, module augmentations, `dsh.client.inject`, and existing metadata-only peers belong only in `devDependencies`. Host runtime imports, including additional Node entries, follow the Host classification. Browser-only third-party build inputs belong in `devDependencies`; a Host runtime value import takes precedence as `dependencies`. Bundled implementations remain runtime license disclosures regardless of their npm section. Static browser libraries remain Web-shell build inputs, without an independent installed-library support promise. [Release-family rules](2026-08-10-npm-release-sequences.md) require `workspace:*` for DSH and `workspace:~` for vendor/native references.
Some development relationships exist only in `dsh.client.inject` or TypeScript project references. The policy's `configurationOnlyDevDependencies` table names only those reviewed edges and keeps them in `devDependencies`.
diff --git a/.agents/notes/implemented/process/2026-08-26-published-dependency-faces.zh.md b/.agents/notes/implemented/process/2026-08-26-published-dependency-faces.zh.md
index d59bb724ce..5ba6333ae4 100644
--- a/.agents/notes/implemented/process/2026-08-26-published-dependency-faces.zh.md
+++ b/.agents/notes/implemented/process/2026-08-26-published-dependency-faces.zh.md
@@ -28,7 +28,7 @@ Host 入口闭包中的运行期 value import 所到达的 workspace 包，只
constructor 身份或模块状态必须共享的导出列入 `peerRequiredHostExports`；一旦使用这类导出，整条包依赖边就保留在范围一致的 `peerDependencies` 与 `devDependencies` 中。每个导出表的 key 都是精确 module specifier，每个 value 都是经审查的导出集合。验证器从 Host 入口沿运行期本地 import 扫描，记录具名与默认 import 和 re-export，并拒绝既没有包级分类、也没有导出级分类的导出；除非完整的精确入口已按包分类，否则 namespace、dynamic 和 side-effect import 仍无法限定范围。
-Client bundle 使用的 workspace import、纯类型 import、模块扩充、`dsh.client.inject` 和仅有元数据的现存 peer 只属于 `devDependencies`。Host 运行时 import（包括额外 Node 入口）遵循 Host 分类。[浏览器第三方构建输入](2026-09-08-browser-third-party-build-inputs.zh.md)规定普通第三方声明，部分取代本决策对它们原区段的保留。[发布范围](2026-09-22-workspace-release-ranges.zh.md)要求 DSH 引用使用 `workspace:*`，vendor/native 引用使用 `workspace:~`。
+Client bundle 使用的 workspace import、纯类型 import、模块扩充、`dsh.client.inject` 和仅有元数据的现存 peer 只属于 `devDependencies`。Host 运行时 import（包括额外 Node 入口）遵循 Host 分类。仅供浏览器使用的第三方构建输入属于 `devDependencies`；Host 运行时 value import 优先归为 `dependencies`。已打包的实现无论位于哪个 npm 区段，都属于运行时许可证披露内容。静态浏览器库仍是 Web shell 的构建输入，不承诺作为独立安装的库提供支持。[发布系列规则](2026-08-10-npm-release-sequences.zh.md)要求 DSH 引用使用 `workspace:*`，vendor/native 引用使用 `workspace:~`。
部分开发期关系只存在于 `dsh.client.inject` 或 TypeScript project reference 中。策略的 `configurationOnlyDevDependencies` 表只列出这些已评审的依赖边，并将它们保留在 `devDependencies` 中。
diff --git a/.agents/notes/implemented/process/2026-08-28-ci-node-compile-cache-data-disk.i18n.yaml b/.agents/notes/implemented/process/2026-08-28-ci-node-compile-cache-data-disk.i18n.yaml
deleted file mode 100644
index 9413c6b4fd..0000000000
--- a/.agents/notes/implemented/process/2026-08-28-ci-node-compile-cache-data-disk.i18n.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-28-ci-node-compile-cache-data-disk.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-08-28-ci-node-compile-cache-data-disk.md
-/agent-note-redirect-the-node-compile-cache-to-the-data-volume-runner-temp:
- en: 52bb1466b8f7f8fe
- zh: fa7c282d3d207e53
-/agent-note-redirect-the-node-compile-cache-to-the-data-volume-runner-temp/problem:
- en: 3efe58882ca81bf7
- zh: 14f802e97e26f03d
-/agent-note-redirect-the-node-compile-cache-to-the-data-volume-runner-temp/decision:
- en: cb66e6c4ad73b50b
- zh: 43540cec116e342a
-/agent-note-redirect-the-node-compile-cache-to-the-data-volume-runner-temp/verification:
- en: e23de17356f97224
- zh: b28bcafb4d1a72ad
-/agent-note-redirect-the-node-compile-cache-to-the-data-volume-runner-temp/alternatives-considered:
- en: 6119e2aff3b6be5a
- zh: e01a6c669a9ec6aa
-/agent-note-redirect-the-node-compile-cache-to-the-data-volume-runner-temp/alternatives-considered/why-not-disable-the-compile-cache-entirely:
- en: cee8de5b45031309
- zh: 6ce10a304e63bdbb
-/agent-note-redirect-the-node-compile-cache-to-the-data-volume-runner-temp/alternatives-considered/why-not-add-node-compile-cache-to-the-dsh-residue-sweep:
- en: 7e06d9c4df7a9f56
- zh: f3151fe2671fd91e
-/agent-note-redirect-the-node-compile-cache-to-the-data-volume-runner-temp/alternatives-considered/why-not-job-level-env-or-gate-step-env-only:
- en: 4ba6c9a14bafbc80
- zh: 410149f4a3e930e6
-/agent-note-redirect-the-node-compile-cache-to-the-data-volume-runner-temp/consequences:
- en: 083e2665e1550111
- zh: 70560c09ca2b3750
diff --git a/.agents/notes/implemented/process/2026-09-02-project-local-issue-planning-fields.i18n.yaml b/.agents/notes/implemented/process/2026-09-02-project-local-issue-planning-fields.i18n.yaml
deleted file mode 100644
index c092807a5a..0000000000
--- a/.agents/notes/implemented/process/2026-09-02-project-local-issue-planning-fields.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-02-project-local-issue-planning-fields.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-02-project-local-issue-planning-fields.md
-/agent-note-project-local-issue-planning-fields:
- en: 9791d03a5df4c38c
- zh: 19cbbf884294402b
-/agent-note-project-local-issue-planning-fields/problem:
- en: d01d052a9f366f35
- zh: b18600b91aad9a7c
-/agent-note-project-local-issue-planning-fields/decision:
- en: 21db463121897497
- zh: fd0551038412fd17
-/agent-note-project-local-issue-planning-fields/verification:
- en: 7d1ef3eb9aac465d
- zh: 68280a4511bce360
-/agent-note-project-local-issue-planning-fields/alternatives-considered:
- en: b51a8fbc92bb7b5f
- zh: 9316e86ac82c0a1b
-/agent-note-project-local-issue-planning-fields/consequences:
- en: d3614b91a0a6523a
- zh: 773a31194e293014
diff --git a/.agents/notes/implemented/process/2026-09-03-semantic-issue-templates-and-policy.i18n.yaml b/.agents/notes/implemented/process/2026-09-03-semantic-issue-templates-and-policy.i18n.yaml
deleted file mode 100644
index 68c4e68e70..0000000000
--- a/.agents/notes/implemented/process/2026-09-03-semantic-issue-templates-and-policy.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-03-semantic-issue-templates-and-policy.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-03-semantic-issue-templates-and-policy.md
-/agent-note-semantic-issue-templates-and-presentation-neutral-policy:
- en: e1e183193c798bf4
- zh: db76ac954cd3038f
-/agent-note-semantic-issue-templates-and-presentation-neutral-policy/problem:
- en: 5da7b92d65316469
- zh: 30bc615947b3a8aa
-/agent-note-semantic-issue-templates-and-presentation-neutral-policy/decision:
- en: a351c272ef520bb9
- zh: 98db942d18da7565
-/agent-note-semantic-issue-templates-and-presentation-neutral-policy/verification:
- en: 90912d4c58b9e35d
- zh: 811eaab5bdd54ab4
-/agent-note-semantic-issue-templates-and-presentation-neutral-policy/alternatives-considered:
- en: 520ba80ce03e05b4
- zh: 50df33c59c4c837d
-/agent-note-semantic-issue-templates-and-presentation-neutral-policy/consequences:
- en: c762b95945320c61
- zh: 935f6e7290c06811
diff --git a/.agents/notes/implemented/process/2026-09-06-evidence-driven-performance-skill.i18n.yaml b/.agents/notes/implemented/process/2026-09-06-evidence-driven-performance-skill.i18n.yaml
deleted file mode 100644
index a9cf40b2dc..0000000000
--- a/.agents/notes/implemented/process/2026-09-06-evidence-driven-performance-skill.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-06-evidence-driven-performance-skill.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-06-evidence-driven-performance-skill.md
-/agent-note-evidence-driven-performance-optimization-workflow:
- en: 0a63ab9dc4847f40
- zh: f8ba9a608396c47c
-/agent-note-evidence-driven-performance-optimization-workflow/problem:
- en: 2e0cb63ef966a541
- zh: 1853e223e530708e
-/agent-note-evidence-driven-performance-optimization-workflow/decision:
- en: bd0e363221108421
- zh: fc83dc1020d53f4e
-/agent-note-evidence-driven-performance-optimization-workflow/historical-evidence:
- en: 2d913642c87e5a01
- zh: 45fce898640c87e8
-/agent-note-evidence-driven-performance-optimization-workflow/alternatives-considered:
- en: 70d016cd8e541933
- zh: 2ebeb9cbeba8129e
-/agent-note-evidence-driven-performance-optimization-workflow/consequences:
- en: 961c634c37340937
- zh: 9a528567223f7bfa
diff --git a/.agents/notes/implemented/process/2026-09-06-master-only-platform-ci.i18n.yaml b/.agents/notes/implemented/process/2026-09-06-master-only-platform-ci.i18n.yaml
deleted file mode 100644
index 0397c20321..0000000000
--- a/.agents/notes/implemented/process/2026-09-06-master-only-platform-ci.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-06-master-only-platform-ci.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-06-master-only-platform-ci.md
-/agent-note-master-only-platform-ci:
- en: fed101c5775cbbcd
- zh: b407efdb4c46cfe2
-/agent-note-master-only-platform-ci/problem:
- en: 85cf39297a859208
- zh: c959bf7f94ebc50b
-/agent-note-master-only-platform-ci/decision:
- en: 98b8ecd3b4cfe5e5
- zh: 2c622950ea7afd42
-/agent-note-master-only-platform-ci/alternatives-considered:
- en: 71ce7f8bb8a31323
- zh: 45f97b72eb9c6971
-/agent-note-master-only-platform-ci/consequences:
- en: 523bbd6a59c120bf
- zh: a9d834b5c32a911f
diff --git a/.agents/notes/implemented/process/2026-09-06-node-compatibility-selfhosted.i18n.yaml b/.agents/notes/implemented/process/2026-09-06-node-compatibility-selfhosted.i18n.yaml
deleted file mode 100644
index 7cc692226f..0000000000
--- a/.agents/notes/implemented/process/2026-09-06-node-compatibility-selfhosted.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-06-node-compatibility-selfhosted.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-06-node-compatibility-selfhosted.md
-/agent-note-isolated-node-compatibility-jobs-on-self-hosted-linux:
- en: 21c12c8bd0c44122
- zh: b07f0ffc18092f0d
-/agent-note-isolated-node-compatibility-jobs-on-self-hosted-linux/problem:
- en: 6bcedb8e3f0dce21
- zh: 83e88ed593259292
-/agent-note-isolated-node-compatibility-jobs-on-self-hosted-linux/decision:
- en: 14f1348f993b9102
- zh: a94e1b802e6a8c39
-/agent-note-isolated-node-compatibility-jobs-on-self-hosted-linux/alternatives-considered:
- en: 93217ca46c2cefb8
- zh: 77a167c69f59111c
-/agent-note-isolated-node-compatibility-jobs-on-self-hosted-linux/consequences:
- en: 116d255b8d1b846c
- zh: 931754a68e4f75c6
-/agent-note-isolated-node-compatibility-jobs-on-self-hosted-linux/verification:
- en: d0b1f1431fae737b
- zh: 6cf4f4d654a9525d
diff --git a/.agents/notes/implemented/process/2026-09-06-preview-hosted-runner-sizing.i18n.yaml b/.agents/notes/implemented/process/2026-09-06-preview-hosted-runner-sizing.i18n.yaml
deleted file mode 100644
index 6bd758533f..0000000000
--- a/.agents/notes/implemented/process/2026-09-06-preview-hosted-runner-sizing.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-06-preview-hosted-runner-sizing.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-06-preview-hosted-runner-sizing.md
-/agent-note-measured-github-hosted-pr-preview-sizing:
- en: 987e2592c644030d
- zh: 55f306766247e4a4
-/agent-note-measured-github-hosted-pr-preview-sizing/problem:
- en: bc382c3ef9c28709
- zh: 27e50735d80696a2
-/agent-note-measured-github-hosted-pr-preview-sizing/decision:
- en: 9988e6268f8fc5b8
- zh: e92f3922b49b193d
-/agent-note-measured-github-hosted-pr-preview-sizing/decision/measurements:
- en: 768cd2ecf9d33c87
- zh: 693ea069a5275736
-/agent-note-measured-github-hosted-pr-preview-sizing/alternatives-considered:
- en: 04f845ddb2a86e31
- zh: 993c6f82f5119f66
-/agent-note-measured-github-hosted-pr-preview-sizing/consequences:
- en: ed9e8446f4579f5d
- zh: c899cdd070e6befa
diff --git a/.agents/notes/implemented/process/2026-09-06-release-rehearsal-selfhosted.i18n.yaml b/.agents/notes/implemented/process/2026-09-06-release-rehearsal-selfhosted.i18n.yaml
deleted file mode 100644
index 9e35b7e987..0000000000
--- a/.agents/notes/implemented/process/2026-09-06-release-rehearsal-selfhosted.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-06-release-rehearsal-selfhosted.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-06-release-rehearsal-selfhosted.md
-/agent-note-trusted-release-rehearsals-on-persistent-linux-runners:
- en: 1bccf6bdafd4cc76
- zh: 28ce63be303697f1
-/agent-note-trusted-release-rehearsals-on-persistent-linux-runners/problem:
- en: c458bf4244320194
- zh: fbd5f64cf8875725
-/agent-note-trusted-release-rehearsals-on-persistent-linux-runners/decision:
- en: d51d35350d91f19b
- zh: 65297576aff64e8a
-/agent-note-trusted-release-rehearsals-on-persistent-linux-runners/alternatives-considered:
- en: cd04297045b93d7b
- zh: 9eacc1d9c6c10726
-/agent-note-trusted-release-rehearsals-on-persistent-linux-runners/consequences:
- en: 90c50dda81822e7c
- zh: 9c3ff4df4d2d9533
diff --git a/.agents/notes/implemented/process/2026-09-07-selective-issue-policy-evaluation.i18n.yaml b/.agents/notes/implemented/process/2026-09-07-selective-issue-policy-evaluation.i18n.yaml
deleted file mode 100644
index b8002f1c9e..0000000000
--- a/.agents/notes/implemented/process/2026-09-07-selective-issue-policy-evaluation.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-07-selective-issue-policy-evaluation.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-07-selective-issue-policy-evaluation.md
-/agent-note-selective-issue-policy-evaluation:
- en: b0f986e68a7b7d74
- zh: cffd2efae38626ef
-/agent-note-selective-issue-policy-evaluation/problem:
- en: 5af4901a5e9576fb
- zh: eb089750b27129b1
-/agent-note-selective-issue-policy-evaluation/decision:
- en: 99e6c76f04a4d49b
- zh: 2631ff72b4db3bdf
-/agent-note-selective-issue-policy-evaluation/alternatives-considered:
- en: 89631c2a92ab079a
- zh: 37b94f76ec6dc36a
-/agent-note-selective-issue-policy-evaluation/consequences:
- en: 6013a044827444e5
- zh: 69f767a1d534761a
-/agent-note-selective-issue-policy-evaluation/verification:
- en: b7fb4ebd009d7fd3
- zh: 6d682a4b7f41a4e0
diff --git a/.agents/notes/implemented/process/2026-09-08-browser-third-party-build-inputs.i18n.yaml b/.agents/notes/implemented/process/2026-09-08-browser-third-party-build-inputs.i18n.yaml
deleted file mode 100644
index 70e32ca967..0000000000
--- a/.agents/notes/implemented/process/2026-09-08-browser-third-party-build-inputs.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-08-browser-third-party-build-inputs.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-08-browser-third-party-build-inputs.md
-/agent-note-browser-third-party-libraries-as-build-inputs:
- en: 907b99b05fcbce0e
- zh: 57980cde5b585338
-/agent-note-browser-third-party-libraries-as-build-inputs/problem:
- en: 55458dc0cd27341e
- zh: ab23b350c17862be
-/agent-note-browser-third-party-libraries-as-build-inputs/decision:
- en: 2e9ff103342733eb
- zh: d8be06fe18aab03a
-/agent-note-browser-third-party-libraries-as-build-inputs/alternatives-considered:
- en: 0247f31a86099d53
- zh: 445a6d35c03fc468
-/agent-note-browser-third-party-libraries-as-build-inputs/consequences:
- en: ee331a2282a6884e
- zh: de81b33db3fd6486
diff --git a/.agents/notes/implemented/process/2026-09-08-package-index-link-discovery.i18n.yaml b/.agents/notes/implemented/process/2026-09-08-package-index-link-discovery.i18n.yaml
deleted file mode 100644
index e57f7c6ecc..0000000000
--- a/.agents/notes/implemented/process/2026-09-08-package-index-link-discovery.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-08-package-index-link-discovery.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-08-package-index-link-discovery.md
-/agent-note-include-package-indexes-in-markdown-link-discovery:
- en: edf2fd5b97c0075a
- zh: da6ca05db38ee998
-/agent-note-include-package-indexes-in-markdown-link-discovery/problem:
- en: 74a87cccbf602fc4
- zh: 88d1116da4cc35fb
-/agent-note-include-package-indexes-in-markdown-link-discovery/decision:
- en: 350354f891182cbf
- zh: 4607ef9c38ff7a68
-/agent-note-include-package-indexes-in-markdown-link-discovery/alternatives-considered:
- en: e12999e567cd2cbd
- zh: a502f11b11e86815
-/agent-note-include-package-indexes-in-markdown-link-discovery/consequences:
- en: 0bd932bd7feb363b
- zh: acce05659887e5e5
diff --git a/.agents/notes/implemented/process/2026-09-08-playwright-video-gif.i18n.yaml b/.agents/notes/implemented/process/2026-09-08-playwright-video-gif.i18n.yaml
deleted file mode 100644
index f8222bf89a..0000000000
--- a/.agents/notes/implemented/process/2026-09-08-playwright-video-gif.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-08-playwright-video-gif.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-08-playwright-video-gif.md
-/agent-note-playwright-video-captures-continuous-browser-demos:
- en: fcca6f069dc51b80
- zh: e9d171b6c84f92a7
-/agent-note-playwright-video-captures-continuous-browser-demos/problem:
- en: 967fed211899587e
- zh: 0062f7ca29211105
-/agent-note-playwright-video-captures-continuous-browser-demos/decision:
- en: 5f9e88a564fd6b8a
- zh: b78164f92167dada
-/agent-note-playwright-video-captures-continuous-browser-demos/alternatives-considered:
- en: 221e89bafcb152d4
- zh: b33816c680dc450f
-/agent-note-playwright-video-captures-continuous-browser-demos/consequences:
- en: e5c9eb6df05801ba
- zh: 786cd7775bfceb9e
diff --git a/.agents/notes/implemented/process/2026-09-09-blocked-weighted-approvals-remain-pending.i18n.yaml b/.agents/notes/implemented/process/2026-09-09-blocked-weighted-approvals-remain-pending.i18n.yaml
deleted file mode 100644
index 3cf9104f6e..0000000000
--- a/.agents/notes/implemented/process/2026-09-09-blocked-weighted-approvals-remain-pending.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-09-blocked-weighted-approvals-remain-pending.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-09-blocked-weighted-approvals-remain-pending.md
-/agent-note-blocked-weighted-approvals-remain-pending:
- en: 6a5da25eb874aece
- zh: 654aa967a9222501
-/agent-note-blocked-weighted-approvals-remain-pending/problem:
- en: 0afdda30d02b666b
- zh: 6624aa9c8c58ea0a
-/agent-note-blocked-weighted-approvals-remain-pending/decision:
- en: cf7ac63f422b4cfb
- zh: 250385e42d546d30
-/agent-note-blocked-weighted-approvals-remain-pending/verification:
- en: af674f57088d303a
- zh: b9c42f04beec9be5
-/agent-note-blocked-weighted-approvals-remain-pending/alternatives-considered:
- en: 13d5f67070bd3396
- zh: c75db3746d31272e
-/agent-note-blocked-weighted-approvals-remain-pending/consequences:
- en: 284f19608b0d449f
- zh: 1d9bd95239ba6ffa
diff --git a/.agents/notes/implemented/process/2026-09-09-cancel-superseded-ci.i18n.yaml b/.agents/notes/implemented/process/2026-09-09-cancel-superseded-ci.i18n.yaml
deleted file mode 100644
index 5dac131679..0000000000
--- a/.agents/notes/implemented/process/2026-09-09-cancel-superseded-ci.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-09-cancel-superseded-ci.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-09-cancel-superseded-ci.md
-/agent-note-cancel-superseded-ci-validation:
- en: 78c382bc45c48256
- zh: a6a93a2ef554c61c
-/agent-note-cancel-superseded-ci-validation/problem:
- en: b436e3c8a7ffe727
- zh: 80b9f77b5cb051de
-/agent-note-cancel-superseded-ci-validation/decision:
- en: a61d1bc387ed8436
- zh: 3162cdd8096a8a01
-/agent-note-cancel-superseded-ci-validation/alternatives-considered:
- en: c7d012d6e43f35ec
- zh: 6f3eaf1342319aeb
-/agent-note-cancel-superseded-ci-validation/consequences:
- en: c226f645a79d0060
- zh: 023071f83b9a126d
-/agent-note-cancel-superseded-ci-validation/verification:
- en: 015f312772637350
- zh: b703cdab8bd4f0ae
diff --git a/.agents/notes/implemented/process/2026-09-10-approval-review-workflow-identity.i18n.yaml b/.agents/notes/implemented/process/2026-09-10-approval-review-workflow-identity.i18n.yaml
deleted file mode 100644
index 521e943a63..0000000000
--- a/.agents/notes/implemented/process/2026-09-10-approval-review-workflow-identity.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-10-approval-review-workflow-identity.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-10-approval-review-workflow-identity.md
-/agent-note-identify-approval-review-workflows-by-file-path:
- en: 8a332b9d080f3d62
- zh: 29f1de05d7867a77
-/agent-note-identify-approval-review-workflows-by-file-path/problem:
- en: 6b927a7545ac2c48
- zh: 0902f03aa478d5ee
-/agent-note-identify-approval-review-workflows-by-file-path/decision:
- en: 82802438f1b8d16c
- zh: ffe8c1fcbcc39abe
-/agent-note-identify-approval-review-workflows-by-file-path/alternatives-considered:
- en: f8fdd869a03ac5ff
- zh: c355eb36e9cba350
-/agent-note-identify-approval-review-workflows-by-file-path/consequences:
- en: 9f31e023a04a7849
- zh: 66831c450af4c88f
diff --git a/.agents/notes/implemented/process/2026-09-11-production-blame-approval-weight.i18n.yaml b/.agents/notes/implemented/process/2026-09-11-production-blame-approval-weight.i18n.yaml
deleted file mode 100644
index 9272a63484..0000000000
--- a/.agents/notes/implemented/process/2026-09-11-production-blame-approval-weight.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-11-production-blame-approval-weight.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-11-production-blame-approval-weight.md
-/agent-note-weight-approvals-by-changed-production-line-ownership:
- en: 40516dee2915ffc3
- zh: 3d58358bc7110df2
-/agent-note-weight-approvals-by-changed-production-line-ownership/problem:
- en: 2dbd821b8d65b054
- zh: 9bef2993db51a00d
-/agent-note-weight-approvals-by-changed-production-line-ownership/decision:
- en: 7dc225f91538ace1
- zh: a22d05ffd8d32b6d
-/agent-note-weight-approvals-by-changed-production-line-ownership/alternatives-considered:
- en: 5e8af03e3ff6018a
- zh: 6b518c8eee8c5172
-/agent-note-weight-approvals-by-changed-production-line-ownership/consequences:
- en: 08495483b77771be
- zh: a798d4af0eda55fe
-/agent-note-weight-approvals-by-changed-production-line-ownership/verification:
- en: cb604625373372b9
- zh: f9056d20ab612537
diff --git a/.agents/notes/implemented/process/2026-09-12-default-product-experimental-isolation.i18n.yaml b/.agents/notes/implemented/process/2026-09-12-default-product-experimental-isolation.i18n.yaml
index cf4ae928c6..e3a2921567 100644
--- a/.agents/notes/implemented/process/2026-09-12-default-product-experimental-isolation.i18n.yaml
+++ b/.agents/notes/implemented/process/2026-09-12-default-product-experimental-isolation.i18n.yaml
@@ -9,8 +9,8 @@
en: 6938ed9a5ca419bb
zh: 6d2cd6bb912b9118
/agent-note-keep-experimental-packages-outside-the-default-product/decision:
- en: d471671fd6c06d03
- zh: 205586983a29eba4
+ en: b5e4681e86cf54c1
+ zh: d04dfcda4d402754
/agent-note-keep-experimental-packages-outside-the-default-product/alternatives-considered:
en: b8615d8d31f313d7
zh: 556e3b96a90f6897
diff --git a/.agents/notes/implemented/process/2026-09-12-default-product-experimental-isolation.md b/.agents/notes/implemented/process/2026-09-12-default-product-experimental-isolation.md
index 5c2485e4f7..2266f39a44 100644
--- a/.agents/notes/implemented/process/2026-09-12-default-product-experimental-isolation.md
+++ b/.agents/notes/implemented/process/2026-09-12-default-product-experimental-isolation.md
@@ -22,7 +22,7 @@ Build-time input checks cover both browser bundling stages. The [client preset](
[`verify-packed-install`](../../../../scripts/release/verify-packed-install.ts) follows the installed dependency graph from `@deepseek-ai/dsh`, using resolved manifest names to detect aliases and external transitive dependencies. Development dependencies and unrelated tarballs installed beside the product are excluded. Missing required dependencies fail; omitted optional dependencies remain allowed unless they name an experimental package.
-This check enforces the existing [experimental dependency isolation rules](../architecture/2026-08-18-experimental-agent-teams-packages.md). The [publication policy](2026-09-12-experimental-publication-denylist.md) independently determines which experimental packages explicit consumers may install.
+This check enforces the existing [experimental dependency isolation rules](../../../../packages/experimental/AGENTS.md). The [publication policy](../../../../packages/experimental/README.md) independently determines which experimental packages explicit consumers may install.
## Alternatives considered
diff --git a/.agents/notes/implemented/process/2026-09-12-default-product-experimental-isolation.zh.md b/.agents/notes/implemented/process/2026-09-12-default-product-experimental-isolation.zh.md
index 3a412a491a..60922b9c39 100644
--- a/.agents/notes/implemented/process/2026-09-12-default-product-experimental-isolation.zh.md
+++ b/.agents/notes/implemented/process/2026-09-12-default-product-experimental-isolation.zh.md
@@ -22,7 +22,7 @@ Status: implemented
[`verify-packed-install`](../../../../scripts/release/verify-packed-install.ts) 从 `@deepseek-ai/dsh` 遍历已安装依赖图，通过解析后的 manifest 名称识别别名和外部传递依赖。开发依赖以及安装在产品旁边的不相关 tarball 不参与遍历。缺失必需依赖会失败；允许省略可选依赖，但其名称不得指向实验包。
-此检查执行现有的[实验包依赖隔离规则](../architecture/2026-08-18-experimental-agent-teams-packages.zh.md)。[发布策略](2026-09-12-experimental-publication-denylist.zh.md) 独立决定显式消费者可以安装哪些实验包。
+此检查执行现有的[实验包依赖隔离规则](../../../../packages/experimental/AGENTS.md)。[发布策略](../../../../packages/experimental/README.zh.md) 独立决定显式消费者可以安装哪些实验包。
## Alternatives considered
diff --git a/.agents/notes/implemented/process/2026-09-12-experimental-publication-denylist.i18n.yaml b/.agents/notes/implemented/process/2026-09-12-experimental-publication-denylist.i18n.yaml
deleted file mode 100644
index 0d6fed02a4..0000000000
--- a/.agents/notes/implemented/process/2026-09-12-experimental-publication-denylist.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-12-experimental-publication-denylist.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-12-experimental-publication-denylist.md
-/agent-note-publish-experimental-packages-with-explicit-private-exceptions:
- en: 20aed7271477745f
- zh: 81b50a3ba89b7935
-/agent-note-publish-experimental-packages-with-explicit-private-exceptions/problem:
- en: c267b50c3004619f
- zh: 91830d04d2972d46
-/agent-note-publish-experimental-packages-with-explicit-private-exceptions/decision:
- en: 3cf968834876a655
- zh: 7f7bad8b931a5ed2
-/agent-note-publish-experimental-packages-with-explicit-private-exceptions/alternatives-considered:
- en: 61369830fb32e695
- zh: 445eb44e1ae3457a
-/agent-note-publish-experimental-packages-with-explicit-private-exceptions/consequences:
- en: 23f4d725196f1c2d
- zh: ebd9455778d8a89f
diff --git a/.agents/notes/implemented/process/2026-09-12-maintained-repository-references.i18n.yaml b/.agents/notes/implemented/process/2026-09-12-maintained-repository-references.i18n.yaml
deleted file mode 100644
index 34379e6e6c..0000000000
--- a/.agents/notes/implemented/process/2026-09-12-maintained-repository-references.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-12-maintained-repository-references.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-12-maintained-repository-references.md
-/agent-note-maintained-repository-references:
- en: 10750a69061b5dd0
- zh: ab4be61612ead1da
-/agent-note-maintained-repository-references/problem:
- en: 36ca11f2ef3d8b4e
- zh: 6e6ca6ae00fab2f7
-/agent-note-maintained-repository-references/decision:
- en: ec87568d74d5dc5f
- zh: bc34159aeafa9fcd
-/agent-note-maintained-repository-references/alternatives-considered:
- en: de1c15bc0d404c41
- zh: a32a80be126d3d71
-/agent-note-maintained-repository-references/consequences:
- en: 17e87405d1ab8efa
- zh: d4dbc337733d9a2d
diff --git a/.agents/notes/implemented/process/2026-09-12-publish-all-experimental-packages.i18n.yaml b/.agents/notes/implemented/process/2026-09-12-publish-all-experimental-packages.i18n.yaml
deleted file mode 100644
index 3568158aca..0000000000
--- a/.agents/notes/implemented/process/2026-09-12-publish-all-experimental-packages.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-12-publish-all-experimental-packages.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-12-publish-all-experimental-packages.md
-/agent-note-publish-every-current-experimental-package:
- en: e08e7bc92478407d
- zh: 45501f51a5f619ec
-/agent-note-publish-every-current-experimental-package/problem:
- en: 7db3c27e4b5c2d09
- zh: 0a770941ec41a50a
-/agent-note-publish-every-current-experimental-package/decision:
- en: cc702e2596b0bd73
- zh: 3815da9b56ae653b
-/agent-note-publish-every-current-experimental-package/alternatives-considered:
- en: e59c9f8484629e20
- zh: d6f64683af3d0460
-/agent-note-publish-every-current-experimental-package/consequences:
- en: 2721ffbcf5341d3b
- zh: be0b430b9d91d7c2
diff --git a/.agents/notes/implemented/process/2026-09-14-generated-cli-help-reference.i18n.yaml b/.agents/notes/implemented/process/2026-09-14-generated-cli-help-reference.i18n.yaml
new file mode 100644
index 0000000000..b0b5d6295a
--- /dev/null
+++ b/.agents/notes/implemented/process/2026-09-14-generated-cli-help-reference.i18n.yaml
@@ -0,0 +1,19 @@
+# Bilingual-pair consistency record for 2026-09-14-generated-cli-help-reference.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-14-generated-cli-help-reference.md
+/agent-note-generate-the-cli-reference-from-command-help:
+ en: 618bafe3fd2afdb9
+ zh: 433df2a8d0530c41
+/agent-note-generate-the-cli-reference-from-command-help/problem:
+ en: 2ad571458d5d8191
+ zh: 4db6bddbad65bf5c
+/agent-note-generate-the-cli-reference-from-command-help/decision:
+ en: d99a93133c460385
+ zh: 0f710ecf6e7137f2
+/agent-note-generate-the-cli-reference-from-command-help/alternatives-considered:
+ en: df2f7f07b3e84418
+ zh: 2dd87333d9d460c3
+/agent-note-generate-the-cli-reference-from-command-help/consequences:
+ en: aada6686406c892e
+ zh: 9a30b6b1c5ab6d55
diff --git a/.agents/notes/implemented/process/2026-09-14-generated-cli-help-reference.md b/.agents/notes/implemented/process/2026-09-14-generated-cli-help-reference.md
new file mode 100644
index 0000000000..2a33722fe0
--- /dev/null
+++ b/.agents/notes/implemented/process/2026-09-14-generated-cli-help-reference.md
@@ -0,0 +1,25 @@
+# Agent Note: Generate the CLI reference from command help
+
+Status: implemented
+
+English | [中文](2026-09-14-generated-cli-help-reference.zh.md)
+
+## Problem
+
+Launcher flags, profile options, and nested commands have separate owners. A manually maintained command reference can omit subcommands or retain obsolete defaults.
+
+## Decision
+
+The CLI reference captures the supported `dsh` launcher's help, the plugin forwarder's help, and each shipped profile's help, then recursively discovers the subcommands listed in each page's `Commands:` section. Shipped profile names come from `PROFILE_TEMPLATES`. Every page retains its complete help text; identical alias help appears once with all invocation forms.
+
+Generation uses temporary Harness and Agents homes. Help exits before application work starts and requires no server or model. The plugin forwarder exposes its own help before pnpm arguments; flags after the pnpm command remain pnpm input.
+
+The generated bilingual pages retain CLI output in its original language. `verify-cli-help` compares the complete pages and pairing record and runs with the documentation checks.
+
+## Alternatives considered
+
+A second command inventory or help-specific runtime API would duplicate the parser's definitions. Reading actual help keeps the reference tied to the same descriptions, options, defaults, and examples users receive.
+
+## Consequences
+
+Command changes update the reference through the same generator. Reviewers can compare complete help without assembling separate command invocations.
diff --git a/.agents/notes/implemented/process/2026-09-14-generated-cli-help-reference.zh.md b/.agents/notes/implemented/process/2026-09-14-generated-cli-help-reference.zh.md
new file mode 100644
index 0000000000..beba0b1ce2
--- /dev/null
+++ b/.agents/notes/implemented/process/2026-09-14-generated-cli-help-reference.zh.md
@@ -0,0 +1,25 @@
+# Agent Note: 从命令帮助生成 CLI 参考
+
+Status: implemented
+
+[English](2026-09-14-generated-cli-help-reference.md) | 中文
+
+## Problem
+
+启动器选项、profile 选项和嵌套命令由不同部分负责。手工维护的命令参考可能遗漏子命令或保留过时的默认值。
+
+## Decision
+
+CLI 参考采集受支持的 `dsh` 启动器帮助、插件转发器帮助和各随附 profile 的帮助，并递归发现每页 `Commands:` 段落列出的子命令。随附 profile 的名称来自 `PROFILE_TEMPLATES`。每页都保留完整的帮助文本；相同的别名帮助只展示一次，并列出所有调用形式。
+
+生成过程使用临时 Harness home 和 Agents home。帮助在应用开始工作前退出，不需要服务器或模型。插件转发器在 pnpm 参数之前提供自己的帮助；pnpm 命令之后的选项仍作为 pnpm 输入。
+
+生成的双语页面保留 CLI 输出的原始语言。`verify-cli-help` 比较完整页面和配对记录，并随文档检查一起运行。
+
+## Alternatives considered
+
+另一份命令清单或专供帮助使用的运行时 API 会重复解析器的定义。读取实际帮助，可以让参考文档始终对应用户收到的说明、选项、默认值和示例。
+
+## Consequences
+
+命令变化通过同一个生成器更新参考文档。审阅者可以直接比较完整帮助，无需自行拼接各个命令的调用结果。
diff --git a/.agents/notes/implemented/process/2026-09-15-pr-approval-delegation.i18n.yaml b/.agents/notes/implemented/process/2026-09-15-pr-approval-delegation.i18n.yaml
deleted file mode 100644
index 14bf4d7016..0000000000
--- a/.agents/notes/implemented/process/2026-09-15-pr-approval-delegation.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-15-pr-approval-delegation.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-15-pr-approval-delegation.md
-/agent-note-pr-scoped-approval-delegation:
- en: 3fa5881b5ca14a79
- zh: 99dbde5fae7cdd6a
-/agent-note-pr-scoped-approval-delegation/problem:
- en: 5fe2f3b3cb7ce046
- zh: ed27d4efc995b8b5
-/agent-note-pr-scoped-approval-delegation/decision:
- en: 41c5c90b82d323c6
- zh: 55d5ed09d88bb821
-/agent-note-pr-scoped-approval-delegation/alternatives-considered:
- en: a6006217cb29613a
- zh: 83968328096f1d91
-/agent-note-pr-scoped-approval-delegation/consequences:
- en: e761c382b4431212
- zh: 43bb475b646c85eb
diff --git a/.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.i18n.yaml b/.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.i18n.yaml
index f5e57341df..e3ffc60e70 100644
--- a/.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.i18n.yaml
+++ b/.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.i18n.yaml
@@ -9,11 +9,11 @@
en: dc43ba84345e1405
zh: dbc03572ab7710d2
/agent-note-ship-optional-bundles-with-the-installation/decision:
- en: d64020c4ca4957e1
- zh: 241b3b851234b6f0
+ en: 5210b3b746cfee78
+ zh: f1907f4807ae0098
/agent-note-ship-optional-bundles-with-the-installation/alternatives-considered:
- en: 05c19f616009bee8
- zh: af318640481351f0
+ en: 95b48b61757f1f13
+ zh: e9fb2d6ea492a4bc
/agent-note-ship-optional-bundles-with-the-installation/consequences:
en: 4a9d3a049a605150
zh: 67b50bbc9f7f4bb0
diff --git a/.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.md b/.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.md
index 059fe5bcce..151cc8ccad 100644
--- a/.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.md
+++ b/.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.md
@@ -10,15 +10,15 @@ The Web plugin page manages only the bundles a person installed into the profile
## Decision
-The launcher names in `OPTIONAL_BUNDLES` (`packages/boot/app-boot/src/profile.ts`, beside the profile templates) the bundles the installation ships for a person to switch on. Each must be a runtime dependency of `apps/cli` that declares `dsh.bundle.patch`, and no shipped profile template selects it. The plugin manager's `listBundles` reports such a bundle as `optional`: switched off until selected, never removable, resolved from the installation like any installation-supplied bundle. The Web plugin page opens its Official group with the optional bundles, tagged beta where the feature is one, ahead of the profile's own installed bundles.
+The launcher names in `OPTIONAL_BUNDLES` (`packages/boot/app-boot/src/profile.ts`, beside the profile templates) the bundles the installation ships for a person to switch on. Each must be a runtime dependency of `apps/cli` that declares `dsh.bundle.patch`, and no shipped profile template selects it. The plugin manager's `listBundles` reports such a bundle as `optional`: switched off until selected, never removable, resolved from the installation like any installation-supplied bundle. The Web plugin page opens its Official group with the optional bundles, tagged experimental when the package is experimental, ahead of the profile's own installed bundles.
Default-product isolation keeps its rules with one declared exception: an optional bundle's dependency graph is outside the default product. The static gate skips the `dependencies` edge from `@deepseek-ai/dsh` to a listed bundle and still rejects a runtime import, a shipped composition, a preset, or a default template that names it, an experimental dependency the list does not name, and a listed name that is not a runtime dependency or not a bundle. The workspace-constraints check accepts the same `dependencies` edges and no other runtime section, and the packed-install release check skips them from the installed entry package while requiring each listed bundle to be installed.
-The [single-bundle decision](../architecture/2026-09-18-agent-teams-single-bundle.md) supersedes the two Agent Teams selections with one `@deepseek-ai/dsh-experimental-agent-team-profile` selection. This note retains the installation-owned optional-bundle policy; the [optional-bundle decision for experimental capabilities](../architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md) names the current list and the display metadata each entry carries.
+The [single-bundle reference](../../../../packages/experimental/agent-team-profile/README.md) supersedes the two Agent Teams selections with one `@deepseek-ai/dsh-experimental-agent-team-profile` selection. This note retains the installation-owned optional-bundle policy; the [optional-bundle decision for experimental capabilities](../architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md) owns composition and display metadata; `OPTIONAL_BUNDLES` owns the current shipped list.
## Alternatives considered
-**A catalog of installable official bundles.** The page would offer names to install from the registry on demand. That keeps the installation unchanged but needs network access at the moment of switching on and a version pin per release.
+**A catalog of installable official bundles.** The page would offer names to install from the registry on demand. That keeps the installation unchanged but needs network access at the moment of switching on and a version pin per release. Lightweight bundles retain the shipped policy; the [on-demand native-bundle decision](../architecture/2026-10-05-official-on-demand-bundles.md) owns the exception for costly native runtimes.
**A flag on the bundle package.** A `dsh.bundle.optional` declaration would let any published bundle claim a place in the installation; the launcher's own list keeps the choice with the product.
diff --git a/.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.zh.md b/.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.zh.md
index 9847095601..9ddd54da88 100644
--- a/.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.zh.md
+++ b/.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.zh.md
@@ -10,15 +10,15 @@ Web 插件页只管理用户装进 profile 的组合包。像 Agent Teams 这样
## 决策
-启动器在 `OPTIONAL_BUNDLES`（`packages/boot/app-boot/src/profile.ts`，与 profile 模板并列）里点名安装随附、供用户开启的组合包。每一个都必须是 `apps/cli` 声明了 `dsh.bundle.patch` 的运行时依赖，且不被任何随附 profile 模板选中。插件管理器的 `listBundles` 把这类组合包报告为 `optional`：选中前保持关闭、永不可卸载、像其他安装提供的组合包一样从安装目录解析。Web 插件页以可选组合包开启「官方」分组，属于 beta 功能的带 beta 标签，排在 profile 自己已安装的组合包之前。
+启动器在 `OPTIONAL_BUNDLES`（`packages/boot/app-boot/src/profile.ts`，与 profile 模板并列）里点名安装随附、供用户开启的组合包。每一个都必须是 `apps/cli` 声明了 `dsh.bundle.patch` 的运行时依赖，且不被任何随附 profile 模板选中。插件管理器的 `listBundles` 把这类组合包报告为 `optional`：选中前保持关闭、永不可卸载、像其他安装提供的组合包一样从安装目录解析。Web 插件页以可选组合包开启「官方」分组，属于实验包的带实验性标签，排在 profile 自己已安装的组合包之前。
默认产品隔离的规则保持不变，只声明一个例外：可选组合包的依赖图在默认产品之外。静态门禁跳过从 `@deepseek-ai/dsh` 到列表中组合包的 `dependencies` 边，仍然拒绝运行时 import、随附组合、preset 或默认模板对它的引用，拒绝列表没有点名的实验依赖，也拒绝不是运行时依赖或不是组合包的列表项。workspace 约束检查接受同样的 `dependencies` 边而不接受其他运行时依赖段；发布时的 packed-install 检查对已安装入口包跳过这些边，并要求列表中的每个组合包都已安装。
-[单组合包决策](../architecture/2026-09-18-agent-teams-single-bundle.zh.md)将两个 Agent Teams 选项替换为一个 `@deepseek-ai/dsh-experimental-agent-team-profile` 选项。本记录保留由安装方决定可选组合包的策略；[实验能力的可选 bundle 决策](../architecture/2026-09-21-experimental-capabilities-as-optional-bundles.zh.md)列出当前名单以及每一项携带的显示元数据。
+[单组合包参考](../../../../packages/experimental/agent-team-profile/README.zh.md)将两个 Agent Teams 选项替换为一个 `@deepseek-ai/dsh-experimental-agent-team-profile` 选项。本记录保留由安装方决定可选组合包的策略；[实验能力的可选 bundle 决策](../architecture/2026-09-21-experimental-capabilities-as-optional-bundles.zh.md)定义组合与显示元数据；当前随附名单由 `OPTIONAL_BUNDLES` 管理。
## 考虑过的替代方案
-**可安装官方组合包目录。** 页面按需提供从注册表安装的包名。安装本身不变，但开启那一刻需要网络，并且每次发布都要钉一个版本。
+**可安装官方组合包目录。** 页面按需提供从注册表安装的包名。安装本身不变，但开启那一刻需要网络，并且每次发布都要钉一个版本。轻量 bundle 仍采用随附策略；[按需原生 bundle 决策](../architecture/2026-10-05-official-on-demand-bundles.zh.md)管理原生运行时成本较高的例外。
**组合包自身的标记。** `dsh.bundle.optional` 声明会让任何已发布的组合包都能自称随安装提供；由启动器自己的列表来决定，选择权留在产品手里。
diff --git a/.agents/notes/implemented/process/2026-09-16-author-approval-credit.i18n.yaml b/.agents/notes/implemented/process/2026-09-16-author-approval-credit.i18n.yaml
deleted file mode 100644
index cfc6317172..0000000000
--- a/.agents/notes/implemented/process/2026-09-16-author-approval-credit.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-16-author-approval-credit.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-16-author-approval-credit.md
-/agent-note-author-approval-credit:
- en: 58068bcf9dbf6d30
- zh: ad51b869c8f3e791
-/agent-note-author-approval-credit/problem:
- en: 13def594e495779d
- zh: d5ceaa0d156ba043
-/agent-note-author-approval-credit/decision:
- en: 5670829131121899
- zh: 7df21c9b22c4978d
-/agent-note-author-approval-credit/alternatives-considered:
- en: 8ab9e11e49044029
- zh: c7930455d747ceb5
-/agent-note-author-approval-credit/consequences:
- en: 70ad19025f7fe6d4
- zh: c73aa8be25724790
-/agent-note-author-approval-credit/verification:
- en: 0617e23e217b0a67
- zh: 82576f05a59d8db7
diff --git a/.agents/notes/implemented/process/2026-09-16-desktop-release-version-derivation.i18n.yaml b/.agents/notes/implemented/process/2026-09-16-desktop-release-version-derivation.i18n.yaml
deleted file mode 100644
index f25c473733..0000000000
--- a/.agents/notes/implemented/process/2026-09-16-desktop-release-version-derivation.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-16-desktop-release-version-derivation.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-16-desktop-release-version-derivation.md
-/agent-note-derive-desktop-test-versions-from-the-complete-dsh-version:
- en: b4afaf99cba87722
- zh: bd6c3b76efebf932
-/agent-note-derive-desktop-test-versions-from-the-complete-dsh-version/problem:
- en: 307dae6b4bdf80de
- zh: 72c9045a2e42036f
-/agent-note-derive-desktop-test-versions-from-the-complete-dsh-version/decision:
- en: 1a3ef4e14511dc1f
- zh: 1db763a1323d9c87
-/agent-note-derive-desktop-test-versions-from-the-complete-dsh-version/alternatives-considered:
- en: cf86267e11a4e534
- zh: daa4fb017b2725a5
-/agent-note-derive-desktop-test-versions-from-the-complete-dsh-version/consequences:
- en: ce62d7f641c0cd45
- zh: 08b05c154f38d816
diff --git a/.agents/notes/implemented/process/2026-09-19-evidence-led-simplification-surveys.i18n.yaml b/.agents/notes/implemented/process/2026-09-19-evidence-led-simplification-surveys.i18n.yaml
deleted file mode 100644
index e36a2aa1c1..0000000000
--- a/.agents/notes/implemented/process/2026-09-19-evidence-led-simplification-surveys.i18n.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-19-evidence-led-simplification-surveys.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-19-evidence-led-simplification-surveys.md
-/agent-note-evidence-led-simplification-surveys:
- en: f0941223baf75c96
- zh: b3cc733f7f90509a
-/agent-note-evidence-led-simplification-surveys/problem:
- en: 528a0c462d456493
- zh: a2af4901a8f498a7
-/agent-note-evidence-led-simplification-surveys/decision:
- en: 865cfb210f13b188
- zh: 777d8155216d98c6
-/agent-note-evidence-led-simplification-surveys/historical-evidence:
- en: 53eea2f1d7560461
- zh: 3c55432d9cd3ebe3
-/agent-note-evidence-led-simplification-surveys/bounded-survey-evidence:
- en: 3637438d2ed7f606
- zh: d78b39ae6b67a442
-/agent-note-evidence-led-simplification-surveys/alternatives-considered:
- en: 9e0039e0ff82ba1b
- zh: fa4b0a52bf3dcbdd
-/agent-note-evidence-led-simplification-surveys/consequences:
- en: 395acde9597898c5
- zh: 45ee94d13427862a
diff --git a/.agents/notes/implemented/process/2026-09-21-desktop-build-version-as-input.i18n.yaml b/.agents/notes/implemented/process/2026-09-21-desktop-build-version-as-input.i18n.yaml
deleted file mode 100644
index 32be76bd93..0000000000
--- a/.agents/notes/implemented/process/2026-09-21-desktop-build-version-as-input.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-21-desktop-build-version-as-input.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-21-desktop-build-version-as-input.md
-/agent-note-pass-the-desktop-build-version-as-an-argument-instead-of-rewriting-manifests:
- en: 300e3ca5e8255a56
- zh: 59f948ca2440d33b
-/agent-note-pass-the-desktop-build-version-as-an-argument-instead-of-rewriting-manifests/problem:
- en: 9f373ce939732eb2
- zh: a021c3f432d10fbe
-/agent-note-pass-the-desktop-build-version-as-an-argument-instead-of-rewriting-manifests/decision:
- en: be9fa7f7e85134f1
- zh: 51796ebbdfffc063
-/agent-note-pass-the-desktop-build-version-as-an-argument-instead-of-rewriting-manifests/alternatives-considered:
- en: b5025ea37e2908bc
- zh: 6f2ebcaa138f1c62
-/agent-note-pass-the-desktop-build-version-as-an-argument-instead-of-rewriting-manifests/consequences:
- en: 686a5979332c0964
- zh: 89cff9e1e04e0325
diff --git a/.agents/notes/implemented/process/2026-09-22-desktop-main-bundle-after-workspace-tsdown.i18n.yaml b/.agents/notes/implemented/process/2026-09-22-desktop-main-bundle-after-workspace-tsdown.i18n.yaml
deleted file mode 100644
index 0cd788f54a..0000000000
--- a/.agents/notes/implemented/process/2026-09-22-desktop-main-bundle-after-workspace-tsdown.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-22-desktop-main-bundle-after-workspace-tsdown.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-22-desktop-main-bundle-after-workspace-tsdown.md
-/agent-note-bundle-the-desktop-main-process-after-the-workspace-tsdown-pass:
- en: 47f6a531ef05a7be
- zh: 18dc33bcd916e2b5
-/agent-note-bundle-the-desktop-main-process-after-the-workspace-tsdown-pass/problem:
- en: dc5156548e545037
- zh: 72010884a2a27877
-/agent-note-bundle-the-desktop-main-process-after-the-workspace-tsdown-pass/decision:
- en: 9b3c9c696207b13e
- zh: 4996ad87dd07d839
-/agent-note-bundle-the-desktop-main-process-after-the-workspace-tsdown-pass/alternatives-considered:
- en: a15cfe689823ae57
- zh: 1d691cd335bdcb87
-/agent-note-bundle-the-desktop-main-process-after-the-workspace-tsdown-pass/consequences:
- en: e46c28e2ba972cfb
- zh: 70d4076a89e0b2ec
diff --git a/.agents/notes/implemented/process/2026-09-22-workspace-release-ranges.i18n.yaml b/.agents/notes/implemented/process/2026-09-22-workspace-release-ranges.i18n.yaml
deleted file mode 100644
index 05753024a2..0000000000
--- a/.agents/notes/implemented/process/2026-09-22-workspace-release-ranges.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-22-workspace-release-ranges.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-22-workspace-release-ranges.md
-/agent-note-workspace-dependency-release-ranges:
- en: 8b7bf2179034aa08
- zh: a7a8b5dc60849d88
-/agent-note-workspace-dependency-release-ranges/problem:
- en: ea71dd3eea6e1c60
- zh: 2a8ea98e8f6a3fbf
-/agent-note-workspace-dependency-release-ranges/decision:
- en: c7e9c7eb5b3e2ebf
- zh: b74ef023fc894e36
-/agent-note-workspace-dependency-release-ranges/alternatives-considered:
- en: b6aa87296ee61fcf
- zh: f516320e589ce7a3
-/agent-note-workspace-dependency-release-ranges/consequences:
- en: 49eac7a43407bbd9
- zh: 8a39766e8df596b8
diff --git a/.agents/notes/implemented/process/2026-09-23-section-keyed-translation-pairing-records.i18n.yaml b/.agents/notes/implemented/process/2026-09-23-section-keyed-translation-pairing-records.i18n.yaml
deleted file mode 100644
index f05c998dde..0000000000
--- a/.agents/notes/implemented/process/2026-09-23-section-keyed-translation-pairing-records.i18n.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-23-section-keyed-translation-pairing-records.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-23-section-keyed-translation-pairing-records.md
-/agent-note-section-keyed-translation-pairing-records:
- en: fe3ee02933f0e25b
- zh: 3518b378aebef215
-/agent-note-section-keyed-translation-pairing-records/problem:
- en: 1662619f5cc6743f
- zh: e98e9b39e82a2294
-/agent-note-section-keyed-translation-pairing-records/decision:
- en: 333d08badeeef8a6
- zh: 2ccb1fe95b3457ff
-/agent-note-section-keyed-translation-pairing-records/alternatives-considered:
- en: 3e17a6963d74e3de
- zh: cc086da130648d3c
-/agent-note-section-keyed-translation-pairing-records/consequences:
- en: 7a1f77c69ef79755
- zh: 7f12bd25f556ba9c
-/agent-note-section-keyed-translation-pairing-records/measured-effect:
- en: 97af2f09c25338f1
- zh: 2ec62a414fa61254
-/agent-note-section-keyed-translation-pairing-records/related:
- en: 8f208df4c003e06e
- zh: c1660f5b55dea743
diff --git a/.agents/notes/implemented/process/2026-10-05-pr-artifact-typechecks.i18n.yaml b/.agents/notes/implemented/process/2026-10-05-pr-artifact-typechecks.i18n.yaml
new file mode 100644
index 0000000000..79f3339e71
--- /dev/null
+++ b/.agents/notes/implemented/process/2026-10-05-pr-artifact-typechecks.i18n.yaml
@@ -0,0 +1,19 @@
+# Bilingual-pair consistency record for 2026-10-05-pr-artifact-typechecks.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-10-05-pr-artifact-typechecks.md
+/agent-note-pr-artifact-builds-and-aggregate-typescript-checks:
+ en: a25e7cdcad03934f
+ zh: 48e31429730e0885
+/agent-note-pr-artifact-builds-and-aggregate-typescript-checks/problem:
+ en: e5c984fa32cc5e69
+ zh: 25d5742b2106d830
+/agent-note-pr-artifact-builds-and-aggregate-typescript-checks/decision:
+ en: 6e84bceaba4573ca
+ zh: 25a37c147a675643
+/agent-note-pr-artifact-builds-and-aggregate-typescript-checks/alternatives-considered:
+ en: f61da066f9ddcd62
+ zh: 816fd6e0063017cd
+/agent-note-pr-artifact-builds-and-aggregate-typescript-checks/consequences:
+ en: 46c247ab91126d52
+ zh: f1be7561ff402bcc
diff --git a/.agents/notes/implemented/process/2026-10-05-pr-artifact-typechecks.md b/.agents/notes/implemented/process/2026-10-05-pr-artifact-typechecks.md
new file mode 100644
index 0000000000..7577a7c06e
--- /dev/null
+++ b/.agents/notes/implemented/process/2026-10-05-pr-artifact-typechecks.md
@@ -0,0 +1,45 @@
+# Agent Note: PR artifact builds and aggregate TypeScript checks
+
+Status: implemented
+
+English | [中文](2026-10-05-pr-artifact-typechecks.zh.md)
+
+## Problem
+
+PR jobs need the same compiled packages for benchmarks, compatibility, packaging, and runtime checks. Building the repository-wide test and script programs in every artifact job repeats expensive diagnostics. In the allowed #3661 baseline, benchmark build preparation takes about 304 seconds before 432 seconds of serial measurements. A cold macOS arm64 Host compiler profile on Node 24.19.0 takes 84.01 seconds, including 55.92 seconds in the aggregate program; its 282 emitted projects take 24.33 seconds combined. Increasing concurrency consumes more shared-runner resources.
+
+## Decision
+
+Required Linux consumer and native Windows build jobs retain normal builds, including both complete aggregate programs. Public `build` and `typecheck` keep the same checks. [Node version ownership](2026-07-06-node-engine-floor.md) and [native Windows ownership](2026-08-08-native-windows-pull-request-ci.md) remain in force.
+
+Checked PR artifact builds compile every existing project reference from each compiler face with one serial `tsc -b` process, then run the ordinary Typert, bundling, Desktop, and Web stages. The helper reads the existing Host and Client aggregates rather than maintaining another package list. It omits only each root's additional test and script program; package diagnostics, emitted outputs, and Host-before-Client ordering remain required. Non-PR release and real-API workflow builds retain their normal checks.
+
+Only the CI benchmark helper selects `tsc -b --noCheck` for package emission. Benchmarks consume JavaScript and Typert runtime metadata; their declaration and build-information files are disposable and never published. Typert analyzes source types independently, while required complete builds own semantic diagnostics. Syntax and configuration failures still reject benchmark preparation. TypeScript records pending checks so a later ordinary incremental build diagnoses the same source without deleting caches or forcing a rebuild. Public benchmark scripts and every release, Python, preview, compatibility, and normal artifact builder keep their checked defaults.
+
+The Python executable builder selects artifact compilation with `--artifacts-only` after verifying its runtime closure. Invalid closure inputs fail before compilation, deployment, or packing; the default complete build and prebuilt `--skip-build` mode keep their existing stages.
+
+CI invokes the internal build helpers directly and keeps the root package manifest unchanged. Root manifest edits activate the separate native-addon platform matrix even when only build aliases change; avoiding that trigger preserves the existing workflow set and concurrent-job ceiling without weakening native validation.
+
+Job inventory, runner selectors, and benchmark sample counts stay fixed; gate and worker ceilings do not increase. The three compatibility cases run one job at a time; the two-target Python runtime matrix starts after the keyless Python SDK job succeeds. Four Linux lanes, the Python SDK, three Windows lanes, and one compatibility job permit at most nine worker jobs initially. Once the SDK job finishes, the remaining seven independent lanes, one compatibility job, and two runtime targets permit at most ten. The runtime plan and wheel stages precede those targets and each use one job. This permits runtime validation to overlap the Node 22 build within the original ten-job ceiling. Coverage partitions reuse compact file-cost metadata within their platform and runner pool. Parallel release packing uses pnpm's existing bounded scheduler; serial publication keeps family order.
+
+Each Node version runs the same seven source compatibility specs in one serial Vitest invocation. Both file parallelism and the CLI worker limit are fixed to one, and the gate sets `VITEST_MAX_WORKERS=1` because that environment variable overrides Vitest's CLI limit. Files retain fork isolation; the build-backed Node 22 lazy-search smoke keeps its separate build dependency. Three paired local samples preserve all 253 assertion outcomes and reduce startup-only median time from 11.52 to 8.69 seconds, without increasing owned descendant-process peak.
+
+## Alternatives considered
+
+**Raise job or worker concurrency.** Rejected because the shared runner must keep its current resource ceiling.
+
+**Remove aggregate checks from every build.** Rejected because package projects do not typecheck all repository tests and scripts; required Linux and Windows jobs must retain those diagnostics.
+
+**Cache compiled outputs across revisions.** Deferred because cache correctness and invalidation add obligations that removing duplicate aggregate work does not need.
+
+## Consequences
+
+The cold Host reference build takes 23.49 seconds with 1.91 GiB peak RSS, compared with 84.01 seconds and 3.87 GiB for the complete compiler pass. All 5,932 emitted files match by path and SHA-256. These are single local compiler samples, excluding bundling and tests; current-head CI owns the PR latency result. The benchmark scenarios and their budgets remain unchanged.
+
+Three alternating cold preparation pairs on Apple M4 Pro / Node 24.19.0 compare checked reference compilation with benchmark-only emission: 61.16, 82.53, and 57.80 seconds versus 55.53, 50.82, and 50.75 seconds. Median preparation falls from 61.16 to 50.82 seconds (16.9%); this includes native support, libraries, benchmark workers, and Web assets, excluding dependency installation and measurements. Every pair has the same 11,894 output paths, including 3,181 byte-identical JavaScript files and unchanged source maps. The 356 build-information files differ, and nine declarations only reorder union members; those files are not published from the benchmark lane. Library-build median user CPU falls from 76.45 to 64.23 seconds, while median maximum RSS stays near 2.75 GiB. Required CI determines the complete PR timing.
+
+Parallel packing relies on the pinned pnpm CLI to honor exact recursive filters, the pack destination, the workspace concurrency limit, and each package's lifecycle hooks. A pnpm upgrade must pass the real-CLI checks in `scripts/release/pack.spec.ts` before release packing adopts it.
+
+Coverage weights sum Vitest's distinct environment, preparation, setup, collection, and execution costs. CI's platform/environment/pool cache prefixes exclude the previous `coverage-times-` archives. Persistent local checkouts can retain wall-clock weights for files not measured during rollout; removing `.coverage-times.json` resets that history. These advisory weights affect partition assignment, while the complete inventory and merged coverage thresholds remain required.
+
+Checked artifact builds deliberately do not diagnose aggregate-only test or script errors. Required normal builds reject those errors; fixture checks also reject package errors on both paths and compare emitted JavaScript, declarations, maps, and build information. Removing or changing a required full build requires transferring both aggregate checks to another blocking owner first. Master serial references remain complete under their [existing policy](2026-07-21-serial-cross-platform-ci-reference.md).
diff --git a/.agents/notes/implemented/process/2026-10-05-pr-artifact-typechecks.zh.md b/.agents/notes/implemented/process/2026-10-05-pr-artifact-typechecks.zh.md
new file mode 100644
index 0000000000..c0b3c1bcf4
--- /dev/null
+++ b/.agents/notes/implemented/process/2026-10-05-pr-artifact-typechecks.zh.md
@@ -0,0 +1,45 @@
+# Agent Note: PR 产物构建与 aggregate TypeScript 检查
+
+Status: implemented
+
+[English](2026-10-05-pr-artifact-typechecks.md) | 中文
+
+## Problem
+
+PR job 需要相同的编译包来运行 benchmark、兼容性、打包和运行时检查。每个产物 job 都构建仓库级测试和脚本 program，会重复执行昂贵的诊断。在允许使用的 #3661 baseline 中，benchmark 在 432 秒的串行测量前花费约 304 秒准备构建。在 macOS arm64、Node 24.19.0 上，一次冷启动 Host 编译器 profile 耗时 84.01 秒，其中 aggregate program 占 55.92 秒；282 个有 emit 的 project 合计耗时 24.33 秒。提高并发会消耗更多共享运行器资源。
+
+## Decision
+
+必需的 Linux consumer 与原生 Windows build job 保留普通构建，包括两个完整 aggregate program。公开的 `build` 和 `typecheck` 保留相同检查。[Node 版本职责](2026-07-06-node-engine-floor.zh.md)与[原生 Windows 职责](2026-08-08-native-windows-pull-request-ci.zh.md)仍然有效。
+
+带检查的 PR 产物构建通过一个串行 `tsc -b` 进程编译各 compiler face 的全部现有 project reference，然后运行普通 Typert、bundling、Desktop 和 Web 阶段。helper 读取现有 Host 与 Client aggregate，而不维护另一份包清单。它只省略各 root 附加的测试和脚本 program；包诊断、emit 输出及 Host 先于 Client 的顺序仍然必需。非 PR 的 release 和真实 API 工作流构建保留普通检查。
+
+只有 CI benchmark helper 选择 `tsc -b --noCheck` 来 emit 包。benchmark 消费 JavaScript 和 Typert 运行时元数据；其声明与 build-information 文件是临时产物，不会发布。Typert 独立分析源码类型，语义诊断由必需的完整构建负责。语法与配置错误仍会拒绝 benchmark 准备。TypeScript 记录待检查状态，使后续普通增量构建无需删除缓存或强制重建，就能诊断相同源码。公开 benchmark script，以及所有 release、Python、preview、compatibility 和普通产物 builder，均保留带检查的默认行为。
+
+Python executable builder 在验证 runtime closure 后，通过 `--artifacts-only` 选择产物编译。无效 closure 在编译、部署或打包前失败；默认完整构建和复用预构建产物的 `--skip-build` 模式保留原有阶段。
+
+CI 直接调用内部 build helper，并保持 root package manifest 不变。即使只修改 build alias，root manifest 改动也会激活独立的 native-addon 平台矩阵；避免这一触发条件，可以在不削弱 native 验证的情况下保留现有 workflow 集合与并发 job 上限。
+
+job 清单、runner 选择和 benchmark sample 数量保持固定；gate 与 worker 上限不提高。三个 compatibility case 每次运行一个 job；双目标 Python runtime 矩阵在 keyless Python SDK job 成功后启动。四个 Linux lane、Python SDK、三个 Windows lane 和一个 compatibility job，初始最多占用九个 worker job。SDK job 完成后，剩余七个独立 lane、一个 compatibility job 和两个 runtime target，最多占用十个 job。runtime plan 与 wheel 阶段先于这些 target，各占一个 job。这允许 runtime 验证与 Node 22 构建重叠，同时保持原有十个 job 的上限。覆盖率分区在各自的平台和 runner pool 内复用精简的文件成本元数据。并行 release 打包使用 pnpm 现有的有界调度器；串行发布保持 family 顺序。
+
+每个 Node 版本在一次串行 Vitest 调用中运行相同的七个 source compatibility spec。文件并行和 CLI worker 上限均固定为一，gate 还设置 `VITEST_MAX_WORKERS=1`，因为该环境变量会覆盖 Vitest 的 CLI 上限。文件保持 fork 隔离；依赖构建的 Node 22 lazy-search smoke 保留独立的 build 依赖。三对本地样本保持全部 253 个 assertion outcome，将启动开销比较的 median 从 11.52 秒降至 8.69 秒，且不增加所拥有 descendant process 的峰值。
+
+## Alternatives considered
+
+**提高 job 或 worker 并发。** 否决，因为共享运行器必须保持现有资源上限。
+
+**从所有构建中移除 aggregate 检查。** 否决，因为包 project 不会检查所有仓库测试和脚本的类型；必需的 Linux 与 Windows job 必须保留这些诊断。
+
+**跨 revision 缓存编译输出。** 暂缓，因为缓存正确性与失效规则增加了额外义务，而移除重复 aggregate 工作无需承担这些义务。
+
+## Consequences
+
+冷启动 Host reference 构建耗时 23.49 秒、峰值 RSS 为 1.91 GiB；完整编译器阶段为 84.01 秒和 3.87 GiB。全部 5,932 个 emit 文件的路径与 SHA-256 相同。这些是单次本地编译器样本，不含 bundling 和测试；PR 延迟结果以当前 head 的 CI 为准。benchmark 场景与预算保持不变。
+
+在 Apple M4 Pro / Node 24.19.0 上，三对交替冷启动准备构建比较带检查的 reference 编译与仅用于 benchmark 的 emit：前者为 61.16、82.53、57.80 秒，后者为 55.53、50.82、50.75 秒。准备阶段中位数从 61.16 降至 50.82 秒（16.9%）；范围包括 native support、library、benchmark worker 和 Web 产物，不含依赖安装与测量。每对都包含相同的 11,894 个输出路径，其中 3,181 个 JavaScript 文件逐字节相同，source map 不变。356 个 build-information 文件不同，九个声明仅调整 union 成员顺序；benchmark lane 不会发布这些文件。library 构建的 user CPU 中位数从 76.45 降至 64.23 秒，maximum RSS 中位数保持在约 2.75 GiB。完整 PR 耗时以必需 CI 为准。
+
+并行打包依赖锁定的 pnpm CLI 正确处理精确 recursive filter、pack destination、workspace 并发上限及各包的 lifecycle hook。升级 pnpm 时，必须先通过 `scripts/release/pack.spec.ts` 中的真实 CLI 检查，再让 release 打包采用该版本。
+
+覆盖率权重累加 Vitest 互不重叠的 environment、preparation、setup、collection 和 execution 成本。CI 的平台/environment/pool cache prefix 不匹配原来的 `coverage-times-` archive。持久化本地 checkout 在切换期间可能为未测量的文件保留墙钟权重；删除 `.coverage-times.json` 可重置该历史。这些参考权重影响分区分配，完整清单与合并后的覆盖率阈值仍然必需。
+
+带检查的产物构建有意不诊断仅属于 aggregate 的测试或脚本错误。必需的普通构建拒绝这些错误；fixture 检查还验证两个路径都会拒绝包错误，并比较 emit 的 JavaScript、声明、map 和 build 信息。删除或改变必需的完整构建前，必须先把两个 aggregate 检查转交另一处阻塞型 owner。master 串行 reference 按[现有政策](2026-07-21-serial-cross-platform-ci-reference.zh.md)保持完整。
diff --git a/.agents/notes/implemented/process/2026-10-05-product-package-classification.i18n.yaml b/.agents/notes/implemented/process/2026-10-05-product-package-classification.i18n.yaml
new file mode 100644
index 0000000000..7673f38075
--- /dev/null
+++ b/.agents/notes/implemented/process/2026-10-05-product-package-classification.i18n.yaml
@@ -0,0 +1,19 @@
+# Bilingual-pair consistency record for 2026-10-05-product-package-classification.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-10-05-product-package-classification.md
+/agent-note-require-product-use-or-an-explicit-package-classification:
+ en: 8caa2edff065f7db
+ zh: 163ee0f31c7adc6a
+/agent-note-require-product-use-or-an-explicit-package-classification/problem:
+ en: 748eb2bf5f645911
+ zh: b123aec22395193a
+/agent-note-require-product-use-or-an-explicit-package-classification/decision:
+ en: 8678a01d48195e8f
+ zh: 9052cc7f64ed452f
+/agent-note-require-product-use-or-an-explicit-package-classification/alternatives-considered:
+ en: 67177e349ecb70de
+ zh: e8263b9445f46ded
+/agent-note-require-product-use-or-an-explicit-package-classification/consequences:
+ en: 449278a2bccea70e
+ zh: 5eb28c22783ac6cf
diff --git a/.agents/notes/implemented/process/2026-10-05-product-package-classification.md b/.agents/notes/implemented/process/2026-10-05-product-package-classification.md
new file mode 100644
index 0000000000..2f3a76ae85
--- /dev/null
+++ b/.agents/notes/implemented/process/2026-10-05-product-package-classification.md
@@ -0,0 +1,29 @@
+# Agent Note: Require product use or an explicit package classification
+
+Status: implemented
+
+English | [中文](2026-10-05-product-package-classification.zh.md)
+
+## Problem
+
+An installation dependency can remain dormant indefinitely. Its presence in the dependency graph does not establish that a shipped profile, runtime import, or optional capability uses it. Conversely, an embedding SDK or a deployment-configured provider can have a maintained product role without appearing in the default GUI.
+
+## Decision
+
+Nonexperimental packages have effective product use or an explicit entry in the [package policy](../../../../scripts/product-package-policy.ts). The policy distinguishes optional integrations, SDKs, build tools, test tools, Web distribution packages, and declaration-only infrastructure. Each exception records its maintained role. [Experimental status](../../../../packages/experimental/README.md#status) describes maturity and support, independently of installation, optional selection, and Official discovery.
+
+The [product-use check](../../../../scripts/verify-product-use.ts) follows effective shipped profiles, preset children, runtime source imports, and explicit dynamic mounts. It preserves disabled state through groups and Includes and applies patches before counting use. Manifest dependencies and type-only references do not create runtime use. Optional-bundle reachability remains separate from default reachability. Unknown packages and invalid or stale policy entries fail static CI and package hygiene.
+
+The [default-product isolation rule](2026-09-12-default-product-experimental-isolation.md) remains independent: its conservative installation and declaration traversal rejects unintended experimental dependencies even when they are disabled. That traversal cannot establish active product use.
+
+## Alternatives considered
+
+**Treat every installed package as used.** A redundant dependency would satisfy its own classification requirement and conceal dormant code.
+
+**Classify every nondefault capability as experimental.** Deployment prerequisites and installation cost do not establish immaturity; supported optional providers and SDKs need separate categories.
+
+**Count every declared patch row.** A disabled Include, missing target, or later replacement can prevent that row from mounting. Only the effective composition establishes use.
+
+## Consequences
+
+Adding a nonexperimental package requires a product consumer or a reviewed classification. Renames and reduced in-box availability require upgrade instructions, while recorded events and released data keep their existing obligations. Regression fixtures reject manifest-only dependencies, disabled subtrees, ineffective patches, and stale classifications. SDK, test, build, and declaration packages remain independently installable without acquiring a runtime mount requirement.
diff --git a/.agents/notes/implemented/process/2026-10-05-product-package-classification.zh.md b/.agents/notes/implemented/process/2026-10-05-product-package-classification.zh.md
new file mode 100644
index 0000000000..e53da65c0e
--- /dev/null
+++ b/.agents/notes/implemented/process/2026-10-05-product-package-classification.zh.md
@@ -0,0 +1,29 @@
+# Agent Note: Require product use or an explicit package classification
+
+Status: implemented
+
+[English](2026-10-05-product-package-classification.md) | 中文
+
+## 问题
+
+安装依赖可能长期处于休眠状态。出现在依赖图中，并不表明随附 profile、运行时导入或可选能力使用了它。反过来，嵌入式 SDK 或需要部署配置的提供方即使不出现在默认 GUI 中，也可以承担维护中的产品职责。
+
+## 决策
+
+非实验包必须具有有效产品用途，或在[包策略](../../../../scripts/product-package-policy.ts)中显式列出。策略区分可选集成、SDK、构建工具、测试工具、Web 分发包和纯声明基础设施，每个例外记录其维护职责。[实验性状态](../../../../packages/experimental/README.zh.md#status)描述成熟度与支持承诺，独立于安装、可选启用与官方发现。
+
+[产品用途检查](../../../../scripts/verify-product-use.ts)跟踪有效的随附 profile、预设子行、运行时源码导入与显式动态挂载。检查在组与 Include 中保留禁用状态，并先应用 patch 再统计用途。Manifest 依赖和纯类型引用不产生运行时用途。可选组合包的可达关系与默认可达关系分别计算。未知包及无效或过时的策略条目会使静态 CI 和包卫生检查失败。
+
+[默认产品隔离规则](2026-09-12-default-product-experimental-isolation.zh.md)保持独立：其保守的安装与声明遍历即使对已禁用行，也会拒绝意外实验依赖。该遍历不能证明活动产品用途。
+
+## 考虑过的替代方案
+
+**将所有已安装包视为已使用。** 冗余依赖本身就能满足分类要求，从而掩盖休眠代码。
+
+**将所有非默认能力归为实验性。** 部署前提与安装成本不能证明不成熟；受支持的可选提供方与 SDK 需要独立分类。
+
+**统计所有声明的 patch 行。** 禁用的 Include、缺失目标或后续替换都可能阻止该行挂载。只有有效组合才能证明用途。
+
+## 影响
+
+新增非实验包需要产品消费者或经过审查的分类。改名和减少随附可用性需要升级说明，已记录事件和已发布数据继续遵守既有义务。回归 fixture 拒绝只有 manifest 依赖、禁用子树、无效 patch 和过时分类的情况。SDK、测试、构建与声明包仍可独立安装，无需新增运行时挂载。
diff --git a/.agents/notes/implemented/simplification/2026-06-20-collapse-trace-only-session-events.i18n.yaml b/.agents/notes/implemented/simplification/2026-06-20-collapse-trace-only-session-events.i18n.yaml
deleted file mode 100644
index be5d21a505..0000000000
--- a/.agents/notes/implemented/simplification/2026-06-20-collapse-trace-only-session-events.i18n.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# Bilingual-pair consistency record for 2026-06-20-collapse-trace-only-session-events.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-06-20-collapse-trace-only-session-events.md
-/agent-note-fold-trace-only-session-facts-into-load-bearing-events:
- en: e7ada88fff270fa2
- zh: 501f2d2ab2122718
-/agent-note-fold-trace-only-session-facts-into-load-bearing-events/problem:
- en: 909f9925807d0e0a
- zh: eba8fb3aba92caa8
-/agent-note-fold-trace-only-session-facts-into-load-bearing-events/decision:
- en: d07841a539028e7a
- zh: 5ebaef62105a0da8
-/agent-note-fold-trace-only-session-facts-into-load-bearing-events/alternatives-considered:
- en: f99cc05ab13c85c3
- zh: 93c92b3894cee7b1
-/agent-note-fold-trace-only-session-facts-into-load-bearing-events/verification:
- en: 67e74bfc51b0a1ed
- zh: dfdc9364ec831b9f
-/agent-note-fold-trace-only-session-facts-into-load-bearing-events/consequences:
- en: 1c0e59938ce8408f
- zh: 8c891d273da28f27
-/agent-note-fold-trace-only-session-facts-into-load-bearing-events/implementation-note:
- en: 40e0c79252a438bc
- zh: 27332c259b4bdf95
diff --git a/.agents/notes/implemented/simplification/2026-06-20-unify-agent-and-session-id.i18n.yaml b/.agents/notes/implemented/simplification/2026-06-20-unify-agent-and-session-id.i18n.yaml
index 3e2757185e..6610e2cc7c 100644
--- a/.agents/notes/implemented/simplification/2026-06-20-unify-agent-and-session-id.i18n.yaml
+++ b/.agents/notes/implemented/simplification/2026-06-20-unify-agent-and-session-id.i18n.yaml
@@ -6,8 +6,8 @@
en: a3b5f1ad744e332a
zh: f56748eb6f1c1e8f
/agent-note-unify-the-agent-id-and-the-session-id/problem:
- en: 13081f69bc061561
- zh: 6062223de9302202
+ en: 98310c2d52fdf13b
+ zh: ccea68b6f7b55b2c
/agent-note-unify-the-agent-id-and-the-session-id/decision:
en: 58fe3d6c1fbe5aff
zh: 564332602546955e
diff --git a/.agents/notes/implemented/simplification/2026-06-20-unify-agent-and-session-id.md b/.agents/notes/implemented/simplification/2026-06-20-unify-agent-and-session-id.md
index 4084912f95..cbf88d7d7d 100644
--- a/.agents/notes/implemented/simplification/2026-06-20-unify-agent-and-session-id.md
+++ b/.agents/notes/implemented/simplification/2026-06-20-unify-agent-and-session-id.md
@@ -10,7 +10,7 @@ A live agent/session pair needs one identity for registry routing, event sourcin
ACP uses the same value for both identities. Stdio and hooks also operate on the session event stream and need the corresponding live agent directly; no production path reattaches one live agent object to several sessions or drives one session through several agent ids.
-The [agent-scope runtime](../architecture/2026-07-12-agent-scope-runtime-design.md) uses one `AgentCreationTransaction` for create and resume, and agent/session entries share the same final-entry collision rule. A second identity would not represent separate liveness, rollback, or quiescence; it would only add API and translation state around the same transaction.
+The [agent-scope runtime](../../../../packages/core/agent-loop/README.md) uses one `AgentCreationTransaction` for create and resume, and agent/session entries share the same final-entry collision rule. A second identity would not represent separate liveness, rollback, or quiescence; it would only add API and translation state around the same transaction.
Session identity likewise has one home in `Session.header.id`; `Session.id` is a derived accessor rather than independent state that needs duplicate validation.
diff --git a/.agents/notes/implemented/simplification/2026-06-20-unify-agent-and-session-id.zh.md b/.agents/notes/implemented/simplification/2026-06-20-unify-agent-and-session-id.zh.md
index 3adba379f1..cb3eb40da4 100644
--- a/.agents/notes/implemented/simplification/2026-06-20-unify-agent-and-session-id.zh.md
+++ b/.agents/notes/implemented/simplification/2026-06-20-unify-agent-and-session-id.zh.md
@@ -10,7 +10,7 @@ Status: implemented
ACP（Agent Client Protocol）对两种 identity 使用相同值。Stdio 和钩子也在会话事件流上工作，并且直接需要对应的存活 agent；没有生产路径会把一个存活 agent 对象重新附着到多个会话，或通过多个 agent id 驱动一个会话。
-[agent 范围运行时](../architecture/2026-07-12-agent-scope-runtime-design.zh.md)使用同一个 `AgentCreationTransaction` 执行创建和恢复，agent/会话条目共享相同的最终条目冲突规则。第二个 identity 并不代表单独的存活性、回滚或完全停稳；它只会围绕同一事务增加 API 与转换状态。
+[agent 范围运行时](../../../../packages/core/agent-loop/README.zh.md)使用同一个 `AgentCreationTransaction` 执行创建和恢复，agent/会话条目共享相同的最终条目冲突规则。第二个 identity 并不代表单独的存活性、回滚或完全停稳；它只会围绕同一事务增加 API 与转换状态。
会话 identity 同样只有一个归属，即 `Session.header.id`；`Session.id` 是派生访问器，而非需要重复验证的独立状态。
diff --git a/.agents/notes/implemented/simplification/2026-06-26-fsspec-style-fs-seam.i18n.yaml b/.agents/notes/implemented/simplification/2026-06-26-fsspec-style-fs-seam.i18n.yaml
deleted file mode 100644
index 413cf22c2d..0000000000
--- a/.agents/notes/implemented/simplification/2026-06-26-fsspec-style-fs-seam.i18n.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-# Bilingual-pair consistency record for 2026-06-26-fsspec-style-fs-seam.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-06-26-fsspec-style-fs-seam.md
-/agent-note-split-the-filesystem-seam-provider-text-mutations-plus-the-dsh-fs-observation-policy-plugin:
- en: 181df186598c42fc
- zh: 07b7687434105955
-/agent-note-split-the-filesystem-seam-provider-text-mutations-plus-the-dsh-fs-observation-policy-plugin/problem:
- en: 4069760b095aa1b6
- zh: ea8baf0050362519
-/agent-note-split-the-filesystem-seam-provider-text-mutations-plus-the-dsh-fs-observation-policy-plugin/decision:
- en: 6f6dc20965bb9948
- zh: 5a858a0359f96a98
-/agent-note-split-the-filesystem-seam-provider-text-mutations-plus-the-dsh-fs-observation-policy-plugin/provider-contract:
- en: a04b6ceab91aa265
- zh: 5fae55161f754f4d
-/agent-note-split-the-filesystem-seam-provider-text-mutations-plus-the-dsh-fs-observation-policy-plugin/policy-contract:
- en: bd54f18f4665b1ec
- zh: eee54b7890c9d8be
-/agent-note-split-the-filesystem-seam-provider-text-mutations-plus-the-dsh-fs-observation-policy-plugin/tool-contract:
- en: b517106d3e0ac7ef
- zh: 2b128d7af26ebed2
-/agent-note-split-the-filesystem-seam-provider-text-mutations-plus-the-dsh-fs-observation-policy-plugin/concurrency-boundary:
- en: 6a459d121a49988c
- zh: 048de517a0f952b6
-/agent-note-split-the-filesystem-seam-provider-text-mutations-plus-the-dsh-fs-observation-policy-plugin/supersedes:
- en: 780789585ce58330
- zh: 7b4b8d171dfdefae
-/agent-note-split-the-filesystem-seam-provider-text-mutations-plus-the-dsh-fs-observation-policy-plugin/verification:
- en: ee6e0f4922f991af
- zh: 3ce55e7b7d0fd431
-/agent-note-split-the-filesystem-seam-provider-text-mutations-plus-the-dsh-fs-observation-policy-plugin/later-extension:
- en: b56210bf2c8f8dec
- zh: 27decb39624c0ef7
-/agent-note-split-the-filesystem-seam-provider-text-mutations-plus-the-dsh-fs-observation-policy-plugin/alternatives-considered:
- en: 3d169e07a912cbab
- zh: d8a550835cfe7801
-/agent-note-split-the-filesystem-seam-provider-text-mutations-plus-the-dsh-fs-observation-policy-plugin/consequences:
- en: 70264e0d9422b871
- zh: ae93add503e8a9bc
diff --git a/.agents/notes/implemented/simplification/2026-07-17-one-send-one-turn.i18n.yaml b/.agents/notes/implemented/simplification/2026-07-17-one-send-one-turn.i18n.yaml
index cea714ade6..c5d4927d16 100644
--- a/.agents/notes/implemented/simplification/2026-07-17-one-send-one-turn.i18n.yaml
+++ b/.agents/notes/implemented/simplification/2026-07-17-one-send-one-turn.i18n.yaml
@@ -9,8 +9,8 @@
en: ed05e7ef01abfafc
zh: 40293ad57c00f902
/agent-note-remove-implicit-batching-from-ordinary-sends/decision:
- en: 354fbb4e6a776538
- zh: c78879212400bf0f
+ en: b173fc358ed6ac4b
+ zh: 549ae0cf806b90d4
/agent-note-remove-implicit-batching-from-ordinary-sends/alternatives-considered:
en: f944e18c49b30b4c
zh: cfcc0b18ce94f37c
diff --git a/.agents/notes/implemented/simplification/2026-07-17-one-send-one-turn.md b/.agents/notes/implemented/simplification/2026-07-17-one-send-one-turn.md
index 71ea5d23c3..a2e89a7af1 100644
--- a/.agents/notes/implemented/simplification/2026-07-17-one-send-one-turn.md
+++ b/.agents/notes/implemented/simplification/2026-07-17-one-send-one-turn.md
@@ -16,7 +16,7 @@ This grouping changes behavior, not just the number of model calls. One ordinary
Each successful `send()` creates one independent FIFO queue item. If that item runs, it is the only ordinary message in its turn. An item can be dropped before it starts, so the precise guarantee is at most one turn rather than exactly one; two sends are never silently combined.
-Before inserting a message, `send()` checks the agent state and accepts an already identified, deeply frozen value. The durable splice and `agent/inbox/inserted { message }` retain its `MessageId`; the pending message remains addressable through `Inbox.replace()` and `Inbox.remove()` until the driver claims or discards it. The [claimed pre-step inbox decision](../architecture/2026-07-31-claimed-pre-step-inbox-lifecycle.md) owns the current lifecycle.
+Before inserting a message, `send()` checks the agent state and accepts an already identified, deeply frozen value. The durable splice and `agent/inbox/inserted { message }` retain its `MessageId`; the pending message remains addressable through `Inbox.replace()` and `Inbox.remove()` until the driver claims or discards it. The [claimed pre-step inbox reference](../../../../packages/core/agent-loop/README.md) owns the current lifecycle.
If messages A and B are both processed, B's turn starts only after A records `turn/end` and A's durability checkpoint settles. B's request therefore sees whatever closed result A left in the same session log. A checkpoint error is reported, but settlement only releases this ordering barrier; it does not make a failed write durable. Broad `cancel()`, disposal, or a failure before `turn/start` can instead discard an unstarted item without opening an empty turn.
diff --git a/.agents/notes/implemented/simplification/2026-07-17-one-send-one-turn.zh.md b/.agents/notes/implemented/simplification/2026-07-17-one-send-one-turn.zh.md
index 8478f3fb35..e9cf36b825 100644
--- a/.agents/notes/implemented/simplification/2026-07-17-one-send-one-turn.zh.md
+++ b/.agents/notes/implemented/simplification/2026-07-17-one-send-one-turn.zh.md
@@ -16,7 +16,7 @@ Status: implemented
一次成功的 `send()` 创建一个独立的 FIFO 队列项。该队列项如果运行，就是所在轮次中唯一的普通消息。队列项可能在启动前被丢弃，因此精确保证是最多一个轮次，而不是必定一个轮次；两次 send 绝不会被悄悄合并。
-消息插入之前，`send()` 会检查 agent 状态，并接受已有标识且经过深度冻结的值。持久化 splice 与 `agent/inbox/inserted { message }` 会保留其 `MessageId`；在驱动器领取或丢弃该消息之前，可以通过 `Inbox.replace()` 与 `Inbox.remove()` 寻址。当前生命周期由[已领取 pre-step inbox 决策](../architecture/2026-07-31-claimed-pre-step-inbox-lifecycle.zh.md)规定。
+消息插入之前，`send()` 会检查 agent 状态，并接受已有标识且经过深度冻结的值。持久化 splice 与 `agent/inbox/inserted { message }` 会保留其 `MessageId`；在驱动器领取或丢弃该消息之前，可以通过 `Inbox.replace()` 与 `Inbox.remove()` 寻址。当前生命周期由[已领取 pre-step inbox 参考](../../../../packages/core/agent-loop/README.zh.md)规定。
如果消息 A、B 都进入处理，B 的轮次只能在 A 记录 `turn/end` 且 A 的持久性检查点处理结束后开始。因此，B 的请求能看到 A 在同一会话日志中留下的已关闭结果。检查点错误会照常报告，但处理结束只表示解除这道顺序屏障，不表示失败的写入已经持久化。面向整个 agent 的 `cancel()`、dispose（资源释放）或 `turn/start` 之前的失败也可能丢弃尚未启动的队列项，而不打开一个空轮次。
diff --git a/.agents/notes/implemented/simplification/2026-07-20-unwrap-injected-content-envelopes.i18n.yaml b/.agents/notes/implemented/simplification/2026-07-20-unwrap-injected-content-envelopes.i18n.yaml
deleted file mode 100644
index bcce3bc92b..0000000000
--- a/.agents/notes/implemented/simplification/2026-07-20-unwrap-injected-content-envelopes.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-20-unwrap-injected-content-envelopes.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-07-20-unwrap-injected-content-envelopes.md
-/agent-note-project-injected-content-verbatim-dropping-the-xml-envelopes:
- en: 488b566c13d0cd05
- zh: e9b9a14dc644a313
-/agent-note-project-injected-content-verbatim-dropping-the-xml-envelopes/problem:
- en: 0005839a50aa093b
- zh: bfb21448bbec1ac9
-/agent-note-project-injected-content-verbatim-dropping-the-xml-envelopes/decision:
- en: ed1a833070d10b97
- zh: b7ce57a2b927f064
-/agent-note-project-injected-content-verbatim-dropping-the-xml-envelopes/alternatives-considered:
- en: 93dca58966e5d55e
- zh: 9fe7fd528d0114a2
-/agent-note-project-injected-content-verbatim-dropping-the-xml-envelopes/consequences:
- en: 2b369a5b2ee9435b
- zh: f72957abff1d2327
-/agent-note-project-injected-content-verbatim-dropping-the-xml-envelopes/deferred:
- en: a772793aea7ee7ee
- zh: a57b31af4422406d
diff --git a/.agents/notes/implemented/simplification/2026-07-22-plan-specific-collaboration-state.i18n.yaml b/.agents/notes/implemented/simplification/2026-07-22-plan-specific-collaboration-state.i18n.yaml
deleted file mode 100644
index ad1c43c6dd..0000000000
--- a/.agents/notes/implemented/simplification/2026-07-22-plan-specific-collaboration-state.i18n.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-22-plan-specific-collaboration-state.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-07-22-plan-specific-collaboration-state.md
-/agent-note-plan-specific-collaboration-state:
- en: b1e94e354a36ef2b
- zh: bbc98d4b9a837a5a
-/agent-note-plan-specific-collaboration-state/problem:
- en: e79a03a0ec1ebc34
- zh: 94adee6ef4f1bcc2
-/agent-note-plan-specific-collaboration-state/decision:
- en: 1255fd4c4852ea9c
- zh: 27e431da895a9a69
-/agent-note-plan-specific-collaboration-state/decision/boundary-and-model-contract:
- en: f9d67f4f91e14f9d
- zh: 3284e2432e8a8466
-/agent-note-plan-specific-collaboration-state/decision/reviewed-exit:
- en: 283fec44700c41e5
- zh: 99b8634a1dff791c
-/agent-note-plan-specific-collaboration-state/deleted-api:
- en: 7da48b6397bad4d0
- zh: cc0af0e26a81c7e0
-/agent-note-plan-specific-collaboration-state/alternatives-considered:
- en: 4098e049cd6d28d8
- zh: 4ab332ad6af53ccf
-/agent-note-plan-specific-collaboration-state/verification:
- en: 41179b6ab02b3f90
- zh: 47f5a602496281cd
-/agent-note-plan-specific-collaboration-state/consequences:
- en: a71537da7d3921e2
- zh: a2ab69676bfe985d
diff --git a/.agents/notes/implemented/simplification/2026-07-23-acp-automation-only-protocol.i18n.yaml b/.agents/notes/implemented/simplification/2026-07-23-acp-automation-only-protocol.i18n.yaml
index 0be5f93a6e..26726b4dde 100644
--- a/.agents/notes/implemented/simplification/2026-07-23-acp-automation-only-protocol.i18n.yaml
+++ b/.agents/notes/implemented/simplification/2026-07-23-acp-automation-only-protocol.i18n.yaml
@@ -3,8 +3,8 @@
# After editing either side, bring the other along and re-record with:
# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-07-23-acp-automation-only-protocol.md
/agent-note-acp-as-an-automation-only-protocol:
- en: e8a5a82b0137b656
- zh: 8b371b4add7c17b4
+ en: 2881e2b2f824bbb5
+ zh: 8c9020f06bd61a0e
/agent-note-acp-as-an-automation-only-protocol/problem:
en: 5123f99030ae618e
zh: fa62dc7b9a4b9fef
diff --git a/.agents/notes/implemented/simplification/2026-07-23-acp-automation-only-protocol.md b/.agents/notes/implemented/simplification/2026-07-23-acp-automation-only-protocol.md
index d3d6a7abb6..221fa0b38f 100644
--- a/.agents/notes/implemented/simplification/2026-07-23-acp-automation-only-protocol.md
+++ b/.agents/notes/implemented/simplification/2026-07-23-acp-automation-only-protocol.md
@@ -4,7 +4,7 @@ Status: implemented
English | [中文](2026-07-23-acp-automation-only-protocol.zh.md)
-> The automation-only boundary remains current. [Standard ACP v1 automation controls](../feature/2026-08-22-standard-acp-automation-controls.md) supersedes only this note's prompt-only method, configuration, MCP, update, and lifecycle inventory; it does not restore ACP as a UI.
+> The automation-only boundary remains current. [Standard ACP v1 automation controls](../../../../packages/acp/acp/README.md) supersedes only this note's prompt-only method, configuration, MCP, update, and lifecycle inventory; it does not restore ACP as a UI.
## Problem
diff --git a/.agents/notes/implemented/simplification/2026-07-23-acp-automation-only-protocol.zh.md b/.agents/notes/implemented/simplification/2026-07-23-acp-automation-only-protocol.zh.md
index d332e3f7c4..f9318905ba 100644
--- a/.agents/notes/implemented/simplification/2026-07-23-acp-automation-only-protocol.zh.md
+++ b/.agents/notes/implemented/simplification/2026-07-23-acp-automation-only-protocol.zh.md
@@ -4,7 +4,7 @@ Status: implemented
[English](2026-07-23-acp-automation-only-protocol.md) | 中文
-> 仅面向自动化的边界仍然有效。[标准 ACP v1 自动化控制](../feature/2026-08-22-standard-acp-automation-controls.zh.md)仅取代本说明中仅支持提示词的方法、配置、MCP、更新和生命周期清单；它不会把 ACP 恢复为 UI。
+> 仅面向自动化的边界仍然有效。[标准 ACP v1 自动化控制](../../../../packages/acp/acp/README.zh.md)仅取代本说明中仅支持提示词的方法、配置、MCP、更新和生命周期清单；它不会把 ACP 恢复为 UI。
## 问题
diff --git a/.agents/notes/implemented/simplification/2026-07-24-agent-loop-observable-state-machine.i18n.yaml b/.agents/notes/implemented/simplification/2026-07-24-agent-loop-observable-state-machine.i18n.yaml
deleted file mode 100644
index 0e8ec12298..0000000000
--- a/.agents/notes/implemented/simplification/2026-07-24-agent-loop-observable-state-machine.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-24-agent-loop-observable-state-machine.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-07-24-agent-loop-observable-state-machine.md
-/agent-note-collapse-agent-loop-events-around-the-observable-state-machine:
- en: b7998bdbf46a06b1
- zh: ea7b4e8ef8e3cef5
-/agent-note-collapse-agent-loop-events-around-the-observable-state-machine/problem:
- en: c55232633eaacf5a
- zh: a71c538c61234c42
-/agent-note-collapse-agent-loop-events-around-the-observable-state-machine/decision:
- en: 75a1c677da39192e
- zh: 81a07f55fce3cbc0
-/agent-note-collapse-agent-loop-events-around-the-observable-state-machine/alternatives-considered:
- en: 0d61d49e9f5964c2
- zh: f5e8802c7fe67839
-/agent-note-collapse-agent-loop-events-around-the-observable-state-machine/consequences:
- en: 675d4ae63174031d
- zh: 2649109d067352e2
-/agent-note-collapse-agent-loop-events-around-the-observable-state-machine/related:
- en: f1610942ca31fdb8
- zh: 04eb3d4ce8e641af
diff --git a/.agents/notes/implemented/simplification/2026-07-27-request-error-retry-action.i18n.yaml b/.agents/notes/implemented/simplification/2026-07-27-request-error-retry-action.i18n.yaml
deleted file mode 100644
index 204f3b5cba..0000000000
--- a/.agents/notes/implemented/simplification/2026-07-27-request-error-retry-action.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-27-request-error-retry-action.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-07-27-request-error-retry-action.md
-/agent-note-request-error-retry-action:
- en: 672e3acc184e72f7
- zh: 10334d48de7dcc0e
-/agent-note-request-error-retry-action/problem:
- en: 8b9476349def23b6
- zh: e3b034bae896e24b
-/agent-note-request-error-retry-action/decision:
- en: 3937a99236b23d80
- zh: ec5e9cb21744e3ae
-/agent-note-request-error-retry-action/alternatives-considered:
- en: 8f50ac6497dfd03e
- zh: 4f1d07901132a184
-/agent-note-request-error-retry-action/consequences:
- en: 3e60793a09964f5a
- zh: b28626761a229d85
diff --git a/.agents/notes/implemented/simplification/2026-07-28-remove-synthetic-log-only-turns.i18n.yaml b/.agents/notes/implemented/simplification/2026-07-28-remove-synthetic-log-only-turns.i18n.yaml
index 036542d074..25b91c2e27 100644
--- a/.agents/notes/implemented/simplification/2026-07-28-remove-synthetic-log-only-turns.i18n.yaml
+++ b/.agents/notes/implemented/simplification/2026-07-28-remove-synthetic-log-only-turns.i18n.yaml
@@ -9,14 +9,14 @@
en: 33413b092d535f4f
zh: 02f79f372227c104
/agent-note-remove-synthetic-turns-for-log-only-events/decision:
- en: a49da9273f224a87
- zh: 870ffea9aacca6c7
+ en: 87283d21751d8950
+ zh: edeb2901bf770ae6
/agent-note-remove-synthetic-turns-for-log-only-events/alternatives-considered:
- en: fbee860bf43530a7
- zh: 276647ba5402d6a8
+ en: f9849e72fa2c3e9f
+ zh: c5dec6de58d9e6bf
/agent-note-remove-synthetic-turns-for-log-only-events/verification:
- en: bb7b19f80c4fbed6
- zh: ef06defe5b745e38
+ en: 4290c31853d42929
+ zh: 7fd3dea33c8e8f8d
/agent-note-remove-synthetic-turns-for-log-only-events/consequences:
en: 0c636b744dfa4ca9
zh: 05f409a4fd962015
diff --git a/.agents/notes/implemented/simplification/2026-07-28-remove-synthetic-log-only-turns.md b/.agents/notes/implemented/simplification/2026-07-28-remove-synthetic-log-only-turns.md
index 073ac08880..92c88c1a87 100644
--- a/.agents/notes/implemented/simplification/2026-07-28-remove-synthetic-log-only-turns.md
+++ b/.agents/notes/implemented/simplification/2026-07-28-remove-synthetic-log-only-turns.md
@@ -16,13 +16,13 @@ The generic helper also duplicated domain policy. Its marker map said which plug
`SessionStore.appendOutOfBand()`, `OutOfBandSessionEventMap`, and `OutOfBandSessionEventType` do not exist. A plugin that owns a log-only event appends it through `Session`; when the operation promises durability, it explicitly awaits `ctx.sessions.flush(session)`. No turn is opened solely to obtain that checkpoint.
-Core session invariants continue to enforce core-owned execution relations: turn and step numbering, enclosure of steering, assistant, tool, todo, and request-header events, and same-step tool call/result pairing. Core permits merge-extensible events between turns because only their declaring plugin knows whether they are execution-scoped or standalone. Plugin invariant companions remain responsible for their own event relations.
+Core permits merge-extensible events between turns because only their declaring plugin knows whether they are execution-scoped or standalone.
The title service appends `session/title` directly after its existing service, revision, cancellation, and live-session checks. The bundled model helper appends its literal `session/title-llm-request` record before dispatch. Persistence admits both through the bounded `session/event` path and drains them at ordinary checkpoints and lifecycle teardown; neither append forces a flush merely because it is between turns. A fallback, auxiliary request record, or accepted provider title may therefore appear after `turn/end` and before the next `turn/start`. Manual compaction uses the same between-turn capability for a `compaction/* { turn: null }` bracket, but explicitly flushes the closed attempt because `/compact` promises durability before releasing queued prompt admission.
-`SessionStore.fork()` preserves standalone title and other plugin-owned log-only records. The [exact-event fork decision](../feature/2026-08-18-arbitrary-seq-session-fork.md) owns cut selection and child-owned closers for an open tail.
+`SessionStore.fork()` preserves standalone title and other plugin-owned log-only records. The [exact-event fork reference](../../../../packages/core/session/README.md) owns cut selection and child-owned closers for an open tail.
-The historical [universal turn-enclosure decision](../../archived/architecture/2026-06-15-turn-enclosure-invariant.md) remains useful only as the reason the synthetic mechanism was introduced. The [context-injection decision](../architecture/2026-07-24-separate-context-injection-from-turn-execution.md) established the current meaning: one turn represents one model-loop execution. The [queued manual compaction decision](../feature/2026-07-30-queued-manual-compaction.md) applies that rule to a durable multi-event bracket and owns its marker and admission semantics.
+The historical [universal turn-enclosure decision](../../archived/architecture/2026-06-15-turn-enclosure-invariant.md) remains useful only as the reason the synthetic mechanism was introduced. The [context-injection decision](../architecture/2026-07-24-separate-context-injection-from-turn-execution.md) established the current meaning: one turn represents one model-loop execution. The [queued manual compaction reference](../../../../packages/compaction/compaction/README.md) applies that rule to a durable multi-event bracket and owns its marker and admission semantics.
## Alternatives considered
@@ -32,11 +32,11 @@ The historical [universal turn-enclosure decision](../../archived/architecture/2
**Store titles as mutable session metadata.** This avoids between-turn events but creates a second mutation, replay, persistence, and fork protocol beside the append-only log. Titles remain replayable latest-wins events instead.
-**Require every plugin event to declare standalone eligibility to core.** This keeps a central allowlist but makes absence mean an execution relation that core cannot verify. Merge-extensible unions already assign semantic ownership to the declaring plugin; its invariant companion is the correct enforcement point.
+**Require every plugin event to declare standalone eligibility to core.** This keeps a central allowlist but makes absence mean an execution relation that core cannot verify. Merge-extensible unions already assign semantic ownership to the declaring plugin.
## Verification
-Core invariant tests accept an unknown plugin event between turns while continuing to reject built-in execution events there. Hook, plan-mode, PTC mode dispatch, and approval invariant companions reject their execution-scoped events when no turn is open; the compaction companion separately accepts a balanced `turn: null` manual bracket between turns and requires numeric owners to match an open turn. Session-title service tests pin one direct fallback event under concurrent refresh, detached-session rejection, and newest-revision acceptance. A JSONL round trip preserves a title appended after `turn/end` through the persistence lifecycle drain, and fork tests retain a standalone log-only tail. A keyless assembled ACP snapshot delays the model-backed title until after `turn/end` and pins one standalone provider title with no synthetic turn. Generated API and type-equivalence catalogs contain no removed symbol.
+Session-title service tests pin one direct fallback event under concurrent refresh, detached-session rejection, and newest-revision acceptance. A JSONL round trip preserves a title appended after `turn/end` through the persistence lifecycle drain, and fork tests retain a standalone log-only tail. A keyless assembled ACP snapshot delays the model-backed title until after `turn/end` and pins one standalone provider title with no synthetic turn. Generated API and type-equivalence catalogs contain no removed symbol.
## Consequences
diff --git a/.agents/notes/implemented/simplification/2026-07-28-remove-synthetic-log-only-turns.zh.md b/.agents/notes/implemented/simplification/2026-07-28-remove-synthetic-log-only-turns.zh.md
index 67b24c7423..7c20a1b429 100644
--- a/.agents/notes/implemented/simplification/2026-07-28-remove-synthetic-log-only-turns.zh.md
+++ b/.agents/notes/implemented/simplification/2026-07-28-remove-synthetic-log-only-turns.zh.md
@@ -16,13 +16,13 @@ Status: implemented
`SessionStore.appendOutOfBand()`、`OutOfBandSessionEventMap` 和 `OutOfBandSessionEventType` 均不再存在。拥有纯日志事件的插件通过 `Session` 追加该事件；当操作承诺持久性时，插件会显式等待 `ctx.sessions.flush(session)`。系统不会仅为获得该检查点而打开轮次。
-核心会话不变量继续强制核心所属的执行关系：轮次与步骤编号、steering（中途引导）、助手、工具、待办和请求头事件的封闭，以及同一步骤内的工具调用／结果配对。核心允许可合并扩展事件位于轮次之间，因为只有声明它们的插件知道这些事件受执行作用域约束，还是可以独立存在。插件的不变量配套组件仍负责其自身的事件关系。
+核心允许可合并扩展事件位于轮次之间，因为只有声明它们的插件知道这些事件受执行作用域约束，还是可以独立存在。
标题服务会在完成既有的服务状态、修订、取消和活跃会话检查后，直接追加 `session/title`。随附模型辅助函数会在发起调用前追加其字面量 `session/title-llm-request` 记录。持久化通过有界 `session/event` 路径接纳两者，并在常规检查点与生命周期结束时排空；二者都不会仅因为位于轮次之间就强制刷写。因此，回退标题、辅助请求记录或已接受的提供方标题可以出现在 `turn/end` 之后、下一个 `turn/start` 之前。手动压缩（compaction）利用同一项轮次间能力记录 `compaction/* { turn: null }` 标记对，但会显式刷写已闭合的尝试，因为 `/compact` 承诺在放行排队中的提示词前完成持久化。
-`SessionStore.fork()` 保留独立标题和其他插件所属的纯日志记录。[精确事件 fork 决策](../feature/2026-08-18-arbitrary-seq-session-fork.zh.md)负责切点选择与开放尾部的子会话自有结束事件。
+`SessionStore.fork()` 保留独立标题和其他插件所属的纯日志记录。[精确事件 fork 参考](../../../../packages/core/session/README.zh.md)负责切点选择与开放尾部的子会话自有结束事件。
-历史上的[通用轮次封闭决策](../../archived/architecture/2026-06-15-turn-enclosure-invariant.md)如今只适合用于解释为何曾引入合成机制。[上下文注入决策](../architecture/2026-07-24-separate-context-injection-from-turn-execution.zh.md)确立了当前语义：一个轮次表示一次模型循环执行。[排队手动压缩决策](../feature/2026-07-30-queued-manual-compaction.zh.md)将该规则应用于持久多事件标记对，并拥有其标记与接纳语义。
+历史上的[通用轮次封闭决策](../../archived/architecture/2026-06-15-turn-enclosure-invariant.md)如今只适合用于解释为何曾引入合成机制。[上下文注入决策](../architecture/2026-07-24-separate-context-injection-from-turn-execution.zh.md)确立了当前语义：一个轮次表示一次模型循环执行。[排队手动压缩参考](../../../../packages/compaction/compaction/README.zh.md)将该规则应用于持久多事件标记对，并拥有其标记与接纳语义。
## 曾考虑的替代方案
@@ -32,11 +32,11 @@ Status: implemented
**将标题存储为可变会话元数据。** 这可以避免轮次间事件，却会在仅追加日志之外建立第二套变更、回放、持久化和 fork 协议。标题仍采用可回放、后写覆盖的事件。
-**要求每个插件事件向核心声明可独立存在的资格。** 这可以保留中心准入列表，但会让缺少声明意味着一种核心无法验证的执行关系。可合并扩展联合类型已经将语义所有权赋予声明事件的插件；该插件的不变量配套组件才是正确的强制位置。
+**要求每个插件事件向核心声明可独立存在的资格。** 这可以保留中心准入列表，但会让缺少声明意味着一种核心无法验证的执行关系。可合并扩展联合类型已经将语义所有权赋予声明事件的插件。
## 验证
-核心不变量测试会接受轮次之间的未知插件事件，同时继续拒绝位于该处的内置执行事件。钩子、plan-mode、PTC mode 分发和审批的不变量配套组件会在没有开放轮次时拒绝其执行作用域事件；压缩配套组件则另外接受轮次之间平衡的 `turn: null` 手动标记对，并要求数字 owner匹配一个开放轮次。会话标题服务测试会在并发刷新、拒绝已脱离会话和接受最新修订的场景下，固定一个直接追加的回退事件。JSONL 往返测试会通过持久化生命周期排空保留追加在 `turn/end` 之后的标题；fork 测试会保留独立纯日志尾部。一个无密钥、经完整组装的 ACP（Agent Client Protocol）快照会将模型生成的标题延迟到 `turn/end` 之后，并固定一个不含合成轮次的独立提供方标题。生成的 API 和类型等价性目录不含任何已移除符号。
+会话标题服务测试会在并发刷新、拒绝已脱离会话和接受最新修订的场景下，固定一个直接追加的回退事件。JSONL 往返测试会通过持久化生命周期排空保留追加在 `turn/end` 之后的标题；fork 测试会保留独立纯日志尾部。一个无密钥、经完整组装的 ACP（Agent Client Protocol）快照会将模型生成的标题延迟到 `turn/end` 之后，并固定一个不含合成轮次的独立提供方标题。生成的 API 和类型等价性目录不含任何已移除符号。
## 后果
diff --git a/.agents/notes/implemented/simplification/2026-08-28-omit-unneeded-invariant-companions.i18n.yaml b/.agents/notes/implemented/simplification/2026-08-28-omit-unneeded-invariant-companions.i18n.yaml
deleted file mode 100644
index 8ccac77c7e..0000000000
--- a/.agents/notes/implemented/simplification/2026-08-28-omit-unneeded-invariant-companions.i18n.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-28-omit-unneeded-invariant-companions.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-08-28-omit-unneeded-invariant-companions.md
-/agent-note-omit-invariant-companions-without-independent-observations:
- en: 1aaf29f8d757fcc8
- zh: 76d99dd71bfabbaa
-/agent-note-omit-invariant-companions-without-independent-observations/problem:
- en: 53d9687bdef70d91
- zh: 61d225b1cd374c28
-/agent-note-omit-invariant-companions-without-independent-observations/decision:
- en: a15c7c13f167e5ac
- zh: 63bcc2ef60c2f344
-/agent-note-omit-invariant-companions-without-independent-observations/decision/independent-observations-justify-publication:
- en: ee3e2ff2f0565d94
- zh: 232ddf075bf3b353
-/agent-note-omit-invariant-companions-without-independent-observations/decision/omission-is-explicit-in-the-package-readme:
- en: 465c523c29fd7836
- zh: 9967d7e5b17f1adf
-/agent-note-omit-invariant-companions-without-independent-observations/decision/audit-result:
- en: b19c08cd1f7df630
- zh: 30e872df9ee3ff0a
-/agent-note-omit-invariant-companions-without-independent-observations/alternatives-considered:
- en: 5908a05a2aeb3f82
- zh: 9a01748e8d8b86f4
-/agent-note-omit-invariant-companions-without-independent-observations/consequences:
- en: c648b67008e676f1
- zh: c89400eae3fef89c
diff --git a/.agents/notes/implemented/simplification/2026-09-03-minimal-profiles-persistent-shell-only.i18n.yaml b/.agents/notes/implemented/simplification/2026-09-03-minimal-profiles-persistent-shell-only.i18n.yaml
deleted file mode 100644
index 2f39ebf65f..0000000000
--- a/.agents/notes/implemented/simplification/2026-09-03-minimal-profiles-persistent-shell-only.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-03-minimal-profiles-persistent-shell-only.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-09-03-minimal-profiles-persistent-shell-only.md
-/agent-note-minimal-profiles-expose-only-a-persistent-shell:
- en: d48e78dc2040921c
- zh: 70122e09d8c78e77
-/agent-note-minimal-profiles-expose-only-a-persistent-shell/problem:
- en: a5d116f8ba3ed48b
- zh: d60d307237a69573
-/agent-note-minimal-profiles-expose-only-a-persistent-shell/decision:
- en: 95a1c2d9322ed9da
- zh: 04bc770915863950
-/agent-note-minimal-profiles-expose-only-a-persistent-shell/alternatives-considered:
- en: 55fc282c31b7d4e8
- zh: 6daa72fb5527fcca
-/agent-note-minimal-profiles-expose-only-a-persistent-shell/consequences:
- en: 4f0e22319608c3be
- zh: a6393182b9452c4a
diff --git a/.agents/notes/implemented/simplification/2026-09-05-base-default-file-editor.i18n.yaml b/.agents/notes/implemented/simplification/2026-09-05-base-default-file-editor.i18n.yaml
deleted file mode 100644
index e70adc677c..0000000000
--- a/.agents/notes/implemented/simplification/2026-09-05-base-default-file-editor.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-05-base-default-file-editor.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-09-05-base-default-file-editor.md
-/agent-note-shared-base-default-file-editor-selection:
- en: 2adaf509a18a68eb
- zh: 3103eec286980735
-/agent-note-shared-base-default-file-editor-selection/problem:
- en: b9cf9c91689aeca7
- zh: 4fce9354bb6c2af0
-/agent-note-shared-base-default-file-editor-selection/decision:
- en: 8aa4e6ecc02abdb8
- zh: 9925a29181c53e81
-/agent-note-shared-base-default-file-editor-selection/alternatives-considered:
- en: 172ed2cdc1d47e20
- zh: e12bbb0576244f43
-/agent-note-shared-base-default-file-editor-selection/consequences:
- en: 886dab29e1e6580f
- zh: 49a7b2ceafac0c48
-/agent-note-shared-base-default-file-editor-selection/verification:
- en: 7e8cd8a29f33aff3
- zh: ee6c24c9adf54998
diff --git a/.agents/notes/implemented/simplification/2026-09-06-agent-request-freeze-evidence.i18n.yaml b/.agents/notes/implemented/simplification/2026-09-06-agent-request-freeze-evidence.i18n.yaml
deleted file mode 100644
index 6c68b294d5..0000000000
--- a/.agents/notes/implemented/simplification/2026-09-06-agent-request-freeze-evidence.i18n.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-06-agent-request-freeze-evidence.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-09-06-agent-request-freeze-evidence.md
-/agent-note-reuse-only-loop-proven-message-freezes:
- en: 7ec7e2c8c1eb46bb
- zh: 93a619878774a795
-/agent-note-reuse-only-loop-proven-message-freezes/problem:
- en: af6aa6181efb2163
- zh: 3f1630947294db0a
-/agent-note-reuse-only-loop-proven-message-freezes/decision:
- en: 64e5058366d82142
- zh: 073f4e1856c58294
-/agent-note-reuse-only-loop-proven-message-freezes/measurement-evidence:
- en: 731e00bb5059b1f3
- zh: 118464dc6e640431
-/agent-note-reuse-only-loop-proven-message-freezes/measurement-evidence/standard-hosted-ci-calibration:
- en: 22ad93c82afc0572
- zh: 86e43487e7791148
-/agent-note-reuse-only-loop-proven-message-freezes/alternatives-considered:
- en: 8a00552d7797826c
- zh: 765a6b84eb663bab
-/agent-note-reuse-only-loop-proven-message-freezes/consequences:
- en: 5947b38f7722d4db
- zh: 147b5ea3d681ebd7
diff --git a/.agents/notes/implemented/simplification/2026-09-07-file-content-scan.i18n.yaml b/.agents/notes/implemented/simplification/2026-09-07-file-content-scan.i18n.yaml
deleted file mode 100644
index 7943e40a05..0000000000
--- a/.agents/notes/implemented/simplification/2026-09-07-file-content-scan.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-07-file-content-scan.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-09-07-file-content-scan.md
-/agent-note-scan-file-content-without-per-array-callbacks:
- en: a814034fce2407dc
- zh: 7de9ec55cbbb30ab
-/agent-note-scan-file-content-without-per-array-callbacks/problem:
- en: cb13a0053453cf45
- zh: ce40afb7fa03f9ed
-/agent-note-scan-file-content-without-per-array-callbacks/decision:
- en: e3d83658869a24f7
- zh: 44dd61458a47df6c
-/agent-note-scan-file-content-without-per-array-callbacks/measurement-evidence:
- en: ad23fa4ee386f3cf
- zh: 41e54e28d26b3d02
-/agent-note-scan-file-content-without-per-array-callbacks/alternatives-considered:
- en: 0128940c217dd77c
- zh: 9394e713dac9675d
-/agent-note-scan-file-content-without-per-array-callbacks/consequences:
- en: dace71e8857e57b1
- zh: 0ee88fdaa4e067ee
diff --git a/.agents/notes/implemented/simplification/2026-09-08-web-subagent-catalog-projections.i18n.yaml b/.agents/notes/implemented/simplification/2026-09-08-web-subagent-catalog-projections.i18n.yaml
deleted file mode 100644
index ebd9b4005d..0000000000
--- a/.agents/notes/implemented/simplification/2026-09-08-web-subagent-catalog-projections.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-08-web-subagent-catalog-projections.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-09-08-web-subagent-catalog-projections.md
-/agent-note-web-subagent-catalogs-consume-shared-projections:
- en: 90a80df3b19785a2
- zh: 8e29073af6c61213
-/agent-note-web-subagent-catalogs-consume-shared-projections/problem:
- en: 21600a979400fc8a
- zh: 59ba11ed5210986e
-/agent-note-web-subagent-catalogs-consume-shared-projections/decision:
- en: de9d755497c49716
- zh: 872a15b960e01618
-/agent-note-web-subagent-catalogs-consume-shared-projections/alternatives-considered:
- en: 2a1d32d867c38abd
- zh: 1f473782ade94fa5
-/agent-note-web-subagent-catalogs-consume-shared-projections/consequences:
- en: 44d73213900d4e43
- zh: 2beec2c2634320e2
diff --git a/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.i18n.yaml b/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.i18n.yaml
index 5a3be08ed1..f00222dc57 100644
--- a/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.i18n.yaml
+++ b/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.i18n.yaml
@@ -15,5 +15,5 @@
en: 72b871064c7ae315
zh: a09e5168f8124c4c
/agent-note-keep-loader-mutations-non-transactional/consequences:
- en: 2b1eece19252ad80
- zh: 8c9f5faf201521e0
+ en: 100f687b9d498308
+ zh: 1c4bc2d989e43ec7
diff --git a/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.md b/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.md
index 98b0b1ce0c..d37539cb3e 100644
--- a/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.md
+++ b/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.md
@@ -32,4 +32,4 @@ Two #932-specific vendor changes remain: awaited initial-file creation and force
A plugin activation failure can leave the new options and a failed fiber in place. Callers that require active plugins must audit after settlement; awaiting `Loader.create()` alone does not establish activation. Automatic plugin rollback requires a separate future decision with evidence that its recovery benefit warrants the additional lifecycle implementation.
-[Live-patch tests](../testing/2026-09-09-user-patch-hmr-test-delivery.md) retain controlled event delivery and native watcher coverage, while asserting failure reporting without rollback. The [terminal-release policy](../bug-fix/2026-07-31-fail-loud-releases-the-terminal.md) remains applicable to fatal errors and partial boot teardown. Web preset composition and a real CLI webhook-created model Session provide the application-level verification beyond hand-mounted plugins.
+[Live-patch tests](../../../../packages/boot/app-boot/tests/user-patches.spec.ts) retain controlled event delivery and native watcher coverage, while asserting failure reporting without rollback. The [terminal-release policy](../../../../packages/boot/app-boot/README.md) remains applicable to fatal errors and partial boot teardown. Web preset composition and a real CLI webhook-created model Session provide the application-level verification beyond hand-mounted plugins.
diff --git a/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.zh.md b/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.zh.md
index 77ae1ce91a..57ad3bb687 100644
--- a/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.zh.md
+++ b/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.zh.md
@@ -32,4 +32,4 @@ Fiber、Entry 和 isolate 保持上游的更新返回行为。App boot 通过现
插件激活失败可能保留新选项和失败的 fiber。要求插件处于激活状态的调用者必须在结算后检查；仅等待 `Loader.create()` 不能证明激活。自动插件回滚需要后续独立决策，并证明其恢复收益值得额外的生命周期实现。
-[实时 patch 测试](../testing/2026-09-09-user-patch-hmr-test-delivery.zh.md) 保留受控事件投递和原生监视覆盖，同时断言不回滚时的失败报告。[终端释放策略](../bug-fix/2026-07-31-fail-loud-releases-the-terminal.zh.md) 仍适用于致命错误和部分启动拆卸。Web preset 组合与真实 CLI webhook 创建的模型 Session 提供手动挂载插件之外的应用级验证。
+[实时 patch 测试](../../../../packages/boot/app-boot/tests/user-patches.spec.ts) 保留受控事件投递和原生监视覆盖，同时断言不回滚时的失败报告。[终端释放策略](../../../../packages/boot/app-boot/README.zh.md) 仍适用于致命错误和部分启动拆卸。Web preset 组合与真实 CLI webhook 创建的模型 Session 提供手动挂载插件之外的应用级验证。
diff --git a/.agents/notes/implemented/simplification/2026-09-10-derived-workspace-recency.i18n.yaml b/.agents/notes/implemented/simplification/2026-09-10-derived-workspace-recency.i18n.yaml
deleted file mode 100644
index 282d674791..0000000000
--- a/.agents/notes/implemented/simplification/2026-09-10-derived-workspace-recency.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-10-derived-workspace-recency.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-09-10-derived-workspace-recency.md
-/agent-note-derive-workspace-recency-independently-of-manual-order:
- en: 96d0de6bdc9dcac1
- zh: a50ab8a60f58a24d
-/agent-note-derive-workspace-recency-independently-of-manual-order/problem:
- en: 796dc4d186169b89
- zh: 058b6a8438e46238
-/agent-note-derive-workspace-recency-independently-of-manual-order/decision:
- en: c598d4991271fbf4
- zh: 6454e56191922501
-/agent-note-derive-workspace-recency-independently-of-manual-order/alternatives-considered:
- en: 0e74f1c4f176107a
- zh: 66a66eaa811c8b11
-/agent-note-derive-workspace-recency-independently-of-manual-order/consequences:
- en: f4658d8f0f3ff8d3
- zh: 68c3c8c87b9c4e31
-/agent-note-derive-workspace-recency-independently-of-manual-order/testing:
- en: 82b15f31cd5b5315
- zh: 5f14bfe0d0e8ef0c
diff --git a/.agents/notes/implemented/simplification/2026-09-11-remove-e2b-providers.i18n.yaml b/.agents/notes/implemented/simplification/2026-09-11-remove-e2b-providers.i18n.yaml
index fd8eb2f048..80b5f329b3 100644
--- a/.agents/notes/implemented/simplification/2026-09-11-remove-e2b-providers.i18n.yaml
+++ b/.agents/notes/implemented/simplification/2026-09-11-remove-e2b-providers.i18n.yaml
@@ -15,8 +15,8 @@
en: dc8a267887d4a65c
zh: 806f4a6c844b6284
/agent-note-remove-the-e2b-execution-providers/consequences:
- en: ec119616577fb094
- zh: 4dafe3fd08e11b79
+ en: ce197a29f22dd125
+ zh: 282ca4d511475df6
/agent-note-remove-the-e2b-execution-providers/reintroduction-conditions:
en: ddc5f44430a6b6d5
zh: 372f28000c98cbd6
diff --git a/.agents/notes/implemented/simplification/2026-09-11-remove-e2b-providers.md b/.agents/notes/implemented/simplification/2026-09-11-remove-e2b-providers.md
index 6ff8f51e94..a73c5849ff 100644
--- a/.agents/notes/implemented/simplification/2026-09-11-remove-e2b-providers.md
+++ b/.agents/notes/implemented/simplification/2026-09-11-remove-e2b-providers.md
@@ -36,7 +36,7 @@ This decision removes one provider family. It changes neither PTC execution nor
Custom compositions that depend on the repository's E2B packages lose that supplied backend. External adoption is unknown. Removing the integration also removes its live remote composition evidence; remaining local and delayed-provider tests protect their own contracts, not an unimplemented replacement.
-The [native containment](../architecture/2026-08-28-subprocess-native-containment.md), [outbound proxy](../architecture/2026-08-27-outbound-proxy-policy.md) and [workspace-file service](../architecture/2026-09-05-workspace-files-service.md) decisions remain active. Their E2B implementation and verification inventories are retired while their process ownership, routing and file-access requirements remain intact. The portability decision is partially superseded only in its E2B realization.
+The [native containment](../../../../packages/subprocess/subprocess-local/README.md), [outbound proxy](../architecture/2026-08-27-outbound-proxy-policy.md) and [workspace-file service](../architecture/2026-09-05-workspace-files-service.md) decisions remain active. Their E2B implementation and verification inventories are retired while their process ownership, routing and file-access requirements remain intact. The portability decision is partially superseded only in its E2B realization.
## Reintroduction conditions
diff --git a/.agents/notes/implemented/simplification/2026-09-11-remove-e2b-providers.zh.md b/.agents/notes/implemented/simplification/2026-09-11-remove-e2b-providers.zh.md
index ebc592fb56..1a092a8043 100644
--- a/.agents/notes/implemented/simplification/2026-09-11-remove-e2b-providers.zh.md
+++ b/.agents/notes/implemented/simplification/2026-09-11-remove-e2b-providers.zh.md
@@ -36,7 +36,7 @@ PTC Node 约束需要独立于任意程序 stdin/stdout/stderr 的双向控制
依赖仓库 E2B 包的自定义组合失去该后端。外部采用情况未知。移除集成也会移除其真实远程组合证据；保留的本地与延迟提供方测试保护各自约定，并不验证尚未实现的替代方案。
-[原生约束](../architecture/2026-08-28-subprocess-native-containment.zh.md)、[出站代理](../architecture/2026-08-27-outbound-proxy-policy.zh.md)和[工作区文件服务](../architecture/2026-09-05-workspace-files-service.zh.md)决策保持有效。它们的 E2B 实现与验证清单被撤下，进程所有权、路由和文件访问要求保持完整。可移植性决策仅有 E2B 实现部分被取代。
+[原生约束](../../../../packages/subprocess/subprocess-local/README.zh.md)、[出站代理](../architecture/2026-08-27-outbound-proxy-policy.zh.md)和[工作区文件服务](../architecture/2026-09-05-workspace-files-service.zh.md)决策保持有效。它们的 E2B 实现与验证清单被撤下，进程所有权、路由和文件访问要求保持完整。可移植性决策仅有 E2B 实现部分被取代。
## 重新引入条件
diff --git a/.agents/notes/implemented/simplification/2026-09-12-ralph-off-in-shipped-defaults.i18n.yaml b/.agents/notes/implemented/simplification/2026-09-12-ralph-off-in-shipped-defaults.i18n.yaml
deleted file mode 100644
index 2f8e4c8416..0000000000
--- a/.agents/notes/implemented/simplification/2026-09-12-ralph-off-in-shipped-defaults.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-12-ralph-off-in-shipped-defaults.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-09-12-ralph-off-in-shipped-defaults.md
-/agent-note-ship-ralph-off-in-the-default-compositions:
- en: 59fe1293d618be67
- zh: 0da7f1b4447f10f1
-/agent-note-ship-ralph-off-in-the-default-compositions/problem:
- en: c8c152617cca4d5d
- zh: 1846b119989b9e5b
-/agent-note-ship-ralph-off-in-the-default-compositions/decision:
- en: 7d95a71842e74d38
- zh: fc0d360ff3acc8b5
-/agent-note-ship-ralph-off-in-the-default-compositions/alternatives-considered:
- en: 4e6ed0566a2de3a8
- zh: c1e7ba6dd4047fa0
-/agent-note-ship-ralph-off-in-the-default-compositions/consequences:
- en: 427242f0a8df0c66
- zh: ca3dd1bd4cd54605
-/agent-note-ship-ralph-off-in-the-default-compositions/verification:
- en: 2511c9dd0da7ab60
- zh: 6d4e801f33f3d81b
diff --git a/.agents/notes/implemented/simplification/2026-09-15-host-only-remote-input-validation.i18n.yaml b/.agents/notes/implemented/simplification/2026-09-15-host-only-remote-input-validation.i18n.yaml
deleted file mode 100644
index 5029c4401d..0000000000
--- a/.agents/notes/implemented/simplification/2026-09-15-host-only-remote-input-validation.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-15-host-only-remote-input-validation.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-09-15-host-only-remote-input-validation.md
-/agent-note-validate-remote-inputs-only-on-the-host:
- en: 4434bfb455727454
- zh: 776fc3b42ce339e6
-/agent-note-validate-remote-inputs-only-on-the-host/problem:
- en: 6cddd9c31c5bf1e5
- zh: f2730b6448f7fc26
-/agent-note-validate-remote-inputs-only-on-the-host/decision:
- en: 6e3ef9540b02336b
- zh: e8abe4ea84d95b95
-/agent-note-validate-remote-inputs-only-on-the-host/alternatives-considered:
- en: 1c9ed80b25403e03
- zh: edbc8301e50cf3a1
-/agent-note-validate-remote-inputs-only-on-the-host/consequences:
- en: caf3ffc95133ac40
- zh: f29864e4b636d6f7
diff --git a/.agents/notes/implemented/simplification/2026-09-15-model-agent-availability-and-team-targets.i18n.yaml b/.agents/notes/implemented/simplification/2026-09-15-model-agent-availability-and-team-targets.i18n.yaml
deleted file mode 100644
index a259fd41c0..0000000000
--- a/.agents/notes/implemented/simplification/2026-09-15-model-agent-availability-and-team-targets.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-15-model-agent-availability-and-team-targets.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-09-15-model-agent-availability-and-team-targets.md
-/agent-note-model-agent-availability-and-team-targets:
- en: 7c8722f7b156cd8c
- zh: aad147cf37021d82
-/agent-note-model-agent-availability-and-team-targets/problem:
- en: 66cc6cea878418a6
- zh: 5df1e5508e10fc02
-/agent-note-model-agent-availability-and-team-targets/decision:
- en: 044f44c456540021
- zh: 975794704c37186f
-/agent-note-model-agent-availability-and-team-targets/alternatives-considered:
- en: a19b8766bcff7e49
- zh: 0851603e9c8315c6
-/agent-note-model-agent-availability-and-team-targets/consequences:
- en: 9b622b43322a407e
- zh: ffe2e0199ba85b5e
diff --git a/.agents/notes/implemented/simplification/2026-09-16-subagent-catalog-membership-only.i18n.yaml b/.agents/notes/implemented/simplification/2026-09-16-subagent-catalog-membership-only.i18n.yaml
deleted file mode 100644
index 3d56b5605f..0000000000
--- a/.agents/notes/implemented/simplification/2026-09-16-subagent-catalog-membership-only.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-16-subagent-catalog-membership-only.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-09-16-subagent-catalog-membership-only.md
-/agent-note-keep-model-configuration-outside-subagent-catalogs:
- en: 58a38a2045e8bd43
- zh: 1a1b02b0a93ebc9e
-/agent-note-keep-model-configuration-outside-subagent-catalogs/problem:
- en: d817b413b7e38939
- zh: a4a3a12df1407a34
-/agent-note-keep-model-configuration-outside-subagent-catalogs/decision:
- en: e46b59047e7cbe7d
- zh: 2249547faa8e6a72
-/agent-note-keep-model-configuration-outside-subagent-catalogs/alternatives-considered:
- en: 415a276e8011a2ab
- zh: d86739d9fbe72fb9
-/agent-note-keep-model-configuration-outside-subagent-catalogs/consequences:
- en: 6849156944864ab6
- zh: b74ba42a7d5711d9
diff --git a/.agents/notes/implemented/simplification/2026-09-17-unified-subagent-activations.i18n.yaml b/.agents/notes/implemented/simplification/2026-09-17-unified-subagent-activations.i18n.yaml
new file mode 100644
index 0000000000..cf9a9b80a3
--- /dev/null
+++ b/.agents/notes/implemented/simplification/2026-09-17-unified-subagent-activations.i18n.yaml
@@ -0,0 +1,25 @@
+# Bilingual-pair consistency record for 2026-09-17-unified-subagent-activations.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-09-17-unified-subagent-activations.md
+/agent-note-unified-subagent-activations:
+ en: bf9959f51e79029c
+ zh: 9526781af4b72f6a
+/agent-note-unified-subagent-activations/problem:
+ en: c97919745873e705
+ zh: b531e60b626c4304
+/agent-note-unified-subagent-activations/decision:
+ en: 86c924e5eedb919d
+ zh: 36dd301bdba6325d
+/agent-note-unified-subagent-activations/decision/retained-decisions:
+ en: 670043a18f9cd32c
+ zh: d925485386bab362
+/agent-note-unified-subagent-activations/alternatives-considered:
+ en: f1fe44375cd78882
+ zh: 9abe43a7aa63c1b0
+/agent-note-unified-subagent-activations/consequences:
+ en: d9f618345ec98d3b
+ zh: 7aceba46b132414e
+/agent-note-unified-subagent-activations/verification:
+ en: ee6acf6a9ae509db
+ zh: e239187d787f24fd
diff --git a/.agents/notes/implemented/simplification/2026-09-17-unified-subagent-activations.md b/.agents/notes/implemented/simplification/2026-09-17-unified-subagent-activations.md
new file mode 100644
index 0000000000..07268e4016
--- /dev/null
+++ b/.agents/notes/implemented/simplification/2026-09-17-unified-subagent-activations.md
@@ -0,0 +1,49 @@
+# Agent Note: Unified subagent activations
+
+Status: implemented
+
+English | [中文](2026-09-17-unified-subagent-activations.zh.md)
+
+## Problem
+
+Local one-shot execution and continuable residency separately owned child creation, cancellation, structured capture, results, and cleanup. Foreground and Job-backed tool paths added more ownership paths. Workflow code still needed to await a result, while external backends needed one process execution without acquiring a multi-turn protocol.
+
+## Decision
+
+`startActivation()` is the consumer entry point for every provider. A published handle exposes child identity, a result promise, and disposal of that exact activation. The caller signal cancels unpublished creation only. Local results wait for pending input and owned descendants before closing admission, so descendant replies can contribute to the final answer. Both local and external result promises settle after cleanup and notifications. Parent waits use that same completion promise; a captured execution result survives cleanup failure, which disposal reports separately. Workflow consumers already wait for cleanup before continuing, so activation ownership needs no independent result-readiness and release signals.
+
+Local spawn and fork providers contribute only `prepareContinuable()` data; the subagent service owns Agent creation and residency. The standalone in-process driver package is removed. Structured tools, validation, instructions, and terminal guards attach to one activation and close with it. After capture, that activation rejects further input; cold resume reconstructs an ordinary conversation without the previous schema.
+
+ACP, DSH SDK, Codex, and Claude Code retain their existing single-execution provider adapters. They join the same activation capacity and ownership graph without accepting follow-up messages or fabricating a local child Session. The parent-owned catalog registers every local child and parent-delivery external leaves. Local membership remains independent of result delivery so completed workflow Sessions and their descendants stay discoverable. Caller delivery leaves external membership tracking to its consumer. External entries carry `mode: 'external'` because they have no local Session to open. Creation records membership once; execution and cleanup do not update the catalog. Execution status has no required consumer and remains outside the membership record. Caller delivery returns the complete result; parent delivery queues the complete completion notice.
+
+The model-facing tool always returns a background child id and promises the manager's completion notice. It has no foreground switch or Job integration. Workflows select caller delivery, await the activation result, and dispose the handle before finishing; they add neither a completion notice nor initial return guidance to the parent/child exchange. Headless completion waits for its own child tree and subsequent parent turns.
+
+Parent completion notices include final text regardless of `send_message` availability or use. Tool availability cannot establish that the child sent its answer: it may send only progress or finish without calling the tool. An answer already sent through the tool can appear twice; accepting that duplication avoids making result delivery depend on model compliance or another delivery ledger.
+
+### Retained decisions
+
+The native Session reader rejects duplicate child membership for both local and external catalog entries.
+
+The [continuable residency](../feature/2026-07-28-continuable-subagent-conversations.md), [fork request prefix](../architecture/2026-08-10-fork-children-stay-one-shot.md), and [parent-owned catalog](../architecture/2026-09-01-parent-owned-subagent-catalog.md) records retain their independent rationale. The [subagent package reference](../../../../packages/subagent/subagent/README.md) owns current provider, result-delivery, and activation-capacity contracts; the corresponding [capability seam](../../archived/feature/2026-06-21-subagent-capability-seam.md), [settlement delivery](../../archived/feature/2026-08-06-manager-owned-subagent-settlement-delivery.md), and [capacity](../../archived/feature/2026-09-15-continuable-activation-capacity.md) records remain historical snapshots. This decision owns the shared entry point, external participation, and caller-versus-parent result delivery.
+
+Released Session generations remain immutable. Historical one-shot descriptors stay readable; removing current execution paths does not justify rewriting or discarding durable history.
+
+## Alternatives considered
+
+**Keep a separate external execution projection.** It duplicates membership, restoration, and client update handling already supplied by the parent catalog. Repeated directory snapshots would also retransmit every retained result. The catalog retains only membership; results remain with their recipient.
+
+**Keep one-shot local execution for synchronous workflows.** Awaiting a result is a consumer requirement. A second Agent lifecycle duplicates cancellation and cleanup solely to supply a promise, which the activation can supply directly.
+
+**Add multi-turn support to every external backend.** This expands backend protocols, recovery, and authenticated routing without being necessary for shared ownership. The adapters retain their existing execution capability.
+
+**Use Jobs for all background children.** Jobs add a second work registry and cancellation authority beside activation residency and the Agent inbox. Child discovery and completion already belong to the subagent service.
+
+**Send every result to the parent.** A workflow already consumes and presents its child result. Another wake adds duplicate context and can disturb a parent that is awaiting the workflow tool. Delivery is an explicit consumer choice; the model-facing tool's notice remains unconditional.
+
+## Consequences
+
+One manager controls admission, cancellation, ownership, and resource release across providers. Workflow result collection remains synchronous at its API, while model delegation leaves the parent's tool step promptly. External children share accounting and durable discovery but gain no continuation or independent result archive. Restoring foreground or Job-backed local execution would require a concrete capability that result collection through an activation cannot provide.
+
+## Verification
+
+Focused tests cover local spawn/fork inheritance, structured capture and schema-free cold resume, explicit cancellation, external catalog membership, result-versus-disposal ordering, workflow collection without parent notices, and headless child-tree completion. Existing replay generations are preserved; updated recorded-session cases cover the current model-visible tool and notice behavior.
diff --git a/.agents/notes/implemented/simplification/2026-09-17-unified-subagent-activations.zh.md b/.agents/notes/implemented/simplification/2026-09-17-unified-subagent-activations.zh.md
new file mode 100644
index 0000000000..66c0ed81f6
--- /dev/null
+++ b/.agents/notes/implemented/simplification/2026-09-17-unified-subagent-activations.zh.md
@@ -0,0 +1,49 @@
+# Agent Note: 统一 subagent activation
+
+Status: implemented
+
+[English](2026-09-17-unified-subagent-activations.md) | 中文
+
+## 问题
+
+本地一次性执行与可继续驻留分别拥有子级创建、取消、结构化捕获、结果和清理。前台与 Job 支持的工具路径又增加了所有权路径。工作流仍需等待结果，而外部后端需要一次进程执行，无需获得多轮协议。
+
+## 决策
+
+`startActivation()` 是所有提供方的消费者入口。已发布句柄暴露子级身份、结果 promise 和对应 activation 的资源释放。调用方信号仅取消未发布的创建。本地结果等待待处理输入与所拥有的后代结束后才关闭准入，使后代回复能够进入最终答案。本地与外部结果 promise 都在清理和通知结束后完成。父级使用同一个完成 promise 等待；清理失败不覆盖已捕获的执行结果，由 disposal 单独报告。工作流消费者本就等待清理后再继续，因此 activation 所有权不需要独立的结果就绪与释放信号。
+
+本地 spawn 和 fork 提供方只贡献 `prepareContinuable()` 数据，由 subagent 服务拥有 Agent 创建与驻留。独立进程内驱动器包被移除。结构化工具、校验、指令与终止保护附着于一次 activation，并随其关闭。捕获后该 activation 拒绝继续输入；冷恢复重建普通对话，不携带此前的 schema。
+
+ACP、DSH SDK、Codex 和 Claude Code 保留单次执行适配器，共享 activation 容量与所有权，不接受后续消息，也不伪造本地子 Session。父级拥有的 catalog 登记所有本地子级，以及 parent 交付的外部叶子项。本地成员关系独立于结果交付，让已完成的工作流 Session 及其后代仍可被发现。caller 交付由消费方跟踪外部成员关系。外部条目携带 `mode: 'external'`，因为没有可打开的本地 Session。创建时记录一次成员关系；执行与清理不更新目录。执行状态没有必需的消费者，不属于成员记录。caller 交付返回完整结果，parent 交付将完整完成通知加入父级队列。
+
+面向模型的工具始终返回后台子级 ID，并承诺管理器的完成通知。它没有前台开关或 Job 集成。工作流选择调用方投递，等待 activation 结果并在完成前释放句柄；它们不向父子交互添加完成通知或初始返回指导。Headless 完成流程等待其自身子树与后续父级轮次。
+
+父级完成通知会附带最终文本，不受 `send_message` 是否可用或是否调用影响。工具可用不能证明子级已经发送答案：它可能只汇报进展，也可能未调用工具便结束。已经通过工具发送的答案可能出现两次；接受这类重复，可以避免让结果投递依赖模型遵循指令或额外的投递台账。
+
+### 保留的决策
+
+原生 Session 读取器对本地与外部目录条目都拒绝重复的子级成员记录。
+
+[可继续驻留](../feature/2026-07-28-continuable-subagent-conversations.zh.md)、[fork 请求前缀](../architecture/2026-08-10-fork-children-stay-one-shot.zh.md)与[父级拥有的目录](../architecture/2026-09-01-parent-owned-subagent-catalog.zh.md)保留各自独立理由。具名提供方、结果投递与 activation 容量的当前约定见 [subagent 包文档](../../../../packages/subagent/subagent/README.zh.md)；相应的[能力 seam](../../archived/feature/2026-06-21-subagent-capability-seam.md)、[结算投递](../../archived/feature/2026-08-06-manager-owned-subagent-settlement-delivery.md)与[容量](../../archived/feature/2026-09-15-continuable-activation-capacity.md)记录作为历史快照保留。本决策拥有共享入口、外部执行参与以及调用方与父级之间的结果投递选择。
+
+已发布 Session 世代保持不可变。历史一次性描述符仍可读取；移除当前执行路径不构成改写或丢弃持久历史的理由。
+
+## 考虑过的替代方案
+
+**保留独立的外部执行投影。** 它重复父级 catalog 已提供的成员登记、恢复与客户端更新，每次目录快照还会重传全部结果。catalog 仅保留成员关系，完整结果由接收方负责。
+
+**为同步工作流保留本地一次性执行。** 等待结果是消费者需求。仅为提供 promise 而维护第二套 Agent 生命周期会重复取消与清理；activation 可以直接提供该 promise。
+
+**为所有外部后端增加多轮支持。** 这会扩展后端协议、恢复和经过授权的路由，却不是共享所有权的必要条件。适配器保留现有执行能力。
+
+**让所有后台子级使用 Jobs。** Jobs 在 activation 驻留和 Agent 收件箱之外增加第二套工作注册表与取消权限。子级发现和完成已属于 subagent 服务。
+
+**把每个结果都发送给父级。** 工作流已经消费并展示子级结果；再次唤醒会重复上下文，也可能干扰正在等待工作流工具的父级。投递是显式消费者选择，面向模型工具的通知仍无条件提供。
+
+## 后果
+
+同一个管理器控制所有提供方的准入、取消、所有权和资源释放。工作流 API 仍同步收集结果，模型委派则及时结束父级工具 step。外部子级获得共享计数与持久发现，但不获得继续执行能力或独立结果档案。恢复前台或 Job 支持的本地执行，需要 activation 结果收集无法提供的具体能力。
+
+## 验证
+
+聚焦测试覆盖本地 spawn/fork 继承、结构化捕获与无 schema 冷恢复、显式取消、外部目录成员关系、结果与释放顺序、不发父级通知的工作流收集，以及 headless 子树完成。既有回放世代得到保留；更新的录制会话用例覆盖当前面向模型的工具与通知行为。
diff --git a/.agents/notes/implemented/simplification/2026-09-19-deepseek-messages-only.i18n.yaml b/.agents/notes/implemented/simplification/2026-09-19-deepseek-messages-only.i18n.yaml
deleted file mode 100644
index b97e9bb8dd..0000000000
--- a/.agents/notes/implemented/simplification/2026-09-19-deepseek-messages-only.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-19-deepseek-messages-only.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-09-19-deepseek-messages-only.md
-/agent-note-one-messages-transport-for-the-official-deepseek-route:
- en: 7f7651d2e098b62d
- zh: 0b12845f48f7ae93
-/agent-note-one-messages-transport-for-the-official-deepseek-route/problem:
- en: 050718df19ce3089
- zh: 676838e85ba91e25
-/agent-note-one-messages-transport-for-the-official-deepseek-route/decision:
- en: 33738d00a2d9564b
- zh: 00101971b1a18d64
-/agent-note-one-messages-transport-for-the-official-deepseek-route/alternatives-considered:
- en: f92695788ada65aa
- zh: b885b30ba9f846f8
-/agent-note-one-messages-transport-for-the-official-deepseek-route/consequences:
- en: 23f7d09fb7cf709c
- zh: 1db0bf29cdc38871
diff --git a/.agents/notes/implemented/simplification/2026-10-05-native-or-ptc-presentation.i18n.yaml b/.agents/notes/implemented/simplification/2026-10-05-native-or-ptc-presentation.i18n.yaml
new file mode 100644
index 0000000000..ed1a46d891
--- /dev/null
+++ b/.agents/notes/implemented/simplification/2026-10-05-native-or-ptc-presentation.i18n.yaml
@@ -0,0 +1,19 @@
+# Bilingual-pair consistency record for 2026-10-05-native-or-ptc-presentation.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-10-05-native-or-ptc-presentation.md
+/agent-note-one-tool-invocation-form-per-agent:
+ en: d45e87191f6e7667
+ zh: 4350b7a9ff83b310
+/agent-note-one-tool-invocation-form-per-agent/problem:
+ en: 55d25e331b37b260
+ zh: d1b091a38d1b106d
+/agent-note-one-tool-invocation-form-per-agent/decision:
+ en: 42e5b09fbab63e84
+ zh: 883ab2072a60a138
+/agent-note-one-tool-invocation-form-per-agent/alternatives-considered:
+ en: 62b0c9c4470b241d
+ zh: 4cf40e5dc6eebd63
+/agent-note-one-tool-invocation-form-per-agent/consequences:
+ en: a08a45bec640e3f6
+ zh: 9f61a47d8133f3ee
diff --git a/.agents/notes/implemented/simplification/2026-10-05-native-or-ptc-presentation.md b/.agents/notes/implemented/simplification/2026-10-05-native-or-ptc-presentation.md
new file mode 100644
index 0000000000..97068af298
--- /dev/null
+++ b/.agents/notes/implemented/simplification/2026-10-05-native-or-ptc-presentation.md
@@ -0,0 +1,25 @@
+# Agent Note: One tool invocation form per agent
+
+Status: implemented
+
+English | [中文](2026-10-05-native-or-ptc-presentation.zh.md)
+
+## Problem
+
+Mixed tool presentation carries direct function schemas and a program SDK for the same capabilities. It adds schema-ordering, admission, configuration, and test combinations without a separate execution capability. The [PTC decision](../feature/2026-06-15-ptc.md) still owns the registry, runtime, and nested-call rules.
+
+## Decision
+
+Each agent selects `native` or `ptc`. Native presentation exposes visible capability schemas. PTC presentation exposes only `run_code` and the generated SDK. The registry rejects `both` in configuration. Presets can select different supported modes in one application.
+
+## Alternatives considered
+
+**Keep mixed presentation.** This lets one agent choose direct calls or programs for each step, but duplicates the advertised capability information and preserves a third admission case. Separate native and PTC agents provide the supported choices.
+
+**Silently map mixed presentation to another mode.** Either mapping changes how existing programs or direct calls execute. Explicit configuration rejection and the [upgrade guide](../../../../docs/upgrade-guide/v0.2.1-alpha.1/tool-presentation-mode/guide.md) make that choice visible.
+
+## Consequences
+
+An agent cannot alternate between direct end-tool calls and `run_code` through one mixed presentation. Reintroduction requires a concrete need for that behavior and evidence that it warrants the additional interface.
+
+Tests for shared policy, cancellation, nested context, and multimodal results use native or PTC setups. Older Session generations and explicitly retained recordings keep their original bytes and remain readable. The removal changes accepted configuration, not the plugin-author registration API or the guarded execution pipeline.
diff --git a/.agents/notes/implemented/simplification/2026-10-05-native-or-ptc-presentation.zh.md b/.agents/notes/implemented/simplification/2026-10-05-native-or-ptc-presentation.zh.md
new file mode 100644
index 0000000000..f6950cb50b
--- /dev/null
+++ b/.agents/notes/implemented/simplification/2026-10-05-native-or-ptc-presentation.zh.md
@@ -0,0 +1,25 @@
+# Agent Note: 每个 agent 使用一种工具调用形式
+
+Status: implemented
+
+[English](2026-10-05-native-or-ptc-presentation.md) | 中文
+
+## Problem
+
+混合工具呈现为同一组能力同时携带直接函数 schema 和程序 SDK。它增加了 schema 排序、准入、配置和测试组合，却没有提供独立的执行能力。[PTC 决策](../feature/2026-06-15-ptc.zh.md) 仍负责注册表、运行时和嵌套调用规则。
+
+## Decision
+
+每个 agent 选择 `native` 或 `ptc`。原生呈现公开可见能力的 schema。PTC 呈现仅公开 `run_code` 和生成的 SDK。注册表拒绝配置中的 `both`。同一应用中的不同 preset 可以选择不同的受支持模式。
+
+## Alternatives considered
+
+**保留混合呈现。** 这允许同一个 agent 在每一步选择直接调用或程序，但会重复通告能力信息，并保留第三种准入情况。独立的原生与 PTC agent 提供受支持的选择。
+
+**将混合呈现静默映射到另一种模式。** 任一映射都会改变现有程序或直接调用的执行方式。明确拒绝配置，并提供[升级指南](../../../../docs/upgrade-guide/v0.2.1-alpha.1/tool-presentation-mode/guide.zh.md)，可以让这一选择可见。
+
+## Consequences
+
+agent 不能通过一种混合呈现在直接调用具体工具与 `run_code` 之间切换。重新引入该模式，需要存在具体的行为需求，并有证据表明值得增加这种接口。
+
+共享策略、取消、嵌套上下文和多模态结果测试使用原生或 PTC 配置。较早的 Session 代际及显式保留的记录保持原始字节，并且仍可读取。移除该模式改变的是受支持的配置，而非插件作者使用的注册 API 或受控执行流水线。
diff --git a/.agents/notes/implemented/testing/2026-06-19-acp-snapshot-tests.i18n.yaml b/.agents/notes/implemented/testing/2026-06-19-acp-snapshot-tests.i18n.yaml
deleted file mode 100644
index f2eedbf389..0000000000
--- a/.agents/notes/implemented/testing/2026-06-19-acp-snapshot-tests.i18n.yaml
+++ /dev/null
@@ -1,46 +0,0 @@
-# Bilingual-pair consistency record for 2026-06-19-acp-snapshot-tests.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/testing/2026-06-19-acp-snapshot-tests.md
-/agent-note-acp-snapshot-tests-record-once-replay-deterministic:
- en: 2f19b76966d5cf54
- zh: cbaed521d650e079
-/agent-note-acp-snapshot-tests-record-once-replay-deterministic/problem:
- en: d1738d268738633e
- zh: ce62a5b0ff65ce8c
-/agent-note-acp-snapshot-tests-record-once-replay-deterministic/decision:
- en: a9e85418ad5d2bbd
- zh: 8e86b30a2a5bd049
-/agent-note-acp-snapshot-tests-record-once-replay-deterministic/decision/the-fixture-projects-the-persisted-session-jsonl:
- en: bdd1333366edfc30
- zh: ed8a0fbab516a62b
-/agent-note-acp-snapshot-tests-record-once-replay-deterministic/decision/replay-derives-the-model-script-from-the-log:
- en: cb71313f2b14f855
- zh: f85809cfd19ce6af
-/agent-note-acp-snapshot-tests-record-once-replay-deterministic/decision/the-in-memory-replay-entry-honors-the-full-llm-contract:
- en: 5d750b82fd88597c
- zh: 22dc6dec0d638449
-/agent-note-acp-snapshot-tests-record-once-replay-deterministic/decision/positional-replay-one-in-flight-stream:
- en: 9ecd0c3efce1b2a1
- zh: 51612956e0c4fc85
-/agent-note-acp-snapshot-tests-record-once-replay-deterministic/decision/recording-harvests-the-log-keyless-replay-needs-a-providerless-config:
- en: 17239981275e59c8
- zh: 8f7fc2d9e6abd3ee
-/agent-note-acp-snapshot-tests-record-once-replay-deterministic/decision/two-outputs-normalize-then-compare:
- en: ee891a839a0c05e9
- zh: 677259307e4357fa
-/agent-note-acp-snapshot-tests-record-once-replay-deterministic/decision/isolation-normalization-now-sandbox-later:
- en: ce58ef2e3180d0d3
- zh: 1e9354614e4d7219
-/agent-note-acp-snapshot-tests-record-once-replay-deterministic/decision/the-replay-plugin-is-its-own-package:
- en: 6c3f938c57f4458b
- zh: f64bb14ffb80ab90
-/agent-note-acp-snapshot-tests-record-once-replay-deterministic/decision/two-subcommands-replay-in-the-default-gate:
- en: a50cb4cd2be177f7
- zh: a29f45aafb83fa6c
-/agent-note-acp-snapshot-tests-record-once-replay-deterministic/alternatives-considered:
- en: c4e83a568e8f483e
- zh: eff19f1872565ff6
-/agent-note-acp-snapshot-tests-record-once-replay-deterministic/consequences:
- en: ea210a6a43707447
- zh: 8c1e2a474d595b96
diff --git a/.agents/notes/implemented/testing/2026-06-19-real-api-e2e-ci.i18n.yaml b/.agents/notes/implemented/testing/2026-06-19-real-api-e2e-ci.i18n.yaml
index 5958148df6..52e964bf01 100644
--- a/.agents/notes/implemented/testing/2026-06-19-real-api-e2e-ci.i18n.yaml
+++ b/.agents/notes/implemented/testing/2026-06-19-real-api-e2e-ci.i18n.yaml
@@ -30,8 +30,8 @@
en: fbbcc9a926dfc943
zh: 506acdb4e034574b
/agent-note-real-api-e2e-in-ci-against-the-external-deepseek-api/decision/scope-runtime-shape:
- en: c59c441547da2a4d
- zh: b08d50e7cfd40cd5
+ en: 31cf2f272a42f476
+ zh: b3f879aa0fc47bdb
/agent-note-real-api-e2e-in-ci-against-the-external-deepseek-api/security:
en: 1fd3925ab26c11d4
zh: 0d7103fd0b1afa89
diff --git a/.agents/notes/implemented/testing/2026-06-19-real-api-e2e-ci.md b/.agents/notes/implemented/testing/2026-06-19-real-api-e2e-ci.md
index bdb20b3d54..8a63c4ad63 100644
--- a/.agents/notes/implemented/testing/2026-06-19-real-api-e2e-ci.md
+++ b/.agents/notes/implemented/testing/2026-06-19-real-api-e2e-ci.md
@@ -54,7 +54,7 @@ The repo secret is named `DEEPSEEK_API_KEY_EXTERNAL`; it is mapped to the `DEEPS
### Scope, runtime shape
-The job runs only `test:e2e` on Node 24; keyless gates and version compatibility belong to the main CI workflow. Tests run unbuilt through the workspace paths map with a bounded configurable worker pool, per-test retries, and a job timeout. The [superseded-CI cancellation policy](../process/2026-09-09-cancel-superseded-ci.md) cancels older runs in the same workflow/ref group across PR, push, schedule, and manual triggers; a post-merge or nightly trigger does not guarantee completion.
+The job runs only `test:e2e` on Node 24; keyless gates and version compatibility belong to the main CI workflow. Tests run unbuilt through the workspace paths map with a bounded configurable worker pool, per-test retries, and a job timeout. The [superseded-CI cancellation policy](../../../../.github/workflows/e2e.yml) cancels older runs in the same workflow/ref group across PR, push, schedule, and manual triggers; a post-merge or nightly trigger does not guarantee completion.
The DeepSeek native `web_search` probe is registered but skipped. The live Anthropic-compatible endpoint can return a successful response without structured source blocks, so its positive-source assertion is not a reliable merge signal; unit coverage still pins response parsing, but CI does not prove the live source-block wire shape.
diff --git a/.agents/notes/implemented/testing/2026-06-19-real-api-e2e-ci.zh.md b/.agents/notes/implemented/testing/2026-06-19-real-api-e2e-ci.zh.md
index b95f7df62e..e18a5caefc 100644
--- a/.agents/notes/implemented/testing/2026-06-19-real-api-e2e-ci.zh.md
+++ b/.agents/notes/implemented/testing/2026-06-19-real-api-e2e-ci.zh.md
@@ -54,7 +54,7 @@ repo secret 命名为 `DEEPSEEK_API_KEY_EXTERNAL`；映射到适配器和测试
### 范围与运行时形态
-job 仅在 Node 24 上运行 `test:e2e`；无密钥门禁和版本兼容性属于主 CI 工作流。测试通过 workspace paths 映射以未构建形式运行，使用有界的可配置 worker 池、逐测试重试和 job 超时。[被取代 CI 的取消策略](../process/2026-09-09-cancel-superseded-ci.zh.md)会在 PR、push、schedule 和手动触发之间取消同一工作流/引用组内的旧运行；合并后或每夜触发并不保证完成。
+job 仅在 Node 24 上运行 `test:e2e`；无密钥门禁和版本兼容性属于主 CI 工作流。测试通过 workspace paths 映射以未构建形式运行，使用有界的可配置 worker 池、逐测试重试和 job 超时。[被取代 CI 的取消策略](../../../../.github/workflows/e2e.yml)会在 PR、push、schedule 和手动触发之间取消同一工作流/引用组内的旧运行；合并后或每夜触发并不保证完成。
DeepSeek 原生 `web_search` 探测已注册但会跳过。线上 Anthropic 兼容端点可能返回成功响应却没有结构化来源块，因此对来源存在性的正向断言不是可靠的合并信号；单元测试仍会锁定响应解析行为，但 CI 不会验证线上端点返回的来源块协议格式（wire format）。
diff --git a/.agents/notes/implemented/testing/2026-07-24-web-gui-browser-e2e-lane.i18n.yaml b/.agents/notes/implemented/testing/2026-07-24-web-gui-browser-e2e-lane.i18n.yaml
index 432ef80b37..3554853dcc 100644
--- a/.agents/notes/implemented/testing/2026-07-24-web-gui-browser-e2e-lane.i18n.yaml
+++ b/.agents/notes/implemented/testing/2026-07-24-web-gui-browser-e2e-lane.i18n.yaml
@@ -6,8 +6,8 @@
en: acbf72f6a3c5bea9
zh: 4d655027ac2b78db
/agent-note-keyless-browser-e2e-lane-for-the-web-gui/problem:
- en: 547a3f60ac28095e
- zh: 85a9d996257f0273
+ en: 63a2f51853b2c530
+ zh: 2babef0ecce89b21
/agent-note-keyless-browser-e2e-lane-for-the-web-gui/decision:
en: c2f86db5f0b6b5a4
zh: dd07b529cc65e7d2
@@ -27,8 +27,8 @@
en: c529437d4fbaeeb3
zh: fe13551e56cba7df
/agent-note-keyless-browser-e2e-lane-for-the-web-gui/decision/ci-stance:
- en: 23b625d86ba7f5e2
- zh: 88f33b233fca0a82
+ en: a4ed258cd19db1c0
+ zh: 913e079a6250d7d7
/agent-note-keyless-browser-e2e-lane-for-the-web-gui/prior-art:
en: 7472e212043721dd
zh: 61dd9f5a8e12730b
diff --git a/.agents/notes/implemented/testing/2026-07-24-web-gui-browser-e2e-lane.md b/.agents/notes/implemented/testing/2026-07-24-web-gui-browser-e2e-lane.md
index eb79591e7b..cbbcee49c7 100644
--- a/.agents/notes/implemented/testing/2026-07-24-web-gui-browser-e2e-lane.md
+++ b/.agents/notes/implemented/testing/2026-07-24-web-gui-browser-e2e-lane.md
@@ -6,7 +6,7 @@ English | [中文](2026-07-24-web-gui-browser-e2e-lane.zh.md)
## Problem
-The web GUI ships as a real assembled chain — chromium page → client plugin bundles → HTTP unary RPC + two SSE streams → `toFetchHandler`/apiproxy → the host agent loop, tools, and JSONL persistence — and no test exercised that chain keylessly and deterministically. The [GUI testing system](../process/2026-07-20-gui-testing-system.md) covers tier 1 (wire isomorphism in node), tier 2 (object-layer state machines), and tier-3 smokes, but the former keyless smoke drove a standalone client fixture — no host, no wire, no agent loop — while the full-chain smoke needed `DEEPSEEK_API_KEY` and a live model, so it was nondeterministic and self-skipped in keyless CI. The snapshot philosophy of [docs/testing.md](../../../../docs/testing.md) — record once with a key, replay forever keyless, refresh on format churn — already covered the ACP, headless `stream-json`, and TUI transcript surfaces; the web surface was the one assembled product shape without it. The gap is exactly where the two confirmed GUI P0s hid: the wire carriage chain the standalone fixture short-circuited.
+The web GUI ships as a real assembled chain — chromium page → client plugin bundles → HTTP unary RPC + two SSE streams → `toFetchHandler`/apiproxy → the host agent loop, tools, and JSONL persistence — and no test exercised that chain keylessly and deterministically. The [GUI testing system](../../../../docs/testing.md) covers tier 1 (wire isomorphism in node), tier 2 (object-layer state machines), and tier-3 smokes, but the former keyless smoke drove a standalone client fixture — no host, no wire, no agent loop — while the full-chain smoke needed `DEEPSEEK_API_KEY` and a live model, so it was nondeterministic and self-skipped in keyless CI. The snapshot philosophy of [docs/testing.md](../../../../docs/testing.md) — record once with a key, replay forever keyless, refresh on format churn — already covered the ACP, headless `stream-json`, and TUI transcript surfaces; the web surface was the one assembled product shape without it. The gap is exactly where the two confirmed GUI P0s hid: the wire carriage chain the standalone fixture short-circuited.
## Decision
@@ -50,7 +50,7 @@ The lane covers three behavior families. Live-turn scenarios pin ordinary tool e
### CI stance
-The lane is a required compare-only gate for Linux pull requests under the [browser snapshot CI decision](2026-07-30-web-browser-snapshot-ci-gate.md). The `node 24 / snapshots and artifacts` consumer job owns the [single Linux build](../../archived/process/2026-07-30-independent-ci-consumer-build.md), installs the lockfile-selected Chromium and WebKit, restores their OS-and-lockfile-keyed cache, and runs the lane with `DSH_SNAPSHOT=replay`. This is an intentional plane split: the host and specs use the [tsx source-launch contract](../architecture/2026-07-29-dsh-source-launch-tsx-esm.md), while the browser consumes `apps/web/dist` and package `lib/client.js` artifacts, so the gate depends on `built-package-invariants` for those client artifacts. The self-hosted default-branch Linux serial standby runs the same gate; there is no hosted Linux serial producer of the browser cache consumed by pull requests, and the persistent self-hosted pool needs no hosted cache. CI never records or refreshes goldens. Scenarios remain POSIX-oriented and stay outside the Windows and macOS matrices.
+The lane is a required compare-only gate for Linux pull requests under the [browser snapshot CI reference](../../../../docs/testing.md). The `node 24 / snapshots and artifacts` consumer job owns the [single Linux build](../../archived/process/2026-07-30-independent-ci-consumer-build.md), installs the lockfile-selected Chromium and WebKit, restores their OS-and-lockfile-keyed cache, and runs the lane with `DSH_SNAPSHOT=replay`. This is an intentional plane split: the host and specs use the [tsx source-launch contract](../architecture/2026-07-29-dsh-source-launch-tsx-esm.md), while the browser consumes `apps/web/dist` and package `lib/client.js` artifacts, so the gate depends on `build` for those client artifacts. The self-hosted default-branch Linux serial standby runs the same gate; there is no hosted Linux serial producer of the browser cache consumed by pull requests, and the persistent self-hosted pool needs no hosted cache. CI never records or refreshes goldens. Scenarios remain POSIX-oriented and stay outside the Windows and macOS matrices.
High-cardinality performance diagnostics use the separate opt-in `apps/web/tests/**/*.perf.ts` inventory selected only by `vitest.web.perf.config.ts`. The isolated `complex-history.perf.ts` cases reuse the real scaffold: the workspace case seeds 1,000 compact sessions plus one 500-turn history containing 500 tool calls, exhausts and remounts that history in Chat, and reports Chromium main-thread, DOM, listener, heap, paging, search, and Trajectory measurements. Two continuation cases seed the same long history but compare the default 24-turn Chat window with all 500 turns expanded before each continues eight identical turns through the real composer, agent loop, SSE wire, tools, and persistence; two turns execute a real `bash` call and assert its durable result, while the final turn fills an 8,232-character mixed-language prompt and replays 120 paced text deltas. A separate soak case starts from a blank session, drives 100 consecutive real composer turns with a `bash` call and result every tenth turn, forces GC every ten turns, and reports ten-turn latency windows plus retained browser state. It then submits a 101st text-only turn with a trusted browser click and measures browser-clock send-to-transcript-DOM and send-to-post-paint latency, excluding the composer's draft mirrors, separately from full-turn completion. Per-turn diagnostics cover composer fill, click-to-user-echo, click-to-first-chunk, completion, browser mutations, persisted chunks, and tool events; the synthetic replay model has enough context capacity to keep fixture cardinality stable instead of consuming scripted calls through compaction. Structural assertions pin the intended load, stream, and tool shapes, but timing remains threshold-free because machine speed is not a correctness contract. The required `vitest.web.config.ts` inventory remains limited to `*.e2e.ts` and `*.snapshot.ts`, so neither `test:web:built` nor its CI gate collects performance cases.
diff --git a/.agents/notes/implemented/testing/2026-07-24-web-gui-browser-e2e-lane.zh.md b/.agents/notes/implemented/testing/2026-07-24-web-gui-browser-e2e-lane.zh.md
index f715f4ca93..f9c522a559 100644
--- a/.agents/notes/implemented/testing/2026-07-24-web-gui-browser-e2e-lane.zh.md
+++ b/.agents/notes/implemented/testing/2026-07-24-web-gui-browser-e2e-lane.zh.md
@@ -6,7 +6,7 @@ Status: implemented
## 问题
-Web GUI 以一条真实组装链交付——chromium 页面 → client 插件 bundle → HTTP 单次 RPC + 两条 SSE（Server-Sent Events）流 → `toFetchHandler`/apiproxy → host 端的 agent loop（智能体循环）、工具与 JSONL 持久化——却没有任何测试无密钥且确定性地检验这条链。[GUI 测试体系](../process/2026-07-20-gui-testing-system.zh.md)覆盖第 1 层（Node 中的协议同构）、第 2 层（对象层状态机）与第 3 层冒烟测试，但原有无密钥冒烟驱动的是独立 Client fixture——没有 host、没有 wire、没有 agent loop——而全链路冒烟需要 `DEEPSEEK_API_KEY` 和真实模型，因此不确定、在无密钥 CI 中自行跳过。[docs/testing.md](../../../../docs/testing.zh.md) 的快照哲学——带密钥录制一次、永久无密钥回放、格式变动时刷新——已覆盖 ACP（Agent Client Protocol）、headless `stream-json` 与 TUI 三个 transcript（文本记录）表面；web 表面是唯一没有这层保障的组装形态。而缺口恰恰是两起已实证 GUI P0 藏身之处：独立 fixture 短路掉的 wire 承载链。
+Web GUI 以一条真实组装链交付——chromium 页面 → client 插件 bundle → HTTP 单次 RPC + 两条 SSE（Server-Sent Events）流 → `toFetchHandler`/apiproxy → host 端的 agent loop（智能体循环）、工具与 JSONL 持久化——却没有任何测试无密钥且确定性地检验这条链。[GUI 测试体系](../../../../docs/testing.zh.md)覆盖第 1 层（Node 中的协议同构）、第 2 层（对象层状态机）与第 3 层冒烟测试，但原有无密钥冒烟驱动的是独立 Client fixture——没有 host、没有 wire、没有 agent loop——而全链路冒烟需要 `DEEPSEEK_API_KEY` 和真实模型，因此不确定、在无密钥 CI 中自行跳过。[docs/testing.md](../../../../docs/testing.zh.md) 的快照哲学——带密钥录制一次、永久无密钥回放、格式变动时刷新——已覆盖 ACP（Agent Client Protocol）、headless `stream-json` 与 TUI 三个 transcript（文本记录）表面；web 表面是唯一没有这层保障的组装形态。而缺口恰恰是两起已实证 GUI P0 藏身之处：独立 fixture 短路掉的 wire 承载链。
## 决策
@@ -50,7 +50,7 @@ Web GUI 以一条真实组装链交付——chromium 页面 → client 插件 bu
### CI 立场
-根据[浏览器快照 CI 决策](2026-07-30-web-browser-snapshot-ci-gate.zh.md)，该车道是 Linux 拉取请求必需的只比较门禁。`node 24 / snapshots and artifacts` 消费方任务在[消费方独立构建](../../archived/process/2026-07-30-independent-ci-consumer-build.md)中负责唯一一次 Linux 构建，安装锁文件选定的 Chromium 和 WebKit，恢复以操作系统和锁文件为键的缓存，并用 `DSH_SNAPSHOT=replay` 运行该车道。这是有意的平面切分：host 与 spec 使用 [tsx 源码启动约定](../architecture/2026-07-29-dsh-source-launch-tsx-esm.zh.md)，浏览器则消费 `apps/web/dist` 和包的 `lib/client.js` 产物，因此门禁依赖 `built-package-invariants` 提供这些客户端产物。自托管的默认分支 Linux 串行热备运行同一门禁；不存在托管 Linux 串行生产者生成供 PR 消费的浏览器缓存，持久化自托管池则不需要托管侧缓存。CI 从不录制或刷新预期输出。场景仍面向 POSIX，并继续置于 Windows 和 macOS 矩阵之外。
+根据[浏览器快照 CI 说明](../../../../docs/testing.zh.md)，该车道是 Linux 拉取请求必需的只比较门禁。`node 24 / snapshots and artifacts` 消费方任务在[消费方独立构建](../../archived/process/2026-07-30-independent-ci-consumer-build.md)中负责唯一一次 Linux 构建，安装锁文件选定的 Chromium 和 WebKit，恢复以操作系统和锁文件为键的缓存，并用 `DSH_SNAPSHOT=replay` 运行该车道。这是有意的平面切分：host 与 spec 使用 [tsx 源码启动约定](../architecture/2026-07-29-dsh-source-launch-tsx-esm.zh.md)，浏览器则消费 `apps/web/dist` 和包的 `lib/client.js` 产物，因此门禁依赖 `build` 提供这些客户端产物。自托管的默认分支 Linux 串行热备运行同一门禁；不存在托管 Linux 串行生产者生成供 PR 消费的浏览器缓存，持久化自托管池则不需要托管侧缓存。CI 从不录制或刷新预期输出。场景仍面向 POSIX，并继续置于 Windows 和 macOS 矩阵之外。
高基数性能诊断使用单独按需启用的 `apps/web/tests/**/*.perf.ts` 清单，并且只由 `vitest.web.perf.config.ts` 选中。`complex-history.perf.ts` 的隔离用例复用真实 scaffold：工作区用例播种 1,000 个紧凑会话以及一份包含 500 次工具调用的 500 轮次历史，在 Chat 中穷尽并重新挂载该历史，并报告 Chromium 主线程、DOM、监听器、堆内存、分页、搜索和 Trajectory 测量结果。两个续聊用例播种同一份长历史，但比较默认的 24 轮次 Chat 窗口与展开全部 500 轮次的状态，然后各自通过真实输入框、agent loop、SSE wire、工具和持久化继续进行 8 个相同轮次；其中两轮执行真实 `bash` 调用并断言其持久化结果，最后一轮则填入一条包含 8,232 个字符的混合语言提示词，并回放 120 个带节奏的文本增量。一个单独的 soak 用例从空白会话开始，通过真实输入框连续驱动 100 轮，每第 10 轮执行一次 `bash` 调用并产生结果，每 10 轮强制执行一次 GC，并报告每 10 轮的延迟窗口及保留的浏览器状态。随后它通过受信任的浏览器点击提交第 101 个纯文本轮次，并使用浏览器时钟分别测量发送到 transcript DOM 和发送到绘制后的延迟，排除输入框的草稿镜像，并与完整轮次完成时间分开。逐轮诊断涵盖输入框填入、点击到用户消息回显、点击到首个分片、完成、浏览器变更、持久化分片和工具事件；合成回放模型拥有足够的上下文容量，可使 fixture 基数保持稳定，而不会因压缩（compaction）消耗脚本化调用。结构性断言钉住预期的负载、流和工具形状，但时间仍不设阈值，因为机器速度不属于正确性约定。必需的 `vitest.web.config.ts` 清单仍仅限 `*.e2e.ts` 和 `*.snapshot.ts`，因此 `test:web:built` 及其 CI 门禁都不会收集性能用例。
diff --git a/.agents/notes/implemented/testing/2026-07-30-web-browser-snapshot-ci-gate.i18n.yaml b/.agents/notes/implemented/testing/2026-07-30-web-browser-snapshot-ci-gate.i18n.yaml
deleted file mode 100644
index 8a40db5638..0000000000
--- a/.agents/notes/implemented/testing/2026-07-30-web-browser-snapshot-ci-gate.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-30-web-browser-snapshot-ci-gate.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/testing/2026-07-30-web-browser-snapshot-ci-gate.md
-/agent-note-required-ci-gate-for-web-browser-expected-outputs:
- en: 246ce605a87c0592
- zh: 37b3fb230abcb280
-/agent-note-required-ci-gate-for-web-browser-expected-outputs/problem:
- en: e04a5ecbd6d6a39e
- zh: 049ce77a1a679daa
-/agent-note-required-ci-gate-for-web-browser-expected-outputs/decision:
- en: 915efba11d7ece34
- zh: 540495b04ef9a305
-/agent-note-required-ci-gate-for-web-browser-expected-outputs/alternatives-considered:
- en: 145e763735dd33b1
- zh: 4ea34838629cd3bf
-/agent-note-required-ci-gate-for-web-browser-expected-outputs/consequences:
- en: d4c6e69ad04c5748
- zh: 5f3034df8f13b106
diff --git a/.agents/notes/implemented/testing/2026-08-23-installed-python-wheel-black-box-ci.i18n.yaml b/.agents/notes/implemented/testing/2026-08-23-installed-python-wheel-black-box-ci.i18n.yaml
index be0529a4d9..4f8b351852 100644
--- a/.agents/notes/implemented/testing/2026-08-23-installed-python-wheel-black-box-ci.i18n.yaml
+++ b/.agents/notes/implemented/testing/2026-08-23-installed-python-wheel-black-box-ci.i18n.yaml
@@ -21,8 +21,8 @@
en: 0f98f5b5f78b5603
zh: 95ee8bafa66d6b1b
/agent-note-installed-wheel-python-runtime-pull-request-validation/decision/required-targets:
- en: 4eafb728b9b3d596
- zh: e127fdfe44659767
+ en: 7a33cde000508475
+ zh: 142fb5ec6b59a280
/agent-note-installed-wheel-python-runtime-pull-request-validation/existing-decisions-and-supersession:
en: 04aa439d4e607324
zh: f4c1d24b6a418cc4
diff --git a/.agents/notes/implemented/testing/2026-08-23-installed-python-wheel-black-box-ci.md b/.agents/notes/implemented/testing/2026-08-23-installed-python-wheel-black-box-ci.md
index a23f7ea1b0..dfa71a9787 100644
--- a/.agents/notes/implemented/testing/2026-08-23-installed-python-wheel-black-box-ci.md
+++ b/.agents/notes/implemented/testing/2026-08-23-installed-python-wheel-black-box-ci.md
@@ -30,7 +30,7 @@ Fork and Dependabot pull requests never receive the repository secret. Their nat
### Required targets
-The pull-request `python-runtime` job calls the reusable builder for Linux x64 and Windows x64; master pushes select Linux arm64 and both macOS architectures under the [master-only platform policy](../process/2026-09-06-master-only-platform-ci.md). Its aggregate result remains a dependency of `all checks passed`, so a failed, cancelled, or missing native carrier blocks the required verdict. The [sdk-runtime README](../../../../python/sdk-runtime/README.md) owns the Windows target and its PowerShell-specific minimal snapshot.
+The pull-request `python-runtime` job calls the reusable builder for Linux x64 and Windows x64; master pushes select Linux arm64 and both macOS architectures under the [master-only platform policy](../../../../.github/workflows/ci-master.yml). Its aggregate result remains a dependency of `all checks passed`, so a failed, cancelled, or missing native carrier blocks the required verdict. The [sdk-runtime README](../../../../python/sdk-runtime/README.md) owns the Windows target and its PowerShell-specific minimal snapshot.
## Existing decisions and supersession
diff --git a/.agents/notes/implemented/testing/2026-08-23-installed-python-wheel-black-box-ci.zh.md b/.agents/notes/implemented/testing/2026-08-23-installed-python-wheel-black-box-ci.zh.md
index 1751430445..fe2e6b6ece 100644
--- a/.agents/notes/implemented/testing/2026-08-23-installed-python-wheel-black-box-ci.zh.md
+++ b/.agents/notes/implemented/testing/2026-08-23-installed-python-wheel-black-box-ci.zh.md
@@ -30,7 +30,7 @@ Fork 与 Dependabot 拉取请求永远不会获得仓库密钥。它们的原生
### 必需目标
-拉取请求的 `python-runtime` job 针对 Linux x64 与 Windows x64 调用可复用构建器；master 推送根据[仅 master 平台策略](../process/2026-09-06-master-only-platform-ci.zh.md)选择 Linux arm64 与两种 macOS 架构。其聚合结果仍是 `all checks passed` 的依赖项，因此任一原生载体失败、取消或缺失都会阻止必需判定通过。[sdk-runtime README](../../../../python/sdk-runtime/README.zh.md) 负责 Windows 目标及其 PowerShell 专属极简快照。
+拉取请求的 `python-runtime` job 针对 Linux x64 与 Windows x64 调用可复用构建器；master 推送根据[仅 master 平台策略](../../../../.github/workflows/ci-master.yml)选择 Linux arm64 与两种 macOS 架构。其聚合结果仍是 `all checks passed` 的依赖项，因此任一原生载体失败、取消或缺失都会阻止必需判定通过。[sdk-runtime README](../../../../python/sdk-runtime/README.zh.md) 负责 Windows 目标及其 PowerShell 专属极简快照。
## Existing decisions and supersession
diff --git a/.agents/notes/implemented/testing/2026-08-24-session-log-snapshot-corpus.i18n.yaml b/.agents/notes/implemented/testing/2026-08-24-session-log-snapshot-corpus.i18n.yaml
index a82fdb832c..f0943aa8a0 100644
--- a/.agents/notes/implemented/testing/2026-08-24-session-log-snapshot-corpus.i18n.yaml
+++ b/.agents/notes/implemented/testing/2026-08-24-session-log-snapshot-corpus.i18n.yaml
@@ -9,8 +9,8 @@
en: ec6f331737be909e
zh: 5faee4c81cf2314f
/agent-note-session-log-snapshot-corpus/decision:
- en: 1611b352461c63c5
- zh: f32a5229bac3264a
+ en: 2cee77ed3a9bb339
+ zh: be2cc1724e1fc13a
/agent-note-session-log-snapshot-corpus/alternatives-considered:
en: 76db318c1c2dad2d
zh: b868b7c9b29c1e00
diff --git a/.agents/notes/implemented/testing/2026-08-24-session-log-snapshot-corpus.md b/.agents/notes/implemented/testing/2026-08-24-session-log-snapshot-corpus.md
index a9001c2eab..47d2f8aae4 100644
--- a/.agents/notes/implemented/testing/2026-08-24-session-log-snapshot-corpus.md
+++ b/.agents/notes/implemented/testing/2026-08-24-session-log-snapshot-corpus.md
@@ -14,7 +14,7 @@ The term snapshot also covers unrelated ARIA, geometry, generator, and package-u
Reserve the top-level `snapshots/` tree and `*.snapshot.ts` suffix for scenarios that own or explicitly reference recorded session JSONL. Each process-level scenario launches a shipped profile through `dsh`; a small adapter controls headless, SDK, ACP, or Web behavior without becoming another application entrypoint. A declarative `snapshot.yml` holds only profile, patch, lifecycle-control, platform, header-pin, and workspace facts that the completed session cannot express.
-This decision supersedes the ACP-specific placement and controller ownership in the [record-once/replay-deterministic decision](2026-06-19-acp-snapshot-tests.md), while that note remains authoritative for session-log replay, exceptional overrides, normalization, and ACP transcript comparison.
+This decision supersedes the ACP-specific placement and controller ownership in the [record-once/replay-deterministic reference](../../../../packages/test-support/session-snapshot/README.md), while that note remains authoritative for session-log replay, exceptional overrides, normalization, and ACP transcript comparison.
The recorded session remains the primary input and, for current-generation scenarios, the expected output. Human-originated messages drive the selected public interface, recorded assistant chunks drive deterministic model replay, and the normalized persisted result must equal the fixture. Parent and child sessions share one typed redaction map. Committed fixtures contain relationship-preserving identity tokens and replace request system prompts and tool schemas with tokens; each distinct header class retains one explicit sidecar owner.
diff --git a/.agents/notes/implemented/testing/2026-08-24-session-log-snapshot-corpus.zh.md b/.agents/notes/implemented/testing/2026-08-24-session-log-snapshot-corpus.zh.md
index d02c798af2..d344988f61 100644
--- a/.agents/notes/implemented/testing/2026-08-24-session-log-snapshot-corpus.zh.md
+++ b/.agents/notes/implemented/testing/2026-08-24-session-log-snapshot-corpus.zh.md
@@ -14,7 +14,7 @@ Status: implemented
顶层 `snapshots/` 树和 `*.snapshot.ts` 后缀只用于拥有或显式引用录制会话 JSONL 的场景。每个进程级场景都通过 `dsh` 启动一个随附 profile；小型适配器控制 headless、SDK、ACP 或 Web 行为，但不成为另一个应用入口。声明式 `snapshot.yml` 只保存已完成会话无法表达的 profile、patch、生命周期控制、平台、header pin 和 workspace 事实。
-本决策取代[一次录制／确定性回放决策](2026-06-19-acp-snapshot-tests.zh.md)中 ACP 专属的放置位置与控制器所有权；后者继续负责会话日志回放、例外 override、规范化和 ACP transcript 比较。
+本决策取代[一次录制／确定性回放说明](../../../../packages/test-support/session-snapshot/README.zh.md)中 ACP 专属的放置位置与控制器所有权；后者继续负责会话日志回放、例外 override、规范化和 ACP transcript 比较。
录制会话仍是主要输入，并在当前代际场景中同时作为预期输出。来自用户的消息驱动所选公开接口，录制的 assistant chunk 驱动确定性模型回放，规范化后的持久化结果必须等于 fixture。父会话和子会话共享同一类型化脱敏映射。提交的 fixture 使用保留关系的身份 token，并将请求 system prompt 和工具 schema 替换为 token；每个不同 header 类仍保留一个显式 sidecar 所有者。
diff --git a/.agents/notes/implemented/testing/2026-09-04-session-open-performance-gate.i18n.yaml b/.agents/notes/implemented/testing/2026-09-04-session-open-performance-gate.i18n.yaml
index fa8f7c9390..d03a5ff8c5 100644
--- a/.agents/notes/implemented/testing/2026-09-04-session-open-performance-gate.i18n.yaml
+++ b/.agents/notes/implemented/testing/2026-09-04-session-open-performance-gate.i18n.yaml
@@ -9,8 +9,8 @@
en: 00ba1f66195351e2
zh: a738b81adceda351
/agent-note-required-ci-performance-gate-for-opening-large-sessions/decision:
- en: 75679c69eeeb1e02
- zh: 49ea45fa46ae3fcb
+ en: 4f94b61c48cceaf4
+ zh: dbb51bfe1fb0f681
/agent-note-required-ci-performance-gate-for-opening-large-sessions/calibration-evidence:
en: f1001a139470f6b7
zh: b7b46f96b84b1271
diff --git a/.agents/notes/implemented/testing/2026-09-04-session-open-performance-gate.md b/.agents/notes/implemented/testing/2026-09-04-session-open-performance-gate.md
index 1b2b0aabb7..926203ea5b 100644
--- a/.agents/notes/implemented/testing/2026-09-04-session-open-performance-gate.md
+++ b/.agents/notes/implemented/testing/2026-09-04-session-open-performance-gate.md
@@ -12,7 +12,7 @@ Measuring only `SessionPersistence.open()` does not stably describe the result f
## Decision
-Linux pull requests run a required `node 24 / benchmarks` job that executes `pnpm run check:ci:bench` → `pnpm run test:bench`. The private `@deepseek-ai/dsh-benchmarks` workspace owns benchmark-only dependencies. The command first builds workspace libraries and dedicated workers under `benchmarks/.dsh-build/`, then invokes `vitest.bench.config.ts`. The [standard hosted runner decision](2026-09-06-standard-hosted-benchmark-runner.md) owns runner selection and the outer job timeout. The job runs the benchmark lane alone; Vitest runs one file at a time and only prepares input, starts measurement children, aggregates results, and enforces budgets. Every timed Node CPU path executes compiled JavaScript under plain Node with `NODE_OPTIONS` removed and no TypeScript loader; bare workspace imports therefore resolve from `benchmarks/node_modules` through package exports to built `lib/` entries.
+Linux pull requests run a required `node 24 / benchmarks` job that executes `pnpm run check:ci:bench` → `scripts/run-ci-bench.ts`. Its disposable library build omits repeated TypeScript diagnostics under the [PR artifact build policy](../process/2026-10-05-pr-artifact-typechecks.md); required full builds retain them. The private `@deepseek-ai/dsh-benchmarks` workspace owns benchmark-only dependencies. The command first builds workspace libraries and dedicated workers under `benchmarks/.dsh-build/`, then invokes `vitest.bench.config.ts`. The [standard hosted runner reference](../../../../.github/workflows/ci.yml) owns runner selection and the outer job timeout. The job runs the benchmark lane alone; Vitest runs one file at a time and only prepares input, starts measurement children, aggregates results, and enforces budgets. Every timed Node CPU path executes compiled JavaScript under plain Node with `NODE_OPTIONS` removed and no TypeScript loader; bare workspace imports therefore resolve from `benchmarks/node_modules` through package exports to built `lib/` entries.
Required performance gates live under top-level `benchmarks/`, grouped by measured user path rather than package ownership. Host files use `*.bench.ts`, Client-face files use `*.bench.client.ts`, and scenario-specific workers and fixtures stay beside their benchmark without a benchmark suffix. Package-local `.perf.ts` files remain non-gating diagnostics; `scripts/` owns orchestration rather than benchmark cases.
diff --git a/.agents/notes/implemented/testing/2026-09-04-session-open-performance-gate.zh.md b/.agents/notes/implemented/testing/2026-09-04-session-open-performance-gate.zh.md
index 9ad56796aa..e8a64dca20 100644
--- a/.agents/notes/implemented/testing/2026-09-04-session-open-performance-gate.zh.md
+++ b/.agents/notes/implemented/testing/2026-09-04-session-open-performance-gate.zh.md
@@ -12,7 +12,7 @@ Session format v2 的推出改变了两条成本随模型输出增长的路径
## 决定
-Linux pull request 运行必需的 `node 24 / benchmarks` job，执行 `pnpm run check:ci:bench` → `pnpm run test:bench`。私有 `@deepseek-ai/dsh-benchmarks` workspace 拥有 benchmark 专属依赖。该命令先构建 workspace library 和 `benchmarks/.dsh-build/` 下的专用 worker，再调用 `vitest.bench.config.ts`。[标准托管运行器决策](2026-09-06-standard-hosted-benchmark-runner.zh.md)拥有运行器选择及外层 job 超时。该 job 单独运行 benchmark lane；Vitest 逐文件运行，只负责准备输入、启动测量子进程、汇总结果和执行预算断言。每条被计时的 Node CPU 路径都以纯 Node 执行编译后的 JavaScript，并移除 `NODE_OPTIONS` 且不加载 TypeScript runtime；workspace 裸导入因此从 `benchmarks/node_modules` 通过 package exports 解析到构建后的 `lib/` 入口。
+Linux pull request 运行必需的 `node 24 / benchmarks` job，执行 `pnpm run check:ci:bench` → `scripts/run-ci-bench.ts`。其临时 library 构建按 [PR 产物构建政策](../process/2026-10-05-pr-artifact-typechecks.zh.md)省略重复的 TypeScript 诊断；必需的完整构建保留这些诊断。私有 `@deepseek-ai/dsh-benchmarks` workspace 拥有 benchmark 专属依赖。该命令先构建 workspace library 和 `benchmarks/.dsh-build/` 下的专用 worker，再调用 `vitest.bench.config.ts`。[标准托管运行器说明](../../../../.github/workflows/ci.yml)拥有运行器选择及外层 job 超时。该 job 单独运行 benchmark lane；Vitest 逐文件运行，只负责准备输入、启动测量子进程、汇总结果和执行预算断言。每条被计时的 Node CPU 路径都以纯 Node 执行编译后的 JavaScript，并移除 `NODE_OPTIONS` 且不加载 TypeScript runtime；workspace 裸导入因此从 `benchmarks/node_modules` 通过 package exports 解析到构建后的 `lib/` 入口。
必需性能 gate 位于顶层 `benchmarks/`，按被测用户路径而非 package 归属组织。Host 文件使用 `*.bench.ts`，Client 面文件使用 `*.bench.client.ts`，场景专属 worker 与 fixture 留在对应 benchmark 旁且不带 benchmark 后缀。包内 `.perf.ts` 文件仍是非门禁诊断；`scripts/` 负责编排而不承载 benchmark case。
diff --git a/.agents/notes/implemented/testing/2026-09-06-backend-continuation-performance.i18n.yaml b/.agents/notes/implemented/testing/2026-09-06-backend-continuation-performance.i18n.yaml
index 60da3ac257..afb6f6cd25 100644
--- a/.agents/notes/implemented/testing/2026-09-06-backend-continuation-performance.i18n.yaml
+++ b/.agents/notes/implemented/testing/2026-09-06-backend-continuation-performance.i18n.yaml
@@ -9,11 +9,11 @@
en: c6a89dac7dea293a
zh: b10610932d55996c
/agent-note-performance-baselines-for-tool-heavy-backend-continuation/decision:
- en: 3429525a40e02b95
- zh: 92f12beb81003101
+ en: a6dca710f2f43b03
+ zh: 49b507d106c5ec81
/agent-note-performance-baselines-for-tool-heavy-backend-continuation/calibration-evidence:
- en: 4f47ca6859cc2d70
- zh: 5bfe8314fd30d82b
+ en: b1bdf65b8b017b68
+ zh: 7e8ed6c18bc6aad1
/agent-note-performance-baselines-for-tool-heavy-backend-continuation/alternatives-considered:
en: 3a61dff7c926eb22
zh: 8f2633b16be78233
diff --git a/.agents/notes/implemented/testing/2026-09-06-backend-continuation-performance.md b/.agents/notes/implemented/testing/2026-09-06-backend-continuation-performance.md
index a2423a404e..dd545253ff 100644
--- a/.agents/notes/implemented/testing/2026-09-06-backend-continuation-performance.md
+++ b/.agents/notes/implemented/testing/2026-09-06-backend-continuation-performance.md
@@ -23,7 +23,7 @@ The shared history has 800 completed two-step turns, four tool calls per turn, a
The tool execution pipeline, request preparation, Session projections required by those services, persistence, and catalog observations remain production code. Only the model adapter and bounded tool body are synthetic. The adapter retains a request counter, not request objects, so the fixture cannot manufacture a growing retention cost. Sequential input means each idle interval belongs to the one request delivered by this worker; it does not generalize idle to a per-message completion API under concurrent input.
-The SDK fixture explicitly inserts `fs-local` and `str_replace_editor` through its profile patch. This preserves the calibrated file-view workload independently of the [minimal profile's shell-only defaults](../simplification/2026-09-03-minimal-profiles-persistent-shell-only.md). File reads, timing endpoints, and budgets remain the same.
+The SDK fixture explicitly inserts `fs-local` and `str_replace_editor` through its profile patch. This preserves the calibrated file-view workload independently of the [minimal profile's shell-only defaults](../../../../packages/bundle/sdk-minimal/README.md). File reads, timing endpoints, and budgets remain the same.
Five samples report raw wall time, CPU user/system time, peak RSS, endpoint counts, and the minimum, median, and maximum total wall time. Each aggregate report also records CPU models, available parallelism, platform, architecture, and Node/V8 versions after the timed workers exit. Budgets enforce the unrounded median. Continuation additionally measures retained heap against an initialized Host: two explicit GCs separated by an event-loop yield precede and follow the timed operation, while the idle Agent remains reachable. The measured delta therefore includes the resident historical Session and live additions, not just newly appended turns. GC and teardown are outside timing; flush is inside. Request-history retention starts after resume and is diagnostic only. Catalog peak RSS is diagnostic; no retained-heap budget claims to measure already-released parent observations.
@@ -39,7 +39,7 @@ The implementation reference is the PR #3537 merge on Apple M4 Pro, macOS arm64,
| Tool continuation | 358.953, 324.790, 318.861, 320.119, 322.896 | 324.280, 321.952, 340.409, 325.470, 324.312 | 322.896 / 324.312 | 340 | 850 |
| Child catalog | 318.730, 309.006, 311.404, 308.565, 310.105 | 308.670, 310.030, 280.086, 303.084, 284.829 | 310.105 / 303.084 | 320 | 800 |
-Continuation retains approximately 22.295 MiB; its source expectation is 23 MiB and its budget is 28.75 MiB. SDK time expectations use the existing [calibration helper](../../../../benchmarks/support/calibration.ts): 2× shared CI time scale and 1.25× variance headroom. Request history uses the direct hosted expectation in the [request-freeze calibration](../simplification/2026-09-06-agent-request-freeze-evidence.md), without the 2× scale. Memory uses only 1.25× headroom. The scale is inherited from the existing lane's calibration, not a new Linux measurement of these cases; CI evidence remains necessary when runner characteristics change. Baseline budgets protect the measured implementation; tighter budgets belong with a measured behavior-preserving fix.
+Continuation retains approximately 22.295 MiB; its source expectation is 23 MiB and its budget is 28.75 MiB. SDK time expectations use the existing [calibration helper](../../../../benchmarks/support/calibration.ts): 2× shared CI time scale and 1.25× variance headroom. Request history uses the direct hosted expectation in the [request-freeze calibration](../../../../benchmarks/agent-continuation/agent-continuation.bench.ts), without the 2× scale. Memory uses only 1.25× headroom. The scale is inherited from the existing lane's calibration, not a new Linux measurement of these cases; CI evidence remains necessary when runner characteristics change. Baseline budgets protect the measured implementation; tighter budgets belong with a measured behavior-preserving fix.
A separate plain-Node request-history CPU profile attributes 132.876 ms of sampled self time to deepFreeze called by buildRequest during a 211.300 ms operation. This identifies repeated traversal of already-frozen history as a focused investigation target, not a proven optimization result. Catalog first/repeat timings separately report the first and second parent-catalog observations.
diff --git a/.agents/notes/implemented/testing/2026-09-06-backend-continuation-performance.zh.md b/.agents/notes/implemented/testing/2026-09-06-backend-continuation-performance.zh.md
index 942cfd3752..9817b72a44 100644
--- a/.agents/notes/implemented/testing/2026-09-06-backend-continuation-performance.zh.md
+++ b/.agents/notes/implemented/testing/2026-09-06-backend-continuation-performance.zh.md
@@ -23,7 +23,7 @@ Status: implemented
工具执行管线、请求准备、这些服务所需的 Session 投影、持久化和目录观察均保留生产代码。只有模型适配器和有界工具体是合成的。适配器只保留请求计数，不保留请求对象，因此 fixture（测试前置数据）不会制造不断增长的保留成本。顺序输入使每个空闲区间对应此 worker 提交的唯一请求；这不代表并发输入时可以把空闲状态推广为逐消息完成 API。
-SDK fixture 通过 profile patch 显式插入 `fs-local` 和 `str_replace_editor`。这使经校准的文件查看负载不依赖[极简 profile 只提供 shell 的默认组合](../simplification/2026-09-03-minimal-profiles-persistent-shell-only.zh.md)。文件读取、计时终点和预算保持不变。
+SDK fixture 通过 profile patch 显式插入 `fs-local` 和 `str_replace_editor`。这使经校准的文件查看负载不依赖[极简 profile 只提供 shell 的默认组合](../../../../packages/bundle/sdk-minimal/README.zh.md)。文件读取、计时终点和预算保持不变。
五个样本报告原始壁钟时间、CPU 用户态／内核态时间、峰值 RSS、终点计数及总壁钟时间的最小值、中位数和最大值。每份汇总报告还在计时 worker 退出后记录 CPU 型号、可用并行度、平台、架构以及 Node/V8 版本。预算约束未经舍入的中位数。续聊还相对已初始化 Host 测量保留堆内存：计时操作前后各执行两次显式 GC，中间让出一次事件循环，空闲 Agent 始终可达。因此该增量包含常驻历史 Session 和实时追加，而不只是新轮次。GC 与资源释放不计时；flush 计时。请求历史的内存基线从恢复后开始，只作诊断。目录峰值 RSS 仅作诊断；没有保留堆预算声称衡量已经释放的父会话观察。
@@ -39,7 +39,7 @@ SDK fixture 通过 profile patch 显式插入 `fs-local` 和 `str_replace_editor
| 工具续聊 | 358.953, 324.790, 318.861, 320.119, 322.896 | 324.280, 321.952, 340.409, 325.470, 324.312 | 322.896 / 324.312 | 340 | 850 |
| 子会话目录 | 318.730, 309.006, 311.404, 308.565, 310.105 | 308.670, 310.030, 280.086, 303.084, 284.829 | 310.105 / 303.084 | 320 | 800 |
-续聊保留约 22.295 MiB；源码期望值为 23 MiB，预算为 28.75 MiB。SDK 时间期望值使用现有[校准辅助函数](../../../../benchmarks/support/calibration.ts)：2× 共享 CI 时间比例和 1.25× 波动余量。请求历史使用[请求冻结校准](../simplification/2026-09-06-agent-request-freeze-evidence.zh.md)中的直接托管期望值，不乘以 2× 比例。内存只使用 1.25× 余量。比例继承现有通道的校准，并非这些用例的新 Linux 实测值；runner 特征变化时仍需 CI 证据。基线预算保护实测实现；更紧预算属于有测量依据且保持行为的修复。
+续聊保留约 22.295 MiB；源码期望值为 23 MiB，预算为 28.75 MiB。SDK 时间期望值使用现有[校准辅助函数](../../../../benchmarks/support/calibration.ts)：2× 共享 CI 时间比例和 1.25× 波动余量。请求历史使用[请求历史基准](../../../../benchmarks/agent-continuation/agent-continuation.bench.ts)中的直接托管期望值，不乘以 2× 比例。内存只使用 1.25× 余量。比例继承现有通道的校准，并非这些用例的新 Linux 实测值；runner 特征变化时仍需 CI 证据。基线预算保护实测实现；更紧预算属于有测量依据且保持行为的修复。
独立的纯 Node 请求历史 CPU profile 在一次 211.300 ms 操作中，将 132.876 ms 采样自身时间归因于 buildRequest 调用的 deepFreeze。这把重复遍历已冻结历史定位为聚焦调查目标，不是已证实的优化结果。目录首次／重复时间分别报告第一次和第二次 parent 目录观察。
diff --git a/.agents/notes/implemented/testing/2026-09-06-client-assembly-test-line.i18n.yaml b/.agents/notes/implemented/testing/2026-09-06-client-assembly-test-line.i18n.yaml
deleted file mode 100644
index f4079749aa..0000000000
--- a/.agents/notes/implemented/testing/2026-09-06-client-assembly-test-line.i18n.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-06-client-assembly-test-line.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/testing/2026-09-06-client-assembly-test-line.md
-/agent-note-whole-client-test-tier-over-an-endpoint-named-remote-mock:
- en: f11c0f43c9f9be09
- zh: 991625645ac91f06
-/agent-note-whole-client-test-tier-over-an-endpoint-named-remote-mock/problem:
- en: 33c0c3670dae25c3
- zh: 4d91a11eea9bbb8f
-/agent-note-whole-client-test-tier-over-an-endpoint-named-remote-mock/decision:
- en: af415345cccb067e
- zh: 8e82f7136f61a80e
-/agent-note-whole-client-test-tier-over-an-endpoint-named-remote-mock/product-exports-added-for-the-tier:
- en: b45dd80dbe278c5f
- zh: cdfb145cd8fab276
-/agent-note-whole-client-test-tier-over-an-endpoint-named-remote-mock/alternatives-considered:
- en: 2898d540f4bb1ee2
- zh: a3e2f1ea4cc8154f
-/agent-note-whole-client-test-tier-over-an-endpoint-named-remote-mock/consequences:
- en: b6a9721dec64d304
- zh: 160edfa839b7d024
-/agent-note-whole-client-test-tier-over-an-endpoint-named-remote-mock/deferred:
- en: 1f18c8a38967698a
- zh: f6809d290748d9cf
-/agent-note-whole-client-test-tier-over-an-endpoint-named-remote-mock/testing:
- en: 84fd4b8cc4a4abc8
- zh: f5d8fcb31a6d103b
diff --git a/.agents/notes/implemented/testing/2026-09-06-frontend-performance-budgets.i18n.yaml b/.agents/notes/implemented/testing/2026-09-06-frontend-performance-budgets.i18n.yaml
index 1d0b70851d..5669420993 100644
--- a/.agents/notes/implemented/testing/2026-09-06-frontend-performance-budgets.i18n.yaml
+++ b/.agents/notes/implemented/testing/2026-09-06-frontend-performance-budgets.i18n.yaml
@@ -9,20 +9,26 @@
en: 9bf1200b5f980008
zh: d2dc07922817c581
/agent-note-frontend-large-session-performance-budgets/decision:
- en: 0ff66ffe55696498
- zh: c05736fde021bcc4
+ en: db46b4d42d64aa1b
+ zh: a21caffa675e8b42
/agent-note-frontend-large-session-performance-budgets/calibration:
- en: f3be2a0d346e80cc
- zh: c49cc56e7714f68c
+ en: 2bbee3ec0bc9e618
+ zh: b4f937d7f4f09ae5
/agent-note-frontend-large-session-performance-budgets/calibration/actual-ci-runs:
en: d4d6aebafcdb8c12
zh: 112d3ca1a4ea8ae1
/agent-note-frontend-large-session-performance-budgets/calibration/standard-hosted-expectations-and-input-scheduling:
- en: 8cb6299dbb42a9fe
- zh: 51ef49d4fcaeb92f
+ en: 346cd1b3d5acf0ea
+ zh: 42e08cd387f982c8
+/agent-note-frontend-large-session-performance-budgets/calibration/older-page-control-preparation:
+ en: de392f6c19df72ee
+ zh: 32cbabf9ebcacbcc
+/agent-note-frontend-large-session-performance-budgets/calibration/trajectory-readiness-polling:
+ en: bdcfefd7358e335b
+ zh: f718f66ca5944203
/agent-note-frontend-large-session-performance-budgets/alternatives-considered:
- en: 1472bd425ef0daec
- zh: a89811758d70331e
+ en: 4d2a4a64ccd14507
+ zh: 8a4aaf4d4abea13d
/agent-note-frontend-large-session-performance-budgets/consequences:
en: 3f4f510612875d54
zh: 3a4af464f159bfe8
diff --git a/.agents/notes/implemented/testing/2026-09-06-frontend-performance-budgets.md b/.agents/notes/implemented/testing/2026-09-06-frontend-performance-budgets.md
index ea91edf8d3..c6c53c364e 100644
--- a/.agents/notes/implemented/testing/2026-09-06-frontend-performance-budgets.md
+++ b/.agents/notes/implemented/testing/2026-09-06-frontend-performance-budgets.md
@@ -12,9 +12,9 @@ A fast Node conversation fold does not prove that a browser paints a long conver
The existing serial benchmark inventory includes two frontend owners: [active reconnect](../../../../benchmarks/active-stream-reconnect/README.md) and a [browser workflow](../../../../benchmarks/long-session-browser/README.md). The browser workflow combines cold open, older-page navigation, first Trajectory activation, return to Chat, and a paced response with trusted keyboard input into one sequential scenario. These are endpoints of one workflow, not independent cold scenarios. The settled conversation-fold benchmark remains unchanged.
-`build:bench` keeps the Node-only library and worker build. `test:bench` additionally builds the Web shell before running all cases; the required benchmark CI job follows the [standard hosted runner decision](2026-09-06-standard-hosted-benchmark-runner.md), unconditionally provisions Chromium and its Linux dependencies on that hosted runner, and enables the existing verbose gate output so successful raw samples remain available for calibration. Browser cases reuse the shipped-composition Web scaffold with private temporary roots and an atomically assigned loopback port. Only the nondeterministic model is replaced by synthetic replay. The scaffold Host runs under the existing Vitest source resolver; measured Client rendering runs built bundles in fresh Chromium processes. Browser wall times therefore include this test Host, transport, Playwright actionability, and rendering, and are not claims about a published Host process.
+`build:bench` keeps the Node-only library and worker build. `test:bench` additionally builds the Web shell before running all cases; the required benchmark CI job follows the [standard hosted runner reference](../../../../.github/workflows/ci.yml), unconditionally provisions Chromium and its Linux dependencies on that hosted runner, and enables the existing verbose gate output so successful raw samples remain available for calibration. Browser cases reuse the shipped-composition Web scaffold with private temporary roots and an atomically assigned loopback port. Only the nondeterministic model is replaced by synthetic replay. The scaffold Host runs under the existing Vitest source resolver; measured Client rendering runs built bundles in fresh Chromium processes. Browser wall times therefore include this test Host, transport, Playwright actionability, and rendering, and are not claims about a published Host process.
-The browser input contains 240 closed turns, 40 tool results, and 20 code fences, plus mixed-language prose and reasoning. Historical Assistant records carry matching compact streams built through the production accumulator with 12-character reasoning/text deltas and 8-character tool-argument deltas; empty streams would omit stored and transferred payload costs. Nine older-page actions exhaust this input from its observed 25-turn initial window; the readiness probe follows mounted turn growth rather than duplicating the pagination algorithm. Each sample uses a fresh scaffold and browser. Setup, seeding, browser launch, initial shell load, and sidebar expansion are excluded from open timing. Open ends at transcript availability and an editable composer; page and navigation timings end at their target DOM state. Two animation frames include a rendering opportunity, not hardware presentation or a guarantee that every offscreen node painted.
+The browser input contains 240 closed turns, 40 tool results, and 20 code fences, plus mixed-language prose and reasoning. Historical Assistant records carry matching compact streams built through the production accumulator with 12-character reasoning/text deltas and 8-character tool-argument deltas; empty streams would omit stored and transferred payload costs. Nine older-page actions exhaust this input from its observed 25-turn initial window; the readiness probe follows mounted turn growth rather than duplicating the pagination algorithm. Each sample uses a fresh scaffold and browser. Setup, seeding, browser launch, initial shell load, and sidebar expansion are excluded from open timing. Paging resolves exactly one current `Load earlier` control before timing, excluding its read-only accessibility lookup. The 875 ms paging ceiling includes actionability, the trusted click, mounted turn-tail growth and the final two animation frames; a replaced control fails. Open ends at transcript availability and an editable composer; page and navigation timings end at their target DOM state. Two animation frames include a rendering opportunity, not hardware presentation or a guarantee that every offscreen node painted.
The continuation sends 120 text deltas at 16 ms replay pacing. The input witness is installed before Enter submission from the focused composer; typing retains focus without a mouse-refocus action or a separate pre-input animation-frame wait. First/final marker lookups sample visible text inside the latest Assistant step on animation frames, avoiding selector retry backoff. Hidden text and markers in older steps cannot satisfy the observer. The first observation captures reply markers and focus in the browser; diagnostics are retrieved after typing to avoid an additional pre-input round trip. Diagnostics also capture browser-clock timestamps and focus at the first actual input event. Replay never waits for input; starvation can still fail overlap. The synchronous input witness reads that same bounded reply. Whole-history text and accessibility queries add observer CPU and garbage collection to the measured interval, so reducing that observer work is benchmark repair, not product optimization. It records Enter-to-first-visible-reply, trusted draft typing whose first actual input event observes the first reply but no completion marker, complete reply wall time through settled persistence and the new rendered turn-tail, and Chromium main-thread task duration. The complete wall budget adds the fixed 1984 ms scripted pacing to a scaled overhead allowance; input and completion have their own enforced budgets. Post-GC browser heap and DOM counts remain diagnostics because one endpoint does not prove a leak.
@@ -22,7 +22,7 @@ Reconnect uses three fresh compiled plain-Node children. Each creates a 100,000-
## Calibration
-Three-sample medians on the arm64 reference machine, Node 24.19 and Chromium 149.0.7827.55, at the PR #3537 merge, establish the baseline below. An isolated repeat follows a complete workflow smoke. Each browser sample reports raw endpoint values and every page; the paging verdict uses the median of the sample maxima. Reconnect reports all child measurements. The following historical reference table uses 8 ms replay pacing and includes a two-frame wait in first-reply timing. Standard-hosted open, paging, Trajectory, and reconnect expectations are recorded separately below; other source reference constants retain these allowances. The bounded-observer 261.60 ms paging median exceeds its 260 ms reference allowance but remains below its 650 ms CI limit; the shared 2× time scale and 1.25× variance allowance produce CI limits. Memory uses only variance allowance. The shared scale originates in Node CI calibration. Both actual x64 browser runs below pass the fixed budgets on unchanged benchmark code; this supplies repeated-run evidence for these runners, not a universal browser speed ratio.
+Three-sample medians on the arm64 reference machine, Node 24.19 and Chromium 149.0.7827.55, at the PR #3537 merge, establish the baseline below. An isolated repeat follows a complete workflow smoke. Each browser sample reports raw endpoint values and every page; the paging verdict uses the median of the sample maxima. Reconnect reports all child measurements. The following historical reference table uses 8 ms replay pacing and includes a two-frame wait in first-reply timing. Its paging samples include the accessibility lookup of the older-page control. Standard-hosted open, paging, Trajectory, and reconnect expectations are recorded separately below; other source reference constants retain these allowances. The bounded-observer 261.60 ms paging median exceeds its 260 ms reference allowance but remains below its 650 ms CI limit; the shared 2× time scale and 1.25× variance allowance produce CI limits. Memory uses only variance allowance. The shared scale originates in Node CI calibration. Both actual x64 browser runs below pass the fixed budgets on unchanged benchmark code; this supplies repeated-run evidence for these runners, not a universal browser speed ratio.
| Endpoint | Measured median | Reference allowance | Historical CI limit |
|---|---:|---:|---:|
@@ -58,7 +58,9 @@ All six browser samples report `inputOverlapped: true` and finish after the 241s
### Standard hosted expectations and input scheduling
-Run 34033336246, job 101487216170 on standard hosted Ubuntu with two CPUs records reconnect replacements of 46.574411, 46.067910, and 44.193704 ms, with 23.028 MiB retained heap. The endpoint-specific expectation is 50 ms; the existing 1.25× headroom gives a 63 ms integer ceiling. The 30 MiB memory budget and shared machine factor remain unchanged. Browser open records 681.276514 and 541.051233 ms before the third sample fails input overlap; both exceed the historical 500 ms limit. Repeated hosted open measurements below set its expectation and ceiling. Deterministic controls pass these recorded values and reject values above the new ceilings through the same assertions as the measured verdicts. Complete repeated hosted verdicts remain required; the two open values are not a three-sample median.
+Reconnect uses a 50 ms reference-machine allowance through the shared 2× CI time scale and 1.25× headroom, giving a 125 ms ceiling. Two isolated three-sample runs on Linux x64 EPYC 7763 / Node 24.18.0 measure 47.13 and 43.08 ms medians. Hosted Node 24.21.0 runs 36619857675 and 36621172285 measure 55.47 ms on Xeon 8573C and 65.69 ms on EPYC 9V74 with two available CPUs; their measured production path is unchanged. The latter run is 1.39–1.53× the local reconnect medians; its preparing-write and preparing-bash medians are 1.54–1.55× and 1.34–1.42× their local counterparts. The shared 2× factor covers these observed ratios; the raw samples do not isolate hardware from Node-version or scheduling effects. Both local and hosted reconnect runs retain 23.03 MiB, so the 30 MiB memory ceiling is unchanged. The same time assertion accepts recorded hosted medians, rejects the 65.69 ms median at the former 63 ms ceiling, and rejects synthetic 126 and 150 ms values at 125 ms. This is budget calibration, not a product speedup or a passing future CI verdict.
+
+Run 34033336246, job 101487216170 on standard hosted Ubuntu with two CPUs records reconnect replacements of 46.574411, 46.067910, and 44.193704 ms, with 23.028 MiB retained heap. Browser open records 681.276514 and 541.051233 ms before the third sample fails input overlap; both exceed the historical 500 ms limit. Repeated hosted open measurements below set its expectation and ceiling. Deterministic controls pass these recorded values and reject values above the new ceilings through the same assertions as the measured verdicts. Complete repeated hosted verdicts remain required; the two open values are not a three-sample median.
A local diagnostic with temporary 3× Chromium CPU throttling reproduces the overlap failure: the first marker becomes visible at 1321 ms, two animation frames finish at 1370 ms, and the composer click finishes at 1660 ms; the actual input is trusted but already sees DONE. Removing the frame wait and installing the witness before Send still leaves a run with first visibility at 1415 ms and click completion at 1726 ms, after the original 992 ms scripted stream. The fixed 16 ms cadence keeps the same 120 deltas and payload, providing 1984 ms of scripted pacing for this workload. Only that pacing term changes in the complete-wall allowance (4484 ms); input, first-reply, and main-thread overhead allowances remain unchanged. With the same diagnostic slowdown, three 16 ms samples reach first visibility at 1307/1479/1599 ms and accept trusted input before DONE; their post-DONE controls reject it. The diagnostic is not a CPU-ratio calibration. Each measured sample still requires trusted input while FIRST is present and DONE absent; a post-measurement trusted key after DONE must fail that same assertion. Host settlement and the 241st rendered turn-tail remain completion witnesses.
@@ -70,6 +72,20 @@ A controlled mouse-refocus delay waits for the real DONE marker without pausing
The current Trajectory acceptance limit is 650 ms, represented by a 520 ms target with the shared 1.25× headroom. Run 35095609422 records medians of 666.651723 ms and 630.843184 ms on its original attempt and retry. This explicit 4% relaxation of the former 625 ms limit accepts the retry median but still rejects the original median; it is a budget decision, not a measured product speedup. Recorded retry samples exercise the accepted range, and the same verdict assertion rejects 651 ms. Other endpoint budgets and workload parameters remain unchanged.
+### Older-page control preparation
+
+Older-page measurements wait for a uniquely named attached control before capturing it. Availability and read-only accessibility lookup are preparation; visibility, enabled/stable actionability, the trusted click, turn-tail growth and the final two frames remain timed. The historical 260 ms reference allowance, 261.60 ms median and 700 ms hosted expectation include the lookup that this endpoint excludes.
+
+Local samples with lookup excluded are 141.202083/126.114041/140.003334 ms, median 140.003334 ms. Hosted run 37272669722, benchmark job 111642813553 records 524.083466/355.648835/349.959862 ms, median 355.648835 ms, under the same 875 ms ceiling. These are observed samples, not a new calibration; the 700 ms expectation and 875 ms ceiling remain conservative retained limits pending repeated hosted measurements of this endpoint. The earlier same-checkout 887.624/441.989 ms CI medians include lookup and establish retry-cleared failure, not the composition of the first miss.
+
+### Trajectory readiness polling
+
+Trajectory activation samples its visible searchbox and a visible record inside `[data-trajectory-scroll]` on animation frames. Playwright's selector polling uses increasing delays up to 500 ms, so DOM readiness can precede the observer by hundreds of milliseconds. The trusted tab click, its actionability checks and the final two-frame wait remain timed; workload and the current 650 ms budget are unchanged.
+
+A controlled macOS arm64 diagnostic on Node 24.19.0, Chromium 149.0.7827.55 and Playwright 1.61.1 makes the searchbox and record ready after 300 or 350 ms. Selector waits take 793.082/791.053 ms and observe readiness 493.5/439.2 ms late; frame sampling takes 307.324/357.423 ms and observes it 8.1/7.9 ms late. This isolates conditional observer delay, not product latency or the cause of the first #4119 CI miss.
+
+Complete local 240-turn runs produce Trajectory samples of 157.795/146.737/148.571 ms before the observer change and 130.184/191.247/157.543 ms afterward, with medians 148.571 and 157.543 ms. Both runs pass every fixed endpoint budget; no local speedup or hosted calibration is claimed. The readiness regression rejects a hidden searchbox or record despite a visible unrelated table row; restoring the original selector waits makes that test fail.
+
## Alternatives considered
**Use the Node fold as paint evidence.** Rejected because it never performs DOM mutation, layout, or browser scheduling. The focused reconnect case likewise makes no GUI speed claim.
@@ -80,6 +96,8 @@ The current Trajectory acceptance limit is 650 ms, represented by a 520 ms targe
**Search the entire loaded history for every stream marker.** Rejected because Playwright injects text and accessibility scans into the same renderer whose CPU the benchmark measures. Scoping queries to the composer and latest Assistant preserves visible completion checks without making observer cost proportional to loaded history.
+**Raise the Trajectory budget or retry failed samples.** This retains the measured selector backoff and can accept slower product behavior. Frame-based readiness removes that observer delay without changing the budget.
+
**Measure stream CPU alone.** Rejected because transport stalls and final-settlement delays can leave main-thread CPU low. The independent input, first-reply, and complete-wall budgets cover those waits.
## Consequences
diff --git a/.agents/notes/implemented/testing/2026-09-06-frontend-performance-budgets.zh.md b/.agents/notes/implemented/testing/2026-09-06-frontend-performance-budgets.zh.md
index 84c115ef09..f2127f195b 100644
--- a/.agents/notes/implemented/testing/2026-09-06-frontend-performance-budgets.zh.md
+++ b/.agents/notes/implemented/testing/2026-09-06-frontend-performance-budgets.zh.md
@@ -12,9 +12,9 @@ Node 对话折叠很快，并不能证明浏览器能绘制长对话或在流式
现有串行基准清单包含两个前端所有者：[活跃重连](../../../../benchmarks/active-stream-reconnect/README.zh.md)和[浏览器工作流](../../../../benchmarks/long-session-browser/README.zh.md)。浏览器工作流在一个顺序场景中组合冷打开、更早分页导航、首次激活 Trajectory、返回 Chat，以及伴随真实键盘输入的有节奏回复。这些是同一工作流的测量终点，而不是相互独立的冷场景。已结算对话折叠基准保持不变。
-`build:bench` 保留仅 Node 的 library 与 worker 构建。`test:bench` 额外构建 Web shell 后再运行所有用例；必需的基准 CI job 遵循[标准托管运行器决策](2026-09-06-standard-hosted-benchmark-runner.zh.md)，在该托管运行器上无条件安装 Chromium 及其 Linux 依赖，并启用现有门禁详细输出，使成功用例的原始样本可用于校准。浏览器用例复用产品组合的 Web scaffold，使用私有临时目录和原子分配的回环端口。只有不确定的模型被合成重放替代。scaffold Host 通过现有 Vitest 源码解析器运行；被测 Client 渲染在全新 Chromium 进程中执行构建后的 bundle。因此浏览器壁钟时间包含测试 Host、传输、Playwright 可交互性等待及渲染，不代表发布版 Host 进程。
+`build:bench` 保留仅 Node 的 library 与 worker 构建。`test:bench` 额外构建 Web shell 后再运行所有用例；必需的基准 CI job 遵循[标准托管运行器说明](../../../../.github/workflows/ci.yml)，在该托管运行器上无条件安装 Chromium 及其 Linux 依赖，并启用现有门禁详细输出，使成功用例的原始样本可用于校准。浏览器用例复用产品组合的 Web scaffold，使用私有临时目录和原子分配的回环端口。只有不确定的模型被合成重放替代。scaffold Host 通过现有 Vitest 源码解析器运行；被测 Client 渲染在全新 Chromium 进程中执行构建后的 bundle。因此浏览器壁钟时间包含测试 Host、传输、Playwright 可交互性等待及渲染，不代表发布版 Host 进程。
-浏览器输入包含 240 个已关闭轮次、40 个工具结果和 20 个代码块，以及混合语言正文和推理。历史 Assistant 记录携带匹配的紧凑 stream，通过生产 accumulator 按 12 字符推理/文本 delta 和 8 字符工具参数 delta 构建；空 stream 会遗漏存储与传输负载成本。从观察到的初始 25 轮窗口开始，九次更早分页操作读完该输入；就绪探针跟踪已挂载轮次增长，不复制分页算法。每个样本使用全新 scaffold 和浏览器。环境准备、数据播种、浏览器启动、初始 shell 加载及侧栏展开不计入打开时间。打开测量在对话可用且输入框可编辑时结束；分页与导航测量在目标 DOM 状态出现时结束。两次动画帧包含一次渲染机会，不代表硬件显示或保证每个屏幕外节点都已绘制。
+浏览器输入包含 240 个已关闭轮次、40 个工具结果和 20 个代码块，以及混合语言正文和推理。历史 Assistant 记录携带匹配的紧凑 stream，通过生产 accumulator 按 12 字符推理/文本 delta 和 8 字符工具参数 delta 构建；空 stream 会遗漏存储与传输负载成本。从观察到的初始 25 轮窗口开始，九次更早分页操作读完该输入；就绪探针跟踪已挂载轮次增长，不复制分页算法。每个样本使用全新 scaffold 和浏览器。环境准备、数据播种、浏览器启动、初始 shell 加载及侧栏展开不计入打开时间。分页计时前解析恰好一个当前的 `Load earlier` 控件，将只读的无障碍查找归入准备。875 ms 分页上限仍包含可操作性等待、受信任的点击、已挂载 turn-tail 增长及最后两次动画帧；控件被替换时失败。打开测量在对话可用且输入框可编辑时结束；分页与导航测量在目标 DOM 状态出现时结束。两次动画帧包含一次渲染机会，不代表硬件显示或保证每个屏幕外节点都已绘制。
续接以 16 ms 重放间隔发送 120 个文本 delta。输入观察器在从已聚焦输入框按 Enter 提交前安装；键入保留焦点，不执行鼠标重新聚焦，也不单独等待输入前动画帧。首段/最终标记查找在动画帧上采样最新 Assistant step 内的可见文本，避免选择器重试退避。隐藏文本和较早步骤中的标记均不能满足观察条件。首次观察在浏览器内记录回复标记与焦点；诊断在键入后取回，避免增加输入前的通信往返。诊断还记录首个实际输入事件的浏览器时钟时间戳与焦点。重放从不等待输入；响应阻塞仍可能导致重叠失败。同步输入证据读取同一个受限回复。全历史文本与无障碍查询会向测量区间加入观察器 CPU 和垃圾回收成本，因此减少此类观察工作属于基准修正，而非产品优化。它记录 Enter 提交到首段可见回复的时间、首个实际输入事件观察到首段回复且完成标记尚未出现时的真实草稿键入、直到持久化结算并渲染新 turn-tail 的完整回复壁钟时间，以及 Chromium 主线程任务时间。完整壁钟预算在缩放后的额外开销额度上加固定的 1984 ms 脚本节奏；输入和完成均有独立执行的预算。强制 GC 后的浏览器 heap 和 DOM 数量仍仅供诊断，因为单个终点不能证明泄漏。
@@ -22,7 +22,7 @@ Node 对话折叠很快，并不能证明浏览器能绘制长对话或在流式
## 校准
-在 arm64 参考机器、Node 24.19、Chromium 149.0.7827.55 和PR #3537 合并结果 上，三个样本的中位数建立下表基线。完整工作流 smoke 后执行一次隔离重复测量。每个浏览器样本报告原始终点数据和每一页；分页判定使用各样本最大值的中位数。重连报告全部子进程测量。下列历史参考表使用 8 ms 重放节奏，首段回复计时包含两帧等待。标准托管打开、分页、Trajectory 和重连预期在下文单独记录；其他源码参考常量保留这些额度。受限观察器的分页中位数 261.60 ms 超过 260 ms 参考额度，但仍低于 650 ms CI 限制；共享的 2× 时间倍率和 1.25× 方差余量产生 CI 限制。内存仅使用方差余量。共享倍率源自 Node CI 校准。下述两次实际 x64 浏览器运行在基准代码不变的情况下均通过固定预算；这提供这些 runner 的重复运行证据，而非普遍适用的浏览器速度比。
+在 arm64 参考机器、Node 24.19、Chromium 149.0.7827.55 和PR #3537 合并结果 上，三个样本的中位数建立下表基线。完整工作流 smoke 后执行一次隔离重复测量。每个浏览器样本报告原始终点数据和每一页；分页判定使用各样本最大值的中位数。重连报告全部子进程测量。下列历史参考表使用 8 ms 重放节奏，首段回复计时包含两帧等待。其中的分页样本包含较早分页控件的无障碍查找。标准托管打开、分页、Trajectory 和重连预期在下文单独记录；其他源码参考常量保留这些额度。受限观察器的分页中位数 261.60 ms 超过 260 ms 参考额度，但仍低于 650 ms CI 限制；共享的 2× 时间倍率和 1.25× 方差余量产生 CI 限制。内存仅使用方差余量。共享倍率源自 Node CI 校准。下述两次实际 x64 浏览器运行在基准代码不变的情况下均通过固定预算；这提供这些 runner 的重复运行证据，而非普遍适用的浏览器速度比。
| 终点 | 实测中位数 | 参考额度 | 历史 CI 限制 |
|---|---:|---:|---:|
@@ -58,7 +58,9 @@ Node 对话折叠很快，并不能证明浏览器能绘制长对话或在流式
### 标准托管预期与输入调度
-运行 34033336246，job 101487216170 在双 CPU 标准托管 Ubuntu 上记录重连替换时间 46.574411、46.067910 和 44.193704 ms，保留 heap 为 23.028 MiB。该终点的预期为 50 ms；现有 1.25× 余量产生向上取整后的 63 ms 上限。30 MiB 内存预算及共享机器倍率不变。浏览器打开记录 681.276514 和 541.051233 ms，第三个样本因输入重叠失败而中止；两个值均超过历史 500 ms 上限。下文的托管打开重复测量决定其预期与上限。确定性对照通过这些记录值，并使用与测量判定相同的断言拒绝超过新上限的值。仍需完整的托管重复运行判定；这两个打开值不是三样本中位数。
+重连使用 50 ms 参考机器额度，通过共享的 2× CI 时间倍率与 1.25× 余量得到 125 ms 上限。Linux x64 EPYC 7763 / Node 24.18.0 上两轮独立三样本运行的中位数为 47.13 和 43.08 ms。托管 Node 24.21.0 运行 36619857675 与 36621172285 均有两个可用 CPU，分别在 Xeon 8573C 和 EPYC 9V74 上测得 55.47 与 65.69 ms；两次被测的生产路径没有变化。后一轮为本地重连中位数的 1.39–1.53×，其中 preparing-write 与 preparing-bash 中位数分别为本地对应值的 1.54–1.55× 和 1.34–1.42×。共享 2× 系数覆盖这些实测比例；原始样本未区分硬件、Node 版本或调度各自的影响。本地和托管重连都保留 23.03 MiB，因此 30 MiB 内存上限不变。同一个时间断言接受托管记录中位数，在旧 63 ms 上限下拒绝 65.69 ms 中位数，并在 125 ms 上限下拒绝合成的 126 与 150 ms 值。这是预算校准，不代表产品提速，也不代表后续 CI 已通过。
+
+运行 34033336246，job 101487216170 在双 CPU 标准托管 Ubuntu 上记录重连替换时间 46.574411、46.067910 和 44.193704 ms，保留 heap 为 23.028 MiB。浏览器打开记录 681.276514 和 541.051233 ms，第三个样本因输入重叠失败而中止；两个值均超过历史 500 ms 上限。下文的托管打开重复测量决定其预期与上限。确定性对照通过这些记录值，并使用与测量判定相同的断言拒绝超过新上限的值。仍需完整的托管重复运行判定；这两个打开值不是三样本中位数。
临时使用 3× Chromium CPU 降速的本地诊断复现重叠失败：首个标记在 1321 ms 可见，两次动画帧在 1370 ms 结束，输入框点击在 1660 ms 完成；实际输入是真实事件，但已看到 DONE。移除帧等待并在发送前安装观察器后，一次运行仍在 1415 ms 才看到首个标记，点击在 1726 ms 完成，晚于原先 992 ms 的脚本流。固定 16 ms 节奏保留相同的 120 个 delta 和负载，为该工作负载提供 1984 ms 脚本节奏。完整壁钟额度仅改变该节奏项（4484 ms）；输入、首段回复及主线程额外开销额度不变。在相同诊断降速下，三个 16 ms 样本在 1307/1479/1599 ms 达到首段可见状态，并接受 DONE 之前的真实输入；其 DONE 之后的对照拒绝该输入。该诊断不是 CPU 比率校准。每个测量样本仍要求真实输入发生时 FIRST 存在且 DONE 不存在；测量后在 DONE 之后发送的真实按键必须无法通过同一个断言。Host 结算和第 241 个已渲染 turn-tail 仍是完成证据。
@@ -70,6 +72,20 @@ Node 对话折叠很快，并不能证明浏览器能绘制长对话或在流式
当前 Trajectory 验收上限为 650 ms，由 520 ms 目标与共享的 1.25× 余量表示。运行 35095609422 的首次执行与重试分别记录中位数 666.651723 ms 和 630.843184 ms。相较于原先的 625 ms 上限，这次明确的 4% 放宽接受重试中位数，但仍拒绝首次中位数；这是预算决策，不代表测得产品提速。记录的重试样本覆盖新增的接受区间，同一个判定断言拒绝 651 ms。其他终点预算与工作负载参数保持不变。
+### 较早分页控件准备
+
+较早分页测量先等待具有唯一名称的控件挂载，再捕获该控件。可用性与只读的无障碍查找归入准备；可见、启用及稳定等可操作性检查、受信任的点击、turn-tail 增长和最后两帧仍计时。历史 260 ms 参考额度、261.60 ms 中位数及 700 ms 托管预期包含当前终点已排除的查找。
+
+排除查找后的本地样本为 141.202083/126.114041/140.003334 ms，中位数 140.003334 ms。托管运行 37272669722 的 benchmark job 111642813553 记录 524.083466/355.648835/349.959862 ms，中位数 355.648835 ms，仍通过相同的 875 ms 上限。这些是观察样本，不是新校准；700 ms 预期与 875 ms 上限作为保守的现有值保留，待此终点的重复托管测量核验。先前相同 checkout 的 887.624/441.989 ms CI 中位数包含查找，只建立重跑可清除的失败，不分解首次超限的组成。
+
+### Trajectory 就绪轮询
+
+Trajectory 激活在动画帧上采样可见搜索框与 `[data-trajectory-scroll]` 内的可见记录。Playwright 选择器轮询使用逐步增加、最高 500 ms 的延迟，因此 DOM 可能比观察器早数百毫秒就绪。真实 tab 点击、其可交互性检查与最后两帧等待仍计时；工作负载与当前 650 ms 预算不变。
+
+在 macOS arm64、Node 24.19.0、Chromium 149.0.7827.55 和 Playwright 1.61.1 上，受控诊断使搜索框与记录在 300 或 350 ms 后就绪。选择器等待耗时 793.082/791.053 ms，晚 493.5/439.2 ms 观察到就绪；动画帧采样耗时 307.324/357.423 ms，晚 8.1/7.9 ms 观察到就绪。这隔离了有条件发生的观察器延迟，不代表产品延迟，也不能证明 #4119 首次 CI 超限的原因。
+
+完整本地 240 轮运行在修改观察器前得到 Trajectory 样本 157.795/146.737/148.571 ms，修改后为 130.184/191.247/157.543 ms，中位数分别为 148.571 和 157.543 ms。两次运行均通过所有固定终点预算；不声称本地提速或托管环境校准。即使存在可见的无关表格行，就绪回归测试仍拒绝隐藏的搜索框或记录；恢复原选择器等待会使该测试失败。
+
## 考虑过的替代方案
**用 Node 折叠作为绘制证据。** 拒绝，因为它不执行 DOM 修改、布局或浏览器调度。聚焦重连用例同样不声称 GUI 提速。
@@ -80,6 +96,8 @@ Node 对话折叠很快，并不能证明浏览器能绘制长对话或在流式
**每次流式标记查找都搜索全部已加载历史。** 拒绝，因为 Playwright 把文本与无障碍扫描注入同一个被测 CPU 的渲染进程。将查询限定在输入框和最新 Assistant 中，可保留可见完成检查，同时避免观察器成本随已加载历史增长。
+**提高 Trajectory 预算或重试失败样本。** 这会保留已测得的选择器退避，并可能接受更慢的产品行为。基于动画帧的就绪观察移除该观察器延迟，不改变预算。
+
**只测量流式 CPU。** 拒绝，因为传输停顿和最终结算延迟可能不增加主线程 CPU。独立的输入、首段回复和完整壁钟预算覆盖这些等待。
## 影响
diff --git a/.agents/notes/implemented/testing/2026-09-06-pr-ci-runner-temporary-storage.i18n.yaml b/.agents/notes/implemented/testing/2026-09-06-pr-ci-runner-temporary-storage.i18n.yaml
deleted file mode 100644
index aa5bb20d1f..0000000000
--- a/.agents/notes/implemented/testing/2026-09-06-pr-ci-runner-temporary-storage.i18n.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-06-pr-ci-runner-temporary-storage.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/testing/2026-09-06-pr-ci-runner-temporary-storage.md
-/agent-note-runner-owned-temporary-storage-for-pr-ci:
- en: 2f9ebea4c52687b3
- zh: 5924c9657eea7ff7
-/agent-note-runner-owned-temporary-storage-for-pr-ci/problem:
- en: 5787327a360024d9
- zh: ee9b8cb63d79e551
-/agent-note-runner-owned-temporary-storage-for-pr-ci/decision:
- en: 44990c35e1cb69cb
- zh: 38a6bed07b5596e3
-/agent-note-runner-owned-temporary-storage-for-pr-ci/recorded-acp-completion-order:
- en: 51f2f962db14ba9c
- zh: 5fc8a908431c3865
-/agent-note-runner-owned-temporary-storage-for-pr-ci/workspace-grant-fixture-placement:
- en: 1008b2fc61d01b10
- zh: f5314d10980611ef
-/agent-note-runner-owned-temporary-storage-for-pr-ci/live-verification-and-browser-fixture-inputs:
- en: 0f8e8478a3fb6486
- zh: 5d74c6902ea9831c
-/agent-note-runner-owned-temporary-storage-for-pr-ci/alternatives-considered:
- en: 8b0f2798f91ff190
- zh: f6e871a723e4d079
-/agent-note-runner-owned-temporary-storage-for-pr-ci/consequences:
- en: ff73f9c3daeb33be
- zh: 28f4245c275c4109
diff --git a/.agents/notes/implemented/testing/2026-09-06-python-runtime-install-retry.i18n.yaml b/.agents/notes/implemented/testing/2026-09-06-python-runtime-install-retry.i18n.yaml
deleted file mode 100644
index 4a7ab9e93d..0000000000
--- a/.agents/notes/implemented/testing/2026-09-06-python-runtime-install-retry.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-06-python-runtime-install-retry.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/testing/2026-09-06-python-runtime-install-retry.md
-/agent-note-bounded-retry-for-python-runtime-dependency-install:
- en: 610eeadbda25f100
- zh: e063790ef0b766c9
-/agent-note-bounded-retry-for-python-runtime-dependency-install/problem:
- en: ea99de707130a978
- zh: 0d8d853cf38e903a
-/agent-note-bounded-retry-for-python-runtime-dependency-install/decision:
- en: 8a91f9e5ade1fbbe
- zh: 82851f2d37f6a216
-/agent-note-bounded-retry-for-python-runtime-dependency-install/alternatives-considered:
- en: c9bee05dfbb068aa
- zh: 7f0712a941209116
-/agent-note-bounded-retry-for-python-runtime-dependency-install/consequences:
- en: 4d036332d39c88a6
- zh: aac5dd7e7f09df2a
diff --git a/.agents/notes/implemented/testing/2026-09-06-standard-hosted-benchmark-runner.i18n.yaml b/.agents/notes/implemented/testing/2026-09-06-standard-hosted-benchmark-runner.i18n.yaml
deleted file mode 100644
index 50c9f04da5..0000000000
--- a/.agents/notes/implemented/testing/2026-09-06-standard-hosted-benchmark-runner.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-06-standard-hosted-benchmark-runner.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/testing/2026-09-06-standard-hosted-benchmark-runner.md
-/agent-note-standard-hosted-runner-for-required-benchmarks:
- en: 07d81b0ddc7349cd
- zh: 0494136a627f09a4
-/agent-note-standard-hosted-runner-for-required-benchmarks/problem:
- en: e930cd992a15b811
- zh: fe791e9581ff6a35
-/agent-note-standard-hosted-runner-for-required-benchmarks/decision:
- en: 07bc990d5c68d617
- zh: 5bf08df36181b2a6
-/agent-note-standard-hosted-runner-for-required-benchmarks/alternatives-considered:
- en: 82f0eab2a8e66383
- zh: 6677a34a53b8915f
-/agent-note-standard-hosted-runner-for-required-benchmarks/consequences:
- en: 173caff985f5ff21
- zh: 83f3ef068ec62439
diff --git a/.agents/notes/implemented/testing/2026-09-07-publint-test-subprocess-lifetime.i18n.yaml b/.agents/notes/implemented/testing/2026-09-07-publint-test-subprocess-lifetime.i18n.yaml
deleted file mode 100644
index 336d27a518..0000000000
--- a/.agents/notes/implemented/testing/2026-09-07-publint-test-subprocess-lifetime.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-07-publint-test-subprocess-lifetime.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/testing/2026-09-07-publint-test-subprocess-lifetime.md
-/agent-note-publint-test-subprocesses-inherit-the-execution-lane-deadline:
- en: 762197e4e97b62a1
- zh: a2ac103348f6e692
-/agent-note-publint-test-subprocesses-inherit-the-execution-lane-deadline/problem:
- en: a5fb106b97023934
- zh: 537bd40564850192
-/agent-note-publint-test-subprocesses-inherit-the-execution-lane-deadline/decision:
- en: 62cc75fa54d44d80
- zh: 72d296ea1d5448bc
-/agent-note-publint-test-subprocesses-inherit-the-execution-lane-deadline/alternatives-considered:
- en: 5cc52a67c84dd039
- zh: 9fdc5ac07da9a056
-/agent-note-publint-test-subprocesses-inherit-the-execution-lane-deadline/consequences:
- en: a2d7dabc61d37634
- zh: 753addcc45383715
diff --git a/.agents/notes/implemented/testing/2026-09-07-pwsh-ci-observable-completion.i18n.yaml b/.agents/notes/implemented/testing/2026-09-07-pwsh-ci-observable-completion.i18n.yaml
deleted file mode 100644
index d9e1bb9952..0000000000
--- a/.agents/notes/implemented/testing/2026-09-07-pwsh-ci-observable-completion.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-07-pwsh-ci-observable-completion.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/testing/2026-09-07-pwsh-ci-observable-completion.md
-/agent-note-powershell-ci-completion-and-profile-expectations:
- en: 30366de41f8f71f6
- zh: d343887adae38ef4
-/agent-note-powershell-ci-completion-and-profile-expectations/problem:
- en: 5806986dfd58191c
- zh: ac082211e112c2d4
-/agent-note-powershell-ci-completion-and-profile-expectations/decision:
- en: f23d0691bc168ad7
- zh: 2873eb08c925f2f6
-/agent-note-powershell-ci-completion-and-profile-expectations/alternatives-considered:
- en: 6fde4f1b34fdd5e7
- zh: 6bc1ef73ce0e2645
-/agent-note-powershell-ci-completion-and-profile-expectations/consequences:
- en: d486f9db082655db
- zh: 01c46ff6b700cb15
diff --git a/.agents/notes/implemented/testing/2026-09-07-subagent-teardown-test-budgets.i18n.yaml b/.agents/notes/implemented/testing/2026-09-07-subagent-teardown-test-budgets.i18n.yaml
deleted file mode 100644
index bd3c2101c7..0000000000
--- a/.agents/notes/implemented/testing/2026-09-07-subagent-teardown-test-budgets.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-07-subagent-teardown-test-budgets.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/testing/2026-09-07-subagent-teardown-test-budgets.md
-/agent-note-subagent-teardown-tests-inherit-their-execution-lane-budgets:
- en: b704be92bc9b9b3c
- zh: 4154bd2d89177e5d
-/agent-note-subagent-teardown-tests-inherit-their-execution-lane-budgets/problem:
- en: 5853599207f6b3bb
- zh: d58b5e8e19d93a4f
-/agent-note-subagent-teardown-tests-inherit-their-execution-lane-budgets/decision:
- en: f2f641fe1f271edf
- zh: 321df1f4ea9e783d
-/agent-note-subagent-teardown-tests-inherit-their-execution-lane-budgets/alternatives-considered:
- en: 3ad30b2574818a61
- zh: d323adddd5065ae4
-/agent-note-subagent-teardown-tests-inherit-their-execution-lane-budgets/consequences:
- en: 20d060fe30ada016
- zh: c73937bffbb251c0
diff --git a/.agents/notes/implemented/testing/2026-09-08-ci-completion-observations.i18n.yaml b/.agents/notes/implemented/testing/2026-09-08-ci-completion-observations.i18n.yaml
deleted file mode 100644
index dc92e99d72..0000000000
--- a/.agents/notes/implemented/testing/2026-09-08-ci-completion-observations.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-08-ci-completion-observations.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/testing/2026-09-08-ci-completion-observations.md
-/agent-note-ci-fixture-completion-and-isolation:
- en: f5c180b0aad40b22
- zh: 89af7791bfbed707
-/agent-note-ci-fixture-completion-and-isolation/problem:
- en: b7350054dcefd411
- zh: 61fd5b508f804ca1
-/agent-note-ci-fixture-completion-and-isolation/decision:
- en: 8b245a4f4974e855
- zh: 93963695545d13ed
-/agent-note-ci-fixture-completion-and-isolation/decision/built-client-import-classification:
- en: 443f119bc5d5b49f
- zh: b1c53efd3a216d63
-/agent-note-ci-fixture-completion-and-isolation/alternatives-considered:
- en: 569976702b273da6
- zh: 3a5e5faba0074398
-/agent-note-ci-fixture-completion-and-isolation/consequences:
- en: 168df70afdad308d
- zh: 0e77a4741fa8024b
diff --git a/.agents/notes/implemented/testing/2026-09-08-ci-readiness-and-completion.i18n.yaml b/.agents/notes/implemented/testing/2026-09-08-ci-readiness-and-completion.i18n.yaml
deleted file mode 100644
index bef8854202..0000000000
--- a/.agents/notes/implemented/testing/2026-09-08-ci-readiness-and-completion.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-08-ci-readiness-and-completion.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/testing/2026-09-08-ci-readiness-and-completion.md
-/agent-note-ci-assertions-wait-for-owned-completion:
- en: 784e4056f020fab9
- zh: 941e7091a7621c9e
-/agent-note-ci-assertions-wait-for-owned-completion/problem:
- en: a7fe3958c0c18911
- zh: cce83727500187bc
-/agent-note-ci-assertions-wait-for-owned-completion/decision:
- en: 2b0ff4ab1d18bd1c
- zh: 39556bf95aec3c56
-/agent-note-ci-assertions-wait-for-owned-completion/alternatives-considered:
- en: 07ee7017cc6f6e74
- zh: b42f742932edd3f8
-/agent-note-ci-assertions-wait-for-owned-completion/consequences:
- en: 70258f58a1e781bb
- zh: fabc014ced9872f5
diff --git a/.agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.i18n.yaml b/.agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.i18n.yaml
deleted file mode 100644
index 4eb8c76f25..0000000000
--- a/.agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-09-user-patch-hmr-test-delivery.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.md
-/agent-note-user-patch-tests-control-filesystem-event-delivery:
- en: c2c70a16f6deea8b
- zh: 3b11c81b87910ce7
-/agent-note-user-patch-tests-control-filesystem-event-delivery/problem:
- en: 3f8862080b8c3c89
- zh: 0e83c485f02c10f1
-/agent-note-user-patch-tests-control-filesystem-event-delivery/decision:
- en: 601a3437a4332b69
- zh: 2b6bcc4636314c31
-/agent-note-user-patch-tests-control-filesystem-event-delivery/alternatives-considered:
- en: 5d559ee291e2e15e
- zh: 828e7def587d71e8
-/agent-note-user-patch-tests-control-filesystem-event-delivery/consequences:
- en: da9f64f4d269cece
- zh: 6bbbcc771c5fbcde
diff --git a/.agents/notes/implemented/testing/2026-09-10-desktop-local-updater-qualification.i18n.yaml b/.agents/notes/implemented/testing/2026-09-10-desktop-local-updater-qualification.i18n.yaml
index f61ba057a5..eccd96c807 100644
--- a/.agents/notes/implemented/testing/2026-09-10-desktop-local-updater-qualification.i18n.yaml
+++ b/.agents/notes/implemented/testing/2026-09-10-desktop-local-updater-qualification.i18n.yaml
@@ -15,5 +15,5 @@
en: f93809633864e337
zh: 4bd2141c2a36e1ac
/agent-note-qualify-desktop-update-downloads-with-an-isolated-local-server/consequences:
- en: 4ef44c91915206b5
- zh: f4ecf7b2d6df4932
+ en: eeb58f3bd35349b8
+ zh: d9276458e6a57ae6
diff --git a/.agents/notes/implemented/testing/2026-09-10-desktop-local-updater-qualification.md b/.agents/notes/implemented/testing/2026-09-10-desktop-local-updater-qualification.md
index 10c0a38410..543fa05b99 100644
--- a/.agents/notes/implemented/testing/2026-09-10-desktop-local-updater-qualification.md
+++ b/.agents/notes/implemented/testing/2026-09-10-desktop-local-updater-qualification.md
@@ -30,7 +30,7 @@ The executable scenarios cover no update, downgrade rejection, HTTP 404/408 and
The ordinary polling regression uses the real coordinator with a fake clock, instance-local random samples, and deferred network completion. It verifies completion-based jitter, capped exponential backoff, successful reset, manual failure visibility while joining an automatic check, retained download failures and prepared packages, and no timer rearming after disposal. Main-entry tests connect the same deadline to focus, resume, explicit IPC, and application shutdown. Removing failure backoff makes the timing assertion fail. These deterministic tests establish request timing, not fleet capacity or startup-burst distribution.
-The actual [mandatory-update window](../feature/2026-09-11-desktop-mandatory-update-client.md), sandboxed preload, and renderer button handlers run against the policy server and updater. A stalled policy request reaches its real deadline without clearing the block. Owner-local DOM expectations pin Chinese text and actions. Screenshot failures are recorded separately; missing screenshots cannot establish visual acceptance.
+The actual [mandatory-update window](../../../../apps/desktop/README.md), sandboxed preload, and renderer button handlers run against the policy server and updater. A stalled policy request reaches its real deadline without clearing the block. Owner-local DOM expectations pin Chinese text and actions. Screenshot failures are recorded separately; missing screenshots cannot establish visual acceptance.
The [workspace browser scenario](../../../../apps/web/tests/desktop-updates.e2e.ts) checks built sidebar composition in both locales against the production presentation function. A page-local carrier supplies update state and records actions; the Host, client plugins, styles, and connection remain real. This separates slot placement and click-guard evidence from Electron IPC, task authorization, and installation evidence. Screenshots and result files use an invocation-specific ignored directory and do not replace release qualification.
diff --git a/.agents/notes/implemented/testing/2026-09-10-desktop-local-updater-qualification.zh.md b/.agents/notes/implemented/testing/2026-09-10-desktop-local-updater-qualification.zh.md
index 9d554bc500..94c95e8cc8 100644
--- a/.agents/notes/implemented/testing/2026-09-10-desktop-local-updater-qualification.zh.md
+++ b/.agents/notes/implemented/testing/2026-09-10-desktop-local-updater-qualification.zh.md
@@ -30,7 +30,7 @@ Desktop 更新交互依赖清单解析、网络失败、下载完整性和平台
常规轮询回归使用真实协调器、模拟时钟、实例私有随机样本和可控的网络完成时机。它验证从完成时刻起算的抖动、有上限的指数退避、成功重置、手动复用自动检查时的失败可见性、下载失败和已准备安装包保留，以及 dispose 后不重新启动计时器。主入口测试将同一期限连接到窗口聚焦、系统恢复、显式 IPC 和应用退出。移除失败退避会使计时断言失败。这些确定性测试证明请求时序，不证明客户端总体容量或启动峰值分布。
-真实的[强更窗口](../feature/2026-09-11-desktop-mandatory-update-client.zh.md)、沙箱预加载和页面按钮处理会对接策略服务器与 updater。停滞的策略请求达到真实截止时间后不会清除阻塞。所属测试目录内的 DOM 预期输出约束中文文案和操作。截图失败单独记录；缺少截图不能证明视觉验收通过。
+真实的[强更窗口](../../../../apps/desktop/README.zh.md)、沙箱预加载和页面按钮处理会对接策略服务器与 updater。停滞的策略请求达到真实截止时间后不会清除阻塞。所属测试目录内的 DOM 预期输出约束中文文案和操作。截图失败单独记录；缺少截图不能证明视觉验收通过。
[工作区浏览器场景](../../../../apps/web/tests/desktop-updates.e2e.ts) 使用生产展示函数检查两种语言下构建后的侧栏组合。页面私有的载体提供更新状态并记录操作；Host、客户端插件、样式和连接保持真实。slot 位置与点击保护的证据因此与 Electron IPC、任务授权和安装证据分开。截图和结果文件使用每次调用独有的忽略目录，不替代发布验收。
diff --git a/.agents/notes/implemented/testing/2026-09-10-hosted-image-test-assumptions.i18n.yaml b/.agents/notes/implemented/testing/2026-09-10-hosted-image-test-assumptions.i18n.yaml
deleted file mode 100644
index 72274416f8..0000000000
--- a/.agents/notes/implemented/testing/2026-09-10-hosted-image-test-assumptions.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-10-hosted-image-test-assumptions.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/testing/2026-09-10-hosted-image-test-assumptions.md
-/agent-note-hosted-image-assumptions-in-the-coverage-suite:
- en: b9e6c590cb18c637
- zh: 02591776cec956ea
-/agent-note-hosted-image-assumptions-in-the-coverage-suite/problem:
- en: c1299114bcbbbbc2
- zh: 1b38aa9c8b0a4eef
-/agent-note-hosted-image-assumptions-in-the-coverage-suite/decision:
- en: 00b0e2ef25435ad3
- zh: 9bf59f5ca765a94b
-/agent-note-hosted-image-assumptions-in-the-coverage-suite/alternatives-considered:
- en: 7cc99ab98600ed3f
- zh: c302b579791a403d
-/agent-note-hosted-image-assumptions-in-the-coverage-suite/consequences:
- en: 96ad46667a025f85
- zh: ba04b1436b82a620
diff --git a/.agents/notes/implemented/testing/2026-09-12-connection-and-compaction-fixture-preconditions.i18n.yaml b/.agents/notes/implemented/testing/2026-09-12-connection-and-compaction-fixture-preconditions.i18n.yaml
deleted file mode 100644
index 52fcc8494f..0000000000
--- a/.agents/notes/implemented/testing/2026-09-12-connection-and-compaction-fixture-preconditions.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-12-connection-and-compaction-fixture-preconditions.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/testing/2026-09-12-connection-and-compaction-fixture-preconditions.md
-/agent-note-connection-and-compaction-fixture-preconditions:
- en: ea762fbdd18bdce3
- zh: 5795a728fd210f69
-/agent-note-connection-and-compaction-fixture-preconditions/problem:
- en: 43949801eda059d6
- zh: 83b579735b9d3e3f
-/agent-note-connection-and-compaction-fixture-preconditions/decision:
- en: 4e7091381ce185cf
- zh: 6e36499f5b5e46f9
-/agent-note-connection-and-compaction-fixture-preconditions/alternatives-considered:
- en: b8842654dbe80f4c
- zh: e4b80e80d89203b0
-/agent-note-connection-and-compaction-fixture-preconditions/consequences:
- en: 054ce1f776693cc9
- zh: dd542b1ccb1cc07d
diff --git a/.agents/notes/implemented/testing/2026-09-14-desktop-installed-update-materials.i18n.yaml b/.agents/notes/implemented/testing/2026-09-14-desktop-installed-update-materials.i18n.yaml
index 17cae8945a..e5f30837c8 100644
--- a/.agents/notes/implemented/testing/2026-09-14-desktop-installed-update-materials.i18n.yaml
+++ b/.agents/notes/implemented/testing/2026-09-14-desktop-installed-update-materials.i18n.yaml
@@ -9,8 +9,8 @@
en: 8d63b992ff6d3161
zh: 86d333255a5400d3
/agent-note-isolate-installed-update-materials-from-releases-and-user-data/decision:
- en: 7778333c76ab9b5d
- zh: fa35b0a12a31ea23
+ en: 815a1c062134d958
+ zh: 05d7d89099e6911c
/agent-note-isolate-installed-update-materials-from-releases-and-user-data/alternatives-considered:
en: c608f186cc94a9d3
zh: 39750c8347e8bece
diff --git a/.agents/notes/implemented/testing/2026-09-14-desktop-installed-update-materials.md b/.agents/notes/implemented/testing/2026-09-14-desktop-installed-update-materials.md
index 1813c6d9bb..24209c1cce 100644
--- a/.agents/notes/implemented/testing/2026-09-14-desktop-installed-update-materials.md
+++ b/.agents/notes/implemented/testing/2026-09-14-desktop-installed-update-materials.md
@@ -10,7 +10,7 @@ An installed-update walkthrough needs two increasing versions with a shared appl
## Decision
-Version derivation follows the [release version decision](../process/2026-09-16-desktop-release-version-derivation.md); this record continues to govern material, application identity, and user-data isolation.
+Version derivation follows the [release version reference](../../../../apps/desktop/README.md); this record continues to govern material, application identity, and user-data isolation.
The [material preparer](../../../../apps/desktop/scripts/prepare-installed-update-runtime.ts) accepts a retained test-only manifest with a random identity and distribution namespace. It copies a verified source runtime into separate derived test versions, changes only release-family versions and matching dependency references, and seals and verifies both inventories. The original runtime is verified again and its descriptor hash must remain unchanged. Existing output directories are not overwritten; a failed copy retains a failure record and cannot create a completion receipt.
diff --git a/.agents/notes/implemented/testing/2026-09-14-desktop-installed-update-materials.zh.md b/.agents/notes/implemented/testing/2026-09-14-desktop-installed-update-materials.zh.md
index b92bb70b32..22ceec3f7b 100644
--- a/.agents/notes/implemented/testing/2026-09-14-desktop-installed-update-materials.zh.md
+++ b/.agents/notes/implemented/testing/2026-09-14-desktop-installed-update-materials.zh.md
@@ -10,7 +10,7 @@ Status: implemented
## 决策
-版本派生遵循[发布版本决策](../process/2026-09-16-desktop-release-version-derivation.zh.md)；本记录继续规定物料、应用身份和用户数据的隔离。
+版本派生遵循[发布版本说明](../../../../apps/desktop/README.zh.md)；本记录继续规定物料、应用身份和用户数据的隔离。
[物料准备器](../../../../apps/desktop/scripts/prepare-installed-update-runtime.ts)接受保留的 test 专用清单，其中包含随机身份和分发命名空间。它将已验证的原始运行时复制为独立的派生测试版本，仅修改发布家族版本和匹配的依赖引用，再生成并验证两个完整性清单。原始运行时再次验证，其描述文件哈希必须保持不变。已有输出目录不被覆盖；复制失败保留失败记录，不能生成完成回执。
diff --git a/.agents/notes/implemented/testing/2026-09-26-web-conversation-clock-fixture-day.i18n.yaml b/.agents/notes/implemented/testing/2026-09-26-web-conversation-clock-fixture-day.i18n.yaml
deleted file mode 100644
index 8f91e16be8..0000000000
--- a/.agents/notes/implemented/testing/2026-09-26-web-conversation-clock-fixture-day.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-26-web-conversation-clock-fixture-day.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/testing/2026-09-26-web-conversation-clock-fixture-day.md
-/agent-note-web-conversation-clocks-on-the-fixture-day:
- en: 13b5d9d0bb3626af
- zh: 0bd01e1848284a35
-/agent-note-web-conversation-clocks-on-the-fixture-day/problem:
- en: 6f334488a6d3a28d
- zh: b33aed9b10d0cd84
-/agent-note-web-conversation-clocks-on-the-fixture-day/decision:
- en: ba875c82795d58e1
- zh: 13a7df6f8c4e0aa6
-/agent-note-web-conversation-clocks-on-the-fixture-day/alternatives-considered:
- en: 9c0a2afb1473c1d1
- zh: 36c9e72a70072f5e
-/agent-note-web-conversation-clocks-on-the-fixture-day/verification:
- en: 5031ca866fed24dd
- zh: c11f71af70c1f5ec
-/agent-note-web-conversation-clocks-on-the-fixture-day/consequences:
- en: c5cdbbd3b2889df7
- zh: 8458ef92443cf1a6
diff --git a/.agents/notes/implemented/testing/2026-09-27-observation-waits-on-observed-state.i18n.yaml b/.agents/notes/implemented/testing/2026-09-27-observation-waits-on-observed-state.i18n.yaml
index 31f8796929..21215ea682 100644
--- a/.agents/notes/implemented/testing/2026-09-27-observation-waits-on-observed-state.i18n.yaml
+++ b/.agents/notes/implemented/testing/2026-09-27-observation-waits-on-observed-state.i18n.yaml
@@ -15,8 +15,8 @@
en: 00e59c561085e081
zh: 4f6ac4dfc3259f58
/agent-note-windows-lane-observations-wait-on-the-state-they-read/consequences:
- en: 46517270dd3b22b1
- zh: 94e300066237cece
+ en: ee581d7bbdfb3da8
+ zh: ea0fdd1b35543dc2
/agent-note-windows-lane-observations-wait-on-the-state-they-read/deferred:
en: 8e182739fdf90baf
zh: 5f93f7b7d9518764
diff --git a/.agents/notes/implemented/testing/2026-09-27-observation-waits-on-observed-state.md b/.agents/notes/implemented/testing/2026-09-27-observation-waits-on-observed-state.md
index 2f7a15921e..67d6a1d22b 100644
--- a/.agents/notes/implemented/testing/2026-09-27-observation-waits-on-observed-state.md
+++ b/.agents/notes/implemented/testing/2026-09-27-observation-waits-on-observed-state.md
@@ -30,7 +30,7 @@ The loader-composition settle-reason assertions carry the recorded reasons and a
Both plugin-manager record cases now observe the record while the run is in flight on a loaded runner, and a genuinely missing record still fails the same assertion. The bounded wait costs 2 s only when the operation never writes the record.
-[The task-detail close note](2026-09-28-detail-close-waits-on-observed-state.md) applies the same rule to a web client case, where the sampled state lands in a passive effect one commit after the list the case already awaited.
+The [archived task-detail close diagnosis](../../archived/testing/2026-09-28-detail-close-waits-on-observed-state.md) records the same rule in a Web client case, where the sampled state landed in a passive effect one commit after the list the case had awaited.
## Deferred
diff --git a/.agents/notes/implemented/testing/2026-09-27-observation-waits-on-observed-state.zh.md b/.agents/notes/implemented/testing/2026-09-27-observation-waits-on-observed-state.zh.md
index 6c38e1ae06..bf68cedd95 100644
--- a/.agents/notes/implemented/testing/2026-09-27-observation-waits-on-observed-state.zh.md
+++ b/.agents/notes/implemented/testing/2026-09-27-observation-waits-on-observed-state.zh.md
@@ -30,7 +30,7 @@ loader-composition 的结算层级断言把记录到的结算原因与一份逐
在负载较高的 runner 上，两个插件管理器记录用例现在都能在该 run 仍在进行时观测到记录，而真正缺失的记录仍会以同一条断言失败。只有在操作始终不写记录时，这段有界等待才会付出 2 秒。
-[任务详情关闭断言](2026-09-28-detail-close-waits-on-observed-state.zh.md) 把同一条规则用在 web 客户端用例上：被采样的状态落在该用例已经等待过的那个列表之后一个 commit 的被动 effect 里。
+[已归档的任务详情关闭诊断](../../archived/testing/2026-09-28-detail-close-waits-on-observed-state.md)记录了同一条规则在 Web 客户端用例中的应用：被采样的状态落在该用例等待的列表之后一个 commit 的被动 effect 里。
## Deferred
diff --git a/.agents/notes/implemented/testing/2026-09-27-oxlint-contract-spawn-case-budgets.i18n.yaml b/.agents/notes/implemented/testing/2026-09-27-oxlint-contract-spawn-case-budgets.i18n.yaml
deleted file mode 100644
index f50d88bce9..0000000000
--- a/.agents/notes/implemented/testing/2026-09-27-oxlint-contract-spawn-case-budgets.i18n.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-27-oxlint-contract-spawn-case-budgets.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/testing/2026-09-27-oxlint-contract-spawn-case-budgets.md
-/agent-note-oxlint-contract-cases-that-spawn-a-process-carry-a-90-s-ceiling:
- en: 152f1e58efbf506e
- zh: 889504ebfe5783ca
-/agent-note-oxlint-contract-cases-that-spawn-a-process-carry-a-90-s-ceiling/problem:
- en: 08d6430c0b4e868f
- zh: b98c15541bcea4ee
-/agent-note-oxlint-contract-cases-that-spawn-a-process-carry-a-90-s-ceiling/decision:
- en: 34bd113b8c9228fb
- zh: 99843bf33b703b5e
-/agent-note-oxlint-contract-cases-that-spawn-a-process-carry-a-90-s-ceiling/alternatives-considered:
- en: 2b317170890802f7
- zh: 2a5221dcfa8b9116
-/agent-note-oxlint-contract-cases-that-spawn-a-process-carry-a-90-s-ceiling/consequences:
- en: e484a10680ca20b8
- zh: 8fd9fcf13e3dbcd7
diff --git a/.agents/notes/implemented/testing/2026-09-27-plugin-install-interceptor-lifetime.i18n.yaml b/.agents/notes/implemented/testing/2026-09-27-plugin-install-interceptor-lifetime.i18n.yaml
deleted file mode 100644
index f39a22bba4..0000000000
--- a/.agents/notes/implemented/testing/2026-09-27-plugin-install-interceptor-lifetime.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-27-plugin-install-interceptor-lifetime.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/testing/2026-09-27-plugin-install-interceptor-lifetime.md
-/agent-note-keep-plugin-install-interception-for-the-page-lifetime:
- en: 2f732d10bfaf9f5b
- zh: fff9f6cf8bcd86a7
-/agent-note-keep-plugin-install-interception-for-the-page-lifetime/problem:
- en: 71b72bb5b13530bb
- zh: b78170e3ac09cccf
-/agent-note-keep-plugin-install-interception-for-the-page-lifetime/decision:
- en: 45d689dced9dad9f
- zh: cb89fbbb7937ca8e
-/agent-note-keep-plugin-install-interception-for-the-page-lifetime/alternatives-considered:
- en: 1027b59d76cd3ff7
- zh: c4c60fb406acb1db
-/agent-note-keep-plugin-install-interception-for-the-page-lifetime/verification:
- en: 0e7fbf7fbb47b07c
- zh: 9b52991ad8b355ca
-/agent-note-keep-plugin-install-interception-for-the-page-lifetime/consequences:
- en: 3583e26c8ec33e03
- zh: 6080722751cf15e6
diff --git a/.agents/notes/implemented/testing/2026-09-27-web-lane-assertions-name-their-input-state.i18n.yaml b/.agents/notes/implemented/testing/2026-09-27-web-lane-assertions-name-their-input-state.i18n.yaml
deleted file mode 100644
index 96f659c8b0..0000000000
--- a/.agents/notes/implemented/testing/2026-09-27-web-lane-assertions-name-their-input-state.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-27-web-lane-assertions-name-their-input-state.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/testing/2026-09-27-web-lane-assertions-name-their-input-state.md
-/agent-note-web-lane-assertions-name-their-input-state:
- en: 6b04734ce8fbeb4a
- zh: 73db3bd3ac5985dc
-/agent-note-web-lane-assertions-name-their-input-state/problem:
- en: 12391509553e0152
- zh: 86d02884ae9c1b09
-/agent-note-web-lane-assertions-name-their-input-state/decision:
- en: c6a8e79707975429
- zh: 4fe1f6abd6fd4c1e
-/agent-note-web-lane-assertions-name-their-input-state/alternatives-considered:
- en: 6cd5940f55500c3d
- zh: 4a2e13717e87b783
-/agent-note-web-lane-assertions-name-their-input-state/verification:
- en: 9a35f9dbc4285674
- zh: 0995a8b137912b6b
-/agent-note-web-lane-assertions-name-their-input-state/consequences:
- en: ad3d8ec4b171b04a
- zh: e254cc9515b33e0e
diff --git a/.agents/notes/implemented/testing/2026-09-28-detail-close-waits-on-observed-state.i18n.yaml b/.agents/notes/implemented/testing/2026-09-28-detail-close-waits-on-observed-state.i18n.yaml
deleted file mode 100644
index 304ae39497..0000000000
--- a/.agents/notes/implemented/testing/2026-09-28-detail-close-waits-on-observed-state.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-28-detail-close-waits-on-observed-state.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/implemented/testing/2026-09-28-detail-close-waits-on-observed-state.md
-/agent-note-the-task-detail-close-waits-on-the-observed-state:
- en: ffb94d33eb1c162c
- zh: 32845a4113ab27c1
-/agent-note-the-task-detail-close-waits-on-the-observed-state/problem:
- en: 0a3fa08f242a0f7e
- zh: fb8c39531405952b
-/agent-note-the-task-detail-close-waits-on-the-observed-state/decision:
- en: 3e4c20e32e3e9445
- zh: 157750a7e1f1fd59
-/agent-note-the-task-detail-close-waits-on-the-observed-state/alternatives-considered:
- en: 8ee7951bdf933b45
- zh: 4736d42c1d52c9b0
-/agent-note-the-task-detail-close-waits-on-the-observed-state/consequences:
- en: c0993f90f7af9c41
- zh: 6a877cb1287000e3
-/agent-note-the-task-detail-close-waits-on-the-observed-state/related:
- en: f35c1fe1c2ff83b3
- zh: 56a3357ab5a67822
diff --git a/.agents/notes/implemented/testing/2026-10-07-memory-limited-benchmarks.i18n.yaml b/.agents/notes/implemented/testing/2026-10-07-memory-limited-benchmarks.i18n.yaml
new file mode 100644
index 0000000000..d0b8ebff98
--- /dev/null
+++ b/.agents/notes/implemented/testing/2026-10-07-memory-limited-benchmarks.i18n.yaml
@@ -0,0 +1,28 @@
+# Bilingual-pair consistency record for 2026-10-07-memory-limited-benchmarks.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/testing/2026-10-07-memory-limited-benchmarks.md
+/agent-note-memory-limited-benchmark-reruns:
+ en: 08979e022b49c675
+ zh: b0c12b1f992ac681
+/agent-note-memory-limited-benchmark-reruns/problem:
+ en: b82519a7026a1a19
+ zh: a72c4417426ec95f
+/agent-note-memory-limited-benchmark-reruns/decision:
+ en: 3cf2db98939b3994
+ zh: f80a1d3d6049381a
+/agent-note-memory-limited-benchmark-reruns/decision/cases:
+ en: 9502c61025d27f23
+ zh: f743a56404327f92
+/agent-note-memory-limited-benchmark-reruns/decision/limit-and-endpoint:
+ en: a314408967c5a450
+ zh: 2b6ed3e1a96fe272
+/agent-note-memory-limited-benchmark-reruns/calibration-evidence:
+ en: ffe31b42aa199614
+ zh: 29e4a3297ab55853
+/agent-note-memory-limited-benchmark-reruns/alternatives-considered:
+ en: 436516beabc2394f
+ zh: 7cabbecb5a05f77c
+/agent-note-memory-limited-benchmark-reruns/consequences:
+ en: cb213ef0e7506c8f
+ zh: 3da65a3981c2518d
diff --git a/.agents/notes/implemented/testing/2026-10-07-memory-limited-benchmarks.md b/.agents/notes/implemented/testing/2026-10-07-memory-limited-benchmarks.md
new file mode 100644
index 0000000000..79cc9d918a
--- /dev/null
+++ b/.agents/notes/implemented/testing/2026-10-07-memory-limited-benchmarks.md
@@ -0,0 +1,42 @@
+# Agent Note: Memory-limited benchmark reruns
+
+Status: implemented
+
+English | [中文](2026-10-07-memory-limited-benchmarks.zh.md)
+
+## Problem
+
+Benchmarks run on hosted runners with 16 GB of memory and on developer machines with more. Neither shows how DSH behaves on a machine with 4 GB or 8 GB available, where the Host, Chromium, and page cache share one memory budget.
+
+## Decision
+
+[run-memory-pressure-bench.ts](../../../../scripts/run-memory-pressure-bench.ts) builds the benchmark artifacts unconfined, then reruns a fixed list of existing benchmark files inside a cgroup v2 whose `memory.max` is 4 or 8 GiB and whose `memory.swap.max` is zero. The files keep their own workloads and budgets; the scenario fails when a case misses its normal budget or the cgroup kills a process.
+
+### Cases
+
+The list holds the files with the largest measured resident memory or the long-history UI path: [session-corpus](../../../../benchmarks/session-corpus/README.md) (list of 3,000 Sessions, content search over 1,000, fork), its projection-list file, [session-open](2026-09-04-session-open-performance-gate.md) (127,400-event Session), and [long-session-browser](../../../../benchmarks/long-session-browser/README.md) (Chromium and its Host). Terminal, fold, reconnect, and continuation files measure small in-process workloads and stay out.
+
+### Limit and endpoint
+
+The cgroup contains Vitest, every benchmark worker, the scaffold Host, and Chromium. Node 24 sizes its default heap from the cgroup limit, and page cache from Session logs is charged to the same limit, so eviction and rereads appear in the timings. On Linux hosts a `systemd-run --user --scope` provides a fresh cgroup. In a container that already enforces the limit, `--scoped` uses the container cgroup. Before running, the launcher requires `memory.max`, `memory.swap.max`, and `process.constrainedMemory()` to match the machine. After the run it reports the cgroup's `memory.peak` and `oom_kill`; both cover the cgroup's lifetime.
+
+## Calibration evidence
+
+On 2026-10-07, Docker on Apple silicon (Linux VM, `--cpus=4`, Node 24.21) ran the list once per limit and once without a limit. All 38 cases passed their budgets under both limits, with no OOM kill.
+
+| Measurement | No limit | 8 GiB | 4 GiB |
+|---|---:|---:|---:|
+| cgroup peak (MB) | 3,538 | 3,649 | 3,895 |
+| List 3,000 first / repeat (ms) | 1,235 / 1,023 | 1,365 / 1,072 | 2,613 / 1,994 |
+| Search 1,000 first (ms) | 54,015 | 50,766 | 61,662 |
+| Browser slowest page / input (ms) | 152 / 95 | 144 / 91 | 187 / 123 |
+
+## Alternatives considered
+
+- `--max-old-space-size` per worker: the list and search workers use about 100 MB of JavaScript heap while their resident memory reaches 0.7–1.2 GB, mostly native memory, so a heap flag does not model the machine. Node already derives the same 2 GB old space for 4 GB and 8 GB cgroups.
+- `RLIMIT_AS`: V8 reserves address space far beyond its resident memory and fails under a virtual-memory limit.
+- A pull-request CI job: the PR workflow keeps at most ten concurrent worker jobs, and each memory-limited run takes as long as the benchmark lane, so the scenario is manual.
+
+## Consequences
+
+macOS has no per-process-tree memory cap; developers there run `--scoped` inside a Linux container started with `--memory` and `--memory-swap` equal to the limit. A file added to the list must keep its budgets valid under both limits.
diff --git a/.agents/notes/implemented/testing/2026-10-07-memory-limited-benchmarks.zh.md b/.agents/notes/implemented/testing/2026-10-07-memory-limited-benchmarks.zh.md
new file mode 100644
index 0000000000..f5a4db01a8
--- /dev/null
+++ b/.agents/notes/implemented/testing/2026-10-07-memory-limited-benchmarks.zh.md
@@ -0,0 +1,42 @@
+# Agent Note: 内存受限的基准重跑
+
+Status: implemented
+
+[English](2026-10-07-memory-limited-benchmarks.md) | 中文
+
+## 问题
+
+基准运行在 16 GB 内存的托管 runner 和内存更大的开发机上。两者都无法显示 DSH 在可用内存为 4 GB 或 8 GB 的机器上的表现，而这类机器上 Host、Chromium 和页缓存共享同一份内存预算。
+
+## 决定
+
+[run-memory-pressure-bench.ts](../../../../scripts/run-memory-pressure-bench.ts) 先在无约束环境中构建基准产物，再在 `memory.max` 为 4 或 8 GiB、`memory.swap.max` 为零的 cgroup v2 中，重跑一份固定的现有基准文件列表。这些文件保留各自的负载和预算；某个用例未达到其常规预算或 cgroup 杀死进程时，该场景失败。
+
+### 用例
+
+列表包含常驻内存实测最大的文件和长历史 UI 路径：[session-corpus](../../../../benchmarks/session-corpus/README.zh.md)（3,000 个 Session 的列表、1,000 个 Session 的内容搜索、fork）、其 projection-list 文件、[session-open](2026-09-04-session-open-performance-gate.zh.md)（127,400 个事件的 Session）和 [long-session-browser](../../../../benchmarks/long-session-browser/README.zh.md)（Chromium 及其 Host）。终端、fold、重连和续写文件测量的是较小的进程内负载，不在列表中。
+
+### 上限与端点
+
+cgroup 包含 Vitest、每个基准 worker、脚手架 Host 和 Chromium。Node 24 按 cgroup 上限确定默认堆大小，Session 日志的页缓存也计入同一上限，因此淘汰和重读会体现在耗时中。在 Linux 主机上，`systemd-run --user --scope` 提供一个新的 cgroup。在已经执行该上限的容器中，`--scoped` 使用容器的 cgroup。运行前，启动脚本要求 `memory.max`、`memory.swap.max` 和 `process.constrainedMemory()` 与机器一致。运行后，它报告该 cgroup 的 `memory.peak` 和 `oom_kill`；两者覆盖 cgroup 的整个生命周期。
+
+## 校准证据
+
+2026-10-07，Apple silicon 上的 Docker（Linux VM，`--cpus=4`，Node 24.21）对每个上限各运行一次该列表，并在无上限时运行一次。两个上限下全部 38 个用例都通过了预算，没有 OOM kill。
+
+| 测量项 | 无上限 | 8 GiB | 4 GiB |
+|---|---:|---:|---:|
+| cgroup 峰值（MB） | 3,538 | 3,649 | 3,895 |
+| 列出 3,000 个：首次 / 重复（ms） | 1,235 / 1,023 | 1,365 / 1,072 | 2,613 / 1,994 |
+| 搜索 1,000 个：首次（ms） | 54,015 | 50,766 | 61,662 |
+| 浏览器最慢一页 / 输入（ms） | 152 / 95 | 144 / 91 | 187 / 123 |
+
+## 考虑过的替代方案
+
+- 为每个 worker 设置 `--max-old-space-size`：列表和搜索 worker 使用约 100 MB JavaScript 堆，而常驻内存达到 0.7–1.2 GB，主要是原生内存，因此堆参数无法模拟机器。Node 已为 4 GB 和 8 GB cgroup 推导出相同的 2 GB old space。
+- `RLIMIT_AS`：V8 预留的地址空间远超其常驻内存，在虚拟内存上限下会失败。
+- PR CI 作业：PR 工作流最多保持十个并发 worker 作业，而每次内存受限运行与基准 lane 耗时相当，因此该场景为手动运行。
+
+## 影响
+
+macOS 没有按进程树的内存上限；那里的开发者在以等于上限的 `--memory` 和 `--memory-swap` 启动的 Linux 容器中运行 `--scoped`。加入列表的文件必须在两个上限下都保持预算有效。
diff --git a/.agents/notes/proposed/architecture/2026-07-24-domain-kv-storage-and-workspace.i18n.yaml b/.agents/notes/proposed/architecture/2026-07-24-domain-kv-storage-and-workspace.i18n.yaml
index 714d3ca25a..380a20a91f 100644
--- a/.agents/notes/proposed/architecture/2026-07-24-domain-kv-storage-and-workspace.i18n.yaml
+++ b/.agents/notes/proposed/architecture/2026-07-24-domain-kv-storage-and-workspace.i18n.yaml
@@ -6,8 +6,8 @@
en: e1792a25ca5d684d
zh: ddb20d72b56eebf8
/agent-note-domain-kv-storage-capability-seam-and-the-workspace-entity/problem:
- en: 9a6abd0305f2e2bb
- zh: 7c3f1132c0fa7b56
+ en: 22a80335f54b17e9
+ zh: 6c0d695a4dba7f0d
/agent-note-domain-kv-storage-capability-seam-and-the-workspace-entity/proposal:
en: 34e5bde1535a2bb1
zh: 559deb25b2ec50ba
@@ -21,14 +21,14 @@
en: 6a26dd7ef357db74
zh: 951b31136e2415f9
/agent-note-domain-kv-storage-capability-seam-and-the-workspace-entity/proposal/dsh-domain-the-domain-data-form:
- en: d51c71c793c26834
- zh: 3aab9f9695a0e225
+ en: 2ee24f36cd93f7dd
+ zh: 45c83bd745de41f9
/agent-note-domain-kv-storage-capability-seam-and-the-workspace-entity/proposal/future-work-session-side-deletion-design-settled-not-implemented-this-phase:
en: a3824326587b6539
zh: 9736e3060bd57651
/agent-note-domain-kv-storage-capability-seam-and-the-workspace-entity/proposal/dsh-workspace:
- en: 71351e042512c03a
- zh: 965622f09f135d37
+ en: 13e68c6072cbfc98
+ zh: 5f111dd13038b535
/agent-note-domain-kv-storage-capability-seam-and-the-workspace-entity/proposal/reuse-and-the-session-backend-migration-outlook:
en: e586acdb16085b91
zh: 4fae53c5b9e4fd5b
diff --git a/.agents/notes/proposed/architecture/2026-07-24-domain-kv-storage-and-workspace.md b/.agents/notes/proposed/architecture/2026-07-24-domain-kv-storage-and-workspace.md
index dc14648c70..950345b57f 100644
--- a/.agents/notes/proposed/architecture/2026-07-24-domain-kv-storage-and-workspace.md
+++ b/.agents/notes/proposed/architecture/2026-07-24-domain-kv-storage-and-workspace.md
@@ -13,7 +13,7 @@ The host's only persistence surface is the session event log (`packages/session/
Separately, Session deletion needs a `SessionPersistence` delete primitive and a `session.delete` endpoint. That gap's design is settled in this note, but its implementation remains future work.
-The later [Workspace registration deletion decision](../../implemented/feature/2026-07-27-workspace-registration-deletion.md) supersedes only that coupling: deleting a Workspace registration preserves its Sessions and their logs, while Session deletion remains separate future work. The cascade design below is therefore not the Workspace GUI delete semantic.
+The [Workspace reference](../../../../packages/workspace/workspace/README.md) defines non-destructive registration removal: deleting a Workspace registration preserves its Sessions and their logs, while Session deletion remains separate future work. The cascade design below is therefore not the Workspace GUI delete semantic.
## Proposal
@@ -106,7 +106,7 @@ export function apply(ctx: Context, config: Config) {
}
```
-(Facility unmount order: dispose each domain first (drain its write chain), then remove the name from the hub — in-flight writes still emit `domain/changed` during the drain, and the event-consistency invariant resolves domains back through the facility, so the name must stay resolvable at that point.)
+(Facility unmount order: dispose each domain first (drain its write chain), then remove the name from the hub — in-flight writes still emit `domain/changed` during the drain, so the name must stay resolvable at that point.)
Domain declarations (the spec object is defined and exported by the package that owns the domain — the single source of type and runtime truth; schemas use zod with `z.infer` deriving the types without re-declaration — the record model projects into RPC wire schemas next phase and the wire boundary is all zod; schemastery still owns plugin Config only):
@@ -243,7 +243,7 @@ export class WorkspaceRegistry extends Service {
- **Path canon**: the stored value = `fs.realpath(input)` (trailing slashes, `..`, and symlinks all resolved); uniqueness = string equality after normalization (a symlink resolving to the same directory counts as a collision). A missing directory makes create reject outright (realpath fails — a workspace must point at an existing directory; "Create new = make the directory" is upper-layer interaction: mkdir first, then create). The session cwd in attach checks follows the same canon. Single-valued cwd + unique path ⇒ one session structurally belongs to at most one workspace; double bookkeeping is impossible on the write side.
- **Title**: a display name, defaults to `basename(path)`, mutable, duplicates allowed. Ownership is never derived from cwd as a fallback — cwd cannot express ordering, and ownership is a workspace-side fact; sessions started headless belong to no workspace.
- Consumers see only the `Workspace` interface; `WorkspaceEntity` stays inside the package (a single implementation does not pre-split a seam). Entities are unique per id (registry cache); the record snapshot is swapped in place after each write, and the outside sees getters only. Every write funnels through the entity's internal `mutate(fn)` → `table.update`, with `updatedAt` refreshed inside mutate. Domain objects never cross RPC; next phase the wire layer projects records into zod wire schemas.
-- **Session deletion remains future work.** The later [Workspace registration deletion decision](../../implemented/feature/2026-07-27-workspace-registration-deletion.md) ships `ctx.workspaceRegistry.delete(id)` as a metadata-only operation that preserves Sessions and logs. Recursive Session deletion, running checks, and crash-rerun convergence belong to a separate `session.delete` capability.
+- **Session deletion remains future work.** The [Workspace registry](../../../../packages/workspace/workspace/README.md) provides `ctx.workspaceRegistry.delete(id)` as a metadata-only operation that preserves Sessions and logs. Recursive Session deletion, running checks, and crash-rerun convergence belong to a separate `session.delete` capability.
Consistency doctrine (the ledger = the only ownership authority; the implementation and test baseline):
diff --git a/.agents/notes/proposed/architecture/2026-07-24-domain-kv-storage-and-workspace.zh.md b/.agents/notes/proposed/architecture/2026-07-24-domain-kv-storage-and-workspace.zh.md
index 1cf7280919..a44086a0d6 100644
--- a/.agents/notes/proposed/architecture/2026-07-24-domain-kv-storage-and-workspace.zh.md
+++ b/.agents/notes/proposed/architecture/2026-07-24-domain-kv-storage-and-workspace.zh.md
@@ -13,7 +13,7 @@ host 侧唯一的持久化面是 session 事件日志（`packages/session/sessio
另外，Session 删除需要 `SessionPersistence` 删除原语和 `session.delete` 端点。该空白的设计随本 Note 定案，但实现仍属未来工作。
-后续的 [Workspace 注册记录删除决策](../../implemented/feature/2026-07-27-workspace-registration-deletion.zh.md)取代的仅是上述耦合关系：删除 Workspace 注册记录会保留相关 Session 及其日志，Session 删除仍是独立的未来工作。因此，下文的级联设计并不是 Workspace GUI 的删除语义。
+[Workspace 参考](../../../../packages/workspace/workspace/README.zh.md)定义非破坏性的注册记录移除：删除 Workspace 注册记录会保留相关 Session 及其日志，Session 删除仍是独立的未来工作。因此，下文的级联设计并不是 Workspace GUI 的删除语义。
## 方案
@@ -106,7 +106,7 @@ export function apply(ctx: Context, config: Config) {
}
```
-（facility 卸载顺序：先 dispose 各域（排空写链）再从枢纽摘名——排空期间在途写仍发 `domain/changed`，事件一致性 invariant 经 facility 反查域，要求此时域名仍可解析。）
+（facility 卸载顺序：先 dispose 各域（排空写链）再从枢纽摘名——排空期间在途写仍发 `domain/changed`，因此此时域名仍须可解析。）
域声明（spec 对象由拥有该域的包定义导出，是类型与运行时的唯一真源；schema 用 zod，`z.infer` 推导类型不重复声明——记录模型下期要投影成 RPC wire schema，wire 边界全是 zod；schemastery 仍只管插件 Config）：
@@ -243,7 +243,7 @@ export class WorkspaceRegistry extends Service {
- **path 规范**：落盘值 = `fs.realpath(输入)`（尾斜杠、`..`、符号链接全解析）；唯一性 = 规范化后字符串相等（符号链接指向同一目录算撞）。目录不存在时 create 直接 reject（realpath 失败——workspace 必须指向存在目录；"Create new = 建目录"是上层交互，先 mkdir 再 create）。attach 校验的 session cwd 同口径。cwd 单值 + path 唯一 ⇒ 一个 session 结构上最多归属一个 workspace，双重记账写侧不可能。
- **title**：显示名，默认 `basename(path)`，可改，允许重复。归属不用 cwd 派生兜底——cwd 表达不了排序，归属是 workspace 侧事实；headless 直开的 session 不属于任何 workspace。
- 消费方只见 `Workspace` 接口，`WorkspaceEntity` 不出包（单实现不预拆 seam）；实体按 id 唯一（注册表缓存），记录快照写后原地换新，外部只见 getter；所有写收敛到实体内 `mutate(fn)` → `table.update`，`updatedAt` 在 mutate 内统一刷。领域对象不过 RPC，下期 wire 层把记录投影成 zod wire schema。
-- **Session 删除仍属未来工作。** 后续的 [Workspace 注册记录删除决策](../../implemented/feature/2026-07-27-workspace-registration-deletion.zh.md)已将 `ctx.workspaceRegistry.delete(id)` 作为仅删除元数据、保留 Session 与日志的操作交付。递归删除 Session、运行中检查和崩溃重跑收敛属于独立的 `session.delete` 能力。
+- **Session 删除仍属未来工作。** [Workspace 注册表](../../../../packages/workspace/workspace/README.zh.md)将 `ctx.workspaceRegistry.delete(id)` 作为仅删除元数据、保留 Session 与日志的操作交付。递归删除 Session、运行中检查和崩溃重跑收敛属于独立的 `session.delete` 能力。
一致性口径（账 = 归属唯一依据；实现与测试基准）：
diff --git a/.agents/notes/proposed/architecture/2026-07-27-session-projection-and-command-log.i18n.yaml b/.agents/notes/proposed/architecture/2026-07-27-session-projection-and-command-log.i18n.yaml
index 7207445070..59a262d59e 100644
--- a/.agents/notes/proposed/architecture/2026-07-27-session-projection-and-command-log.i18n.yaml
+++ b/.agents/notes/proposed/architecture/2026-07-27-session-projection-and-command-log.i18n.yaml
@@ -15,8 +15,8 @@
en: e6c93d89a25f0d03
zh: 65e1f5842bc74008
/agent-note-session-projections-and-command-lifecycle-logging/proposal/host-projection-registry-dsh-session-projection-new-package:
- en: 6068eb6aba54b102
- zh: 20e91466baf6ad11
+ en: a0f86a588c9dff31
+ zh: 421803bc8b0dddb5
/agent-note-session-projections-and-command-lifecycle-logging/proposal/shipped-consumer-the-subagent-identity-unit:
en: 10093535660c3cae
zh: a7f4ff9e71ee6751
@@ -33,8 +33,8 @@
en: 7b536bd8a51cc5dc
zh: 1ead63f6358b3799
/agent-note-session-projections-and-command-lifecycle-logging/proposal/command-lifecycle-in-the-log:
- en: a7e04451f3ed417c
- zh: fb60c8729200b825
+ en: 41c7f98634d4762f
+ zh: 0f3b85f4c6fa06a3
/agent-note-session-projections-and-command-lifecycle-logging/delivery-plan:
en: 64ad8d08a8ab44e0
zh: fb0a0f7369d0bd23
@@ -45,5 +45,5 @@
en: 9dfcca30fffda225
zh: 0beddb81d32e0ca7
/agent-note-session-projections-and-command-lifecycle-logging/risks:
- en: f0eb219b4119ca7d
- zh: de870016c1623895
+ en: c3740b6e12eb7295
+ zh: b0b427b83c73dbba
diff --git a/.agents/notes/proposed/architecture/2026-07-27-session-projection-and-command-log.md b/.agents/notes/proposed/architecture/2026-07-27-session-projection-and-command-log.md
index fb329a4117..4e2e02482e 100644
--- a/.agents/notes/proposed/architecture/2026-07-27-session-projection-and-command-log.md
+++ b/.agents/notes/proposed/architecture/2026-07-27-session-projection-and-command-log.md
@@ -59,7 +59,6 @@ declare module 'cordis' {
- **State is always computed, never logged.** The log holds events only; the unit's state lives in the framework's per-session watermark cache (`{state, observedSeq}` per unit) and, in a later phase, in a **persisted projection cache** on the domain-KV storage seam: rows of `(sessionId, key, ver, seq, val)` (`ver` = the unit's `stateVersion`, `seq` = the watermark, `val` = the state JSON). A row is never wrong, only possibly stale — its `seq` says exactly how stale. The one read recipe, cold and live alike: take the cached state (or `init()`), forward-apply only the events past its watermark, `view` the result. Cold listings (every session's title across all workspaces) become an index read plus, at worst, a short tail replay; the session-persistence seam grows a read-from-seq primitive for that tail in the same later phase. Write policy: throttled (count/interval, configurable) plus two mandatory points — `turn/end` and detach (the live-to-cold moment). A crash between writes costs a longer tail replay, never a wrong value.
- A domain's input event set is its own choice: todos folds `todo/write` alone; plan folds `plan/mode` plus its own `/plan` `command/run` records (see the plan section); goal folds `goal/change` metadata; session title folds its title events (retiring the bespoke `session/title` frame and the client's title-snapshot map — the fourth hand-rolled projection this seam absorbs).
- Registration is an effect (disposer with the fiber): an unloaded plugin's key disappears from subsequent responses and the client reads it as capability absence — HMR semantics for free. Duplicate keys throw. Domain plugins register under `ctx.inject(['sessionProjections'], …)` so headless assemblies without the registry stay unaffected.
-- The package owns `./invariant` (every served key has a live registration).
### Shipped consumer: the subagent identity unit
@@ -128,7 +127,7 @@ Two log-only (non-surface, model-invisible) events, mirroring the `tool/call`/`t
'command/done': { commandId: string; kind: 'success' | 'error'; text?: string }
```
-The host command executor (`packages/interaction/commands`) appends `command/run` before invoking the handler and `command/done` at settlement — direct standalone appends on the receiving agent's session, in the same shape as every other plugin-owned log-only event after the [synthetic-turn removal](../../implemented/simplification/2026-07-28-remove-synthetic-log-only-turns.md): no turn wraps them (turns describe model-loop executions only), persistence drains them at ordinary checkpoints, and the commands package's own invariant companion enforces the run/done pairing. The payload is structured — `name` and, by default, `args` are the parser's own split (`parseCommand`'s name and rawInput), so a consumer (a projection unit folding its own command records, a rich command card) never re-parses a line. A definition sets `recordInput: false` when its authoritative domain event owns the payload; `command/run` then omits `args` rather than duplicating it. `text` is the handler's verbatim outcome — factual data of the same nature as `tool/result.content`, not presentation (how it is laid out remains client-computed at render time, satisfying the "presentation never enters the log" red line). Domains that want the model to know the outcome keep their existing behavior (plan's narration, goal's inject) — that is a domain decision, unchanged.
+The host command executor (`packages/interaction/commands`) appends `command/run` before invoking the handler and `command/done` at settlement — direct standalone appends on the receiving agent's session, in the same shape as every other plugin-owned log-only event after the [synthetic-turn removal](../../implemented/simplification/2026-07-28-remove-synthetic-log-only-turns.md): no turn wraps them (turns describe model-loop executions only), and persistence drains them at ordinary checkpoints. The payload is structured — `name` and, by default, `args` are the parser's own split (`parseCommand`'s name and rawInput), so a consumer (a projection unit folding its own command records, a rich command card) never re-parses a line. A definition sets `recordInput: false` when its authoritative domain event owns the payload; `command/run` then omits `args` rather than duplicating it. `text` is the handler's verbatim outcome — factual data of the same nature as `tool/result.content`, not presentation (how it is laid out remains client-computed at render time, satisfying the "presentation never enters the log" red line). Domains that want the model to know the outcome keep their existing behavior (plan's narration, goal's inject) — that is a domain decision, unchanged.
Because committed events broadcast on the mux stream, refresh persistence, multi-tab sync, and fork/resume recovery all come for free. The `command.execute` RPC degrades to admission — `{ matched, commandId? }`: whether the line resolved, and the minted pairing id when it did, so the issuing client can correlate its request with the flow node the lifecycle events produce. The one-shot notice channel (`runDetached` → `noticeFor`) is retired.
@@ -184,7 +183,7 @@ Infrastructure first; the three in-flight PRs are left untouched and re-target a
## Risks
- **Whole-value rule is load-bearing**: a future domain logging bare deltas cannot serve consumers from its latest event and complicates its own unit. Mitigation: the rule is stated here and in the projection package README; the unit contract makes the full state explicit at every transition.
-- **Synchronous unit discipline**: `init`/`apply`/`view` that await would tear the consistency cut. The registry documents and the invariant companion asserts synchronicity as far as practical; review owns the rest.
+- **Synchronous unit discipline**: `init`/`apply`/`view` that await would tear the consistency cut. The registry documents it; review enforces it.
- **Live registry churn is not pushed**: loading or unloading a domain plugin mid-session changes the key set, but no session event fires and no frame is pushed; open clients hold the stale key until the next tail pull (reconnect, gap repair, open). Accepted as a dev-only (HMR) staleness window — a registry-change push can be added to the change feed later without contract impact.
- **Eager drive costs on busy sessions**: every committed event passes every registered unit's `apply`. Units are cheap per-event by construction (whole-value rule), non-matching events return the same reference, and the count of registered domains is small; if a hot path ever shows, per-unit event-type prefilters can be added without contract change.
- **Projection payload growth**: every tail page carries every registered key. Payloads are whole values of UI-scale state (a todo list, a goal snapshot); if a future domain's value is large, per-key opt-out or lazy keys can be added to the request without changing the model.
diff --git a/.agents/notes/proposed/architecture/2026-07-27-session-projection-and-command-log.zh.md b/.agents/notes/proposed/architecture/2026-07-27-session-projection-and-command-log.zh.md
index eb359058a7..f226acfc83 100644
--- a/.agents/notes/proposed/architecture/2026-07-27-session-projection-and-command-log.zh.md
+++ b/.agents/notes/proposed/architecture/2026-07-27-session-projection-and-command-log.zh.md
@@ -59,7 +59,6 @@ declare module 'cordis' {
- **状态永远靠计算得出，绝不入日志。** 日志只存事件；单元的状态住在框架的按会话水位线缓存里（每单元一份 `{state, observedSeq}`），并在后续阶段进入 domain-KV 存储 seam 上的**持久投影缓存（persisted projection cache）**：形如 `(sessionId, key, ver, seq, val)` 的行（`ver` = 单元的 `stateVersion`，`seq` = 水位线，`val` = 状态 JSON）。一行永远不会是错的，至多是陈旧的——其 `seq` 精确说明陈旧到哪。冷读与活读共用同一套读取配方：取缓存状态（或 `init()`），只对超出其水位线的事件做正向 `apply`，再对结果做 `view`。冷列表（跨全部 workspace 列出每个会话的标题）变成一次索引读，至多外加一小段尾部回放；session-persistence seam 在同一后续阶段为这段尾部补一个按 seq 起读的原语。写入策略：节流（次数/间隔，可配置）外加两个强制点——`turn/end` 与 detach（由活转冷的时刻）。两次写入之间崩溃的代价是尾部回放更长一些，绝不会是值出错。
- 领域的输入事件集由领域自己选择：todos 只折叠 `todo/write`；plan 折叠 `plan/mode` 外加它自己的 `/plan` `command/run` 记录（见 plan 一节）；goal 折叠 `goal/change` 元数据；会话标题折叠其标题事件（顺带下线专设的 `session/title` 帧与客户端的标题快照表——这是该 seam 收编的第四个手工投影）。
- 注册是 effect（disposer 随 fiber 走）：插件卸载后其 key 从后续响应中消失，客户端将其读作能力缺失——HMR（热模块替换）语义随之自动成立。key 重复直接 throw。领域插件在 `ctx.inject(['sessionProjections'], …)` 下注册，因此不带注册表的 headless 组装完全不受影响。
-- 该包拥有 `./invariant`（每个被服务的 key 都有一条存活的注册）。
### 已交付的消费方：subagent 身份单元
@@ -128,7 +127,7 @@ type UseProjection = {
'command/done': { commandId: string; kind: 'success' | 'error'; text?: string }
```
-host 侧命令执行器（`packages/interaction/commands`）在调用处理器前追加 `command/run`，在结算时追加 `command/done`——在接收 agent（智能体）的会话上直接独立追加，与[合成轮次移除](../../implemented/simplification/2026-07-28-remove-synthetic-log-only-turns.zh.md)之后所有插件自有 log-only 事件同一形状：没有轮次包裹它们（轮次只描述模型循环执行），持久化在常规检查点排空它们，run/done 配对由 commands 包自己的 invariant 伴生插件把守。载荷是结构化的——`name` 以及默认携带的 `args` 来自解析器自己的切分（`parseCommand` 的 name 与 rawInput），因此消费方（折叠自己命令记录的投影单元、富命令卡片）永远无需重新解析行文本。当载荷由权威领域事件持有时，命令定义会设置 `recordInput: false`；此时 `command/run` 省略 `args`，而不是重复该载荷。`text` 是处理器的原样结果——与 `tool/result.content` 同一性质的事实数据，不是呈现（版式如何编排仍由客户端在渲染时计算，满足「呈现永不入日志」这条红线）。想让模型知道结果的领域保持既有行为（plan 的旁白、goal 的注入）——那是领域自己的决定，保持不变。
+host 侧命令执行器（`packages/interaction/commands`）在调用处理器前追加 `command/run`，在结算时追加 `command/done`——在接收 agent（智能体）的会话上直接独立追加，与[合成轮次移除](../../implemented/simplification/2026-07-28-remove-synthetic-log-only-turns.zh.md)之后所有插件自有 log-only 事件同一形状：没有轮次包裹它们（轮次只描述模型循环执行），持久化在常规检查点排空它们。载荷是结构化的——`name` 以及默认携带的 `args` 来自解析器自己的切分（`parseCommand` 的 name 与 rawInput），因此消费方（折叠自己命令记录的投影单元、富命令卡片）永远无需重新解析行文本。当载荷由权威领域事件持有时，命令定义会设置 `recordInput: false`；此时 `command/run` 省略 `args`，而不是重复该载荷。`text` 是处理器的原样结果——与 `tool/result.content` 同一性质的事实数据，不是呈现（版式如何编排仍由客户端在渲染时计算，满足「呈现永不入日志」这条红线）。想让模型知道结果的领域保持既有行为（plan 的旁白、goal 的注入）——那是领域自己的决定，保持不变。
由于已提交事件会在 mux 流上广播，刷新后仍在、多标签页同步、fork/恢复后可还原这三件事随之全部自动获得。`command.execute` RPC 退化为准入判定——`{ matched, commandId? }`：该行是否匹配命中，以及命中时新铸的配对 id，发起命令的客户端据此把自己的请求与生命周期事件产出的 flow 节点关联起来。一次性通知通道（`runDetached` → `noticeFor`）就此下线。
@@ -184,7 +183,7 @@ host 侧命令执行器（`packages/interaction/commands`）在调用处理器
## 风险
- **全量值规则是承重结构**：未来某个领域若只记裸增量，就无法凭其最新事件服务消费方，还会让自己的单元复杂化。缓解：该规则写明在本 Note 与投影包的 README 里；单元约定让完整状态在每次转移处都是显式的。
-- **单元的同步纪律**：`init`/`apply`/`view` 一旦 await 就会撕裂一致性切面。注册表在文档中申明这条纪律，invariant 配套在可行范围内断言同步性；其余由评审把关。
+- **单元的同步纪律**：`init`/`apply`/`view` 一旦 await 就会撕裂一致性切面。注册表在文档中申明这条纪律，由评审把关。
- **注册表的实时增删不做推送**：会话中途加载或卸载领域插件会改变键集，但不会触发任何会话事件、也不会推任何帧；开着的客户端持有陈旧的 key 直到下次尾页拉取（重连、缺口修补、打开）。接受为仅开发期（HMR）的陈旧时窗——日后可以在变更流上加一个注册表变更推送，约定不受影响。
- **忙碌会话上的主动驱动开销**：每个已提交事件都要过每个已注册单元的 `apply`。按构造，单元的逐事件开销很低（全量值规则），不匹配的事件返回同一引用，且已注册领域的数量很小；若真出现热点路径，可以加按单元的事件类型预过滤，约定不变。
- **投影载荷膨胀**：每个尾页携带每个已注册的 key。载荷是 UI 量级状态的全量值（一张 todo 清单、一份 goal 快照）；将来若某领域的值很大，可以在请求上加逐 key 的 opt-out 或惰性 key，模型本身不用改。
diff --git a/.agents/notes/proposed/architecture/2026-07-28-storage-root-and-derived-medium-recovery.i18n.yaml b/.agents/notes/proposed/architecture/2026-07-28-storage-root-and-derived-medium-recovery.i18n.yaml
index db04c28547..d8512e33ec 100644
--- a/.agents/notes/proposed/architecture/2026-07-28-storage-root-and-derived-medium-recovery.i18n.yaml
+++ b/.agents/notes/proposed/architecture/2026-07-28-storage-root-and-derived-medium-recovery.i18n.yaml
@@ -6,8 +6,8 @@
en: 9ebb460b39f06952
zh: 0fc0480869566600
/agent-note-storage-root-placement-and-derived-medium-recovery/problem:
- en: e94be80df86b1da9
- zh: fe9b9dad3299562e
+ en: 82f3782b8c856da9
+ zh: f3d7be6283a6a07d
/agent-note-storage-root-placement-and-derived-medium-recovery/proposal:
en: bd212f50ff01960a
zh: de2c69ef9be74629
diff --git a/.agents/notes/proposed/architecture/2026-07-28-storage-root-and-derived-medium-recovery.md b/.agents/notes/proposed/architecture/2026-07-28-storage-root-and-derived-medium-recovery.md
index 3a4124e577..e840991cee 100644
--- a/.agents/notes/proposed/architecture/2026-07-28-storage-root-and-derived-medium-recovery.md
+++ b/.agents/notes/proposed/architecture/2026-07-28-storage-root-and-derived-medium-recovery.md
@@ -10,7 +10,7 @@ The persisted projection cache ([note](2026-07-27-session-projection-and-command
**Where the files actually live (root mismatch closed; resolve-once residual still open).** The shared base defaults the session store to the global harness home (`$DSH_HOME/sessions`, default `~/.dsh/sessions`), while the shipped Web overlay used to give the json backend the relative root `./.storages`: `workspace.json` and `session_projcache.json` landed under `/.storages/` — two launches from different directories shared their sessions yet saw different workspace registries and different projection caches, and the cache exists precisely to serve the cross-session cold listing, which missed for every session last cached under another launch directory. That mismatch is now closed: the overlay anchors `storage-json.root` to `$DSH_HOME/storages` with the same `!!js` expression the session root uses (`apps/cli/config/web.cordis.yml`). The residual hazard: `JsonStorageBackend` still never resolves its root — each unit open joins the path against whatever `process.cwd()` is at that moment (packages/storage/storage-json/src/index.ts); the shipped overlay root is already absolute and unaffected, but any relative root (bare Loader boots, tests) still splits on a later cwd change — the exact hazard the JSONL session backend resolves-once to prevent ("later process.cwd() changes cannot split one backend across roots", packages/session/session-persistence-jsonl/src/index.ts).
-**Recovery behavior.** Inside a healthy medium the cache is fully self-healing by design: a `stateVersion`-mismatched row is discarded and refolded, a log shrunk below a row's watermark is detected by the anchored restore floor and answered with one full re-read, and every background write is fail-soft. But at the *medium* level there is no recovery at all: a truncated, hand-edited, or version-bumped `session_projcache.json` fails `openJsonUnit` with `malformed-medium`/`version-mismatch` (packages/storage/storage-json/src/format.ts), a schema-drifted record fails domain open with `invalid-record` (packages/storage/storage-domain/src/index.ts), the rejection propagates through `SessionProjectionCache[Service.init]`, and under the CLI's fail-loud boot the assembly refuses to start. A file whose entire content is rebuildable from session logs can brick boot. This contradicts the cache package's own stated stance ("a stale or unreadable cache costs a longer tail replay, never a wrong value") and the cache domain spec's JSDoc ("version bumps discard the whole medium"), which describes an aspiration, not the implementation. Partially superseded for the projection cache: [the per-session cache files note](../../archived/architecture/2026-08-19-projection-cache-per-session-files.md) removed the global `session_projcache` domain, so the cache half of this proposal (recovery on that domain) no longer applies; the `workspace.json` half remains current. The `invalid-record` class for the per-record projection cache is now also superseded: the shipped domain declares `invalidRecords: 'backup-and-skip'` ([cross-version read-compat note](../../implemented/architecture/2026-09-02-projcache-cross-version-read-compat.md)), which backs the failing record up and skips it at open, so the reset/destroy proposal below stays relevant only for whole-medium damage on authoritative or single-document media. The same fail-loud path is *correct* for `workspace.json` — workspace records are authoritative, not derivable — so the missing concept is a per-domain declaration of authority, not a global behavior change.
+**Recovery behavior.** Inside a healthy medium the cache is fully self-healing by design: a `stateVersion`-mismatched row is discarded and refolded, a log shrunk below a row's watermark is detected by the anchored restore floor and answered with one full re-read, and every background write is fail-soft. But at the *medium* level there is no recovery at all: a truncated, hand-edited, or version-bumped `session_projcache.json` fails `openJsonUnit` with `malformed-medium`/`version-mismatch` (packages/storage/storage-json/src/format.ts), a schema-drifted record fails domain open with `invalid-record` (packages/storage/storage-domain/src/index.ts), the rejection propagates through `SessionProjectionCache[Service.init]`, and under the CLI's fail-loud boot the assembly refuses to start. A file whose entire content is rebuildable from session logs can brick boot. This contradicts the cache package's own stated stance ("a stale or unreadable cache costs a longer tail replay, never a wrong value") and the cache domain spec's JSDoc ("version bumps discard the whole medium"), which describes an aspiration, not the implementation. Partially superseded for the projection cache: [the per-session cache files note](../../archived/architecture/2026-08-19-projection-cache-per-session-files.md) removed the global `session_projcache` domain, so the cache half of this proposal (recovery on that domain) no longer applies; the `workspace.json` half remains current. The `invalid-record` class for the per-record projection cache is now also superseded: the shipped domain declares `invalidRecords: 'backup-and-skip'` ([cross-version read-compat reference](../../../../packages/session/session-projection-cache/README.md)), which backs the failing record up and skips it at open, so the reset/destroy proposal below stays relevant only for whole-medium damage on authoritative or single-document media. The same fail-loud path is *correct* for `workspace.json` — workspace records are authoritative, not derivable — so the missing concept is a per-domain declaration of authority, not a global behavior change.
## Proposal
diff --git a/.agents/notes/proposed/architecture/2026-07-28-storage-root-and-derived-medium-recovery.zh.md b/.agents/notes/proposed/architecture/2026-07-28-storage-root-and-derived-medium-recovery.zh.md
index f8d91402ba..ea4399ab9a 100644
--- a/.agents/notes/proposed/architecture/2026-07-28-storage-root-and-derived-medium-recovery.zh.md
+++ b/.agents/notes/proposed/architecture/2026-07-28-storage-root-and-derived-medium-recovery.zh.md
@@ -10,7 +10,7 @@ Status: proposed
**文件到底存在哪（根错位已收口，resolve-once 残余仍开放）。** 共享 base 将会话存储默认为全局 harness home（`$DSH_HOME/sessions`，默认 `~/.dsh/sessions`），而出厂 Web overlay 曾给 json 后端相对根 `./.storages`：`workspace.json` 和 `session_projcache.json` 落在 `<启动目录>/.storages/` 下——从两个不同目录启动，会话相同，工作区注册表和投影缓存却各是一份，而缓存存在的意义恰恰是跨会话冷列表，凡上次在别的启动目录下缓存过的会话全部 miss。这一错位已消除：overlay 现以与会话根同一段 `!!js` 表达式把 `storage-json.root` 锚定到 `$DSH_HOME/storages`（`apps/cli/config/web.cordis.yml`）。残余隐患：`JsonStorageBackend` 仍从不 resolve 根——每次打开 unit 都把路径 join 到当时的 `process.cwd()` 上（packages/storage/storage-json/src/index.ts）；出厂 overlay 的根已是绝对路径不受影响，但任何相对根（裸 Loader 启动、测试）仍会被后续 cwd 变化劈开，JSONL 会话后端用「构造时 resolve 一次」防住的正是它（"later process.cwd() changes cannot split one backend across roots"，packages/session/session-persistence-jsonl/src/index.ts）。
-**恢复行为。** 在健康介质内部，缓存按设计完全自愈：`stateVersion` 不匹配的行被丢弃重折，日志缩短到行水位以下由带锚的 restore floor 检出并以一次全量重读回答，每次后台写都是 fail-soft。但在*介质*层面完全没有恢复：被截断、被手改或版本被 bump 的 `session_projcache.json` 会让 `openJsonUnit` 以 `malformed-medium`/`version-mismatch` 失败（packages/storage/storage-json/src/format.ts），schema 漂移的记录让域 open 以 `invalid-record` 失败（packages/storage/storage-domain/src/index.ts），拒绝一路穿过 `SessionProjectionCache[Service.init]`，在 CLI 的 fail-loud 启动下整个组装拒绝启动。一个内容完全可从会话日志重建的文件能把启动搞死。这与缓存包自己声明的立场（"a stale or unreadable cache costs a longer tail replay, never a wrong value"）和缓存域 spec 的 JSDoc（"version bumps discard the whole medium"）相矛盾——后者描述的是愿望而非实现。投影缓存半边已被[每会话缓存文件 note](../../archived/architecture/2026-08-19-projection-cache-per-session-files.md) 部分取代：全局 `session_projcache` domain 已移除，本提案的缓存恢复半边不再适用；`workspace.json` 半边仍然有效。per-record 投影缓存的 `invalid-record` 一类如今也已被取代：已发布的域声明了 `invalidRecords: 'backup-and-skip'`（[跨版本读兼容 note](../../implemented/architecture/2026-09-02-projcache-cross-version-read-compat.zh.md)），open 时把失败记录备份后跳过，因此下文 reset/destroy 提案仅对权威介质或单文档介质的整介质损坏仍然相关。同一条 fail-loud 路径对 `workspace.json` 却是*正确*的——工作区记录是权威数据，不可派生——所以缺的概念是按域声明权威性，而不是全局改行为。
+**恢复行为。** 在健康介质内部，缓存按设计完全自愈：`stateVersion` 不匹配的行被丢弃重折，日志缩短到行水位以下由带锚的 restore floor 检出并以一次全量重读回答，每次后台写都是 fail-soft。但在*介质*层面完全没有恢复：被截断、被手改或版本被 bump 的 `session_projcache.json` 会让 `openJsonUnit` 以 `malformed-medium`/`version-mismatch` 失败（packages/storage/storage-json/src/format.ts），schema 漂移的记录让域 open 以 `invalid-record` 失败（packages/storage/storage-domain/src/index.ts），拒绝一路穿过 `SessionProjectionCache[Service.init]`，在 CLI 的 fail-loud 启动下整个组装拒绝启动。一个内容完全可从会话日志重建的文件能把启动搞死。这与缓存包自己声明的立场（"a stale or unreadable cache costs a longer tail replay, never a wrong value"）和缓存域 spec 的 JSDoc（"version bumps discard the whole medium"）相矛盾——后者描述的是愿望而非实现。投影缓存半边已被[每会话缓存文件 note](../../archived/architecture/2026-08-19-projection-cache-per-session-files.md) 部分取代：全局 `session_projcache` domain 已移除，本提案的缓存恢复半边不再适用；`workspace.json` 半边仍然有效。per-record 投影缓存的 `invalid-record` 一类如今也已被取代：已发布的域声明了 `invalidRecords: 'backup-and-skip'`（[跨版本读兼容 reference](../../../../packages/session/session-projection-cache/README.zh.md)），open 时把失败记录备份后跳过，因此下文 reset/destroy 提案仅对权威介质或单文档介质的整介质损坏仍然相关。同一条 fail-loud 路径对 `workspace.json` 却是*正确*的——工作区记录是权威数据，不可派生——所以缺的概念是按域声明权威性，而不是全局改行为。
## 提案
diff --git a/.agents/notes/proposed/architecture/2026-07-29-durable-last-activity-index.i18n.yaml b/.agents/notes/proposed/architecture/2026-07-29-durable-last-activity-index.i18n.yaml
index bab183a3a2..4e59397821 100644
--- a/.agents/notes/proposed/architecture/2026-07-29-durable-last-activity-index.i18n.yaml
+++ b/.agents/notes/proposed/architecture/2026-07-29-durable-last-activity-index.i18n.yaml
@@ -6,14 +6,14 @@
en: f64dc6aee10c755f
zh: a28d8450c78b0c01
/agent-note-record-last-activity-in-the-session-index/problem:
- en: 332469396acd98d4
- zh: c9e4d587628fc0e7
+ en: 485ea0012ab3d9ed
+ zh: cc02544a320a22bb
/agent-note-record-last-activity-in-the-session-index/proposal:
en: 2260380e10b59eb6
zh: dcf5a7f2d6003021
/agent-note-record-last-activity-in-the-session-index/alternatives-considered:
- en: 9034b95d80405f9c
- zh: 573e1dcd10b62344
+ en: 7a40315717074a92
+ zh: f7f1e7bf79a85863
/agent-note-record-last-activity-in-the-session-index/acceptance-criteria:
en: ec546e4feceb77a7
zh: a29c9268e1c189c7
@@ -21,5 +21,5 @@
en: 9aaf88097b46e9b6
zh: d16e5bbbe221b139
/agent-note-record-last-activity-in-the-session-index/related:
- en: 3fde35c997f273f8
- zh: 2d063c34cc9fe0bb
+ en: 6baa1ed65ac7dd16
+ zh: 2cb7b878fb233220
diff --git a/.agents/notes/proposed/architecture/2026-07-29-durable-last-activity-index.md b/.agents/notes/proposed/architecture/2026-07-29-durable-last-activity-index.md
index f007f01bf3..52b2a6b436 100644
--- a/.agents/notes/proposed/architecture/2026-07-29-durable-last-activity-index.md
+++ b/.agents/notes/proposed/architecture/2026-07-29-durable-last-activity-index.md
@@ -8,7 +8,7 @@ English | [中文](2026-07-29-durable-last-activity-index.zh.md)
A cold (persisted, unattached) session has no authoritative stored answer to "when did the user last prompt here". `dsh-host-apiproxy` serves `updatedAt` from the optional projection cache's `lastPromptAt`, falling back to `createdAt`, and the Web client sorts its Session tree by that value. The cache is fail-soft and checkpointed asynchronously, so a missing or delayed row makes a recently prompted Session sort too old.
-The gateway previously used JSONL artifact mtime when available. mtime answers a different question: when the artifact was last written. Every durable write refreshes it, including a truncate-repair of a torn tail, synthetic closers that balance an interrupted turn, and the [`session/end-seed` boundary](../../implemented/architecture/2026-07-30-session-end-seed-log-boundary.md) appended during pickup. That approximation promoted a Session merely because it was opened. The [bounded cold blank verification](../../archived/bug-fix/2026-08-13-bounded-cold-blank-verification.md) removed mtime ordering and accepted the cache's conservative "too old" failure direction as an interim tradeoff.
+The gateway previously used JSONL artifact mtime when available. mtime answers a different question: when the artifact was last written. Every durable write refreshes it, including a truncate-repair of a torn tail, synthetic closers that balance an interrupted turn, and the [`session/end-seed` boundary](../../../../packages/core/session/src/types.ts) appended during pickup. That approximation promoted a Session merely because it was opened. The [bounded cold blank verification](../../archived/bug-fix/2026-08-13-bounded-cold-blank-verification.md) removed mtime ordering and accepted the cache's conservative "too old" failure direction as an interim tradeoff.
An attached summary can fold the live event log and select the latest human-authored `user/message`, but the cold path deliberately reads no logs: cold summaries come from the projection cache alone, so cold recency is only as fresh as the cache.
@@ -34,7 +34,7 @@ Three questions must be answered before implementation, and none of them is sett
**Keep mtime and exclude boundary writes from it.** Rejected as impossible rather than undesirable: mtime is the filesystem's, not the backend's. Nothing short of restoring the timestamp after every boundary write would preserve it, and that races any concurrent reader and lies about the artifact.
-**Write the boundary only when repair occurred.** Would reduce the frequency, and the [boundary note](../../implemented/architecture/2026-07-30-session-end-seed-log-boundary.md) already rejected it: the predicate must hold for an orderly restart too. Trading a correctness invariant for timestamp accuracy is the wrong direction.
+**Write the boundary only when repair occurred.** Would reduce the frequency, and the [boundary reference](../../../../packages/core/session/src/types.ts) already rejected it: the predicate must hold for an orderly restart too. Trading a correctness invariant for timestamp accuracy is the wrong direction.
**Derive activity from a projection cache.** This is the current interim implementation. `session-projection-cache` folds tails past a watermark without changing the persistence format, but it is optional and fail-soft. Its absence or checkpoint delay makes ordering depend on cache availability and freshness, so it cannot provide the authoritative value proposed here.
@@ -59,6 +59,6 @@ Three questions must be answered before implementation, and none of them is sett
## Related
- [Bounded cold blank verification](../../archived/bug-fix/2026-08-13-bounded-cold-blank-verification.md) — removes mtime ordering and defines the interim cache-only cold summary this proposal would make exact.
-- [The end-seed log boundary](../../implemented/architecture/2026-07-30-session-end-seed-log-boundary.md) — one of the non-prompt writes that made mtime unsuitable.
-- [Session persistence](../../implemented/architecture/2026-06-14-session-persistence.md) — the append-only and never-rewrite invariants that rule out a mutable JSONL header field.
+- [The end-seed log boundary](../../../../packages/core/session/src/types.ts) — one of the non-prompt writes that made mtime unsuitable.
+- [Session persistence](../../../../packages/session/session-persistence/README.md) — the append-only and never-rewrite invariants that rule out a mutable JSONL header field.
- [Handle-based session persistence](../../implemented/architecture/2026-08-27-handle-based-session-persistence.md) — the write-handle append path a stored field would hook into.
diff --git a/.agents/notes/proposed/architecture/2026-07-29-durable-last-activity-index.zh.md b/.agents/notes/proposed/architecture/2026-07-29-durable-last-activity-index.zh.md
index c3259f47bc..a8a1556b91 100644
--- a/.agents/notes/proposed/architecture/2026-07-29-durable-last-activity-index.zh.md
+++ b/.agents/notes/proposed/architecture/2026-07-29-durable-last-activity-index.zh.md
@@ -8,7 +8,7 @@ Status: proposed
一个冷会话（已持久化、未附加）对「用户上次是什么时候在这里发出 prompt」没有权威的已存储答案。`dsh-host-apiproxy` 从可选 projection cache 的 `lastPromptAt` 提供 `updatedAt`，缺失时回退到 `createdAt`，Web 客户端按该值为 Session 树排序。cache 采用 fail-soft 并异步写入 checkpoint，因此缺失或延迟的记录会让最近收到 prompt 的 Session 排得过旧。
-网关以前会在可用时采用 JSONL 产物的 mtime。mtime 回答的是另一件事：这份产物上次是什么时候被写入。每一次持久写入都会刷新它，包括对撕裂尾部的截断修复、平衡中断轮次的合成 closer，以及拾起时追加的 [`session/end-seed` 边界](../../implemented/architecture/2026-07-30-session-end-seed-log-boundary.zh.md)。这套近似会让 Session 仅仅因为被打开就提升排序。[有界冷空白验证](../../archived/bug-fix/2026-08-13-bounded-cold-blank-verification.md)移除了 mtime 排序，并把 cache 保守的「过旧」错误方向作为现阶段取舍。
+网关以前会在可用时采用 JSONL 产物的 mtime。mtime 回答的是另一件事：这份产物上次是什么时候被写入。每一次持久写入都会刷新它，包括对撕裂尾部的截断修复、平衡中断轮次的合成 closer，以及拾起时追加的 [`session/end-seed` 边界](../../../../packages/core/session/src/types.ts)。这套近似会让 Session 仅仅因为被打开就提升排序。[有界冷空白验证](../../archived/bug-fix/2026-08-13-bounded-cold-blank-verification.md)移除了 mtime 排序，并把 cache 保守的「过旧」错误方向作为现阶段取舍。
已附加摘要可以折叠实时事件日志并选择最新的真人 `user/message`，但冷路径有意不读取任何日志：冷摘要只来自 projection cache，因此冷最近时间的新旧只取决于 cache。
@@ -34,7 +34,7 @@ Status: proposed
**保留 mtime，但把边界的写入排除在它之外。** 否决的理由是做不到，而不是不合意：mtime 属于文件系统，不属于后端。除了在每次边界写入之后把时间戳复原，没有别的办法能保住它，而那样做会与任何并发读取方产生竞态，也会对这份产物撒谎。
-**仅在确实发生了修复时才写入边界。** 这能降低出现频率，而[边界 Agent Note](../../implemented/architecture/2026-07-30-session-end-seed-log-boundary.zh.md)已经否决过它：谓词对有序重启同样必须成立。用一条正确性不变式去换时间戳的准确度，方向是错的。
+**仅在确实发生了修复时才写入边界。** 这能降低出现频率，而[边界 reference](../../../../packages/core/session/src/types.ts)已经否决过它：谓词对有序重启同样必须成立。用一条正确性不变式去换时间戳的准确度，方向是错的。
**从投影缓存派生活动时间。** 这是当前的过渡实现。`session-projection-cache` 会折叠水位线之后的尾部，无需改变持久格式，但它是可选且 fail-soft 的。缺失或 checkpoint 延迟会让排序取决于 cache 是否存在以及是否新鲜，因此无法提供本文所提议的权威值。
@@ -59,6 +59,6 @@ Status: proposed
## 相关
- [有界冷空白验证](../../archived/bug-fix/2026-08-13-bounded-cold-blank-verification.md)——移除 mtime 排序，并定义了本提案将使之精确的、仅依赖 cache 的过渡冷摘要。
-- [种子结束日志边界](../../implemented/architecture/2026-07-30-session-end-seed-log-boundary.zh.md)——让 mtime 不适用的非 prompt 写入之一。
-- [会话持久化](../../implemented/architecture/2026-06-14-session-persistence.zh.md)——仅追加与绝不重写这两条不变式，正是它们排除了可变的 JSONL header 字段。
+- [种子结束日志边界](../../../../packages/core/session/src/types.ts)——让 mtime 不适用的非 prompt 写入之一。
+- [会话持久化](../../../../packages/session/session-persistence/README.zh.md)——仅追加与绝不重写这两条不变式，正是它们排除了可变的 JSONL header 字段。
- [基于句柄的会话持久化](../../implemented/architecture/2026-08-27-handle-based-session-persistence.zh.md)——一个已存储字段将挂入的那条写句柄追加路径。
diff --git a/.agents/notes/proposed/architecture/2026-08-08-semantic-composer-chain-phases.i18n.yaml b/.agents/notes/proposed/architecture/2026-08-08-semantic-composer-chain-phases.i18n.yaml
index 311038880f..8db6097575 100644
--- a/.agents/notes/proposed/architecture/2026-08-08-semantic-composer-chain-phases.i18n.yaml
+++ b/.agents/notes/proposed/architecture/2026-08-08-semantic-composer-chain-phases.i18n.yaml
@@ -9,8 +9,8 @@
en: 45193c3a6f3d29bf
zh: 7f508649dbe65db5
/agent-note-semantic-phases-for-composer-chain-election/proposal:
- en: 9dc3866376b4590b
- zh: 93c2208fe9a43d91
+ en: 2c71821b085dd337
+ zh: 4da440bdbb0b12ab
/agent-note-semantic-phases-for-composer-chain-election/alternatives-considered:
en: 966a5082d8c2fe35
zh: 6a384edcdec8495e
diff --git a/.agents/notes/proposed/architecture/2026-08-08-semantic-composer-chain-phases.md b/.agents/notes/proposed/architecture/2026-08-08-semantic-composer-chain-phases.md
index 8dab5afcdd..ddabc91e0d 100644
--- a/.agents/notes/proposed/architecture/2026-08-08-semantic-composer-chain-phases.md
+++ b/.agents/notes/proposed/architecture/2026-08-08-semantic-composer-chain-phases.md
@@ -18,7 +18,7 @@ Question and approval register in `interaction`, retaining their current within-
The phase vocabulary belongs to the declaring slot, not to the slot framework globally. `SlotMap` carries the exact phase tuple for compile-time registration, and the runtime `SlotSpec` repeats that tuple as the sorting authority. Other chains acquire no composer terminology and need no migration unless they deliberately declare phases.
-This proposal extends the [Web subagent conversation](../../implemented/feature/2026-07-27-web-subagent-conversations.md), [Web permission and approval](../../archived/feature/2026-07-23-web-permission-and-approval.md), and [plan-review presentation](../../archived/feature/2026-07-30-plan-review-presentation-intent.md) contracts; it supersedes none of them. The [runtime-owned child guard record](../../archived/bug-fix/2026-08-01-ask-user-delegated-caller-guard.md) introduced the guard that prevents new child-owned human waits. No active Agent Note should be archived when this proposal lands.
+This proposal extends the [Web subagent conversation](../../../../packages/client/ui-subagent/README.md), [Web permission and approval](../../archived/feature/2026-07-23-web-permission-and-approval.md), and [plan-review presentation](../../archived/feature/2026-07-30-plan-review-presentation-intent.md) contracts; it supersedes none of them. The [runtime-owned child guard record](../../archived/bug-fix/2026-08-01-ask-user-delegated-caller-guard.md) introduced the guard that prevents new child-owned human waits. No active Agent Note should be archived when this proposal lands.
## Alternatives considered
diff --git a/.agents/notes/proposed/architecture/2026-08-08-semantic-composer-chain-phases.zh.md b/.agents/notes/proposed/architecture/2026-08-08-semantic-composer-chain-phases.zh.md
index d00332b155..c5d38110df 100644
--- a/.agents/notes/proposed/architecture/2026-08-08-semantic-composer-chain-phases.zh.md
+++ b/.agents/notes/proposed/architecture/2026-08-08-semantic-composer-chain-phases.zh.md
@@ -18,7 +18,7 @@ Status: proposed
阶段词汇归声明该 slot 的领域所有，而不属于全局 slot 框架。`SlotMap` 携带确切的阶段元组，用于编译期注册；运行时 `SlotSpec` 重复该元组，作为排序依据。其他链不会获得任何 composer 术语，也无需迁移，除非它们主动声明阶段。
-本提案扩展 [Web subagent 对话](../../implemented/feature/2026-07-27-web-subagent-conversations.zh.md)、[Web 权限与审批](../../archived/feature/2026-07-23-web-permission-and-approval.md)和[计划审阅呈现](../../archived/feature/2026-07-30-plan-review-presentation-intent.md)约定，但不取代其中任何一项。[运行时所有权子级守卫记录](../../archived/bug-fix/2026-08-01-ask-user-delegated-caller-guard.md)引入了防止子级新建自己负责的人类等待的守卫。本提案落地时，不应归档任何活跃 Agent Note。
+本提案扩展 [Web subagent 对话](../../../../packages/client/ui-subagent/README.zh.md)、[Web 权限与审批](../../archived/feature/2026-07-23-web-permission-and-approval.md)和[计划审阅呈现](../../archived/feature/2026-07-30-plan-review-presentation-intent.md)约定，但不取代其中任何一项。[运行时所有权子级守卫记录](../../archived/bug-fix/2026-08-01-ask-user-delegated-caller-guard.md)引入了防止子级新建自己负责的人类等待的守卫。本提案落地时，不应归档任何活跃 Agent Note。
## 备选方案
diff --git a/.agents/notes/proposed/feature/2026-06-30-pre-tool-input-rewrite.i18n.yaml b/.agents/notes/proposed/feature/2026-06-30-pre-tool-input-rewrite.i18n.yaml
index 8d5b683f9e..2cc9228795 100644
--- a/.agents/notes/proposed/feature/2026-06-30-pre-tool-input-rewrite.i18n.yaml
+++ b/.agents/notes/proposed/feature/2026-06-30-pre-tool-input-rewrite.i18n.yaml
@@ -6,8 +6,8 @@
en: 28be5a60d0f8f70d
zh: 2ade899f45347755
/agent-note-pre-tool-input-rewrite-a-consistent-design/problem:
- en: 1e84d54d317750ed
- zh: 5436c2f44569ab52
+ en: edd34e93748ea618
+ zh: 182f02dffa0d654f
/agent-note-pre-tool-input-rewrite-a-consistent-design/the-problem-three-readers-of-pre-execution-arguments:
en: bdc0958b87dbd888
zh: 0364cad8a5727306
diff --git a/.agents/notes/proposed/feature/2026-06-30-pre-tool-input-rewrite.md b/.agents/notes/proposed/feature/2026-06-30-pre-tool-input-rewrite.md
index a42b05ac7d..add55c305b 100644
--- a/.agents/notes/proposed/feature/2026-06-30-pre-tool-input-rewrite.md
+++ b/.agents/notes/proposed/feature/2026-06-30-pre-tool-input-rewrite.md
@@ -6,7 +6,7 @@ English | [中文](2026-06-30-pre-tool-input-rewrite.zh.md)
## Problem
-The [interception extension-points Agent Note](../../implemented/feature/2026-06-30-interception-extension-points.md) defines `tools/pre-execute` as an allow/deny/ask gate over an execution whose identity is already protected and whose arguments are deeply frozen. Claude Code's `PreToolUse` hook also offers `updatedInput`, so a faithful bridge needs an explicit rewrite mechanism. A rewrite cannot be a mutation escape hatch on the existing execution object: it must keep the durable history, audit record, presentation, and executed value consistent.
+The [interception extension-points reference](../../../../packages/core/tools/README.md) defines `tools/pre-execute` as an allow/deny/ask gate over an execution whose identity is already protected and whose arguments are deeply frozen. Claude Code's `PreToolUse` hook also offers `updatedInput`, so a faithful bridge needs an explicit rewrite mechanism. A rewrite cannot be a mutation escape hatch on the existing execution object: it must keep the durable history, audit record, presentation, and executed value consistent.
## The problem: three readers of pre-execution arguments
diff --git a/.agents/notes/proposed/feature/2026-06-30-pre-tool-input-rewrite.zh.md b/.agents/notes/proposed/feature/2026-06-30-pre-tool-input-rewrite.zh.md
index 8ef07ea7b6..4eaa7ba0ba 100644
--- a/.agents/notes/proposed/feature/2026-06-30-pre-tool-input-rewrite.zh.md
+++ b/.agents/notes/proposed/feature/2026-06-30-pre-tool-input-rewrite.zh.md
@@ -6,7 +6,7 @@ Status: proposed
## 问题
-[拦截扩展点 Agent Note](../../implemented/feature/2026-06-30-interception-extension-points.zh.md) 将 `tools/pre-execute` 定义为一道针对执行的允许/拒绝/询问门禁，此时执行的身份标识已受保护、参数已被深度冻结。Claude Code 的 `PreToolUse` 钩子还提供了 `updatedInput`，因此忠实的桥接需要一个显式的重写机制。重写不能是对现有执行对象的可变逃逸口：它必须保持持久化历史、审计记录、展示层与实际执行值之间的一致性。
+[拦截扩展点 参考](../../../../packages/core/tools/README.zh.md) 将 `tools/pre-execute` 定义为一道针对执行的允许/拒绝/询问门禁，此时执行的身份标识已受保护、参数已被深度冻结。Claude Code 的 `PreToolUse` 钩子还提供了 `updatedInput`，因此忠实的桥接需要一个显式的重写机制。重写不能是对现有执行对象的可变逃逸口：它必须保持持久化历史、审计记录、展示层与实际执行值之间的一致性。
## 问题本质：执行前参数的三个读取方
diff --git a/.agents/notes/proposed/feature/2026-07-08-interactive-side-sessions.i18n.yaml b/.agents/notes/proposed/feature/2026-07-08-interactive-side-sessions.i18n.yaml
index a142187273..30e665ca0b 100644
--- a/.agents/notes/proposed/feature/2026-07-08-interactive-side-sessions.i18n.yaml
+++ b/.agents/notes/proposed/feature/2026-07-08-interactive-side-sessions.i18n.yaml
@@ -6,8 +6,8 @@
en: a200e33a65a4f530
zh: 47d02d3736310892
/agent-note-interactive-side-sessions-and-merge-back/problem:
- en: 181d0078a702fdf2
- zh: ad1bff4f82fafdf3
+ en: 212258ada8f174eb
+ zh: 9a02b100533118fe
/agent-note-interactive-side-sessions-and-merge-back/proposal:
en: 5fa7d2000db6b265
zh: a892b74299e0f984
@@ -18,5 +18,5 @@
en: 17d0937a1f28b1ac
zh: 9710ab0af3268da1
/agent-note-interactive-side-sessions-and-merge-back/risks:
- en: 86f12d62580d8d98
- zh: 8c39be21a1e3958f
+ en: 2435d8e2aba0d1c1
+ zh: 3854c476bea061d4
diff --git a/.agents/notes/proposed/feature/2026-07-08-interactive-side-sessions.md b/.agents/notes/proposed/feature/2026-07-08-interactive-side-sessions.md
index 53b21497c9..fd1b79a820 100644
--- a/.agents/notes/proposed/feature/2026-07-08-interactive-side-sessions.md
+++ b/.agents/notes/proposed/feature/2026-07-08-interactive-side-sessions.md
@@ -6,7 +6,7 @@ English | [中文](2026-07-08-interactive-side-sessions.zh.md)
## Problem
-A user may want to explore a question from a live session without changing its main context. Existing primitives do not expose that product shape: [session-store fork](../../archived/feature/2026-06-30-session-store-fork-api.md) creates an unattached session, while [fork subagents](../../implemented/feature/2026-06-21-subagent-capability-seam.md) are model-driven tasks whose transcript collapses into one tool result. Neither gives the user a separate conversation, and neither records a conclusion in the parent together with the side session that produced it.
+A user may want to explore a question from a live session without changing its main context. Existing primitives do not expose that product shape: [session-store fork](../../archived/feature/2026-06-30-session-store-fork-api.md) creates an unattached session, while [fork subagents](../../../../packages/subagent/subagent-fork-in-process/README.md) are model-driven tasks whose transcript collapses into one tool result. Neither gives the user a separate conversation, and neither records a conclusion in the parent together with the side session that produced it.
## Proposal
@@ -36,6 +36,6 @@ Rewind productization, session-tree views, a model-facing side-session tool, and
## Risks
-- Read-only behavior is advisory until a `tools/pre-execute` deny gate enforces it; [the interception point](../../implemented/feature/2026-06-30-interception-extension-points.md) can add that gate without changing these mechanics.
+- Read-only behavior is advisory until a `tools/pre-execute` deny gate enforces it; [the interception point](../../../../docs/tool-execution-pipeline.md) can add that gate without changing these mechanics.
- A compacted source forks its compacted view, so a bound UI should disclose that the child inherits summaries rather than replaced turns.
- Repeated handbacks consume parent context. The per-merge length cap bounds each note; later consolidation belongs to compaction.
diff --git a/.agents/notes/proposed/feature/2026-07-08-interactive-side-sessions.zh.md b/.agents/notes/proposed/feature/2026-07-08-interactive-side-sessions.zh.md
index 439d9c4d1a..5837897709 100644
--- a/.agents/notes/proposed/feature/2026-07-08-interactive-side-sessions.zh.md
+++ b/.agents/notes/proposed/feature/2026-07-08-interactive-side-sessions.zh.md
@@ -6,7 +6,7 @@ Status: proposed
## 问题
-用户可能希望在不改变当前会话主上下文的前提下，探索一个来自活跃会话的问题。现有原语无法提供这种产品形态：[会话存储 fork](../../archived/feature/2026-06-30-session-store-fork-api.md) 创建的是一个未绑定的会话，而 [fork subagent](../../implemented/feature/2026-06-21-subagent-capability-seam.zh.md) 是模型驱动的任务，其 transcript（文本记录）会折叠为一条工具结果。两者都不能给用户一个独立的对话，也都不能在父会话中同时记录结论和产生该结论的侧会话。
+用户可能希望在不改变当前会话主上下文的前提下，探索一个来自活跃会话的问题。现有原语无法提供这种产品形态：[会话存储 fork](../../archived/feature/2026-06-30-session-store-fork-api.md) 创建的是一个未绑定的会话，而 [fork subagent](../../../../packages/subagent/subagent-fork-in-process/README.zh.md) 是模型驱动的任务，其 transcript（文本记录）会折叠为一条工具结果。两者都不能给用户一个独立的对话，也都不能在父会话中同时记录结论和产生该结论的侧会话。
## 提案
@@ -36,6 +36,6 @@ Status: proposed
## 风险
-- 只读行为在 `tools/pre-execute` 拒绝门禁强制执行之前仅为建议性质；[拦截点](../../implemented/feature/2026-06-30-interception-extension-points.zh.md)可在不改变本机制的前提下添加该门禁。
+- 只读行为在 `tools/pre-execute` 拒绝门禁强制执行之前仅为建议性质；[拦截点](../../../../docs/tool-execution-pipeline.zh.md)可在不改变本机制的前提下添加该门禁。
- 经过压缩（compaction）的源会话 fork 出的是其压缩视图，因此绑定的界面应当告知用户子会话继承的是摘要而非被替换的轮次。
- 反复的 handback 会消耗父会话上下文。每次合并的长度上限约束了单条笔记的大小；后续的合并整理属于上下文压缩的职责。
diff --git a/.agents/notes/proposed/feature/2026-08-04-task-surface.i18n.yaml b/.agents/notes/proposed/feature/2026-08-04-task-surface.i18n.yaml
index faa5a8965e..fbb5dea139 100644
--- a/.agents/notes/proposed/feature/2026-08-04-task-surface.i18n.yaml
+++ b/.agents/notes/proposed/feature/2026-08-04-task-surface.i18n.yaml
@@ -15,8 +15,8 @@
en: 9650ef8f65049b7d
zh: c0925b701a6b681c
/agent-note-task-surface-for-structured-session-interaction/tool-and-presentation-contract:
- en: 836a14533a918d95
- zh: 0522d458992c5355
+ en: 13f923b5958b5f6d
+ zh: c8aa92cac29769fd
/agent-note-task-surface-for-structured-session-interaction/submission-contract:
en: 480c434bc0825063
zh: bbcace61f8d82188
@@ -33,8 +33,8 @@
en: 121ceb5920763980
zh: 7d7c1576faf4f331
/agent-note-task-surface-for-structured-session-interaction/acceptance-criteria:
- en: e5db6c885617dd5d
- zh: 0a54a00d2a195bfb
+ en: 2b278bc21a87232a
+ zh: 49d0556ec77b542f
/agent-note-task-surface-for-structured-session-interaction/risks:
en: 84a297fcdef9aaad
zh: a9ce38547d650e55
diff --git a/.agents/notes/proposed/feature/2026-08-04-task-surface.md b/.agents/notes/proposed/feature/2026-08-04-task-surface.md
index 749ce9e40e..bc8b0e9ae7 100644
--- a/.agents/notes/proposed/feature/2026-08-04-task-surface.md
+++ b/.agents/notes/proposed/feature/2026-08-04-task-surface.md
@@ -81,9 +81,9 @@ Limits are schema-backed configuration on the Task Surface service. The initial
`show_task_surface` accepts `{ model: TaskSurfaceModelV1 }`. The Host parses and normalizes the complete model, rejects the call when that Session already has an open Task Surface, mints `surfaceId`, and returns canonical `{ surfaceId, model }` with the normalized model. `presentationMeta` persists `value.model`, so the projector and executor cannot disagree about normalization. The Native result names the Surface and explains that an ordinary message bypasses it when the client cannot render the panel. The tool then calls `exec.concludeTurn()` so the agent does not continue past the requested human checkpoint.
-The tool definition omits `isConcurrencySafe`. Under the existing tool-registry contract, omission classifies every call as an exclusive ordering barrier; no new `ToolDefinition` field is introduced. The tool is composed only in Web profiles that mount both the Host service and Web renderer. Version 1 supports `native` and `both` tool modes; a `ptc`-only profile does not advertise it because PTC mode dispatch is nested and cannot carry its presentation metadata to the outer result.
+The tool definition omits `isConcurrencySafe`. Under the existing tool-registry contract, omission classifies every call as an exclusive ordering barrier; no new `ToolDefinition` field is introduced. The tool is composed only in Web profiles that mount both the Host service and Web renderer. Version 1 supports `native` tool mode; a `ptc`-only profile does not advertise it because PTC mode dispatch is nested and cannot carry its presentation metadata to the outer result.
-The browser-safe domain package imports the type-only `Branded` primitive from `@deepseek-ai/dsh-brand` and owns all three Task Surface IDs. The canonical value is execution-local under the [canonical tool output contract](../../implemented/architecture/2026-07-20-canonical-tool-output-contract.md). Replay therefore uses `output.presentationMeta(args, value)` to persist this tagged payload with `tool/result.meta`:
+The browser-safe domain package imports the type-only `Branded` primitive from `@deepseek-ai/dsh-brand` and owns all three Task Surface IDs. The canonical value is execution-local under the [canonical tool output contract](../../../../packages/core/tools/README.md). Replay therefore uses `output.presentationMeta(args, value)` to persist this tagged payload with `tool/result.meta`:
```ts
import type { Branded } from '@deepseek-ai/dsh-brand'
@@ -248,7 +248,7 @@ The implementation depends on the existing message log, canonical tool output, t
## Acceptance criteria
-- A real model in `native` or `both` mode can call one stable `show_task_surface` schema, the call ends its turn, and a capable Web client renders the same normalized model live and after replay; `ptc`-only mode does not advertise it.
+- A real model in `native` mode can call one stable `show_task_surface` schema, the call ends its turn, and a capable Web client renders the same normalized model live and after replay; `ptc`-only mode does not advertise it.
- The static `TaskSurfaceDock` is the only editor and remains actionable for an active result outside the loaded history window; the keyed toolview remains a read-only transcript summary and replay. A composer takeover hides the still-mounted Dock, preserves its draft, and reveals the same owner after release.
- Submitting produces exactly one visible user message per `submissionId`, starts the next turn through normal queue admission, and retains exact branded occurrence correlation while keeping `source.kind: 'user'`; dismissing records one log event and starts no turn.
- The queued client row retains the correlated message source. `getActive` exposes `queued` or `claiming` across same-process reconnect; commit closes the projection, while explicit discard clears pending state and leaves the Surface open. Queue-row disappearance alone changes no UI state. Edit and steer are rejected, and remove succeeds only before claim.
diff --git a/.agents/notes/proposed/feature/2026-08-04-task-surface.zh.md b/.agents/notes/proposed/feature/2026-08-04-task-surface.zh.md
index 4a63e671ff..3bb982f032 100644
--- a/.agents/notes/proposed/feature/2026-08-04-task-surface.zh.md
+++ b/.agents/notes/proposed/feature/2026-08-04-task-surface.zh.md
@@ -81,9 +81,9 @@ Task Surface 服务通过受 schema 校验的配置定义限制。初始默认
`show_task_surface` 接收 `{ model: TaskSurfaceModelV1 }`。Host 解析并规范化完整模型；若该会话已有一个打开的 Task Surface，则拒绝调用；否则生成 `surfaceId`，并返回带规范化模型的规范值 `{ surfaceId, model }`。`presentationMeta` 持久化 `value.model`，使投影器和执行器不会对规范化结果产生分歧。Native 结果会指明该 Surface，并说明客户端无法渲染面板时，可以通过普通消息绕过它。随后工具调用 `exec.concludeTurn()`，防止 agent 越过所要求的人工检查点继续执行。
-工具定义省略 `isConcurrencySafe`。根据现有工具注册表约定，省略该字段会将每次调用归类为独占排序屏障，无需新增 `ToolDefinition` 字段。该工具只会组装到同时挂载 Host 服务和 Web 渲染器的 Web profile 中。版本 1 支持 `native` 和 `both` 工具模式；仅支持 `ptc` 的 profile 不会向模型公布该工具，因为 PTC mode 分发属于嵌套调用，无法把呈现元数据传到外层结果。
+工具定义省略 `isConcurrencySafe`。根据现有工具注册表约定，省略该字段会将每次调用归类为独占排序屏障，无需新增 `ToolDefinition` 字段。该工具只会组装到同时挂载 Host 服务和 Web 渲染器的 Web profile 中。版本 1 支持 `native` 工具模式；仅支持 `ptc` 的 profile 不会向模型公布该工具，因为 PTC mode 分发属于嵌套调用，无法把呈现元数据传到外层结果。
-浏览器安全的领域包从 `@deepseek-ai/dsh-brand` 以仅类型方式导入 `Branded` 原语，并拥有全部三个 Task Surface ID。根据[规范工具输出约定](../../implemented/architecture/2026-07-20-canonical-tool-output-contract.zh.md)，规范值仅存在于本次执行中。因此，回放通过 `output.presentationMeta(args, value)` 将以下带标签的载荷随 `tool/result.meta` 一并持久化：
+浏览器安全的领域包从 `@deepseek-ai/dsh-brand` 以仅类型方式导入 `Branded` 原语，并拥有全部三个 Task Surface ID。根据[规范工具输出约定](../../../../packages/core/tools/README.zh.md)，规范值仅存在于本次执行中。因此，回放通过 `output.presentationMeta(args, value)` 将以下带标签的载荷随 `tool/result.meta` 一并持久化：
```ts
import type { Branded } from '@deepseek-ai/dsh-brand'
@@ -248,7 +248,7 @@ Web 插件将未提交值保存在一个有界、按会话持久化的 slot stor
## 验收标准
-- 在 `native` 或 `both` 工具模式下，真实模型可以调用一个稳定的 `show_task_surface` schema；调用结束当前轮次；具备相应能力的 Web 客户端在实时运行和回放后都能渲染同一份规范化模型；仅支持 `ptc` 的模式不会向模型公布该工具。
+- 在 `native` 工具模式下，真实模型可以调用一个稳定的 `show_task_surface` schema；调用结束当前轮次；具备相应能力的 Web 客户端在实时运行和回放后都能渲染同一份规范化模型；仅支持 `ptc` 的模式不会向模型公布该工具。
- 静态 `TaskSurfaceDock` 是唯一的编辑器，即使活动结果位于已加载历史窗口之外也仍可操作；带 key 的 toolview 始终是 transcript 的只读摘要和回放。composer 接管会隐藏仍处于挂载状态的 Dock、保留其草稿，并在接管释放后重新显示同一个所有者。
- 每个 `submissionId` 的提交操作恰好生成一条可见用户消息，通过普通队列接纳开始下一轮，并在保留 `source.kind: 'user'` 的同时维持带品牌类型的确切调用实例关联；关闭操作记录一条日志事件，且不启动轮次。
- 客户端排队行保留已关联的消息来源。`getActive` 可在同一进程的重新连接前后公开 `queued` 或 `claiming`；持久化完成后会关闭投影，显式丢弃则会清除待处理状态并让 Surface 保持打开。队列行消失本身不会改变任何 UI 状态。系统会拒绝编辑和 steering，且移除操作只能在认领前成功。
diff --git a/.agents/notes/proposed/feature/2026-09-08-desktop-mandatory-update-api.i18n.yaml b/.agents/notes/proposed/feature/2026-09-08-desktop-mandatory-update-api.i18n.yaml
index 540d081a58..1e0038bd15 100644
--- a/.agents/notes/proposed/feature/2026-09-08-desktop-mandatory-update-api.i18n.yaml
+++ b/.agents/notes/proposed/feature/2026-09-08-desktop-mandatory-update-api.i18n.yaml
@@ -12,8 +12,8 @@
en: 264c54ffe91f3193
zh: 005512e1c498ccc1
/agent-note-desktop-mandatory-update-api/proposal/endpoint-and-access:
- en: 6c82820724930bb5
- zh: 5f6a0bbfd6fb6b16
+ en: c9f53773a42e779e
+ zh: a50a6e98eb92c479
/agent-note-desktop-mandatory-update-api/proposal/request:
en: fb66b137a600f3a6
zh: 83f5c74a1716d57c
diff --git a/.agents/notes/proposed/feature/2026-09-08-desktop-mandatory-update-api.md b/.agents/notes/proposed/feature/2026-09-08-desktop-mandatory-update-api.md
index 429547c85b..1e86503c43 100644
--- a/.agents/notes/proposed/feature/2026-09-08-desktop-mandatory-update-api.md
+++ b/.agents/notes/proposed/feature/2026-09-08-desktop-mandatory-update-api.md
@@ -14,7 +14,7 @@ Use a guest-accessible policy endpoint. This document owns its Desktop request a
### Endpoint and access
-The [client decision](../../implemented/feature/2026-09-11-desktop-mandatory-update-client.md) owns the implemented polling and blocking UI. This API proposal remains active for backend deployment and live integration; local fixtures do not certify the service.
+The [client reference](../../../../apps/desktop/README.md) owns the implemented polling and blocking UI. This API proposal remains active for backend deployment and live integration; local fixtures do not certify the service.
```http
GET /api/v0/check_client_update
diff --git a/.agents/notes/proposed/feature/2026-09-08-desktop-mandatory-update-api.zh.md b/.agents/notes/proposed/feature/2026-09-08-desktop-mandatory-update-api.zh.md
index e2b992f746..ef2fa52f65 100644
--- a/.agents/notes/proposed/feature/2026-09-08-desktop-mandatory-update-api.zh.md
+++ b/.agents/notes/proposed/feature/2026-09-08-desktop-mandatory-update-api.zh.md
@@ -14,7 +14,7 @@ Desktop 在业务 server 为本地进程、用户尚未登录时也需要获取
### 接口与访问
-[客户端决策](../../implemented/feature/2026-09-11-desktop-mandatory-update-client.zh.md)负责已实现的轮询和阻塞界面。本接口提案仍负责后端部署与真实联调；本地 fixture（测试前置数据）不能认证服务。
+[客户端参考](../../../../apps/desktop/README.zh.md)负责已实现的轮询和阻塞界面。本接口提案仍负责后端部署与真实联调；本地 fixture（测试前置数据）不能认证服务。
```http
GET /api/v0/check_client_update
diff --git a/.agents/notes/proposed/feature/2026-09-08-desktop-update-policy-and-installation.i18n.yaml b/.agents/notes/proposed/feature/2026-09-08-desktop-update-policy-and-installation.i18n.yaml
index 11052cfad3..0d88040d32 100644
--- a/.agents/notes/proposed/feature/2026-09-08-desktop-update-policy-and-installation.i18n.yaml
+++ b/.agents/notes/proposed/feature/2026-09-08-desktop-update-policy-and-installation.i18n.yaml
@@ -9,8 +9,8 @@
en: 96e7c7a206e06f15
zh: 189133653543a98c
/agent-note-desktop-update-policy-and-installation/proposal:
- en: 73b06c4b868250d5
- zh: 947419d367f6c7e9
+ en: 68c7ebc3e29eb4d8
+ zh: c98d151b6ca44ecb
/agent-note-desktop-update-policy-and-installation/proposal/release-and-backend-qualification:
en: 03612a65e4a65939
zh: 4d45467930e9f364
diff --git a/.agents/notes/proposed/feature/2026-09-08-desktop-update-policy-and-installation.md b/.agents/notes/proposed/feature/2026-09-08-desktop-update-policy-and-installation.md
index fa88a7dd79..97db1cebef 100644
--- a/.agents/notes/proposed/feature/2026-09-08-desktop-update-policy-and-installation.md
+++ b/.agents/notes/proposed/feature/2026-09-08-desktop-update-policy-and-installation.md
@@ -10,7 +10,7 @@ Desktop usually runs a local dsh server, so remote business errors cannot reliab
## Proposal
-This proposal records outstanding release and backend work; the [implemented client decision](../../implemented/feature/2026-09-11-desktop-mandatory-update-client.md) and [Desktop README](../../../../apps/desktop/README.md) own current behavior.
+This proposal records outstanding release and backend work; the [Desktop README](../../../../apps/desktop/README.md) owns current client behavior.
| Document | Owns |
|---|---|
diff --git a/.agents/notes/proposed/feature/2026-09-08-desktop-update-policy-and-installation.zh.md b/.agents/notes/proposed/feature/2026-09-08-desktop-update-policy-and-installation.zh.md
index d9dc74f66a..0c7195dd63 100644
--- a/.agents/notes/proposed/feature/2026-09-08-desktop-update-policy-and-installation.zh.md
+++ b/.agents/notes/proposed/feature/2026-09-08-desktop-update-policy-and-installation.zh.md
@@ -10,7 +10,7 @@ Desktop 通常运行本地 dsh server，无法依靠远程业务错误可靠触
## 提案
-本文记录尚未完成的发布与后端工作；[已实施的客户端决策](../../implemented/feature/2026-09-11-desktop-mandatory-update-client.zh.md)和[桌面 README](../../../../apps/desktop/README.zh.md)负责当前行为。
+本文记录尚未完成的发布与后端工作；[桌面 README](../../../../apps/desktop/README.zh.md)负责当前客户端行为。
| 文档 | 负责内容 |
|---|---|
diff --git a/.agents/notes/proposed/feature/2026-10-03-pi-extensions-bridge.i18n.yaml b/.agents/notes/proposed/feature/2026-10-03-pi-extensions-bridge.i18n.yaml
new file mode 100644
index 0000000000..6a09cae1de
--- /dev/null
+++ b/.agents/notes/proposed/feature/2026-10-03-pi-extensions-bridge.i18n.yaml
@@ -0,0 +1,43 @@
+# Bilingual-pair consistency record for 2026-10-03-pi-extensions-bridge.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/proposed/feature/2026-10-03-pi-extensions-bridge.md
+/agent-note-pi-extensions-bridge:
+ en: cd9f68956ba34672
+ zh: 1fc649c5eb0d3cf4
+/agent-note-pi-extensions-bridge/problem:
+ en: eb4d3f10c3feedb4
+ zh: a1a1a75a724c9a8b
+/agent-note-pi-extensions-bridge/proposal:
+ en: 56b36193ca6f829d
+ zh: a31e226794c1ca90
+/agent-note-pi-extensions-bridge/proposal/packages-and-composition:
+ en: 2ab10852b93ad41b
+ zh: 3c14d410235fcfac
+/agent-note-pi-extensions-bridge/proposal/loading-and-execution:
+ en: d95ece799bc6bab7
+ zh: 1e19d3b49473a57e
+/agent-note-pi-extensions-bridge/proposal/serving-the-api:
+ en: b1365f16d76fe27a
+ zh: 105b88f80eb8964d
+/agent-note-pi-extensions-bridge/proposal/built-in-tool-calls-as-pi-sees-them:
+ en: c74e4662ad0a8ee7
+ zh: 653729b41e983b13
+/agent-note-pi-extensions-bridge/proposal/unserved-features:
+ en: 70c74cf93526cfad
+ zh: cab3efc2c109ad5a
+/agent-note-pi-extensions-bridge/proposal/extension-state:
+ en: be58f498b8d28548
+ zh: 4cc057f794c288bf
+/agent-note-pi-extensions-bridge/proposal/core-mechanisms-narrower-than-pi-s:
+ en: 9fa8297436332064
+ zh: 9a000e157940b0f8
+/agent-note-pi-extensions-bridge/alternatives-considered:
+ en: a3769b960278c17f
+ zh: e7d86ff1aff243b8
+/agent-note-pi-extensions-bridge/acceptance-criteria:
+ en: 60894db423a54ec3
+ zh: 13b435271f6a1371
+/agent-note-pi-extensions-bridge/risks:
+ en: 2b9a626b13c604f6
+ zh: f67cb80d2b699989
diff --git a/.agents/notes/proposed/feature/2026-10-03-pi-extensions-bridge.md b/.agents/notes/proposed/feature/2026-10-03-pi-extensions-bridge.md
new file mode 100644
index 0000000000..28faf5911a
--- /dev/null
+++ b/.agents/notes/proposed/feature/2026-10-03-pi-extensions-bridge.md
@@ -0,0 +1,142 @@
+# Agent Note: Pi extensions bridge
+
+Status: proposed
+
+English | [中文](2026-10-03-pi-extensions-bridge.zh.md)
+
+## Problem
+
+Pi 1.0.0 extensions are in-process TypeScript factories `(pi: ExtensionAPI) => void`. A factory subscribes to about forty lifecycle, context, tool, and provider events, registers model tools, slash commands, model providers, and MCP servers, and talks to the user through `ctx.ui` ([extensions guide](https://github.com/earendil-works/pi/blob/v1.0.0/packages/coding-agent/docs/extensions.md), [API types](https://github.com/earendil-works/pi/blob/v1.0.0/packages/coding-agent/src/core/extensions/types.ts)). The API is published and widely used: about 11,000 npm packages carried the `pi-package` keyword in October 2026.
+
+DSH has bridges for two other ecosystems: shell hooks written for Claude Code and Codex ([hooks group](../../../../packages/experimental/README.md)) and Claude Code mods ([compatibility page](../../../../docs/subsystems/claude-code-mods.md)). Pi's extension API is broader than either. It lets one in-process module rewrite the messages of a single request, edit tool arguments, append its own durable records, and continue a finished run. Serving that API from DSH extension points answers two questions: how much of an extension written for another harness runs unchanged, and which DSH core mechanisms are narrower than Pi's.
+
+## Proposal
+
+Add an experimental bridge that loads unmodified Pi extension sources and serves Pi's `ExtensionAPI` from existing DSH extension points. The bridge is a capability demonstration: it runs extensions as written where an existing DSH mechanism carries the behavior, leaves the rest unserved, and lists every difference on a compatibility page. Apart from the restricted plugin records that extension state needs (row 9 of the gap table), each core gap is closed by a separate change.
+
+### Packages and composition
+
+- `@deepseek-ai/dsh-experimental-pi-extensions` is the Host package and provides `ctx.piExtensions`. `@deepseek-ai/dsh-experimental-client-ui-pi-extensions` is the Web package. Neither is an optional bundle; an opt-in overlay composes them, as for the Claude Code mods bridge.
+- One cordis.yml row names one extension source: a file, a directory with an `index.ts` or `index.js`, or a Pi package directory whose `package.json` lists `pi.extensions`. The row also carries the extension's flag values. Row order is Pi's load order, which is also its handler dispatch order.
+- The bridge does not scan `~/.pi` or `.pi`, install packages, or decide project trust. A Pi package's skills, prompt templates, and themes are not loaded.
+
+### Loading and execution
+
+- The bridge has its own loader and event dispatcher. `@earendil-works/pi-coding-agent` is not a dependency.
+- `jiti` imports the source, so TypeScript loads in a built installation. The loader resolves the imports Pi supplies to extensions: `typebox` and `@earendil-works/pi-ai` to the bridge's own dependencies, `@earendil-works/pi-coding-agent` to a module of the bridge that implements the helpers that need no Pi runtime (`defineTool`, the tool-event type guards, the truncation helpers, `withFileMutationQueue`, `getAgentDir`), and `@earendil-works/pi-tui` to the optional peer dependency when the deployment installed it. An extension that imports a module the loader cannot resolve fails to load with an error naming the module.
+- Extension code runs in the Host process with the process's full authority, as mods do.
+- Every Session with an in-process Agent gets its own runtime: the module is evaluated once per row, and its factory runs once per Session, as Pi re-runs factories for each Session. State an extension keeps at module scope is shared by all Sessions of the Host process; Pi also keeps one module instance across the Sessions of a process, but runs one Session at a time. A subagent's Session gets a separate runtime in Pi's `print` mode with `hasUI: false`, so a tool call a subagent makes passes the same extension handlers as the root's.
+
+### Serving the API
+
+| Pi API | DSH mechanism |
+|---|---|
+| `session_start`, `session_shutdown` | `agent/created` (awaited before the first turn), `agent/disposed` |
+| `input` (after inbox admission; see row 7), `before_agent_start` | `system-prompt/assemble` and `agent/pre-step`: claimed user messages are transformed or dropped, a returned `systemPrompt` replaces the assembled prompt for that turn, and returned messages join the step |
+| `tool_call` | `tools/pre-execute`: `block` becomes a denial; a handler that throws denies the call |
+| `tool_result` | `tools/post-execute`: replaced content is installed as the result's content |
+| `agent_before_settle` | `agent/turn-stopping`: returned custom entries are recorded, and a returned message with `continue` is steered into the turn |
+| `agent_start`, `agent_end`, `agent_settled`, `turn_start`, `turn_end`, `message_start`, `message_end`, `tool_execution_start`, `tool_execution_end`, `model_select`, `session_info_changed`, `session_compact` | Session events and `agent/status`, delivered in order as notifications |
+| `registerTool`, `ctx.executeTool` | Agent-scoped `ctx.tools` registrations; nested calls run the full tool pipeline; built-in names follow the translation below |
+| `registerCommand`, `getCommands` | Agent-scoped `ctx.commands` |
+| `sendUserMessage`, `sendMessage` | `agent.followup()`, `agent.steer()`, `agent.inject()` |
+| `appendEntry`, `setLabel`, tool `details`, `ctx.sessionManager` | Ignorable Session records and `tool/result` metadata, read back as Pi entries |
+| `getActiveTools`, `setActiveTools`, `getAllTools` | `ctx.tools.schemas()`; `setActiveTools` applies a scoped `ctx.tools.restrict()` to global tools and adds or removes the bridge's own Agent-scoped registrations, because a restriction does not hide scoped tools |
+| `setModel`, `getThinkingLevel`, `setThinkingLevel` | An `agent/request` override |
+| `exec` | `ctx.subprocess`, argv without a shell |
+| `ctx.ui.select`, `confirm`, `input`, `editor` | `ctx.userQuestions` |
+| `ctx.ui.notify`, `setStatus`, `setWidget`, `setTitle`, `setEditorText` | A Remote stream the Web package renders |
+| `registerFlag`, `getFlag`, `events` | Row configuration; an in-process event bus per Session runtime |
+
+All Pi handlers for one Session run through one ordered queue. A notification never overtakes an earlier one, and an awaited hook such as `tool_call` runs after every notification queued before it, which keeps the order Pi's awaited dispatch gives handlers.
+
+The Web and Desktop GUI appear to extensions as Pi's `rpc` mode with `hasUI: true`; headless, SDK, and ACP Sessions appear as `print` mode. Extensions already handle both: terminal-only calls such as `ctx.ui.custom()` return what Pi's `rpc` mode returns.
+
+### Built-in tool calls as Pi sees them
+
+DSH and Pi share the names `bash`, `read`, `edit`, `write`, and `grep`, but not their arguments, and Pi's `find` is DSH's `glob`. A Pi safety extension reads `event.input.path` or `event.input.command`. The bridge therefore presents each call of these six tools to handlers with Pi's name and Pi's argument names, translated from the DSH call. Other tools pass through unchanged. A test loads the registered DSH tool schemas and fails when a mapped parameter is renamed or removed, or when a tool gains a parameter the table has not classified.
+
+The opposite direction uses the same table. `getActiveTools()` and `getAllTools()` report Pi names for the six tools and DSH names for every other tool, and `setActiveTools()` accepts the same names. `ctx.executeTool()` given a Pi name translates the arguments into the DSH call; an `edit` call with more than one entry in `edits` is refused, because one DSH `edit` call makes one replacement. An extension tool registered under a Pi built-in name replaces the corresponding DSH tool for that Agent, as it replaces Pi's own tool (`find` replaces `glob`).
+
+### Unserved features
+
+- An event DSH cannot raise is accepted at registration, never raised, and named in a warning when the extension loads.
+- A `pi` or `ctx` member DSH cannot serve throws an error naming the member.
+- Where Pi fails closed, the bridge does too. A `tool_call` handler that edits `event.input` gets the call denied with a reason, because the logged call would otherwise differ from the executed one.
+
+### Extension state
+
+Pi extensions rebuild their state on `session_start` from what they wrote earlier. The bridge keeps that state in the Session log so that it follows resume and fork:
+
+- `appendEntry` and `setLabel` write ignorable records whose type starts with `plugin:`. A restricted core operation, callable only from experimental packages, appends them. They are not `SessionEventMap` members, so the persistence catalog and its type history are unchanged. A build without the bridge retains and skips them when it reads the current format, as the [ignorable events decision](../../implemented/architecture/2026-08-30-retain-ignorable-external-session-events.md) requires. A later format edge carries them on a best-effort basis: it keeps them under their names where it can and otherwise states which it drops, while the alpha historical edges refuse every unknown event ([decision](../../implemented/architecture/2026-08-31-alpha-historical-unknown-event-refusal.md)).
+- A tool's `details` is stored as the `tool/result` metadata the tool's output declaration projects.
+- `sendMessage` content is logged as an ordinary user-sourced message with the extension's content unchanged. A companion ignorable record carries `customType`, `display`, and `details`.
+
+### Core mechanisms narrower than Pi's
+
+Ranked by how much of Pi's API each blocks, with the GitHub issue that tracks each. Rows 1 and 3 follow from DSH rules: a request is derived from the Session log, and the log is linear. The other rows are missing extension points.
+
+| # | Mechanism | Pi API blocked | DSH today | Issue |
+|---|---|---|---|---|
+| 1 | Per-request rewrite of model input | `context`, `context_with_system`, `before_provider_request`, `prepareLoadout` hidden declarations | The loop derives each request from the log and freezes it; `llm/stream` listeners read it. A rewrite needs an awaited hook and a core event that every log reader applies to that request. | #5661 |
+| 2 | Tool-argument rewrite | `tool_call` editing `event.input` | `PreToolDecision` excludes input rewriting ([proposal](2026-06-30-pre-tool-input-rewrite.md)). | #5662 |
+| 3 | Session tree and assistant-message replacement | `navigateTree`, `session_before_tree`, `session_tree`, `message_end` replacement | The log is linear, a fork creates a new Session, and an `assistant/message` cannot replace another. | #5663 |
+| 4 | Awaited step-end and pre-commit hooks | `turn_end` entries and `continue`, `message_end` | `step/end` and `assistant/message` are committed events; a Session-event listener cannot append. | #5664 |
+| 5 | Tool progress and result replacement | `onUpdate`, `tool_execution_update`, `tool_result` turning an error into a success, tool `usage` | `ToolRunContext` has no progress channel, and `tools/post-execute` cannot replace the value of a failed result. | #5665 |
+| 6 | Per-tool exposure | `codemode`, `deferred`, and `hidden` exposure | Presentation is chosen per Agent, and a tool the model cannot see refuses execution. | #5666 |
+| 7 | Input admission | `input` before the prompt is stored | A prompt is durable in the inbox before `agent/pre-step`; a swallowed prompt leaves a turn without a step. | #5667 |
+| 8 | Logged model call by a plugin | `ctx.modelRegistry.complete`, `stream`, `streamSimple` | No Session event records a plugin's own model request, which also blocks `$.model.complete` for mods. | #5668 |
+| 9 | Plugin-owned durable records | `appendEntry` | `Session.append()` accepts declared event types only. The restricted `plugin:` records close this for experimental packages. | #5669 |
+| 10 | Compaction customization | `session_before_compact` | One `CompactionEngine` owns summarization, and `/compact` takes no instructions. | #5670 |
+| 11 | Lifecycle reasons | `session_start` reasons `new`, `fork`, and `reload`; `session_shutdown` reasons | `agent/created` reports `startup` or `resume`; `SessionStartSource` also declares `clear` and `compact`, which nothing emits yet; `agent/disposed` carries no reason. | #5671 |
+| 12 | Host-plugin display in the GUI | `ctx.ui.notify`, `setStatus`, `setWidget` | No shared mechanism; each bridge ships its own Client package. | #5672 |
+| 13 | Command capabilities | Argument completion; `newSession`, `fork`, and `switchSession` moving the user to another Session | `ctx.commands` takes unstructured text and has no Client-side effects. | #5673 |
+| 14 | Provider request hooks | `before_provider_headers`, `after_provider_response`, `provider_stream_event` | Headers, responses, and raw stream events stay inside each adapter. | #5674 |
+| 15 | Fault isolation | An extension bug stops one Pi process | An uncaught exception in the Host disposes the application for every Session. | #5675 |
+
+Terminal rendering (`ctx.ui.custom`, custom editors, renderers, shortcuts) is outside this list: DSH's GUI is not a terminal, and Pi's own `rpc` mode does not serve these either.
+
+## Alternatives considered
+
+**Depend on `@earendil-works/pi-coding-agent` and reuse its loader and runner.** It would reproduce Pi's handler ordering and error rules exactly and supply every helper extensions import. It was rejected because the exercise is to carry Pi's API on DSH mechanisms, not to embed Pi's harness: the runner is constructed over Pi's `SessionManager` and `ModelRegistry`, the package brings Pi's whole dependency closure, and its built-in tool factories would run Pi's own file and shell implementations outside DSH's filesystem and sandbox policy.
+
+**A wrapper module per extension, like `defineMod`.** A Pi extension is already a default-exported factory with no manifest to replace, so a wrapper adds a step for every extension and prevents loading a published Pi package directory.
+
+**Discover Pi's own locations automatically.** Loading `~/.pi/agent/extensions` and project `.pi/extensions` executes code a DSH user did not compose, which needs a project-trust decision DSH does not have. The mods bridge removed its directory loader for the same composition reason. Discovery can be a later opt-in layer.
+
+**Run extensions in a separate process per Session.** An uncaught extension error would then reach the Host as an event. Every awaited hook would become an inter-process round trip, and Pi's edit-in-place event objects would have to be reproduced by sending changes back. Deferred until real extensions show the isolation is needed.
+
+**Evaluate each extension module once per Session.** Concurrent Sessions would then not share module-scope state. Rejected because Pi keeps one module instance across the Sessions of a process, so an extension may rely on module state surviving a Session switch, and per-Session evaluation repeats the transpilation for every Session and subagent.
+
+**Run extensions for root Sessions only.** It needs an explicit filter, since `agent/created` fires for every Agent, and it lets a subagent's tool calls bypass a Pi safety extension.
+
+**Pass DSH tool names and arguments to handlers unchanged.** Pi's own `protected-paths` example reads `event.input.path`; with DSH's `file_path` it throws, and a handler written slightly differently would allow the write.
+
+**Declare `pi/*` Session events and a `pi-extension` message source.** Correct attribution, but each is a required-on-read persistence type: the catalog and type history change, and a build without the bridge refuses the Session.
+
+**Keep extension state in a storage domain outside the log.** State would not follow a fork, and `ctx.sessionManager.getBranch()` would not show what the extension wrote.
+
+**Raise `context` and `before_provider_request` without logging their effect.** The model would see input that the Session log cannot reconstruct.
+
+**Refuse to load an extension that subscribes to an unserved event.** Most extensions use several features; the mods bridge already warns and keeps the rest working.
+
+**Build a shared GUI notification mechanism first.** It would also serve the mods bridge, but it is a core addition; the Web package of this bridge renders its own stream until that exists.
+
+## Acceptance criteria
+
+- Pi's MIT-licensed example extensions are committed unchanged as fixtures, and only those a test exercises. Through a real agent loop with a mock model: a permission extension denies a tool call and the model sees the reason; an extension tool is called by the model and its `details` survive a resumed Session; an extension command runs; an extension replaces the system prompt for a turn; `appendEntry` state is rebuilt on `session_start` after resume.
+- A subagent's tool call reaches the handlers of its own runtime.
+- The tool translation test fails when a mapped DSH tool parameter changes.
+- A Loader composition test boots the bridge from a cordis.yml, and a disposal test shows every registration removed when the bridge unloads.
+- A recorded-Session snapshot covers an extension-denied tool call and an extension tool call.
+- `docs/subsystems/pi-extensions.md` lists every event and member with its status and every behavioral difference.
+- The new packages' `src/` have 100% coverage, and `doc-sync` passes.
+
+## Risks
+
+- Extension code has the Host's full authority, and one uncaught error stops every Session. Mount only extensions you would run as a plugin.
+- Fidelity rests on the bridge's reading of Pi 1.0.0 dispatch rules, checked against Pi's examples but not executed on Pi's code. A later Pi release can change an event or helper the bridge serves.
+- An extension that imports a helper the bridge does not implement fails to load, even if it would have used that helper on one code path only.
+- A future Session format edge that cannot carry plugin records loses extension state for Sessions written before it.
+- Extensions that keep per-Session state at module scope mix the state of concurrent Sessions, including subagents.
+- A message an extension sends is attributed to the user everywhere outside the Web package that reads the companion record.
diff --git a/.agents/notes/proposed/feature/2026-10-03-pi-extensions-bridge.zh.md b/.agents/notes/proposed/feature/2026-10-03-pi-extensions-bridge.zh.md
new file mode 100644
index 0000000000..855f7b160c
--- /dev/null
+++ b/.agents/notes/proposed/feature/2026-10-03-pi-extensions-bridge.zh.md
@@ -0,0 +1,142 @@
+# Agent Note: Pi 扩展桥接
+
+Status: proposed
+
+[English](2026-10-03-pi-extensions-bridge.md) | 中文
+
+## 问题
+
+Pi 1.0.0 的扩展是进程内的 TypeScript 工厂函数 `(pi: ExtensionAPI) => void`。工厂函数订阅约四十个生命周期、上下文、工具与提供方事件，注册模型工具、斜杠命令、模型提供商与 MCP server，并通过 `ctx.ui` 与用户交互（[扩展指南](https://github.com/earendil-works/pi/blob/v1.0.0/packages/coding-agent/docs/extensions.md)、[API 类型](https://github.com/earendil-works/pi/blob/v1.0.0/packages/coding-agent/src/core/extensions/types.ts)）。该 API 已发布并被广泛使用：截至 2026 年 10 月，npm 上约有 11,000 个包带有 `pi-package` 关键字。
+
+DSH 已为另外两个生态提供桥接：为 Claude Code 与 Codex 编写的 shell 钩子（[hooks 组](../../../../packages/experimental/README.zh.md)），以及 Claude Code mods（[兼容性页面](../../../../docs/subsystems/claude-code-mods.zh.md)）。Pi 的扩展 API 比两者都宽。它允许一个进程内模块改写单次请求的消息、编辑工具参数、追加自己的持久记录，并让已经结束的运行继续。用 DSH 扩展点提供这套 API 可以回答两个问题：为另一个 harness 编写的扩展有多少能原样运行，以及 DSH 的哪些核心机制比 Pi 窄。
+
+## 提案
+
+新增一个实验性桥接，加载未修改的 Pi 扩展源码，并用现有的 DSH 扩展点提供 Pi 的 `ExtensionAPI`。该桥接是一次能力演示：凡现有 DSH 机制能承载的行为，就让扩展原样运行；其余部分不提供，并在兼容性页面列出每一处差异。除扩展状态所需的受限插件记录（缺口表第 9 行）外，每项核心缺口都由单独的变更弥补。
+
+### 包与组合
+
+- `@deepseek-ai/dsh-experimental-pi-extensions` 是 Host 包，提供 `ctx.piExtensions`。`@deepseek-ai/dsh-experimental-client-ui-pi-extensions` 是 Web 包。两者都不是可选 bundle；与 Claude Code mods 桥接一样，由一个按需启用的 overlay 组合它们。
+- cordis.yml 的一行指定一个扩展来源：一个文件、一个含 `index.ts` 或 `index.js` 的目录，或一个在 `package.json` 中列出 `pi.extensions` 的 Pi 包目录。该行同时携带扩展的 flag 值。行的顺序就是 Pi 的加载顺序，也是其 handler 的分发顺序。
+- 桥接不扫描 `~/.pi` 或 `.pi`，不安装包，也不判定项目信任。Pi 包中的 skill、提示词模板与主题不会被加载。
+
+### 加载与执行
+
+- 桥接有自己的 loader 与事件分发器。`@earendil-works/pi-coding-agent` 不是依赖。
+- 源码由 `jiti` 导入，因此 TypeScript 在已构建的安装中也能加载。loader 解析 Pi 提供给扩展的那些导入：`typebox` 与 `@earendil-works/pi-ai` 解析到桥接自己的依赖；`@earendil-works/pi-coding-agent` 解析到桥接的一个模块，它实现了不需要 Pi 运行时的辅助函数（`defineTool`、工具事件类型守卫、截断辅助函数、`withFileMutationQueue`、`getAgentDir`）；`@earendil-works/pi-tui` 在部署安装了该可选对等依赖（peer dependency）时解析到它。扩展导入了 loader 无法解析的模块时加载失败，错误信息会指出该模块。
+- 与 mods 一样，扩展代码在 Host 进程中以进程的全部权限运行。
+- 每个拥有进程内 Agent 的 Session 都有自己的运行时：每行的模块只求值一次，其工厂函数对每个 Session 运行一次，正如 Pi 为每个 Session 重新运行工厂函数。扩展保存在模块作用域的状态由 Host 进程中的所有 Session 共享；Pi 同样在一个进程的多个 Session 之间保留同一个模块实例，但同一时间只运行一个 Session。subagent 的 Session 有独立的运行时，处于 Pi 的 `print` 模式且 `hasUI: false`，因此 subagent 发起的工具调用与根 Agent 的调用经过同样的扩展 handler。
+
+### 提供 API
+
+| Pi API | DSH 机制 |
+|---|---|
+| `session_start`、`session_shutdown` | `agent/created`（在首个轮次之前等待完成）、`agent/disposed` |
+| `input`（在 inbox 准入之后，见第 7 行）、`before_agent_start` | `system-prompt/assemble` 与 `agent/pre-step`：被认领的用户消息可被改写或丢弃，返回的 `systemPrompt` 替换该轮次已组装的提示词，返回的消息加入该步骤 |
+| `tool_call` | `tools/pre-execute`：`block` 成为拒绝；handler 抛出异常时拒绝该调用 |
+| `tool_result` | `tools/post-execute`：被替换的内容安装为结果内容 |
+| `agent_before_settle` | `agent/turn-stopping`：返回的自定义条目被记录，带 `continue` 返回的消息被 steer 进该轮次 |
+| `agent_start`、`agent_end`、`agent_settled`、`turn_start`、`turn_end`、`message_start`、`message_end`、`tool_execution_start`、`tool_execution_end`、`model_select`、`session_info_changed`、`session_compact` | 会话事件与 `agent/status`，作为通知按顺序送达 |
+| `registerTool`、`ctx.executeTool` | Agent 作用域的 `ctx.tools` 注册；嵌套调用走完整的工具管线；内置名称遵循下文的转换 |
+| `registerCommand`、`getCommands` | Agent 作用域的 `ctx.commands` |
+| `sendUserMessage`、`sendMessage` | `agent.followup()`、`agent.steer()`、`agent.inject()` |
+| `appendEntry`、`setLabel`、工具 `details`、`ctx.sessionManager` | ignorable Session 记录与 `tool/result` 元数据，读回时还原为 Pi 条目 |
+| `getActiveTools`、`setActiveTools`、`getAllTools` | `ctx.tools.schemas()`；`setActiveTools` 对全局工具使用作用域内的 `ctx.tools.restrict()`，并增删桥接自己在 Agent 作用域的注册，因为限制不会隐藏作用域内的工具 |
+| `setModel`、`getThinkingLevel`、`setThinkingLevel` | `agent/request` 覆盖 |
+| `exec` | `ctx.subprocess`，不经 shell 的 argv |
+| `ctx.ui.select`、`confirm`、`input`、`editor` | `ctx.userQuestions` |
+| `ctx.ui.notify`、`setStatus`、`setWidget`、`setTitle`、`setEditorText` | 由 Web 包渲染的 Remote 流 |
+| `registerFlag`、`getFlag`、`events` | 行配置；每个 Session 运行时一个进程内事件总线 |
+
+同一个 Session 的所有 Pi handler 都经过一个有序队列。通知不会越过更早的通知；`tool_call` 这类需要等待的钩子，在排在它之前的所有通知之后运行。这样就保持了 Pi 的等待式分发给 handler 的顺序。
+
+Web 与 Desktop GUI 对扩展呈现为 Pi 的 `rpc` 模式且 `hasUI: true`；headless、SDK 与 ACP Session 呈现为 `print` 模式。扩展本来就处理这两种模式：`ctx.ui.custom()` 这类仅限终端的调用返回 Pi 的 `rpc` 模式所返回的值。
+
+### Pi 视角下的内置工具调用
+
+DSH 与 Pi 共有 `bash`、`read`、`edit`、`write` 与 `grep` 这些名称，但参数不同，而 Pi 的 `find` 是 DSH 的 `glob`。Pi 的安全类扩展会读取 `event.input.path` 或 `event.input.command`。因此，桥接把这六个工具的每次调用以 Pi 的名称和 Pi 的参数名呈现给 handler，由 DSH 调用转换而来。其他工具原样传递。有一项测试加载已注册的 DSH 工具 schema，在被映射的参数改名或被移除时失败，在工具新增了映射表尚未归类的参数时也失败。
+
+反方向使用同一张映射表。`getActiveTools()` 与 `getAllTools()` 对这六个工具报告 Pi 名称，对其他工具报告 DSH 名称；`setActiveTools()` 接受同样的名称。`ctx.executeTool()` 收到 Pi 名称时，把参数转换为 DSH 调用；`edits` 中多于一项的 `edit` 调用会被拒绝，因为一次 DSH `edit` 调用只做一处替换。以 Pi 内置名称注册的扩展工具会替换该 Agent 中对应的 DSH 工具，正如它在 Pi 中替换 Pi 自己的工具（`find` 替换 `glob`）。
+
+### 不提供的功能
+
+- DSH 无法触发的事件：注册时接受，永不触发，并在扩展加载时的警告中列出名称。
+- DSH 无法提供的 `pi` 或 `ctx` 成员：抛出指明该成员的错误。
+- Pi 在哪里失败关闭，桥接也在哪里失败关闭。编辑 `event.input` 的 `tool_call` handler 会使该调用被拒绝并附带原因，否则已记录的调用会与实际执行的调用不一致。
+
+### 扩展状态
+
+Pi 扩展在 `session_start` 时根据自己此前写入的内容重建状态。桥接把这些状态保存在 Session 日志中，使其跟随 resume 与 fork：
+
+- `appendEntry` 与 `setLabel` 写入类型以 `plugin:` 开头的 ignorable 记录。追加它们的是一项受限的核心操作，只能由实验性包调用。它们不是 `SessionEventMap` 成员，因此持久化目录及其类型历史不变。不带该桥接的构建在读取当前格式时保留并跳过它们，这是 [ignorable 事件决策](../../implemented/architecture/2026-08-30-retain-ignorable-external-session-events.zh.md)的要求。之后的格式迁移边以尽力而为的方式携带它们：能保留时以原名称保留，否则说明丢弃哪些；Alpha 历史格式迁移边则拒绝所有未知事件（[决策](../../implemented/architecture/2026-08-31-alpha-historical-unknown-event-refusal.zh.md)）。
+- 工具的 `details` 保存为 `tool/result` 元数据，由工具的输出声明投影得出。
+- `sendMessage` 的内容记录为普通的用户来源消息，扩展的内容保持不变。一条伴随的 ignorable 记录携带 `customType`、`display` 与 `details`。
+
+### 比 Pi 窄的核心机制
+
+按各自阻塞的 Pi API 数量排序，并列出跟踪每一项的 GitHub issue。第 1、3 行源自 DSH 的规则：请求由 Session 日志派生，而日志是线性的。其余各行是缺失的扩展点。
+
+| # | 机制 | 被阻塞的 Pi API | DSH 现状 | Issue |
+|---|---|---|---|---|
+| 1 | 按请求改写模型输入 | `context`、`context_with_system`、`before_provider_request`、`prepareLoadout` 隐藏声明 | 循环从日志派生每个请求并将其冻结；`llm/stream` 监听器只读取它。改写需要一个可等待的钩子，以及一个每个日志读取方都会应用到该请求上的核心事件。 | #5661 |
+| 2 | 改写工具参数 | 编辑 `event.input` 的 `tool_call` | `PreToolDecision` 不包含输入改写（[提案](2026-06-30-pre-tool-input-rewrite.zh.md)）。 | #5662 |
+| 3 | Session 树与 assistant 消息替换 | `navigateTree`、`session_before_tree`、`session_tree`、`message_end` 替换 | 日志是线性的，fork 会创建新的 Session，`assistant/message` 不能替换另一条。 | #5663 |
+| 4 | 可等待的步骤结束钩子与提交前钩子 | `turn_end` 的条目与 `continue`、`message_end` | `step/end` 与 `assistant/message` 是已提交的事件；会话事件监听器不能追加事件。 | #5664 |
+| 5 | 工具进度与结果替换 | `onUpdate`、`tool_execution_update`、把错误变为成功的 `tool_result`、工具 `usage` | `ToolRunContext` 没有进度通道，`tools/post-execute` 不能替换失败结果的值。 | #5665 |
+| 6 | 按工具设置可见性 | `codemode`、`deferred` 与 `hidden` exposure | 呈现方式按 Agent 选择，模型看不到的工具拒绝执行。 | #5666 |
+| 7 | 输入准入 | 在提示词被保存之前的 `input` | 提示词在 `agent/pre-step` 之前就已持久保存在 inbox 中；被吞掉的提示词会留下一个没有步骤的轮次。 | #5667 |
+| 8 | 插件发起且被记录的模型调用 | `ctx.modelRegistry.complete`、`stream`、`streamSimple` | 没有会话事件记录插件自己的模型请求，这同样阻塞了 mods 的 `$.model.complete`。 | #5668 |
+| 9 | 插件拥有的持久记录 | `appendEntry` | `Session.append()` 只接受已声明的事件类型。受限的 `plugin:` 记录为实验性包补上了这一点。 | #5669 |
+| 10 | 定制压缩 | `session_before_compact` | 摘要由唯一的 `CompactionEngine` 负责，`/compact` 不接受指令。 | #5670 |
+| 11 | 生命周期原因 | `session_start` 的 `new`、`fork` 与 `reload` 原因；`session_shutdown` 的原因 | `agent/created` 报告 `startup` 或 `resume`；`SessionStartSource` 还声明了尚无生产者的 `clear` 与 `compact`；`agent/disposed` 不带原因。 | #5671 |
+| 12 | Host 插件在 GUI 中的显示 | `ctx.ui.notify`、`setStatus`、`setWidget` | 没有共享机制；每个桥接各自附带 Client 包。 | #5672 |
+| 13 | 命令能力 | 参数补全；把用户带到另一个 Session 的 `newSession`、`fork` 与 `switchSession` | `ctx.commands` 接受非结构化文本，没有 Client 侧效果。 | #5673 |
+| 14 | 提供方请求钩子 | `before_provider_headers`、`after_provider_response`、`provider_stream_event` | 请求头、响应与原始流事件都留在各适配器内部。 | #5674 |
+| 15 | 故障隔离 | 扩展的缺陷只中止一个 Pi 进程 | Host 中未捕获的异常会为所有 Session 释放整个应用。 | #5675 |
+
+终端渲染（`ctx.ui.custom`、自定义编辑器、渲染器、快捷键）不在此列：DSH 的 GUI 不是终端，Pi 自己的 `rpc` 模式也不提供这些。
+
+## 考虑过的替代方案
+
+**依赖 `@earendil-works/pi-coding-agent` 并复用其 loader 与 runner。** 这样可以精确复现 Pi 的 handler 顺序与错误规则，并提供扩展导入的全部辅助函数。否决的原因是：这项工作要用 DSH 的机制承载 Pi 的 API，而不是嵌入 Pi 的 harness。该 runner 构造于 Pi 的 `SessionManager` 与 `ModelRegistry` 之上，这个包会带入 Pi 的全部依赖闭包，而且它的内置工具工厂会在 DSH 的文件系统与沙箱策略之外运行 Pi 自己的文件与 shell 实现。
+
+**像 `defineMod` 那样为每个扩展写一个包装模块。** Pi 扩展本身就是默认导出的工厂函数，没有需要替代的 manifest，因此包装只会给每个扩展多加一步，并且无法直接加载已发布的 Pi 包目录。
+
+**自动发现 Pi 自己的位置。** 加载 `~/.pi/agent/extensions` 与项目的 `.pi/extensions` 会执行 DSH 用户并未组合进来的代码，这需要 DSH 尚不具备的项目信任判定。mods 桥接出于同样的组合原因移除了它的目录 loader。发现机制可以作为之后按需启用的一层。
+
+**为每个 Session 在独立进程中运行扩展。** 这样未捕获的扩展错误会以事件的形式到达 Host。但每个需要等待的钩子都会变成一次跨进程往返，Pi 的就地编辑事件对象也必须通过回传变更来复现。待真实扩展表明确实需要这种隔离时再做。
+
+**为每个 Session 各求值一次扩展模块。** 这样并发的 Session 不会共享模块作用域的状态。否决的原因是：Pi 在一个进程的多个 Session 之间保留同一个模块实例，扩展可能依赖模块状态在切换 Session 后仍然存在；而且按 Session 求值会为每个 Session 与 subagent 重复转译。
+
+**只为根 Session 运行扩展。** 这需要显式过滤，因为 `agent/created` 对每个 Agent 都会触发；它还会让 subagent 的工具调用绕过 Pi 的安全类扩展。
+
+**把 DSH 的工具名称与参数原样传给 handler。** Pi 自己的 `protected-paths` 示例读取 `event.input.path`；遇到 DSH 的 `file_path` 时它会抛出异常，而写法稍有不同的 handler 会放行这次写入。
+
+**声明 `pi/*` 会话事件与 `pi-extension` 消息来源。** 归属是正确的，但两者都是读取时必需的持久化类型：目录与类型历史会改变，没有该桥接的构建会拒绝这个 Session。
+
+**把扩展状态保存在日志之外的 storage domain 中。** 状态不会跟随 fork，`ctx.sessionManager.getBranch()` 也看不到扩展写入的内容。
+
+**触发 `context` 与 `before_provider_request` 但不记录其效果。** 模型会看到 Session 日志无法重建的输入。
+
+**拒绝加载订阅了不提供的事件的扩展。** 多数扩展同时使用多项功能；mods 桥接已经采用“发出警告并让其余部分继续工作”的做法。
+
+**先构建共享的 GUI 通知机制。** 它也能服务 mods 桥接，但属于核心新增；在它出现之前，本桥接的 Web 包渲染自己的流。
+
+## 验收标准
+
+- Pi 以 MIT 许可发布的示例扩展原样提交为 fixture，且只提交有测试覆盖的那些。在使用 mock 模型的真实 agent loop 中：权限扩展拒绝一次工具调用，模型看到原因；模型调用扩展工具，其 `details` 在恢复的 Session 中仍然存在；扩展命令可以运行；扩展替换某个轮次的系统提示词；resume 之后，`appendEntry` 的状态在 `session_start` 时被重建。
+- subagent 的工具调用到达它自己运行时的 handler。
+- 被映射的 DSH 工具参数变化时，工具转换测试失败。
+- Loader 组合测试从 cordis.yml 启动桥接，释放测试表明桥接卸载时每项注册都被移除。
+- 一个录制的 Session 快照覆盖一次被扩展拒绝的工具调用和一次扩展工具调用。
+- `docs/subsystems/pi-extensions.md` 列出每个事件与成员及其状态，以及每一处行为差异。
+- 新包的 `src/` 覆盖率为 100%，`doc-sync` 通过。
+
+## 风险
+
+- 扩展代码拥有 Host 的全部权限，一个未捕获的错误会中止所有 Session。只挂载你愿意作为插件运行的扩展。
+- 保真度取决于桥接对 Pi 1.0.0 分发规则的理解；它经过 Pi 示例的检验，但没有在 Pi 的代码上执行。之后的 Pi 版本可能改变桥接所提供的事件或辅助函数。
+- 扩展导入了桥接未实现的辅助函数时会加载失败，即使它只在某一条代码路径上用到该函数。
+- 无法携带插件记录的未来 Session 格式迁移边，会使迁移之前写入的 Session 丢失扩展状态。
+- 把按 Session 区分的状态放在模块作用域的扩展，会混用并发 Session（包括 subagent）的状态。
+- 扩展发送的消息，在读取伴随记录的 Web 包之外的所有地方，都归属于用户。
diff --git a/.agents/notes/proposed/feature/2026-10-03-pi-plugins-compatibility.i18n.yaml b/.agents/notes/proposed/feature/2026-10-03-pi-plugins-compatibility.i18n.yaml
new file mode 100644
index 0000000000..18c0105d65
--- /dev/null
+++ b/.agents/notes/proposed/feature/2026-10-03-pi-plugins-compatibility.i18n.yaml
@@ -0,0 +1,46 @@
+# Bilingual-pair consistency record for 2026-10-03-pi-plugins-compatibility.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/proposed/feature/2026-10-03-pi-plugins-compatibility.md
+/agent-note-pi-plugins-compatibility-levels-of-support:
+ en: 68e63fd54584ecbc
+ zh: e1cedbf64975bc53
+/agent-note-pi-plugins-compatibility-levels-of-support/problem:
+ en: f98ddabdc0ea831b
+ zh: e695439507286576
+/agent-note-pi-plugins-compatibility-levels-of-support/proposal:
+ en: 37a27883d679bb6a
+ zh: 62c60e0cd06bf8fb
+/agent-note-pi-plugins-compatibility-levels-of-support/what-a-pi-plugin-is:
+ en: fd37c3aa5d6c092b
+ zh: e39a84ef9aabaa48
+/agent-note-pi-plugins-compatibility-levels-of-support/level-1-session-facets:
+ en: 5e08e808af0a741a
+ zh: eae79e9c8f1fc301
+/agent-note-pi-plugins-compatibility-levels-of-support/level-2-presentation-facets-on-the-host:
+ en: 6a4b96426808d653
+ zh: c341dd2ba594ed45
+/agent-note-pi-plugins-compatibility-levels-of-support/level-3-transcript-and-stored-selection:
+ en: defc273e0759bb9f
+ zh: 59a4cf0dd0b46faa
+/agent-note-pi-plugins-compatibility-levels-of-support/level-4-presentation-facets-in-the-browser:
+ en: 5b2fcfdb38eb6121
+ zh: 1d583d9a6486d2dd
+/agent-note-pi-plugins-compatibility-levels-of-support/level-5-parity:
+ en: 657aa240a06f663f
+ zh: 74ca5260a5a3d215
+/agent-note-pi-plugins-compatibility-levels-of-support/runtime-differences-the-plugin-model-exposes:
+ en: 114b54fae1ff94cd
+ zh: 0d0dde9f0563b27b
+/agent-note-pi-plugins-compatibility-levels-of-support/chord-mechanisms-to-evaluate-for-dsh:
+ en: e44ed4dcd7fc9eb9
+ zh: 825a41daa69931f9
+/agent-note-pi-plugins-compatibility-levels-of-support/alternatives-considered:
+ en: 390883362b220cfb
+ zh: 1c072dd19744a92e
+/agent-note-pi-plugins-compatibility-levels-of-support/acceptance-criteria:
+ en: 386ae81c30ec7cfc
+ zh: 6f8bc4257fa8898c
+/agent-note-pi-plugins-compatibility-levels-of-support/risks:
+ en: b6410c36a55acc47
+ zh: e7de4e26be7a3c58
diff --git a/.agents/notes/proposed/feature/2026-10-03-pi-plugins-compatibility.md b/.agents/notes/proposed/feature/2026-10-03-pi-plugins-compatibility.md
new file mode 100644
index 0000000000..352a9b3f40
--- /dev/null
+++ b/.agents/notes/proposed/feature/2026-10-03-pi-plugins-compatibility.md
@@ -0,0 +1,140 @@
+# Agent Note: Pi plugins compatibility — levels of support
+
+Status: proposed
+
+English | [中文](2026-10-03-pi-plugins-compatibility.zh.md)
+
+## Problem
+
+Pi 1.0.0 has two separate mechanisms for running customization code. Extensions are in-process TypeScript factories with a published API; the [Pi extensions bridge note](2026-10-03-pi-extensions-bridge.md) covers them. Plugins are a newer mechanism built on Pi's Chord composition runtime: a plugin package contributes facets, and each facet runs in the process its name selects. This note covers plugins.
+
+A compatibility layer for Pi plugins is not worth building today, for two reasons the upstream sources state themselves.
+
+- **The API is unpublished and unstable.** The plugin stack runs only with `PI_EXPERIMENTAL=1`. The `./experimental/plugin` export of `@earendil-works/pi-coding-agent` has only a `source` condition, and the npm tarball excludes its build output. Chord's plan says it "is not a stable public API contract yet" ([PLANNING.md](https://github.com/earendil-works/pi/blob/v1.0.0/packages/chord/PLANNING.md)), and pi-durable, which the Session worker runs on, says its "API changes without notice between releases" ([README](https://github.com/earendil-works/pi/blob/v1.0.0/packages/durable/README.md)). The [services README](https://github.com/earendil-works/pi/blob/v1.0.0/packages/coding-agent/src/experimental/services/README.md) lists `AgentController.navigate()`, `nextRun()`, and `resume()` as dropped.
+- **A plugin can do less than an extension.** The Session worker builds its tool, hook, and prompt registry itself and does not expose it as a service, so a facet cannot register a model tool, intercept a tool call, or change the prompt. Pi ships one example plugin.
+
+Deferring the work without a record loses two results of the investigation: the mapping from Pi's plugin services onto DSH services, which decides what each increment of support costs, and the DSH runtime properties that differ from Chord's, which matter to DSH independently of Pi.
+
+## Proposal
+
+Treat Pi-plugin compatibility as six levels. Each level names what a plugin author gets, the upstream change that makes it worth building, and the DSH work it needs. DSH stays at level 0 until the trigger of a higher level occurs. A level includes the levels below it, except that level 4 replaces the Host-side presentation of level 2.
+
+| Level | Support | Upstream trigger | DSH work |
+|---|---|---|---|
+| 0 | None. This note is the only artifact. | — | Re-read the upstream status when Pi releases. |
+| 1 | `session` facets run in one Chord host per DSH Session. `AgentController`, `Models`, and `SessionPlugins` are served over DSH services. | Pi ships the plugin API in its npm package, or removes the `PI_EXPERIMENTAL` requirement. | One experimental Host package. No core change. |
+| 2 | `tui` facets run on the Host. Their slash commands become DSH commands, `select` becomes a user question, and `showStatus` a status line. Pi's example plugin runs unmodified. | Same as level 1. | Adapters, plus the Web status display of the Pi extensions bridge. |
+| 3 | `Transcript` is served, and a Session's plugin selection is stored with the Session. | A plugin that consumes `Transcript` exists, or pi-durable declares `ConversationView` stable. | A projection from the Session log to `ConversationView`, and a per-Session selection record. |
+| 4 | `tui` facets run in the browser and reach Session services through a generic Chord bridge. | Chord commits to browser support, and Pi defines a presentation facet that is not terminal-specific. | One generic JSON Remote endpoint, a browser facet loader, and argument text for Client commands. |
+| 5 | Parity: one worker per Session, and plugins register model tools and hooks. | Pi exposes its tool and hook registry to facets. | Per-Session process isolation, and the tool and hook mappings of the Pi extensions bridge. |
+
+## What a Pi plugin is
+
+A plugin is a package directory. Its `package.json` may carry `chord.facets`, which maps a facet name to an entry file or disables it; without the field, Pi uses `src/session.ts` and `src/tui.ts` when they exist. An entry default-exports `{ id, setup(env) }`. `setup` is synchronous and only declares: `env.use` and `env.observe` acquire services, `env.provide` and `env.provideMany` publish them, `env.replicatedState` creates shared state, and `env.own`, `env.onActivate`, and `env.onDeactivate` attach lifecycle work. The Chord host validates the complete dependency graph, activates providers before consumers, and can replace a facet whose declared services are unchanged while consumers keep their service handles.
+
+The server builds each entry with Chord's esbuild bundler into a content-addressed CommonJS file listed in `chord-facets.json`. The Session worker loads the `session` entry with `node:vm` after checking its SHA-256 digest, and `require` resolves only the externals the entry declared. The `tui` entry reaches each client as a JSON artifact in a service response and loads the same way. The loader is not a sandbox: plugin code runs with the process's full authority.
+
+`pi server -e ` sets the server's default plugins, and `pi client -e ` selects plugins for one Session. Pi stores a Session's selection and refuses a different selection while that Session's worker is running.
+
+Pi serves these to facets:
+
+| Scope | Service | Members |
+|---|---|---|
+| server | `SessionDirectory`, `SessionManagement`, `PresentationPlugins` | Session list state; create, remove, attach, detach; build and reload of presentation artifacts |
+| session | `AgentController` | `prompt`, `steer`, `followUp`, `cancelQueued`, `abort`, `compact`, `waitForPrompt` |
+| session | `Models` | replicated catalog and selection state; `select`, `selectThinking`, `cycleThinking`, `getThinkingLevels`, `refresh` |
+| session | `Transcript` | the root conversation's pi-durable `ConversationView` as replicated state |
+| session | `SessionPlugins` | `reload` |
+| presentation, process-local | `SlashCommands` | `register`, `replace`, `list`, `subscribe`; a command has a name, description, argument hint, optional argument completions, and `run(args, context)` |
+| presentation, process-local | `PresentationUI` | `select(title, items, selected, context)`, `showStatus(message, context)` |
+
+A service that is not process-local may contain only replicated JSON state and methods whose arguments and result are JSON and whose last parameter is a Chord `Context`.
+
+## Level 1: session facets
+
+The package depends on `@earendil-works/chord` at one exact version. It builds each selected package with `bundleFacetPackage` into a cache under the Harness home and loads the `session` entry with `createFacetBundleLoader`. Chord neither installs dependencies nor runs lifecycle scripts, so a package arrives with its dependencies installed.
+
+The loader resolves two externals itself. `@earendil-works/chord` resolves to the package's own Chord instance, because Chord identifies replicated state through a registry held by the module instance. `@earendil-works/pi-coding-agent/experimental/plugin` resolves to a module that defines service tokens with Pi's IDs (`pi.agent-controller`, `pi.local.presentation-ui`, `pi.local.slash-commands`); Chord matches services by ID string, so a token defined outside Pi binds to a facet compiled against Pi's.
+
+The package creates one Chord host per Agent in `agent/created` and disposes it with the Agent's context. Built-in facets serve Pi's Session services:
+
+| Pi member | DSH mechanism | Difference |
+|---|---|---|
+| `AgentController.prompt` | `agent.followup()` | Refusal with `busy` is derived from `agent.status`. |
+| `steer`, `followUp` | `agent.steer()`, `agent.followup()` | None. |
+| `cancelQueued` | `agent.inbox.remove()` | Telling `already_consumed` from `not_found` reads the Session log. |
+| `abort` | `agent.cancel()` | None. |
+| `compact` | `ctx.compaction.compactNow()` | Non-null `customInstructions` is refused; DSH compaction takes none. |
+| `waitForPrompt` | A fold over Session events from the queued message to its `turn/end` | DSH does not link a prompt to its answer; the fold does. |
+| `Models` | The model catalog and model selection of `session-controller` | Reasoning-effort identifiers stand in for Pi's thinking levels. |
+| `SessionPlugins.reload` | Rebuild, `FacetHost.reload()`, then dispose the retired generation | None. |
+
+`Transcript` is not provided at this level. Chord rejects a host whose facet requires a service nobody provides, so a plugin that uses `Transcript` fails to load with an error naming it.
+
+## Level 2: presentation facets on the Host
+
+Pi's `tui` facets use no terminal API. They consume `SlashCommands`, `PresentationUI`, and Session services, so they can run in a second Chord host per Agent on the DSH Host, bound in-process to the Session host.
+
+A registered slash command becomes an Agent-scoped `ctx.commands` registration whose handler passes the raw input as `args`. A command run on the Host is logged as `command/run` and `command/done`; Pi does not log presentation commands. `getArgumentCompletions` has no DSH counterpart and is not called. `PresentationUI.select` maps to `ctx.userQuestions.ask()` and needs a connected Web Client; `showStatus` maps to the status display the Pi extensions bridge adds to the Web Client.
+
+## Level 3: transcript and stored selection
+
+`Transcript` requires a projection from DSH Session events to pi-durable's `ConversationView`: entries in pi-durable's entry kinds plus its live, inbox, agent, and usage documents. The projection is lossy where DSH records events Pi has no entry for, and it binds DSH to a type pi-durable declares unstable.
+
+A Session's plugin selection is stored as a `plugin:`-prefixed ignorable Session record, the mechanism the Pi extensions bridge uses for extension state, and a live Agent's selection is fixed, as in Pi.
+
+## Level 4: presentation facets in the browser
+
+Running `tui` facets in the page matches Pi's placement of presentation code. It needs three additions. A browser loader evaluates the CommonJS artifact, because Chord's artifact loader uses the filesystem and `node:vm`. One generic Remote endpoint carries Chord's service calls, snapshots, and updates as JSON between the page and the Host, because DSH generates Remote methods at build time and the Client does not discover Host services at runtime. Client commands accept argument text, which `ui-commands` actions do not receive today.
+
+## Level 5: parity
+
+Pi isolates each Session in a worker process and plans to give plugins tools and hooks through its registry. Matching that needs a DSH Session to run in its own process or worker thread with Chord's service protocol across the process boundary, and, once Pi exposes the registry, the tool, hook, and prompt mappings that the Pi extensions bridge already defines.
+
+## Runtime differences the plugin model exposes
+
+| Property | Chord and Pi | DSH | Levels affected |
+|---|---|---|---|
+| Provider replacement | A consumer holds a handle that resolves the current provider on each access; a reload swaps the implementation behind it. | A fiber whose injected service changes is unloaded and re-run. | 1: the Chord host keeps Chord's behavior for services between facets; a DSH service mapped into Chord still restarts its adapter. |
+| Fault isolation | One worker process per Session. | All Sessions share the Host process, and an uncaught exception or unhandled rejection disposes the application ([app-boot](../../../../packages/boot/app-boot/README.md)). | 1–4 run plugin code in the Host; 5 removes the difference. |
+| Remote declaration | A host publishes a service's remote members from the object it was given at runtime. | Remote methods are generated at build time, and the Client does not discover Host services at runtime ([remotes](../../../../packages/api/remotes/README.md)). | 4 |
+| Shared state | Replicated JSON state with operation batches, hydration, and gap recovery, read through one API locally and remotely. | Each domain defines its own snapshot and delta types, or publishes complete projection values. | 3, 4 |
+| Runtime loading | One bundle per facet, loaded outside the module cache after an integrity check. | Packages are built ahead of time; a built installation does not transpile TypeScript. | 1 adds Chord's bundler as a dependency of the plugin package. |
+
+## Chord mechanisms to evaluate for DSH
+
+Four Chord mechanisms address limits DSH has independently of Pi. Each needs its own proposal; this note only records them.
+
+- **Stable service handles.** A consumer keeps its handle while a provider is replaced, so a plugin reload does not restart its dependents and lose their state.
+- **Declaration before activation.** Setup declares every dependency synchronously, and the host rejects a missing provider, a duplicate provider, or a cycle before any facet activates. Cordis resolves dependencies as services appear, so a fiber with a missing provider stays pending until an audit after startup reports it.
+- **Replicated JSON state.** One primitive gives local and remote consumers complete immutable values, with operation batches on the wire and a full reset when a subscriber falls behind.
+- **Verified plugin artifacts.** A content-addressed bundle with a manifest digest lets a host load a plugin generation outside the module cache and release it when retired.
+
+## Alternatives considered
+
+**Build levels 1 and 2 now as a prototype.** The API is unpublished, has one example plugin, and its services README already lists three `AgentController` methods as dropped. A prototype would need maintenance against each Pi release without a user. The service mapping above keeps the design result without that cost.
+
+**Skip the record and decide when Pi stabilizes.** The service mapping and the runtime comparison took a full reading of Chord and Pi's experimental server, worker, and client. The runtime differences also apply to DSH work that has nothing to do with Pi.
+
+**Implement Pi's plugin services on Cordis without Chord.** A facet calls Chord's API directly: `env.use`, `env.provide`, and `replicatedState`. Serving that API without Chord means reimplementing graph validation, stable handles, keyed services, and replicated state. Chord is MIT-licensed, has one runtime dependency, and is the runtime plugins are compiled against.
+
+**Add plugins to the Pi extensions bridge package.** The two mechanisms share no API and have different stability. Separate packages let each be enabled, versioned, and removed without the other.
+
+**Run presentation facets only in the browser.** Level 2 reuses Pi's Node artifacts unchanged and needs no browser loader. Browser support is an open decision in Chord's plan, and Pi has no presentation facet that is not terminal-specific.
+
+## Acceptance criteria
+
+- **Level 0:** this note is merged, and the Pi extensions compatibility page links to it for the plugin mechanism.
+- **Level 1:** the `session` facet of Pi's example plugin loads from its unmodified package directory. A test calls its greeting service and every served `AgentController` member against a real agent loop with a mock model. `SessionPlugins.reload` replaces the facet generation without recreating the Chord host, and disposing the Agent disposes the host.
+- **Level 2:** `/hello ` from Pi's example plugin runs through `ctx.commands`, shows its status text in the Web Client, and submits its prompt.
+- **Level 3:** a facet that subscribes to `Transcript` receives the root conversation after hydration and after each committed step, and a resumed Session loads the plugins it was created with.
+- **Level 4:** the `tui` facet of Pi's example plugin runs in the browser, and its service calls reach the Host through the generic endpoint.
+- **Every level:** a compatibility page lists each difference from Pi, and the package's README states that plugin code runs in the Host with its full authority.
+
+## Risks
+
+- The upstream API can change or be withdrawn before a level is built. The service mapping describes Pi 1.0.0 and needs a re-read against the release that triggers the work.
+- Levels 1 to 4 run plugin code in the Host process, where one uncaught error stops every Session.
+- Level 3 depends on a pi-durable type that upstream declares unstable.
+- Level 4 adds a Remote endpoint whose payloads are validated by Chord's wire parsers instead of generated per-method codecs.
+- The plugin package brings esbuild as a runtime dependency through Chord's bundler.
diff --git a/.agents/notes/proposed/feature/2026-10-03-pi-plugins-compatibility.zh.md b/.agents/notes/proposed/feature/2026-10-03-pi-plugins-compatibility.zh.md
new file mode 100644
index 0000000000..b7078a9eba
--- /dev/null
+++ b/.agents/notes/proposed/feature/2026-10-03-pi-plugins-compatibility.zh.md
@@ -0,0 +1,140 @@
+# Agent Note: Pi 插件兼容——分级支持
+
+Status: proposed
+
+[English](2026-10-03-pi-plugins-compatibility.md) | 中文
+
+## 问题
+
+Pi 1.0.0 有两套相互独立、用于运行定制代码的机制。扩展是进程内的 TypeScript 工厂函数，API 已发布，由 [Pi 扩展桥接 Agent Note](2026-10-03-pi-extensions-bridge.zh.md) 负责。插件是较新的机制，构建在 Pi 的 Chord 组合运行时之上：一个插件包贡献若干 facet，每个 facet 运行在其名称选定的进程里。本 Agent Note 只讨论插件。
+
+现在还不值得为 Pi 插件构建兼容层，上游资料自己给出了两条理由。
+
+- **API 未发布且不稳定。** 插件栈只在 `PI_EXPERIMENTAL=1` 下运行。`@earendil-works/pi-coding-agent` 的 `./experimental/plugin` 导出只有 `source` 条件，npm tarball 不包含它的构建产物。Chord 的规划文档称它“is not a stable public API contract yet”（[PLANNING.md](https://github.com/earendil-works/pi/blob/v1.0.0/packages/chord/PLANNING.md)）；Session worker 所基于的 pi-durable 称其“API changes without notice between releases”（[README](https://github.com/earendil-works/pi/blob/v1.0.0/packages/durable/README.md)）。[services README](https://github.com/earendil-works/pi/blob/v1.0.0/packages/coding-agent/src/experimental/services/README.md) 把 `AgentController.navigate()`、`nextRun()` 与 `resume()` 列为已移除。
+- **插件能做的事比扩展少。** Session worker 自行构建工具、钩子与提示词注册表，不把它暴露为服务，因此 facet 无法注册模型工具、拦截工具调用或修改提示词。Pi 只附带一个示例插件。
+
+如果不留记录就搁置这项工作，会丢失调研得到的两项结果：Pi 插件服务到 DSH 服务的映射，它决定每一级支持的成本；以及 DSH 运行时与 Chord 的差异，这些差异与 Pi 无关，对 DSH 自身同样重要。
+
+## 提案
+
+把 Pi 插件兼容划分为六个级别。每一级说明插件作者能得到什么、哪项上游变化使它值得构建，以及需要哪些 DSH 工作。在更高级别的触发条件出现之前，DSH 停留在 0 级。每一级包含其下各级，唯一例外是 4 级取代 2 级在 Host 侧的 presentation 实现。
+
+| 级别 | 支持内容 | 上游触发条件 | DSH 工作 |
+|---|---|---|---|
+| 0 | 无。本 Agent Note 是唯一产物。 | — | Pi 发版时重新核对上游状态。 |
+| 1 | `session` facet 运行在每个 DSH Session 各自的 Chord host 中。`AgentController`、`Models` 与 `SessionPlugins` 由 DSH 服务提供。 | Pi 在 npm 包中发布插件 API，或取消 `PI_EXPERIMENTAL` 要求。 | 一个实验性 Host 包。不改核心。 |
+| 2 | `tui` facet 运行在 Host 上。它们的斜杠命令成为 DSH 命令，`select` 成为用户提问，`showStatus` 成为状态行。Pi 的示例插件原样运行。 | 同 1 级。 | 适配器，以及 Pi 扩展桥接的 Web 状态显示。 |
+| 3 | 提供 `Transcript`，并把 Session 的插件选择随 Session 保存。 | 出现消费 `Transcript` 的插件，或 pi-durable 宣布 `ConversationView` 稳定。 | 从 Session 日志到 `ConversationView` 的投影，以及按 Session 保存的选择记录。 |
+| 4 | `tui` facet 运行在浏览器中，经通用 Chord 桥访问 Session 服务。 | Chord 承诺支持浏览器，且 Pi 定义了不依赖终端的 presentation facet。 | 一个通用 JSON Remote 端点、一个浏览器 facet loader，以及 Client 命令的参数文本。 |
+| 5 | 对等：每个 Session 一个 worker，插件可注册模型工具与钩子。 | Pi 把工具与钩子注册表暴露给 facet。 | 按 Session 的进程隔离，以及 Pi 扩展桥接已有的工具与钩子映射。 |
+
+## Pi 插件是什么
+
+插件是一个包目录。它的 `package.json` 可以带 `chord.facets`，把 facet 名称映射到入口文件或将其禁用；没有该字段时，Pi 在 `src/session.ts` 与 `src/tui.ts` 存在的情况下使用它们。入口默认导出 `{ id, setup(env) }`。`setup` 是同步的，只做声明：`env.use` 与 `env.observe` 获取服务，`env.provide` 与 `env.provideMany` 发布服务，`env.replicatedState` 创建共享状态，`env.own`、`env.onActivate` 与 `env.onDeactivate` 挂接生命周期工作。Chord host 校验完整的依赖图，先激活提供方再激活消费方，并且能在消费方保留服务句柄的同时替换所声明服务不变的 facet。
+
+服务器用 Chord 的 esbuild 打包器把每个入口构建为内容寻址的 CommonJS 文件，并登记在 `chord-facets.json` 中。Session worker 校验 SHA-256 摘要后用 `node:vm` 加载 `session` 入口，`require` 只解析该入口声明过的外部依赖。`tui` 入口作为 JSON 制品随服务响应到达各客户端，并以同样方式加载。该 loader 不是沙箱：插件代码以进程的全部权限运行。
+
+`pi server -e ` 设置服务器的默认插件，`pi client -e ` 为单个 Session 选择插件。Pi 保存 Session 的选择，并在该 Session 的 worker 运行期间拒绝不同的选择。
+
+Pi 向 facet 提供以下服务：
+
+| 作用域 | 服务 | 成员 |
+|---|---|---|
+| server | `SessionDirectory`、`SessionManagement`、`PresentationPlugins` | Session 列表状态；创建、删除、attach、detach；presentation 制品的构建与重载 |
+| session | `AgentController` | `prompt`、`steer`、`followUp`、`cancelQueued`、`abort`、`compact`、`waitForPrompt` |
+| session | `Models` | 可复制的目录与选择状态；`select`、`selectThinking`、`cycleThinking`、`getThinkingLevels`、`refresh` |
+| session | `Transcript` | 根对话的 pi-durable `ConversationView`，以可复制状态提供 |
+| session | `SessionPlugins` | `reload` |
+| presentation，进程内 | `SlashCommands` | `register`、`replace`、`list`、`subscribe`；命令包含名称、描述、参数提示、可选的参数补全，以及 `run(args, context)` |
+| presentation，进程内 | `PresentationUI` | `select(title, items, selected, context)`、`showStatus(message, context)` |
+
+非进程内的服务只能包含可复制的 JSON 状态，以及参数与结果均为 JSON、最后一个参数为 Chord `Context` 的方法。
+
+## 1 级：session facet
+
+该包依赖某一精确版本的 `@earendil-works/chord`。它用 `bundleFacetPackage` 把每个选中的包构建到 Harness 主目录下的缓存，并用 `createFacetBundleLoader` 加载 `session` 入口。Chord 既不安装依赖也不运行生命周期脚本，因此包到达时必须已装好依赖。
+
+loader 自行解析两个外部依赖。`@earendil-works/chord` 解析为该包自己的 Chord 实例，因为 Chord 通过模块实例持有的注册表识别可复制状态。`@earendil-works/pi-coding-agent/experimental/plugin` 解析为一个模块，它用 Pi 的 ID（`pi.agent-controller`、`pi.local.presentation-ui`、`pi.local.slash-commands`）定义服务 token；Chord 按 ID 字符串匹配服务，因此在 Pi 之外定义的 token 可以绑定到按 Pi 的 token 编译的 facet。
+
+该包在 `agent/created` 中为每个 Agent 创建一个 Chord host，并随 Agent 的上下文一同释放。内置 facet 提供 Pi 的 Session 服务：
+
+| Pi 成员 | DSH 机制 | 差异 |
+|---|---|---|
+| `AgentController.prompt` | `agent.followup()` | 以 `busy` 拒绝的行为由 `agent.status` 推导。 |
+| `steer`、`followUp` | `agent.steer()`、`agent.followup()` | 无。 |
+| `cancelQueued` | `agent.inbox.remove()` | 区分 `already_consumed` 与 `not_found` 需要读取 Session 日志。 |
+| `abort` | `agent.cancel()` | 无。 |
+| `compact` | `ctx.compaction.compactNow()` | 拒绝非空的 `customInstructions`；DSH 压缩不接受指令。 |
+| `waitForPrompt` | 对 Session 事件做 fold，从入队消息到它的 `turn/end` | DSH 不关联提示词与其回答；由该 fold 完成关联。 |
+| `Models` | `session-controller` 的模型目录与模型选择 | 以推理强度标识符代替 Pi 的 thinking level。 |
+| `SessionPlugins.reload` | 重新构建、调用 `FacetHost.reload()`，再释放退役的 generation | 无。 |
+
+本级不提供 `Transcript`。Chord 会拒绝含有“所需服务无人提供”的 facet 的 host，因此使用 `Transcript` 的插件加载失败，错误信息会指出该服务。
+
+## 2 级：Host 上的 presentation facet
+
+Pi 的 `tui` facet 不使用任何终端 API。它们消费 `SlashCommands`、`PresentationUI` 与 Session 服务，因此可以运行在 DSH Host 上每个 Agent 的第二个 Chord host 中，并在进程内绑定到 Session host。
+
+注册的斜杠命令成为 Agent 作用域的 `ctx.commands` 注册，其 handler 把原始输入作为 `args` 传入。在 Host 上运行的命令会记录为 `command/run` 与 `command/done`；Pi 不记录 presentation 命令。`getArgumentCompletions` 在 DSH 中没有对应物，不会被调用。`PresentationUI.select` 映射到 `ctx.userQuestions.ask()`，需要已连接的 Web Client；`showStatus` 映射到 Pi 扩展桥接为 Web Client 增加的状态显示。
+
+## 3 级：transcript 与保存的选择
+
+`Transcript` 需要从 DSH Session 事件到 pi-durable `ConversationView` 的投影：按 pi-durable 条目类型组织的条目，加上它的 live、inbox、agent 与 usage 文档。DSH 记录了 Pi 没有对应条目的事件，在这些地方投影是有损的；它还把 DSH 绑定到一个被 pi-durable 声明为不稳定的类型上。
+
+Session 的插件选择保存为带 `plugin:` 前缀的 ignorable Session 记录，即 Pi 扩展桥接保存扩展状态所用的机制；与 Pi 一样，存活 Agent 的选择固定不变。
+
+## 4 级：浏览器中的 presentation facet
+
+在页面中运行 `tui` facet 与 Pi 对 presentation 代码的放置一致。它需要三项新增。浏览器 loader 负责求值 CommonJS 制品，因为 Chord 的制品 loader 使用文件系统与 `node:vm`。一个通用 Remote 端点以 JSON 在页面与 Host 之间承载 Chord 的服务调用、快照与更新，因为 DSH 在构建时生成 Remote 方法，Client 不在运行时发现 Host 服务。Client 命令需要接受参数文本，目前 `ui-commands` 的 action 收不到它。
+
+## 5 级：对等
+
+Pi 把每个 Session 隔离在一个 worker 进程中，并计划通过其注册表向插件提供工具与钩子。要达到这一点，DSH Session 需要运行在自己的进程或 worker 线程中，并让 Chord 的服务协议跨越进程边界；在 Pi 暴露注册表之后，还需要 Pi 扩展桥接已经定义的工具、钩子与提示词映射。
+
+## 插件模型暴露出的运行时差异
+
+| 属性 | Chord 与 Pi | DSH | 受影响的级别 |
+|---|---|---|---|
+| 提供方替换 | 消费方持有句柄，每次访问时解析当前提供方；重载在句柄背后替换实现。 | 所注入服务发生变化的 fiber 会被卸载并重新运行。 | 1：Chord host 对 facet 之间的服务保持 Chord 的行为；映射进 Chord 的 DSH 服务仍会重启其适配器。 |
+| 故障隔离 | 每个 Session 一个 worker 进程。 | 所有 Session 共享 Host 进程，未捕获的异常或未处理的 rejection 会释放整个应用（[app-boot](../../../../packages/boot/app-boot/README.zh.md)）。 | 1–4 在 Host 中运行插件代码；5 消除这一差异。 |
+| Remote 声明 | host 根据运行时拿到的对象发布服务的远程成员。 | Remote 方法在构建时生成，Client 不在运行时发现 Host 服务（[remotes](../../../../packages/api/remotes/README.zh.md)）。 | 4 |
+| 共享状态 | 可复制的 JSON 状态，带操作批次、hydration 与缺口恢复，本地与远程通过同一 API 读取。 | 每个领域定义自己的快照与增量类型，或发布完整的投影值。 | 3、4 |
+| 运行时加载 | 每个 facet 一个 bundle，经完整性校验后在模块缓存之外加载。 | 包提前构建；已构建的安装不转译 TypeScript。 | 1 把 Chord 的打包器加为插件包的依赖。 |
+
+## 值得为 DSH 评估的 Chord 机制
+
+有四项 Chord 机制针对的是 DSH 自身存在、与 Pi 无关的限制。每一项都需要单独的提案；本 Agent Note 只做记录。
+
+- **稳定的服务句柄。** 提供方被替换时消费方保留句柄，因此插件重载不会重启其依赖方并丢失它们的状态。
+- **先声明后激活。** setup 同步声明全部依赖，host 在任何 facet 激活之前拒绝缺失的提供方、重复的提供方或循环依赖。Cordis 随服务出现逐步解析依赖，因此缺少提供方的 fiber 会一直挂起，直到启动后的审计报告它。
+- **可复制的 JSON 状态。** 一个原语为本地与远程消费方提供完整的不可变值，线上传输操作批次，订阅方落后时做一次完整重置。
+- **经过校验的插件制品。** 带 manifest 摘要的内容寻址 bundle 让 host 在模块缓存之外加载某一代插件，并在其退役后释放。
+
+## 考虑过的替代方案
+
+**现在就把 1、2 级做成原型。** 该 API 未发布，只有一个示例插件，其 services README 已把三个 `AgentController` 方法列为已移除。原型需要跟随 Pi 的每次发版维护，却没有用户。上文的服务映射保留了设计结论，而不必付出这项成本。
+
+**不留记录，等 Pi 稳定后再决定。** 服务映射与运行时对比来自对 Chord 以及 Pi 实验性 server、worker 与 client 的完整阅读。这些运行时差异同样适用于与 Pi 无关的 DSH 工作。
+
+**不用 Chord，直接在 Cordis 上实现 Pi 的插件服务。** facet 直接调用 Chord 的 API：`env.use`、`env.provide` 与 `replicatedState`。不用 Chord 而提供这套 API，意味着重新实现依赖图校验、稳定句柄、keyed 服务与可复制状态。Chord 采用 MIT 许可，只有一个运行时依赖，而且插件正是针对它编译的。
+
+**把插件并入 Pi 扩展桥接包。** 两套机制没有共同的 API，稳定性也不同。分成独立的包，才能各自启用、定版与移除。
+
+**只在浏览器中运行 presentation facet。** 2 级原样复用 Pi 的 Node 制品，不需要浏览器 loader。浏览器支持在 Chord 的规划中仍是未决事项，Pi 也没有不依赖终端的 presentation facet。
+
+## 验收标准
+
+- **0 级：** 本 Agent Note 已合并，Pi 扩展兼容性页面在插件机制处链接到它。
+- **1 级：** Pi 示例插件的 `session` facet 从未修改的包目录加载。测试在使用 mock 模型的真实 agent loop 上调用它的问候服务以及每个已提供的 `AgentController` 成员。`SessionPlugins.reload` 替换 facet generation 而不重建 Chord host，释放 Agent 时 host 随之释放。
+- **2 级：** Pi 示例插件的 `/hello ` 经 `ctx.commands` 运行，在 Web Client 中显示其状态文本，并提交其提示词。
+- **3 级：** 订阅 `Transcript` 的 facet 在 hydration 之后以及每个已提交的步骤之后收到根对话，恢复的 Session 加载其创建时所用的插件。
+- **4 级：** Pi 示例插件的 `tui` facet 在浏览器中运行，其服务调用经通用端点到达 Host。
+- **每一级：** 兼容性页面列出与 Pi 的每一处差异，包的 README 说明插件代码以 Host 的全部权限运行。
+
+## 风险
+
+- 在任何一级构建之前，上游 API 都可能变化或被撤回。服务映射描述的是 Pi 1.0.0，需要对照触发这项工作的发行版重新核对。
+- 1 至 4 级在 Host 进程中运行插件代码，一个未捕获的错误会中止所有 Session。
+- 3 级依赖一个被上游声明为不稳定的 pi-durable 类型。
+- 4 级增加的 Remote 端点由 Chord 的 wire 解析器校验载荷，而不是由按方法生成的编解码器校验。
+- 插件包经由 Chord 的打包器引入 esbuild 作为运行时依赖。
diff --git a/.agents/notes/proposed/process/2026-08-27-port-tool-owned-render.i18n.yaml b/.agents/notes/proposed/process/2026-08-27-port-tool-owned-render.i18n.yaml
deleted file mode 100644
index 38917672a7..0000000000
--- a/.agents/notes/proposed/process/2026-08-27-port-tool-owned-render.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-27-port-tool-owned-render.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/proposed/process/2026-08-27-port-tool-owned-render.md
-/agent-note-port-tool-owned-render-into-current-dsh-apis:
- en: a13180eec1968793
- zh: e47a83ddb329de88
-/agent-note-port-tool-owned-render-into-current-dsh-apis/problem:
- en: 3a3ceea534efabd1
- zh: f13f8531d1819b8a
-/agent-note-port-tool-owned-render-into-current-dsh-apis/proposal:
- en: a51c0e6f23d8d4d4
- zh: 1eecd0ed06685c40
-/agent-note-port-tool-owned-render-into-current-dsh-apis/alternatives-considered:
- en: a2364e3fca0a06e5
- zh: a76370082e218154
-/agent-note-port-tool-owned-render-into-current-dsh-apis/acceptance-criteria:
- en: 5e2815d18df000f9
- zh: 97845472646b1881
-/agent-note-port-tool-owned-render-into-current-dsh-apis/risks:
- en: 4fa51a62af0a3fc5
- zh: d6f555a8a5d9120c
diff --git a/.agents/notes/proposed/process/2026-08-27-port-tool-owned-render.md b/.agents/notes/proposed/process/2026-08-27-port-tool-owned-render.md
deleted file mode 100644
index 4ab27142fd..0000000000
--- a/.agents/notes/proposed/process/2026-08-27-port-tool-owned-render.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# Agent Note: Port tool-owned render into current DSH APIs
-
-Status: proposed
-
-English | [中文](2026-08-27-port-tool-owned-render.zh.md)
-
-## Problem
-
-The `dsh-tool-owned-render` prototype (`Chinesezjc/dsh-tool-owned-render`) ships tool-owned render registrants for `read`, `bash`, `write`/`edit`, `grep`/`glob`, and `web_search`/`web_fetch`, written against an older API where `ToolCallBlock` exposed `callView` / `resultView` and the client received host `presentResult` output. Current master derives client cards from raw `block.call` / `block.content` / `block.meta`, and `ctx.slots` requires the `@deepseek-ai/dsh-client-ui-renderer/client` module augmentation. A direct merge of the prototype does not typecheck, so its registrants cannot ship without a port.
-
-## Proposal
-
-- Add `packages/client/tool-owned-render` as a workspace package.
-- Port the `read`, `bash`, `write`/`edit`, `grep`/`glob`, and `web_search`/`web_fetch` registrants to derive from current `ToolCallBlock` fields.
-- Add a `read_image` registrant using the same ToolCard/Segment primitives.
-- Wire `ctx.slots` type augmentation through `dsh-client-ui-renderer`.
-- Keep PR #2828 mergeable while this port proceeds separately.
-
-## Alternatives considered
-
-- **Merge the prototype and fix its type errors in place** — rejected: every registrant would have to be re-derived from the current `ToolCallBlock` fields anyway, so the port is the same work with the obsolete `callView` / `resultView` contract already gone.
-- **Fold the port into PR #2828** — rejected: the image card is one feature with a defined scope, and a second package plus five more registrants would enlarge the review surface of an already large PR.
-
-## Acceptance criteria
-
-- `packages/client/tool-owned-render` exists as a workspace package.
-- The ported registrants derive card state from current `ToolCallBlock` fields and typecheck on master.
-- A `read_image` registrant renders through the same primitives as `read`.
-- The `ctx.slots` type augmentation resolves through `dsh-client-ui-renderer`.
-- PR #2828 merges independently of this port.
-
-## Risks
-
-- The port may not reproduce the prototype's exact visual output, because the current card primitives differ from the old `callView` / `resultView` contract.
-- API drift while the port proceeds can stale this proposal; the acceptance criteria are re-checked against master at port time.
diff --git a/.agents/notes/proposed/process/2026-08-27-port-tool-owned-render.zh.md b/.agents/notes/proposed/process/2026-08-27-port-tool-owned-render.zh.md
deleted file mode 100644
index fe8a018235..0000000000
--- a/.agents/notes/proposed/process/2026-08-27-port-tool-owned-render.zh.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# Agent Note: 把 tool-owned render 移植到当前 DSH API
-
-Status: proposed
-
-[English](2026-08-27-port-tool-owned-render.md) | 中文
-
-## 问题
-
-`dsh-tool-owned-render` 原型（`Chinesezjc/dsh-tool-owned-render`）带有 `read`、`bash`、`write`/`edit`、`grep`/`glob`、`web_search`/`web_fetch` 的 tool-owned render 注册项，基于旧 API 编写：`ToolCallBlock` 暴露 `callView` / `resultView`，客户端能拿到 host `presentResult` 输出。当前 master 从原始 `block.call` / `block.content` / `block.meta` 推导客户端卡片，`ctx.slots` 也需要 `@deepseek-ai/dsh-client-ui-renderer/client` 模块增强。直接合并原型不能通过类型检查，因此这些注册项不经移植无法发布。
-
-## 提案
-
-- 新增 `packages/client/tool-owned-render` workspace 包。
-- 把 `read`、`bash`、`write`/`edit`、`grep`/`glob`、`web_search`/`web_fetch` 注册项移植到从当前 `ToolCallBlock` 字段推导。
-- 增加 `read_image` 注册项，使用同一套 ToolCard/Segment 原语。
-- 通过 `dsh-client-ui-renderer` 接通 `ctx.slots` 类型增强。
-- 移植单独推进，保持 PR #2828 可合并。
-
-## 已考虑的替代方案
-
-- **直接合并原型并就地修复类型错误** — 否决：每个注册项反正都要按当前 `ToolCallBlock` 字段重新推导，移植就是同一份工作，只是旧的 `callView` / `resultView` 契约已不存在。
-- **把移植并入 PR #2828** — 否决：image 卡片是一个范围明确的单一功能，再加一个新包和五个注册项会扩大本已很大的 PR 的审查面。
-
-## 验收标准
-
-- `packages/client/tool-owned-render` 作为 workspace 包存在。
-- 移植后的注册项从当前 `ToolCallBlock` 字段推导卡片状态，并在 master 上通过类型检查。
-- `read_image` 注册项与 `read` 使用同一套原语渲染。
-- `ctx.slots` 类型增强通过 `dsh-client-ui-renderer` 解析。
-- PR #2828 独立于本移植合并。
-
-## 风险
-
-- 移植可能无法复现原型的精确视觉输出，因为当前卡片原语与旧的 `callView` / `resultView` 契约不同。
-- 移植推进期间 API 继续漂移会使本提案过时；验收标准在移植时按当时的 master 重新核对。
diff --git a/.agents/notes/proposed/simplification/2026-09-19-omit-fs-payload-invariant.i18n.yaml b/.agents/notes/proposed/simplification/2026-09-19-omit-fs-payload-invariant.i18n.yaml
deleted file mode 100644
index 30d37e8252..0000000000
--- a/.agents/notes/proposed/simplification/2026-09-19-omit-fs-payload-invariant.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-09-19-omit-fs-payload-invariant.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/proposed/simplification/2026-09-19-omit-fs-payload-invariant.md
-/agent-note-omit-the-filesystem-payload-only-invariant-companion:
- en: 6385aa079529c4f4
- zh: 602b99cea351125c
-/agent-note-omit-the-filesystem-payload-only-invariant-companion/problem:
- en: 4568d53b3ef69254
- zh: 66c9aea2ae3645e7
-/agent-note-omit-the-filesystem-payload-only-invariant-companion/proposal:
- en: 2bfceaa480b6645d
- zh: 3ad1060bf91ded74
-/agent-note-omit-the-filesystem-payload-only-invariant-companion/alternatives-considered:
- en: d12fd1577a308af3
- zh: 56271794646f5a87
-/agent-note-omit-the-filesystem-payload-only-invariant-companion/acceptance-criteria:
- en: 253009b93ce34c5b
- zh: 2268e0303bd025d6
-/agent-note-omit-the-filesystem-payload-only-invariant-companion/risks:
- en: 70c52f193d72d02d
- zh: f30844e865ac4c27
diff --git a/.agents/notes/proposed/simplification/2026-09-19-omit-fs-payload-invariant.md b/.agents/notes/proposed/simplification/2026-09-19-omit-fs-payload-invariant.md
deleted file mode 100644
index e91fa1784a..0000000000
--- a/.agents/notes/proposed/simplification/2026-09-19-omit-fs-payload-invariant.md
+++ /dev/null
@@ -1,34 +0,0 @@
-# Agent Note: Omit the filesystem payload-only invariant companion
-
-Status: proposed
-
-English | [中文](2026-09-19-omit-fs-payload-invariant.zh.md)
-
-## Problem
-
-The [filesystem invariant](../../../../packages/fs/fs/src/invariant.ts) checks non-empty target strings, a non-empty present version, and an observation discriminant. It reads one dispatch payload, retains no history, and compares no provider, policy, filesystem, or independently mutable state. Its [tests](../../../../packages/fs/fs/tests/invariant.spec.ts) construct malformed payloads directly. Publishing this check costs a companion module, export/build wiring, invariant dependencies, compiler references, and dedicated tests.
-
-Current guidance needs an explicit decision: the [independent-observation rule](../../implemented/simplification/2026-08-28-omit-unneeded-invariant-companions.md) requires observations that can independently diverge, while the [runtime-contract examples](../../implemented/architecture/2026-07-19-package-invariant-runtime-contracts.md) specifically endorse filesystem target/version validity. The later rule retains the earlier note's semantic authority, so chronology alone does not resolve this conflict.
-
-## Proposal
-
-Apply the independent-observation criterion to this concrete companion and remove it. The event producers are independent plugins, but checking the format of each single payload does not compare their observations. Keep typed filesystem events and the real [observation-policy consumer](../../../../packages/fs/fs-observation-policy/src/index.ts), along with parser, wire, read, edit, and write validation at their existing owners.
-
-Remove the 48-line companion, its 55-line dedicated test, `./invariant` export/publication, invariant-only dependencies and compiler references. Add the package-specific omission reason to both fs READMEs. Amend the earlier representative-check row when implementing this decision, retaining its other semantic examples and the shared invariant registration machinery. This proposal leaves those current owners unchanged until acceptance.
-
-## Alternatives considered
-
-**Keep payload validation as an explicit policy exception.** It can detect malformed third-party emissions early, but this would deliberately broaden the stated independent-observation criterion. The proposal prefers input validation at its owner and reserves companions for relational checks.
-
-**Add a second state source to justify the companion.** Rejected without a concrete missing invariant. Duplicating policy state or exposing new API solely to retain this diagnostic increases the maintenance burden.
-
-## Acceptance criteria
-
-- Resolve the named policy conflict in the active owning notes; do not claim this is already an uncontested mechanical omission.
-- No companion source, test, export, artifact entry, invariant-only dependency, or compiler reference remains; package topology checks accept the explained omission.
-- Real file-tool and observation-policy tests retain stale-version, absent-target, alias, actor-routing, and world-state assertions. The events and consumers remain.
-- Run focused fs and observation-policy tests, relevant file-tool integration checks, source/built invariant-topology checks, build/hygiene, doc-sync, and lint. Do not replace the module with equivalent generic payload-validation machinery.
-
-## Risks
-
-Malformed trusted-plugin emissions lose this opt-in early diagnostic. The check's removal does not justify weakening validation of external data, nor removing other companions that compare lifecycle, durable history, or independently assembled values. If payload-format diagnostics are intentionally part of the companion policy, retain this module and clarify that exception instead.
diff --git a/.agents/notes/proposed/simplification/2026-09-19-omit-fs-payload-invariant.zh.md b/.agents/notes/proposed/simplification/2026-09-19-omit-fs-payload-invariant.zh.md
deleted file mode 100644
index ba81baed5f..0000000000
--- a/.agents/notes/proposed/simplification/2026-09-19-omit-fs-payload-invariant.zh.md
+++ /dev/null
@@ -1,34 +0,0 @@
-# Agent Note: 省略仅校验载荷的文件系统 invariant 配套模块
-
-Status: proposed
-
-[English](2026-09-19-omit-fs-payload-invariant.md) | 中文
-
-## 问题
-
-[文件系统 invariant](../../../../packages/fs/fs/src/invariant.ts) 检查目标字符串非空、present 版本非空及观察值的判别标签。它只读取一次分发的载荷，不保留历史，也不与提供方、策略、文件系统或独立可变状态比较。其[测试](../../../../packages/fs/fs/tests/invariant.spec.ts) 直接构造格式错误的载荷。发布该检查需要配套模块、导出/构建配置、invariant 依赖、编译器引用和专用测试。
-
-当前指导需要显式决策：[独立观察规则](../../implemented/simplification/2026-08-28-omit-unneeded-invariant-companions.zh.md) 要求能够独立分歧的观察值，而[运行时约定示例](../../implemented/architecture/2026-07-19-package-invariant-runtime-contracts.zh.md) 明确认可文件系统目标/版本有效性检查。后者的语义权威仍被较新的规则保留，因此不能仅凭时间先后解决冲突。
-
-## 提案
-
-将独立观察标准应用于这个具体配套模块，并删除它。事件生产方来自独立插件，但逐一检查单个载荷的格式，并没有比较它们的观察值。保留类型化文件系统事件和实际的[观察策略消费方](../../../../packages/fs/fs-observation-policy/src/index.ts)，以及现有归属处的解析器、wire、读取、编辑和写入校验。
-
-删除 48 行配套模块、55 行专用测试、`./invariant` 导出/发布项、仅供 invariant 使用的依赖和编译器引用。在 fs 的两个 README 中补充包特有的省略理由。实现本决策时修改较早的代表性检查行，保留其他语义示例及共享 invariant 注册机制。本提案获接受前不修改这些当前归属文档。
-
-## 考虑过的替代方案
-
-**将载荷校验保留为显式策略例外。** 它能提前发现第三方格式错误的事件，但这会有意扩大已声明的独立观察标准。提案倾向于在输入归属处校验，并将配套模块留给关系检查。
-
-**添加第二个状态源以证明配套模块有必要。** 在没有具体缺失 invariant 的情况下否决。仅为保留此诊断而复制策略状态或暴露新 API，会增加维护负担。
-
-## 验收标准
-
-- 在当前归属 Agent Notes 中解决已指出的策略冲突；不将其宣称为已有共识的机械省略。
-- 不再保留配套源码、测试、导出、产物条目、仅供 invariant 使用的依赖或编译器引用；包拓扑检查接受有说明的省略。
-- 真实文件工具和观察策略测试保留过期版本、目标缺失、别名、执行方路由及外部状态断言。事件及其消费方保留。
-- 运行聚焦的 fs 与观察策略测试、相关文件工具集成检查、源码/构建产物 invariant 拓扑检查、build/hygiene、doc-sync（文档同步门禁）和 lint。不用等价的通用载荷校验机制替换该模块。
-
-## 风险
-
-来自受信任插件的格式错误事件会失去这项可选的早期诊断。删除该检查不构成削弱外部数据校验的理由，也不意味着可以删除比较生命周期、持久化历史或独立组装值的其他配套模块。如果载荷格式诊断本来就是配套模块策略的一部分，应保留模块并澄清该例外。
diff --git a/.agents/notes/proposed/simplification/2026-09-19-provider-only-instruction-reads.i18n.yaml b/.agents/notes/proposed/simplification/2026-09-19-provider-only-instruction-reads.i18n.yaml
index 47b5014e29..232069c543 100644
--- a/.agents/notes/proposed/simplification/2026-09-19-provider-only-instruction-reads.i18n.yaml
+++ b/.agents/notes/proposed/simplification/2026-09-19-provider-only-instruction-reads.i18n.yaml
@@ -9,8 +9,8 @@
en: 5426489eed9b447e
zh: 97132891bfff4b41
/agent-note-read-instruction-files-only-through-a-filesystem-provider/proposal:
- en: 1f6d8ce78f5ab682
- zh: c71c97c0268ac165
+ en: 0096f75858b4c565
+ zh: 7c2c6a18fb111c08
/agent-note-read-instruction-files-only-through-a-filesystem-provider/alternatives-considered:
en: c942573554ef1d63
zh: 7af89ae9434f7521
diff --git a/.agents/notes/proposed/simplification/2026-09-19-provider-only-instruction-reads.md b/.agents/notes/proposed/simplification/2026-09-19-provider-only-instruction-reads.md
index 26d004c136..c3951a6510 100644
--- a/.agents/notes/proposed/simplification/2026-09-19-provider-only-instruction-reads.md
+++ b/.agents/notes/proposed/simplification/2026-09-19-provider-only-instruction-reads.md
@@ -18,7 +18,7 @@ Keep the plugin's missing-provider no-op and the pure `renderAgentInstructions`
Migrate direct helper tests to explicitly owned local or controlled providers. The [test suite](../../../../packages/context/agent-instructions/tests/agent-instructions.spec.ts) already mounts both. Preserve unique assertions and consolidate duplicate Node-mocking cases into provider coverage. Expected deletion is roughly 50–65 production lines before signature/documentation updates, plus redundant test machinery; measure the actual reduction during implementation.
-The [symlink decision](../../implemented/feature/2026-07-21-follow-instruction-symlinks.md) remains active because its accepted behavior survives. At implementation, update its references to the two implementations and the [package README](../../../../packages/context/agent-instructions/README.md), including bilingual counterparts. The [archived workspace-context note](../../archived/feature/2026-06-24-workspace-context.md) remains frozen; no existing note changes accompany this proposal.
+The [agent-instructions reference](../../../../packages/context/agent-instructions/README.md) owns the retained symlink-loading behavior. At implementation, update its provider-read descriptions and Chinese counterpart. The [archived workspace-context note](../../archived/feature/2026-06-24-workspace-context.md) remains frozen; this proposal requires no change to that historical record.
## Alternatives considered
diff --git a/.agents/notes/proposed/simplification/2026-09-19-provider-only-instruction-reads.zh.md b/.agents/notes/proposed/simplification/2026-09-19-provider-only-instruction-reads.zh.md
index 82f3451f96..b678ea69be 100644
--- a/.agents/notes/proposed/simplification/2026-09-19-provider-only-instruction-reads.zh.md
+++ b/.agents/notes/proposed/simplification/2026-09-19-provider-only-instruction-reads.zh.md
@@ -18,7 +18,7 @@ Status: proposed
让直接调用辅助函数的测试改用显式管理生命周期的本地或受控提供方。[测试套件](../../../../packages/context/agent-instructions/tests/agent-instructions.spec.ts)已经挂载了这两类实现。保留独有断言，把重复的 Node mock 场景合并到提供方覆盖中。预计在更新签名和文档之前删除约 50–65 行生产源码，另加冗余测试机制；实施时测量实际减少量。
-[符号链接决策](../../implemented/feature/2026-07-21-follow-instruction-symlinks.zh.md)所接受的行为继续存在，因此该说明保持现行状态。实施时，更新其中对两种实现的引用和[包 README](../../../../packages/context/agent-instructions/README.zh.md)，包括双语对侧。[已归档的工作区上下文说明](../../archived/feature/2026-06-24-workspace-context.md)保持冻结；本提案不附带任何既有说明变更。
+[agent-instructions 参考](../../../../packages/context/agent-instructions/README.zh.md)负责保留的符号链接加载行为。实施时更新其中对提供方读取的描述及英文对侧。[已归档的工作区上下文说明](../../archived/feature/2026-06-24-workspace-context.md)保持冻结；本提案无需修改该历史记录。
## 备选方案
diff --git a/.agents/notes/proposed/simplification/2026-09-19-prune-stream-visibility-helpers.i18n.yaml b/.agents/notes/proposed/simplification/2026-09-19-prune-stream-visibility-helpers.i18n.yaml
index 51801755e1..d8ee6e246b 100644
--- a/.agents/notes/proposed/simplification/2026-09-19-prune-stream-visibility-helpers.i18n.yaml
+++ b/.agents/notes/proposed/simplification/2026-09-19-prune-stream-visibility-helpers.i18n.yaml
@@ -6,11 +6,11 @@
en: 5d82ce82cac8a687
zh: 4cfc68fceb215e35
/agent-note-prune-unused-stream-visibility-helpers/problem:
- en: da5bf344b0d704c1
- zh: 6826b064d8b66373
+ en: 0665c67fb7460f1f
+ zh: 28215a7a02e9262b
/agent-note-prune-unused-stream-visibility-helpers/proposal:
- en: b6cec09bd23a2f5a
- zh: ac348bbe47ea7cc9
+ en: b3f72cf66541614f
+ zh: cc214a5dc75ae6b7
/agent-note-prune-unused-stream-visibility-helpers/alternatives-considered:
en: 1a190cf86a9f7ec9
zh: 2a30aa235c69bdc7
diff --git a/.agents/notes/proposed/simplification/2026-09-19-prune-stream-visibility-helpers.md b/.agents/notes/proposed/simplification/2026-09-19-prune-stream-visibility-helpers.md
index e44716fe15..8c64dba545 100644
--- a/.agents/notes/proposed/simplification/2026-09-19-prune-stream-visibility-helpers.md
+++ b/.agents/notes/proposed/simplification/2026-09-19-prune-stream-visibility-helpers.md
@@ -6,7 +6,7 @@ English | [中文](2026-09-19-prune-stream-visibility-helpers.zh.md)
## Problem
-The [compact Assistant stream implementation](../../../../packages/llm/llm/src/assistant-stream.ts) exports five visibility queries: `isVisibleChunk`, `chunkHasVisibleText`, `runFirstVisibleTime`, `assistantStreamHasVisibleContent`, and `assistantStreamHasVisibleText`. Repository searches find no production caller outside that family. Its other consumers are the [unit tests](../../../../packages/llm/llm/tests/assistant-stream.spec.ts), package documentation, and the [record-reader decision](../../implemented/architecture/2026-09-06-embedded-stream-record-readers.md). The package root and published `./assistant-stream` entry expose the functions to external callers, whose usage this search cannot establish.
+The [compact Assistant stream implementation](../../../../packages/llm/llm/src/assistant-stream.ts) exports five visibility queries: `isVisibleChunk`, `chunkHasVisibleText`, `runFirstVisibleTime`, `assistantStreamHasVisibleContent`, and `assistantStreamHasVisibleText`. Repository searches find no production caller outside that family. Its other consumers are the [unit tests](../../../../packages/llm/llm/tests/assistant-stream.spec.ts), package documentation, and the [record-reader reference](../../../../packages/llm/llm/README.md). The package root and published `./assistant-stream` entry expose the functions to external callers, whose usage this search cannot establish.
The retained first-token reader has current consumers in [Session Stats](../../../../packages/session/session-stats/src/projection.ts) and [Trajectory](../../../../packages/client/ui-trajectory/src/client/trajectory-assistant-definition.ts). Their timing requirements do not require the separate whitespace-sensitive visibility classification.
@@ -16,7 +16,7 @@ Remove the five exported visibility queries and their exclusive private helpers,
Remove dedicated visibility tests and only the obsolete assertions inside mixed reader tests. Keep the mixed fixtures and assertions that verify first-token timing, early exit, raw chunks, text joining, and assembly equivalence.
-The record-reader decision is only partially superseded: its allocation rationale and used readers remain current. When implementing this proposal, update that active note, the [package README](../../../../packages/llm/llm/README.md), and the [LLM subsystem page](../../../../docs/subsystems/llm-streaming.md) with their bilingual counterparts. Do not delete the owning note or alter archived records while adding this proposal.
+The [package README](../../../../packages/llm/llm/README.md) owns compact-reader behavior: retained readers avoid materializing per-member expansions, and durable input still uses validating expansion. Preserve those constraints and the used readers. When implementing this proposal, update that README and the [LLM subsystem page](../../../../docs/subsystems/llm-streaming.md) with their bilingual counterparts; archived records remain unchanged.
## Alternatives considered
diff --git a/.agents/notes/proposed/simplification/2026-09-19-prune-stream-visibility-helpers.zh.md b/.agents/notes/proposed/simplification/2026-09-19-prune-stream-visibility-helpers.zh.md
index 60d010f260..406b21847b 100644
--- a/.agents/notes/proposed/simplification/2026-09-19-prune-stream-visibility-helpers.zh.md
+++ b/.agents/notes/proposed/simplification/2026-09-19-prune-stream-visibility-helpers.zh.md
@@ -6,7 +6,7 @@ Status: proposed
## 问题
-[紧凑 Assistant 流实现](../../../../packages/llm/llm/src/assistant-stream.ts)导出五个可见性查询：`isVisibleChunk`、`chunkHasVisibleText`、`runFirstVisibleTime`、`assistantStreamHasVisibleContent` 和 `assistantStreamHasVisibleText`。仓库搜索未找到这组函数之外的生产调用方。其余消费方是[单元测试](../../../../packages/llm/llm/tests/assistant-stream.spec.ts)、包文档和[记录读取器决策](../../implemented/architecture/2026-09-06-embedded-stream-record-readers.zh.md)。包根入口和发布的 `./assistant-stream` 入口向外部调用方暴露这些函数；本次搜索无法确定外部使用情况。
+[紧凑 Assistant 流实现](../../../../packages/llm/llm/src/assistant-stream.ts)导出五个可见性查询：`isVisibleChunk`、`chunkHasVisibleText`、`runFirstVisibleTime`、`assistantStreamHasVisibleContent` 和 `assistantStreamHasVisibleText`。仓库搜索未找到这组函数之外的生产调用方。其余消费方是[单元测试](../../../../packages/llm/llm/tests/assistant-stream.spec.ts)、包文档和[记录读取器参考](../../../../packages/llm/llm/README.zh.md)。包根入口和发布的 `./assistant-stream` 入口向外部调用方暴露这些函数；本次搜索无法确定外部使用情况。
保留的首 token 读取器已有 [Session Stats](../../../../packages/session/session-stats/src/projection.ts) 和 [Trajectory](../../../../packages/client/ui-trajectory/src/client/trajectory-assistant-definition.ts) 消费方。它们的计时要求不依赖单独区分空白文本的可见性分类。
@@ -16,7 +16,7 @@ Status: proposed
移除专门的可见性测试；混合读取器测试只删除过时断言。保留验证首 token 计时、提前退出、原始分片、文本拼接和组装等价性的混合 fixture（测试前置数据）与断言。
-记录读取器决策只被部分替代：其分配开销方面的理由和仍被使用的读取器继续有效。实施本提案时，更新该现行说明、[包 README](../../../../packages/llm/llm/README.zh.md) 和 [LLM 子系统页面](../../../../docs/subsystems/llm-streaming.zh.md)及其双语对侧。添加本提案时不删除所属说明，也不修改归档记录。
+[包 README](../../../../packages/llm/llm/README.zh.md)负责紧凑读取器的行为：保留的读取器避免将逐成员展开结果实体化，持久化输入仍使用带校验的展开操作。保留这些约束和仍被使用的读取器。实施本提案时，更新该 README、[LLM 子系统页面](../../../../docs/subsystems/llm-streaming.zh.md)及其双语对侧；归档记录保持不变。
## 备选方案
diff --git a/.agents/notes/proposed/simplification/2026-09-19-python-sdk-directional-client.i18n.yaml b/.agents/notes/proposed/simplification/2026-09-19-python-sdk-directional-client.i18n.yaml
index df72997d92..beb6fb007b 100644
--- a/.agents/notes/proposed/simplification/2026-09-19-python-sdk-directional-client.i18n.yaml
+++ b/.agents/notes/proposed/simplification/2026-09-19-python-sdk-directional-client.i18n.yaml
@@ -6,8 +6,8 @@
en: 29c6b53f7f81bfd8
zh: 94139164373cda91
/agent-note-remove-the-python-sdk-s-unused-reverse-rpc-direction/problem:
- en: e8779fc70adce0e4
- zh: 288565d427fe65ae
+ en: 839a904fc25dc18e
+ zh: 5f7b3cac4fac2755
/agent-note-remove-the-python-sdk-s-unused-reverse-rpc-direction/proposal:
en: 508671a9a29a8f2a
zh: 750587c118eb7450
diff --git a/.agents/notes/proposed/simplification/2026-09-19-python-sdk-directional-client.md b/.agents/notes/proposed/simplification/2026-09-19-python-sdk-directional-client.md
index 287126d65c..439a479ac6 100644
--- a/.agents/notes/proposed/simplification/2026-09-19-python-sdk-directional-client.md
+++ b/.agents/notes/proposed/simplification/2026-09-19-python-sdk-directional-client.md
@@ -8,7 +8,7 @@ English | [中文](2026-09-19-python-sdk-directional-client.zh.md)
The [Python client](../../../../python/sdk/src/deepseek_harness/client.py) keeps an incoming-request queue, close-time wake-up, and `next_request`, `respond`, `respond_error`, and `notify` methods. The [SDK server](../../../../packages/sdk/server/src/server.ts) receives requests and emits notifications; it declares no server-originated request or client-notification handler. Searches across Python sources, examples, and runtime profiles found the reverse direction only in client implementation and [synthetic client tests](../../../../python/sdk/tests/test_client.py). The exported `IncomingRequest` model consequently has no supported runtime producer.
-This is a narrower continuation of the [directional JSON-RPC proposal](../../rejected/simplification/2026-07-19-make-jsonrpc-directional.md), whose rejection explicitly permits transport narrowing separately. Its completion redesign remains rejected. Its claim about the shared TypeScript transport is now inapplicable: the [Codex wire adapter](../../../../packages/subagent/subagent-codex/src/wire.ts) uses requests and notifications in both directions.
+This proposal narrows only the Python client. The [SDK server](../../../../packages/sdk/server/README.md) retains its durable enqueue receipt and streamed Session events; prompt responses do not represent turn completion. The shared TypeScript transport remains bidirectional because the [Codex wire adapter](../../../../packages/subagent/subagent-codex/src/wire.ts) uses requests and notifications in both directions.
## Proposal
diff --git a/.agents/notes/proposed/simplification/2026-09-19-python-sdk-directional-client.zh.md b/.agents/notes/proposed/simplification/2026-09-19-python-sdk-directional-client.zh.md
index caf9b7c73a..e6279dbb80 100644
--- a/.agents/notes/proposed/simplification/2026-09-19-python-sdk-directional-client.zh.md
+++ b/.agents/notes/proposed/simplification/2026-09-19-python-sdk-directional-client.zh.md
@@ -8,7 +8,7 @@ Status: proposed
[Python 客户端](../../../../python/sdk/src/deepseek_harness/client.py) 维护入站请求队列、关闭时的唤醒，以及 `next_request`、`respond`、`respond_error` 和 `notify` 方法。[SDK 服务端](../../../../packages/sdk/server/src/server.ts) 接收请求并发送通知，没有定义服务端主动发起的请求或客户端通知处理器。搜索 Python 源码、示例和运行时 profile 后，仅在客户端实现和[合成客户端测试](../../../../python/sdk/tests/test_client.py) 中发现反向通信。因此，导出的 `IncomingRequest` 模型没有受支持运行时的生产方。
-这是[定向 JSON-RPC 提案](../../rejected/simplification/2026-07-19-make-jsonrpc-directional.zh.md) 的缩小范围续案；该提案的否决原因明确允许单独重提传输收缩。其完成语义重设计仍被否决。它对共享 TypeScript 传输的判断已不适用：[Codex wire 适配器](../../../../packages/subagent/subagent-codex/src/wire.ts) 在两个方向上都使用请求和通知。
+本提案只收缩 Python 客户端。[SDK 服务端](../../../../packages/sdk/server/README.zh.md) 保留持久化入队回执和 Session 事件流；prompt 响应不表示轮次完成。共享 TypeScript 传输保留双向能力，因为 [Codex wire 适配器](../../../../packages/subagent/subagent-codex/src/wire.ts) 在两个方向上都使用请求和通知。
## 提案
diff --git a/.agents/notes/proposed/simplification/2026-09-19-retire-prompt-registry-change-event.i18n.yaml b/.agents/notes/proposed/simplification/2026-09-19-retire-prompt-registry-change-event.i18n.yaml
index 1f094f2d6f..80524894f7 100644
--- a/.agents/notes/proposed/simplification/2026-09-19-retire-prompt-registry-change-event.i18n.yaml
+++ b/.agents/notes/proposed/simplification/2026-09-19-retire-prompt-registry-change-event.i18n.yaml
@@ -6,8 +6,8 @@
en: 081a6a1f8f256c6e
zh: c49dd9c0e7e42f24
/agent-note-retire-the-prompt-registry-change-event/problem:
- en: 22259f002f329483
- zh: d5a9c78a80af5187
+ en: 53a2f8957e78dc15
+ zh: 75fa547166f1d45a
/agent-note-retire-the-prompt-registry-change-event/proposal:
en: dba84cfd3aa5f719
zh: d3f6eece6f2f8148
diff --git a/.agents/notes/proposed/simplification/2026-09-19-retire-prompt-registry-change-event.md b/.agents/notes/proposed/simplification/2026-09-19-retire-prompt-registry-change-event.md
index 1103675525..80cee5fbad 100644
--- a/.agents/notes/proposed/simplification/2026-09-19-retire-prompt-registry-change-event.md
+++ b/.agents/notes/proposed/simplification/2026-09-19-retire-prompt-registry-change-event.md
@@ -8,7 +8,7 @@ English | [中文](2026-09-19-retire-prompt-registry-change-event.zh.md)
[`SystemPrompt`](../../../../packages/core/system-prompt/src/index.ts) emits `system-prompt/change` when providers register or dispose. Repository searches find no executing product listener, but generated Host discovery advertises the event. Tests maintain notification counts and rollback after listener exceptions. This is a public extension with maintenance obligations, even without a first-party subscriber.
-The active [Remote event delivery decision](../../implemented/architecture/2026-08-10-remote-event-delivery.md) explicitly retains this extension despite having no shipped consumer. Per-step assembly predates that promise and serves a different purpose: rebuilding model input does not replace push observation of registry changes.
+The active [Remote event delivery reference](../../../../packages/api/remotes/README.md) explicitly retains this extension despite having no shipped consumer. Per-step assembly predates that promise and serves a different purpose: rebuilding model input does not replace push observation of registry changes.
## Proposal
diff --git a/.agents/notes/proposed/simplification/2026-09-19-retire-prompt-registry-change-event.zh.md b/.agents/notes/proposed/simplification/2026-09-19-retire-prompt-registry-change-event.zh.md
index a49df2eeba..41563c0e9b 100644
--- a/.agents/notes/proposed/simplification/2026-09-19-retire-prompt-registry-change-event.zh.md
+++ b/.agents/notes/proposed/simplification/2026-09-19-retire-prompt-registry-change-event.zh.md
@@ -8,7 +8,7 @@ Status: proposed
[`SystemPrompt`](../../../../packages/core/system-prompt/src/index.ts) 在提供方注册或 dispose（资源释放）时发出 `system-prompt/change`。仓库搜索未找到执行的产品监听者，但生成的 Host 发现目录会展示该事件。测试维护通知次数及监听者抛出异常后的回滚行为。即使没有第一方订阅者，它仍是具有维护义务的公开扩展。
-活动的 [Remote 事件投递决策](../../implemented/architecture/2026-08-10-remote-event-delivery.zh.md) 明确保留了这一扩展，尽管没有随产品提供的消费方。逐步骤组装早于该承诺，且用途不同：重新构建模型输入不能替代注册表变更的推送观测。
+活动的 [Remote 事件投递参考](../../../../packages/api/remotes/README.zh.md) 明确保留了这一扩展，尽管没有随产品提供的消费方。逐步骤组装早于该承诺，且用途不同：重新构建模型输入不能替代注册表变更的推送观测。
## 提案
diff --git a/.agents/notes/proposed/simplification/2026-09-19-shell-env-key-declarations.i18n.yaml b/.agents/notes/proposed/simplification/2026-09-19-shell-env-key-declarations.i18n.yaml
index 06790c6cff..be77cf402a 100644
--- a/.agents/notes/proposed/simplification/2026-09-19-shell-env-key-declarations.i18n.yaml
+++ b/.agents/notes/proposed/simplification/2026-09-19-shell-env-key-declarations.i18n.yaml
@@ -9,8 +9,8 @@
en: ff308f45fc6f5242
zh: 025b58883a3e175b
/agent-note-keep-shell-environment-declarations-focused-on-key-ownership/proposal:
- en: ffd78167917dfa4b
- zh: dbcb1004009ea9f5
+ en: 38511c6da912406d
+ zh: 2ee9dcf7a611c57f
/agent-note-keep-shell-environment-declarations-focused-on-key-ownership/alternatives-considered:
en: 476de18c44f2ad86
zh: a0a15da6c5e7fbf7
diff --git a/.agents/notes/proposed/simplification/2026-09-19-shell-env-key-declarations.md b/.agents/notes/proposed/simplification/2026-09-19-shell-env-key-declarations.md
index 7b74e55e6b..8487a6253d 100644
--- a/.agents/notes/proposed/simplification/2026-09-19-shell-env-key-declarations.md
+++ b/.agents/notes/proposed/simplification/2026-09-19-shell-env-key-declarations.md
@@ -14,7 +14,7 @@ The method is nevertheless discoverable through the [Cordis inspection provider]
Represent a contributor's declaration as an explicit readonly collection of keys. Remove description objects, `BashEnvVariable`, `BashEnvVariableInfo`, `list()`, description-only validation, and the exhaustive-catalog TODO. Update the Web contributor, README pair, and generated service/type declarations together.
-Keep `register`, `collect`, reserved keys, ownership conflicts, undeclared-output refusal, deterministic environment output, and effect disposal. The [PowerShell parity decision](../../implemented/feature/2026-08-02-pwsh-tool-bash-parity.md) continues to own the shared registry and both shell consumers. The proposal removes one public method, two metadata types, and their validation/enumeration tests; roughly 32 identified source lines disappear before the small key-membership adaptation.
+Keep `register`, `collect`, reserved keys, ownership conflicts, undeclared-output refusal, deterministic environment output, and effect disposal. The [PowerShell parity reference](../../../../packages/shell/shell-env/README.md) continues to own the shared registry and both shell consumers. The proposal removes one public method, two metadata types, and their validation/enumeration tests; roughly 32 identified source lines disappear before the small key-membership adaptation.
## Alternatives considered
diff --git a/.agents/notes/proposed/simplification/2026-09-19-shell-env-key-declarations.zh.md b/.agents/notes/proposed/simplification/2026-09-19-shell-env-key-declarations.zh.md
index 03d7ed9fde..ebc0524f58 100644
--- a/.agents/notes/proposed/simplification/2026-09-19-shell-env-key-declarations.zh.md
+++ b/.agents/notes/proposed/simplification/2026-09-19-shell-env-key-declarations.zh.md
@@ -14,7 +14,7 @@ Status: proposed
将贡献方声明表示为显式只读键集合。删除描述对象、`BashEnvVariable`、`BashEnvVariableInfo`、`list()`、仅针对描述的校验，以及完整目录 TODO。同时更新 Web 贡献方、README 配对与生成的服务/类型声明。
-保留 `register`、`collect`、保留键、所有权冲突、拒绝未声明输出、确定性的环境输出和 effect 释放。[PowerShell 对齐决策](../../implemented/feature/2026-08-02-pwsh-tool-bash-parity.zh.md) 继续拥有共享注册表及两个 shell 消费方。提案删除一个公共方法、两个元数据类型及其校验/枚举测试；在少量键成员判定适配前，已定位可删除约 32 行源码。
+保留 `register`、`collect`、保留键、所有权冲突、拒绝未声明输出、确定性的环境输出和 effect 释放。[PowerShell 对齐参考](../../../../packages/shell/shell-env/README.zh.md) 继续拥有共享注册表及两个 shell 消费方。提案删除一个公共方法、两个元数据类型及其校验/枚举测试；在少量键成员判定适配前，已定位可删除约 32 行源码。
## 考虑过的替代方案
diff --git a/.agents/notes/proposed/testing/2026-06-11-mutation-testing.i18n.yaml b/.agents/notes/proposed/testing/2026-06-11-mutation-testing.i18n.yaml
index c1c40758be..1937f884f0 100644
--- a/.agents/notes/proposed/testing/2026-06-11-mutation-testing.i18n.yaml
+++ b/.agents/notes/proposed/testing/2026-06-11-mutation-testing.i18n.yaml
@@ -6,8 +6,8 @@
en: 521fac2a2df2498e
zh: 9a508486144b2e74
/agent-note-mutation-testing-as-the-coverage-counterweight/problem:
- en: f67a5e8beb51c898
- zh: 9f997eaf27491ea4
+ en: bb51340cca98a1be
+ zh: ee8e9297edf623bb
/agent-note-mutation-testing-as-the-coverage-counterweight/proposal:
en: 4aa172d4d1c7e419
zh: dae8a42d5693e509
diff --git a/.agents/notes/proposed/testing/2026-06-11-mutation-testing.md b/.agents/notes/proposed/testing/2026-06-11-mutation-testing.md
index 591d901264..1e996158ff 100644
--- a/.agents/notes/proposed/testing/2026-06-11-mutation-testing.md
+++ b/.agents/notes/proposed/testing/2026-06-11-mutation-testing.md
@@ -6,7 +6,7 @@ English | [中文](2026-06-11-mutation-testing.zh.md)
## Problem
-The per-file 100% coverage gate ([the quality-gates decision](../../implemented/process/2026-06-11-quality-gates.md)) proves every line *executes* under test — not that any assertion would notice if the line were wrong. Under agent-written tests, coverage pressure can produce execution-without-assertion. Mutation testing measures what coverage cannot: whether the suite *kills* deliberately injected bugs.
+The per-file 100% coverage gate ([the quality-gates reference](../../../../docs/testing.md)) proves every line *executes* under test — not that any assertion would notice if the line were wrong. Under agent-written tests, coverage pressure can produce execution-without-assertion. Mutation testing measures what coverage cannot: whether the suite *kills* deliberately injected bugs.
## Proposal
diff --git a/.agents/notes/proposed/testing/2026-06-11-mutation-testing.zh.md b/.agents/notes/proposed/testing/2026-06-11-mutation-testing.zh.md
index a8e786ab65..cd80dac8a5 100644
--- a/.agents/notes/proposed/testing/2026-06-11-mutation-testing.zh.md
+++ b/.agents/notes/proposed/testing/2026-06-11-mutation-testing.zh.md
@@ -6,7 +6,7 @@ Status: proposed
## 问题
-逐文件 100% 覆盖率门禁（[质量门禁决策](../../implemented/process/2026-06-11-quality-gates.zh.md)）证明每一行代码在测试中都被*执行*了，但不能证明如果该行出错，任何断言会注意到。在 agent（智能体）编写测试的场景下，覆盖率压力可能产出「执行但不断言」的测试。变异测试衡量的正是覆盖率无法衡量的：测试套件是否能*杀死*被刻意注入的缺陷。
+逐文件 100% 覆盖率门禁（[质量门禁说明](../../../../docs/testing.zh.md)）证明每一行代码在测试中都被*执行*了，但不能证明如果该行出错，任何断言会注意到。在 agent（智能体）编写测试的场景下，覆盖率压力可能产出「执行但不断言」的测试。变异测试衡量的正是覆盖率无法衡量的：测试套件是否能*杀死*被刻意注入的缺陷。
## 提案
diff --git a/.agents/notes/rejected/architecture/2026-06-16-typed-event-schemas.i18n.yaml b/.agents/notes/rejected/architecture/2026-06-16-typed-event-schemas.i18n.yaml
index a1a2f350fc..139a14628d 100644
--- a/.agents/notes/rejected/architecture/2026-06-16-typed-event-schemas.i18n.yaml
+++ b/.agents/notes/rejected/architecture/2026-06-16-typed-event-schemas.i18n.yaml
@@ -6,8 +6,8 @@
en: 63685a0c0afc3f07
zh: 8f7e06562771ee1d
/agent-note-runtime-schemas-for-the-event-vocabulary-zod-vs-the-merge-extensible-map-pattern/problem:
- en: 6bea9eb883f324d2
- zh: 2bef9b9fa5233d09
+ en: 8b2780f7c75a81a9
+ zh: 62525da8b9750f84
/agent-note-runtime-schemas-for-the-event-vocabulary-zod-vs-the-merge-extensible-map-pattern/why-this-is-not-a-persistence-change:
en: 42d48e48d694d3de
zh: f556f4624b55a480
@@ -36,5 +36,5 @@
en: 79e720cfffe60257
zh: b4aea0d52f3ee072
/agent-note-runtime-schemas-for-the-event-vocabulary-zod-vs-the-merge-extensible-map-pattern/open-questions:
- en: afc8275e1598eb34
- zh: f3684ee3aba33cf1
+ en: 2c9095d05efbd00f
+ zh: c18fca57a4600284
diff --git a/.agents/notes/rejected/architecture/2026-06-16-typed-event-schemas.md b/.agents/notes/rejected/architecture/2026-06-16-typed-event-schemas.md
index 5912c39016..d43a6d809d 100644
--- a/.agents/notes/rejected/architecture/2026-06-16-typed-event-schemas.md
+++ b/.agents/notes/rejected/architecture/2026-06-16-typed-event-schemas.md
@@ -8,7 +8,7 @@ English | [中文](2026-06-16-typed-event-schemas.zh.md)
The harness models its core vocabulary — content blocks, message sources, finish reasons, turn triggers, turn-end reasons, and session events — as **merge-extensible maps**: a TypeScript `interface` (e.g. `SessionEventMap`, `ContentBlockMap`) that plugins augment via declaration merging, with the public union derived as `Map[keyof Map]`. This is the repo's universal extension pattern, documented in [docs/architecture.md](../../../../docs/architecture.md) ("The same merge-extensible-map pattern is used for `MessageSource`, `FinishReason`, `TurnTrigger`, and `TurnEndReason`") and relied on by the `defineTool` `InferArgs` DSL and the `assertNever` exhaustiveness convention.
-The pattern is **compile-time only**. The types vanish at runtime: there is no schema object to validate an incoming value against, parse untrusted input with, or enumerate at runtime. The [session-persistence contract](../../implemented/architecture/2026-06-14-session-persistence.md) exposes two consequences:
+The pattern is **compile-time only**. The types vanish at runtime: there is no schema object to validate an incoming value against, parse untrusted input with, or enumerate at runtime. The [session-persistence contract](../../../../packages/session/session-persistence/README.md) exposes two consequences:
1. **Persistence treats `event.data` as opaque JSON.** The JSONL provider `JSON.stringify`s and `JSON.parse`s each event verbatim; the only runtime guard is `isJsonValue` (round-trip serializability — rejects BigInt, functions, cycles, non-finite numbers, …), not structural validation. A corrupted-but-still-JSON event datum (wrong field types, missing fields) round-trips silently and is only caught later, if at all, by a consumer's `switch`.
2. **No runtime contract for plugin-added variants.** A plugin that declaration-merges a new `SessionEventMap` key gets compile-time typing for its own code, but nothing validates that the values it produces match the shape it declared — at the producer, at the persistence boundary, or on reload.
@@ -72,4 +72,4 @@ Defer. If runtime validation is wanted at the durable boundary, **Option B** (sc
- If a registry is adopted, is the library **schemastery** (already in the tree, already the config schema lib) or **Zod** (richer ecosystem, currently only transitive)? Adopting two schema libraries is a cost in itself.
- Can a hybrid keep compile-time inference (so `defineTool` and plugin DX survive) while adding an *optional* runtime schema per variant, validated only at the persistence/wire boundary rather than on every in-process append?
-- Does the `ctx.invariants` service already cover enough of the runtime-shape gap when enabled that boundary validation is only needed for genuinely untrusted input (reload of an externally-modified log)?
+- Did the `ctx.invariants` service, since removed, already cover enough of the runtime-shape gap when enabled that boundary validation is only needed for genuinely untrusted input (reload of an externally-modified log)?
diff --git a/.agents/notes/rejected/architecture/2026-06-16-typed-event-schemas.zh.md b/.agents/notes/rejected/architecture/2026-06-16-typed-event-schemas.zh.md
index 67d0c1be31..a30fd7b8ce 100644
--- a/.agents/notes/rejected/architecture/2026-06-16-typed-event-schemas.zh.md
+++ b/.agents/notes/rejected/architecture/2026-06-16-typed-event-schemas.zh.md
@@ -8,7 +8,7 @@ Status: rejected — runtime event-schema registry declined; event maps stay com
harness 将其核心词汇——内容块、消息来源、结束原因、轮次触发器、轮次结束原因与会话事件——建模为 **merge-extensible map**：一个 TypeScript `interface`（如 `SessionEventMap`、`ContentBlockMap`），插件通过声明合并对其扩展，公开联合类型则以 `Map[keyof Map]` 派生。这是本仓库的通用扩展模式，记录在 [docs/architecture.md](../../../../docs/architecture.zh.md) 中（「The same merge-extensible-map pattern is used for `MessageSource`, `FinishReason`, `TurnTrigger`, and `TurnEndReason`」），`defineTool` 的 `InferArgs` DSL 和 `assertNever` 穷举约定都依赖于它。
-该模式**仅存在于编译期**。类型在运行时消失：没有 schema 对象可供校验传入值、解析不可信输入或在运行时枚举变体。[会话持久化约定](../../implemented/architecture/2026-06-14-session-persistence.zh.md)暴露了两个后果：
+该模式**仅存在于编译期**。类型在运行时消失：没有 schema 对象可供校验传入值、解析不可信输入或在运行时枚举变体。[会话持久化约定](../../../../packages/session/session-persistence/README.zh.md)暴露了两个后果：
1. **持久化将 `event.data` 视为不透明 JSON。** JSONL provider 对每个事件原样执行 `JSON.stringify`/`JSON.parse`；唯一的运行时守卫是 `isJsonValue`（往返可序列化性检查：拒绝 BigInt、函数、循环引用、非有限数等），而非结构校验。一个损坏但仍为合法 JSON 的事件数据（字段类型错误、字段缺失）会静默往返，只有在后续消费方的 `switch` 中才可能被捕获。
2. **插件新增变体没有运行时约定。** 一个通过声明合并添加新 `SessionEventMap` 键的插件，在自身代码中获得了编译期类型，但没有任何机制校验它产出的值是否符合它所声明的形状——无论是在生产者处、持久化边界处还是重新加载时。
@@ -72,4 +72,4 @@ harness 将其核心词汇——内容块、消息来源、结束原因、轮次
- 如果采用注册表，库选 **schemastery**（已在仓库中，已作为配置 schema 库）还是 **Zod**（生态更丰富，目前仅为传递依赖）？同时维护两个 schema 库本身就是一种成本。
- 能否采用混合方案：保留编译期推断（使 `defineTool` 和插件开发体验不受影响），同时为每个变体添加*可选*的运行时 schema，仅在持久化/协议边界校验，而非每次进程内 append 都校验？
-- `ctx.invariants` 服务启用后是否已覆盖了足够多的运行时形状缺口，使得边界校验仅在面对真正不可信输入（重新加载外部修改过的日志）时才有必要？
+- 已移除的 `ctx.invariants` 服务启用后是否曾覆盖足够多的运行时形状缺口，使得边界校验仅在面对真正不可信输入（重新加载外部修改过的日志）时才有必要？
diff --git a/.agents/notes/rejected/architecture/2026-07-25-client-settings-locale-theme.i18n.yaml b/.agents/notes/rejected/architecture/2026-07-25-client-settings-locale-theme.i18n.yaml
deleted file mode 100644
index 0d568431e3..0000000000
--- a/.agents/notes/rejected/architecture/2026-07-25-client-settings-locale-theme.i18n.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-25-client-settings-locale-theme.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/rejected/architecture/2026-07-25-client-settings-locale-theme.md
-/agent-note-client-settings-locale-and-theme-layering:
- en: ebeba4110da742d5
- zh: 3cfc57b1eb553185
-/agent-note-client-settings-locale-and-theme-layering/problem:
- en: 4cec7e053c53607b
- zh: 3796b79366e7ea58
-/agent-note-client-settings-locale-and-theme-layering/proposal:
- en: 3dd489ca0eab19bd
- zh: a57d5dd4d2496f04
-/agent-note-client-settings-locale-and-theme-layering/proposal/first-phase-registration-surfaces:
- en: 7a4890dffd207a66
- zh: 4353be1cf48bf68d
-/agent-note-client-settings-locale-and-theme-layering/proposal/slot-topology:
- en: bc2aba013c52fca5
- zh: 734e5ef05792bdf9
-/agent-note-client-settings-locale-and-theme-layering/proposal/slot-declarations-are-first-class-injectable-waits:
- en: 9df71cdd33cd691d
- zh: 9ac3eba3d89192d9
-/agent-note-client-settings-locale-and-theme-layering/proposal/service-contracts:
- en: 30c49423999492e5
- zh: bce71328fdd946c5
-/agent-note-client-settings-locale-and-theme-layering/alternatives-considered:
- en: 258859f30f0b9784
- zh: 70d48285033c3d8f
-/agent-note-client-settings-locale-and-theme-layering/acceptance-criteria:
- en: 9ff6ce8ea22dab22
- zh: c8dd20442b50df21
-/agent-note-client-settings-locale-and-theme-layering/risks:
- en: fb649d6c5a86bc09
- zh: cb5520268d365ca9
diff --git a/.agents/notes/rejected/architecture/2026-07-25-client-settings-locale-theme.md b/.agents/notes/rejected/architecture/2026-07-25-client-settings-locale-theme.md
deleted file mode 100644
index e7f4b64ab0..0000000000
--- a/.agents/notes/rejected/architecture/2026-07-25-client-settings-locale-theme.md
+++ /dev/null
@@ -1,130 +0,0 @@
-# Agent Note: Client Settings, Locale, and Theme layering
-
-Status: rejected — closed as a proposal: the shipped ui-settings, locale, and ui-theme packages and their READMEs own the design
-
-English | [中文](2026-07-25-client-settings-locale-theme.zh.md)
-
-## Problem
-
-The browser client's existing Settings is written directly inside the Sidebar, and language and theme are applied by component-local state mutating the DOM directly. As a result Settings cannot be extended by independent plugins, preference state has no stable cross-plugin service contract, and the theme registry carries both state and presentation responsibilities.
-
-## Proposal
-
-**Collaboration doctrine (how every later module joins Settings): feature owners self-register.** The Settings shell is a pure composition surface: it only declares slots and renders the chrome structure — zero copy, no locale dependency, and neither importing nor enumerating any feature; for a feature to appear in Settings, its own plugin registers into the corresponding slot — locale registers the Language row, ui-theme registers the Appearance row, ui-settings-models registers the Models top-level panel. No separate `ui-settings-*` package is created for "a feature's settings page": the settings surface belongs to the feature package itself (shipping the Theme feature means Theme's settings choices ship with ui-theme). Content that belongs to no single feature (the trigger/title/close chrome copy, the General directory with its skeleton rows, the `settings` dictionary) is owned by `ui-settings-general` — the owner of the ownerless copy, not a feature satellite package.
-
-The Sidebar declares the `sidebar.settings` single slot; `ui-settings` occupies it and declares four slots: `settings.trigger` / `settings.header` / `settings.close` (chrome content seats, single) and `settings.section` (top-level pages, list). Accessible names all resolve from slot content: the trigger's accessible name is its text content, the dialog points at the header content node via aria-labelledby, and close is a visually hidden text seat. Each section is contributed by a feature plugin; the shell only reads entry metadata from the slot ledger to build the navigation, rendering the current section via `only`. General is registered by `ui-settings-general` (order 0) and declares the `settings.general.item` list slot, into which the feature plugins' preference rows slot by order.
-
-The Settings entry is the Settings row in the sidebar Foot; clicking it directly opens a 1080×700 centered overlay (black 24% mask); the close button, a mask click, and ESC all close it. There is no intermediate menu form of any kind.
-
-`@deepseek-ai/dsh-client-locale` provides `ctx.locale`; `ui-theme` provides `ctx.theme`. Both services read through a getter, write through a setter, and publish immutable snapshots via typed Cordis change events; each service persists its own preference (storing only the id, with bad values falling back to the default).
-
-Each feature row's apply layer subscribes to its own change event (locale to `locale/change`, ui-theme to `theme/change`) and projects the snapshot into the slot store declared when that row registered. React components only read `useStore` and write through the injected setter callbacks, never reading ctx or the services.
-
-The theme preference has three states — `light`, `dark`, `system` — defaulting to `system` (when no persisted preference exists or the value is bad). Resolving system belongs to the theme domain: ThemeRuntime holds the `prefers-color-scheme` matchMedia listener (environment sensing, not DOM presentation) and re-emits the snapshot when the preference is system and the system color scheme changes; the snapshot carries both `preference` and the resolved `active` definition.
-
-The theme service never touches the DOM. `ui-layout` reads the Theme getter initially and then subscribes to `theme/change`; the presenter owned by Layout updates `body[data-ds-dark-theme]` and the theme tokens according to `active`. The presenter has no notion of system — it consumes only resolved results.
-
-### First-phase registration surfaces
-
-| Registration surface | Owning plugin | First-phase content |
-|---|---|---|
-| chrome content (trigger/header/close) | `ui-settings-general` | Settings entry-row icon and copy, panel title, close hidden text |
-| General section (order 0) | `ui-settings-general` | Permission and Tool Call visual skeletons (no write operations) plus the `settings.general.item` slot declaration |
-| Language row (item order 0) | `locale` | Selector dropdown; 中文/English genuinely switch |
-| Appearance row (item order 10) | `ui-theme` | Light/Dark/System three cubes genuinely switch (the selected state reflects preference) |
-| Models section (order 10) | `ui-settings-models` | Navigation item only, with an empty content area; later model-management features land in that package |
-| Plugin | none | Not built this phase, and the navigation does not show the item (once a later plugin feature package registers the section it appears automatically) |
-
-The first phase localizes only the copy inside the Settings overlay; dictionaries stay close to their owners — the chrome plus the General skeletons live in `ui-settings-general`'s `settings` namespace, and feature-row copy lives in each feature package (`settings.locale`, `settings.theme`, `settings.models`).
-
-### Slot topology
-
-```text
-root
-└─ sidebar
- └─ sidebar.settings single/root
- └─ ui-settings（壳，零文案）
- ├─ settings.trigger single/root ui-settings-general 注册
- ├─ settings.header single/root ui-settings-general 注册
- ├─ settings.close single/root ui-settings-general 注册
- └─ settings.section list/root
- ├─ general (order 0) ui-settings-general 注册
- │ └─ settings.general.item list/root
- │ ├─ language (0) locale 注册
- │ └─ appearance (10) ui-theme 注册
- └─ models (order 10) ui-settings-models 注册
-```
-
-Section and item contributions use `ctx.slots.inject()` and do not depend on the client manifest's apply order; localized labels ride the label thunk from the [full-rollout note](../../archived/architecture/2026-07-30-client-locale-full-rollout.md). The SlotMap types split homes: trigger/header/close/section have their canonical home in the ui-settings contract (the consumers, general and models, both depend on the shell — no cycle); `settings.general.item`'s canonical home is the locale package — it is the lowest common dependency of all item registrants (a settings row always carries copy), while the declarer general's contract is unreachable from locale/ui-theme (it would form a cycle); ui-theme consumes it through a re-export outlet.
-
-### Slot declarations are first-class injectable waits
-
-`SlotRegistry.inject()` now waits on the typed ledger key directly; it does not bridge declarations into synthetic `slot:` Cordis services. The callback follows declaration collapse and redeclaration while its controller remains owned by the contributing plugin fiber, and direct registration into an undeclared slot still fails loud. This removes the stale-disposer presence machine and the typo-prone parallel service namespace. The complete lifecycle and failure contract lives in the [slot declaration injection decision](../../archived/architecture/2026-08-05-slot-declaration-injection.md).
-
-### Service contracts
-
-```ts
-export type ThemePreference = 'light' | 'dark' | 'system'
-
-export interface ThemeDefinition {
- id: string
- colorScheme: 'light' | 'dark'
- tokens: Record
-}
-
-export interface ThemeSnapshot {
- preference: ThemePreference
- active: ThemeDefinition // system 已解析为具体 light/dark 定义
- themes: readonly ThemeDefinition[]
- revision: number
-}
-
-export interface LocaleDefinition {
- id: 'zh' | 'en'
- label: string
-}
-
-export interface LocaleSnapshot {
- active: 'zh' | 'en'
- locales: readonly LocaleDefinition[]
- revision: number
-}
-
-export interface Events {
- /** @param snapshot - Current locale registry snapshot. @mode emit */
- 'locale/change'(snapshot: LocaleSnapshot): void
- /** @param snapshot - Current theme registry snapshot. @mode emit */
- 'theme/change'(snapshot: ThemeSnapshot): void
-}
-```
-
-Locale ships with 中文 and English built in; `setLocale`/`setTheme` are the only write entry points, and an unknown id fails.
-
-## Alternatives considered
-
-**Having the app shell subscribe to preferences centrally and re-render the root slot tree.** A language or theme change only needs to update the actual consumers; a whole-tree refresh amplifies the blast radius and wires business preferences into the shell.
-
-**The theme service mutating the DOM directly.** The registry service would then depend on the presentation environment, with unclear lifecycle and global-style ownership; Layout already owns the page-root presentation boundary.
-
-**Resolving system in the Layout presenter.** The presenter would need its own matchMedia subscription and would pick the concrete definition out of the themes list, forcing the presentation layer to understand preference semantics; resolving on the service side gives every consumer the same resolved snapshot.
-
-**Settings importing and enumerating the sections.** Adding a page would require modifying the shell plugin, breaking the composition model where each feature occupies a slot from its own plugin.
-
-**A per-feature `ui-settings-*` satellite package for each section.** It divorces the settings surface from the feature itself: changing Theme behavior touches two packages, the package count grows linearly with settings items, and the satellite packages depending back on the locale/theme services form an intermediate layer that exists purely for the package split. Under feature-owner self-registration that layer does not exist: preference rows ship with their feature packages, and `ui-settings-general` takes in only the ownerless copy (the chrome and the General skeletons), carrying no feature's settings surface.
-
-**Injecting the Locale/Theme snapshots into React directly.** Inject results are cached by entry identity, so volatile values go stale; hand-rolling a React hook per service also bypasses the slot store's unified binding.
-
-## Acceptance criteria
-
-- The Settings shell depends only on the slot ledger, never on any feature implementation; General's item list likewise depends only on the ledger.
-- Adding a settings item = the feature package registering it itself (a section or a general item), with zero shell changes.
-- Locale and Theme writes go only through the setters; ongoing synchronization goes only through the change events.
-- Each feature row's store initializes from the getter and is thereafter updated by its own change event with local re-renders.
-- Layout applies the theme snapshot on its own and the theme service never accesses the DOM; no system branch appears in the presenter.
-- 中文/English and Light/Dark/System switch and are restored after a refresh; with the preference on system, a system color-scheme change takes effect immediately.
-- Models has only a navigation item and an empty content area; the Permission and Tool Call skeletons perform no writes.
-- The overlay closes via the close button, a mask click, and ESC.
-
-## Risks
-
-The apply order of slot declarations and contributions is not fixed, so every section/item registrant must use `ctx.slots.inject()` rather than a service or local-disposer presence signal. Service events may fire before a row's first render, so both a feature row store's init and the inject attach must align to the current snapshot from the getter. The duplicated merge copies of `settings.general.item` (locale, ui-theme) must stay verbatim-identical to the ui-settings canonical home — any drift means changing all three together. Layout must clean up the global attributes it set on unmount, and ThemeRuntime must remove its matchMedia listener on dispose, so nothing lingers after HMR.
diff --git a/.agents/notes/rejected/architecture/2026-07-25-client-settings-locale-theme.zh.md b/.agents/notes/rejected/architecture/2026-07-25-client-settings-locale-theme.zh.md
deleted file mode 100644
index 9edd7395af..0000000000
--- a/.agents/notes/rejected/architecture/2026-07-25-client-settings-locale-theme.zh.md
+++ /dev/null
@@ -1,130 +0,0 @@
-# Agent Note: Client Settings、Locale 与 Theme 分层
-
-Status: rejected — closed as a proposal: the shipped ui-settings, locale, and ui-theme packages and their READMEs own the design
-
-[English](2026-07-25-client-settings-locale-theme.md) | 中文
-
-## 问题
-
-浏览器端已有的 Settings 直接写在 Sidebar 内，语言和主题也由组件本地状态直接改 DOM。这使 Settings 无法由独立插件扩展，偏好状态没有稳定的跨插件服务约定，主题注册表同时承担状态与呈现职责。
-
-## 提案
-
-**协作导向（后续所有模块接入 Settings 的方式）：功能属主自注册。** Settings 壳是纯组合面：只声明 slot、渲染 chrome 结构，零文案、不依赖 locale、不 import 也不枚举任何功能；一个功能要出现在 Settings 里，由它自己的插件向对应 slot 注册——locale 注册 Language 行，ui-theme 注册 Appearance 行，ui-settings-models 注册 Models 一级面板。不为「某功能的设置页」单开 `ui-settings-*` 包：设置面属于功能包本身（做 Theme 功能，Theme 的设置选择就随 ui-theme 一起交付）。不属于任何单一功能的内容（trigger/标题/close 的 chrome 文案、General 目录与骨架行、`settings` 字典）由 `ui-settings-general` 拥有——它是「无主文案」的属主，不是功能卫星包。
-
-Sidebar 声明 `sidebar.settings` single slot，`ui-settings` 占用它并声明四个 slot：`settings.trigger` / `settings.header` / `settings.close`（chrome 内容座，single）与 `settings.section`（一级页面，list）。无障碍名称全部解析自 slot 内容：trigger 的无障碍名称即其文本内容，dialog 经 aria-labelledby 指向 header 内容节点，close 是视觉隐藏文本座。每个 section 由功能插件贡献；壳只从 slot ledger 读取 entry metadata 生成导航，通过 `only` 渲染当前 section。General 由 `ui-settings-general` 注册（order 0）并声明 `settings.general.item` list slot，功能插件的偏好行按 order 排入。
-
-Settings 入口是 sidebar Foot 的 Settings 行，点击直接打开 1080×700 居中浮层（黑 24% 遮罩）；close 按钮、点击遮罩、ESC 均关闭。无任何中间菜单形态。
-
-`@deepseek-ai/dsh-client-locale` 提供 `ctx.locale`，`ui-theme` 提供 `ctx.theme`。两个服务都以 getter 读取、setter 写入并用 typed Cordis 变更事件发布不可变快照；服务自己持久化偏好（只存 id，无效值回退默认）。
-
-功能行的 apply 层各自订阅自家变更事件（locale 订 `locale/change`，ui-theme 订 `theme/change`），把快照投影到该行注册时声明的 slot store。React 组件只读 `useStore`、写注入的 setter callback，不读取 ctx 或服务。
-
-Theme 偏好三态：`light`、`dark`、`system`，默认 `system`（无持久化偏好或无效值时）。system 的解析属主题领域：ThemeRuntime 持有 `prefers-color-scheme` matchMedia 监听（环境感知，非 DOM 呈现），偏好为 system 且系统配色变化时重发快照；快照同时携带 `preference` 与解析后的 `active` 定义。
-
-Theme 服务不操作 DOM。`ui-layout` 初始读取 Theme getter，随后订阅 `theme/change`，由 Layout 持有的 presenter 按 `active` 更新 `body[data-ds-dark-theme]` 和主题 token；presenter 不感知 system，只消费已解析结果。
-
-### 首期注册面
-
-| 注册面 | 属主插件 | 首期内容 |
-|---|---|---|
-| chrome 内容（trigger/header/close）| `ui-settings-general` | 设置入口行图标+文案、面板标题、close 隐藏文本 |
-| General section（order 0）| `ui-settings-general` | Permission、Tool Call 视觉骨架（无写操作）+ `settings.general.item` slot 声明 |
-| Language 行（item order 0）| `locale` | Selector 下拉，中文/English 真实可切 |
-| Appearance 行（item order 10）| `ui-theme` | Light/Dark/System 三 cube 真实可切（选中态看 preference） |
-| Models section（order 10）| `ui-settings-models` | 仅导航项，内容区为空；后续模型管理功能落在该包 |
-| 插件 | 无 | 首期不做，导航不出现该项（后续插件功能包注册 section 即自动出现） |
-
-首期只对 Settings 浮层内文案进行本地化；字典就近存放——chrome + General 骨架归 `ui-settings-general` 的 `settings` namespace，功能行文案归各功能包（`settings.locale`、`settings.theme`、`settings.models`）。
-
-### slot 拓扑
-
-```text
-root
-└─ sidebar
- └─ sidebar.settings single/root
- └─ ui-settings（壳，零文案）
- ├─ settings.trigger single/root ui-settings-general 注册
- ├─ settings.header single/root ui-settings-general 注册
- ├─ settings.close single/root ui-settings-general 注册
- └─ settings.section list/root
- ├─ general (order 0) ui-settings-general 注册
- │ └─ settings.general.item list/root
- │ ├─ language (0) locale 注册
- │ └─ appearance (10) ui-theme 注册
- └─ models (order 10) ui-settings-models 注册
-```
-
-section/item contribution 使用 `ctx.slots.inject()`，不依赖 client manifest（元数据清单）的 apply 顺序；本地化 label 走 [全量接入 Note](../../archived/architecture/2026-07-30-client-locale-full-rollout.md) 的 label thunk。SlotMap 类型分家：trigger/header/close/section 正家在 ui-settings 约定（消费方 general/models 均依赖壳，无环）；`settings.general.item` 正家在 locale 包——它是全部 item 注册方的最低公共依赖（设置行必带文案），而声明方 general 的约定对 locale/ui-theme 不可达（会成环）；ui-theme 经 re-export 出口消费。
-
-### slot 声明是一等可注入等待对象
-
-`SlotRegistry.inject()` 直接等待有类型约束的 ledger key；它不会将声明桥接为合成的 `slot:` Cordis 服务。回调会跟随声明折叠与重新声明，而其控制器仍归贡献方插件 fiber 所有；直接向未声明 slot 注册仍会直接报错。这删除了基于陈旧 disposer 的在位状态机，以及容易因拼写错误出错的平行服务命名空间。完整的生命周期与失败约定见 [slot 声明注入决策](../../archived/architecture/2026-08-05-slot-declaration-injection.md)。
-
-### 服务约定
-
-```ts
-export type ThemePreference = 'light' | 'dark' | 'system'
-
-export interface ThemeDefinition {
- id: string
- colorScheme: 'light' | 'dark'
- tokens: Record
-}
-
-export interface ThemeSnapshot {
- preference: ThemePreference
- active: ThemeDefinition // system 已解析为具体 light/dark 定义
- themes: readonly ThemeDefinition[]
- revision: number
-}
-
-export interface LocaleDefinition {
- id: 'zh' | 'en'
- label: string
-}
-
-export interface LocaleSnapshot {
- active: 'zh' | 'en'
- locales: readonly LocaleDefinition[]
- revision: number
-}
-
-export interface Events {
- /** @param snapshot - Current locale registry snapshot. @mode emit */
- 'locale/change'(snapshot: LocaleSnapshot): void
- /** @param snapshot - Current theme registry snapshot. @mode emit */
- 'theme/change'(snapshot: ThemeSnapshot): void
-}
-```
-
-Locale 内置中文和 English；`setLocale`/`setTheme` 是唯一写入口，未知 id 失败。
-
-## 曾考虑的替代方案
-
-**由 app shell 统一订阅偏好并重渲染 root slot tree。** 语言和主题变化只需要更新实际消费方；全树刷新放大影响面，也把业务偏好接入 shell。
-
-**Theme 服务直接修改 DOM。**注册表服务因此依赖呈现环境，生命周期与全局样式所有权不清；Layout 已经拥有页面根呈现边界。
-
-**system 由 Layout presenter 解析。** presenter 需自带 matchMedia 订阅并在 themes 列表里挑选具体定义，呈现层被迫理解偏好语义；解析放服务侧则所有消费方拿到一致的已解析快照。
-
-**Settings import 并枚举各 section。** 新增页面必须修改壳插件，破坏「每个功能由自己的插件占用 slot」的组合模型。
-
-**按功能为每个 section 单开 `ui-settings-*` 卫星包。** 设置面与功能本体分家：改 Theme 行为要动两个包，包数随设置项线性膨胀，且卫星包反向依赖 locale/theme 服务，形成纯粹为拆包而生的中间层。功能属主自注册下不存在这层：preference 行随功能包交付；`ui-settings-general` 只收无主文案（chrome 与 General 骨架），不承载任何功能的设置面。
-
-**把 Locale/Theme 快照直接注入 React。** inject 结果按 entry identity 缓存，易变值会陈旧；为每个服务自造 React 钩子也绕开 slot store 的统一绑定。
-
-## 验收标准
-
-- Settings 壳只依赖 slot ledger，不依赖任一功能实现；General 的 item 列表同样只依赖 ledger。
-- 新增一个设置项 = 功能包自己注册（section 或 general item），零壳改动。
-- Locale 与 Theme 的写入只走 setter，持续同步只走变更事件。
-- 功能行 store 初始化走 getter，后续由自家变更事件更新并局部重渲染。
-- Layout 独立应用 Theme 快照，Theme 服务不访问 DOM；presenter 不出现 system 分支。
-- 中文/English 与 Light/Dark/System 能切换并刷新后恢复；偏好为 system 时系统配色变化即时生效。
-- Models 只有导航项与空内容区；Permission、Tool Call 骨架无写操作。
-- 浮层经 close 按钮、遮罩点击、ESC 均可关闭。
-
-## 风险
-
-slot 声明与 contribution 的 apply 顺序不固定，所有 section/item 注册方必须使用 `ctx.slots.inject()`，而不能以服务或本地 disposer 作为在位信号。service event 可能早于行首次渲染，功能行 store 的 init 与 inject attach 都必须从 getter 对齐当前快照。`settings.general.item` 的重复合并副本（locale、ui-theme）与 ui-settings 正家必须逐字一致，漂移即三处一起改。Layout 卸载时必须清理自己设置的全局属性，ThemeRuntime dispose（资源释放）时必须移除 matchMedia 监听，避免 HMR（热模块替换）后残留。
diff --git a/.agents/notes/rejected/architecture/2026-08-08-cordis-web-dynamic-packages.i18n.yaml b/.agents/notes/rejected/architecture/2026-08-08-cordis-web-dynamic-packages.i18n.yaml
deleted file mode 100644
index ede08a7406..0000000000
--- a/.agents/notes/rejected/architecture/2026-08-08-cordis-web-dynamic-packages.i18n.yaml
+++ /dev/null
@@ -1,73 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-08-cordis-web-dynamic-packages.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/rejected/architecture/2026-08-08-cordis-web-dynamic-packages.md
-/agent-note-cordis-host-client-dynamic-plugin-runtime:
- en: f89118c354fe715d
- zh: dcee1e4dd9bbb250
-/agent-note-cordis-host-client-dynamic-plugin-runtime/problem:
- en: 19617f888995a1ec
- zh: e4abb5efa2b77571
-/agent-note-cordis-host-client-dynamic-plugin-runtime/proposal:
- en: 986dd8097aac4d3d
- zh: 986dd8097aac4d3d
-/agent-note-cordis-host-client-dynamic-plugin-runtime/proposal/core-principles:
- en: 400bacbc13cc4ca2
- zh: efb84f4257ebf13c
-/agent-note-cordis-host-client-dynamic-plugin-runtime/proposal/package-responsibilities-and-dependency-direction:
- en: 60b7a0c8880e579c
- zh: d85388f9e9d34589
-/agent-note-cordis-host-client-dynamic-plugin-runtime/proposal/domain-objects:
- en: fb29437ba7cc624a
- zh: 2c2322991e282f7c
-/agent-note-cordis-host-client-dynamic-plugin-runtime/proposal/domain-objects/plugin:
- en: 84d17d0aa91fa20c
- zh: 354cf1a6531e2353
-/agent-note-cordis-host-client-dynamic-plugin-runtime/proposal/domain-objects/package:
- en: 950f4e014a7fa6df
- zh: 9641809a80ddbb9f
-/agent-note-cordis-host-client-dynamic-plugin-runtime/proposal/domain-objects/plugin-run:
- en: f5cc71352e3f2eea
- zh: 6933e78a031bb3e1
-/agent-note-cordis-host-client-dynamic-plugin-runtime/proposal/domain-objects/version-pointers:
- en: 0d17a946a46eb645
- zh: 0d82d5287cd227af
-/agent-note-cordis-host-client-dynamic-plugin-runtime/proposal/host-authority-and-persistence:
- en: 02a605a63f0b9d06
- zh: 3918b603de86ad4b
-/agent-note-cordis-host-client-dynamic-plugin-runtime/proposal/define-run-and-version-switching:
- en: dce63bf4526ae240
- zh: 32898ea25290fd35
-/agent-note-cordis-host-client-dynamic-plugin-runtime/proposal/client-approval-and-authorization:
- en: d3c874acd464c5da
- zh: 04ffde8db6a0daa9
-/agent-note-cordis-host-client-dynamic-plugin-runtime/proposal/client-activation-orchestration:
- en: 58708703b5069952
- zh: c378e4398b8d8063
-/agent-note-cordis-host-client-dynamic-plugin-runtime/proposal/package-private-client-to-host-communication:
- en: 02f6557f8f3f1155
- zh: 33e2f26f371f20b6
-/agent-note-cordis-host-client-dynamic-plugin-runtime/proposal/dynamic-code-guard-and-lifecycle:
- en: 601f8cc278c10286
- zh: 31aa97d5c66b086c
-/agent-note-cordis-host-client-dynamic-plugin-runtime/proposal/inspect-providers-and-catalogs:
- en: 8febbabca425cce7
- zh: 078461769a69719f
-/agent-note-cordis-host-client-dynamic-plugin-runtime/proposal/model-guidance-layers:
- en: 879ad6fef8ca4ae7
- zh: 38ec8d838628bacd
-/agent-note-cordis-host-client-dynamic-plugin-runtime/proposal/pluginid-and-tool-ui:
- en: 03c501a6503961fc
- zh: 4e5b6633a393f8ca
-/agent-note-cordis-host-client-dynamic-plugin-runtime/proposal/errors-and-model-feedback:
- en: ec2d9dedbe2cd9d5
- zh: 005260a95cda020c
-/agent-note-cordis-host-client-dynamic-plugin-runtime/alternatives-considered:
- en: ef5f387f4019d7ad
- zh: 4d5da887bafc5f22
-/agent-note-cordis-host-client-dynamic-plugin-runtime/acceptance-criteria:
- en: 3a4b3100f19377d6
- zh: c36d31e04f7d4b2d
-/agent-note-cordis-host-client-dynamic-plugin-runtime/risks:
- en: 3ec21c3758ab98a8
- zh: e949a28f8e38042c
diff --git a/.agents/notes/rejected/architecture/2026-08-08-cordis-web-dynamic-packages.md b/.agents/notes/rejected/architecture/2026-08-08-cordis-web-dynamic-packages.md
deleted file mode 100644
index e6c7b91351..0000000000
--- a/.agents/notes/rejected/architecture/2026-08-08-cordis-web-dynamic-packages.md
+++ /dev/null
@@ -1,270 +0,0 @@
-# Agent Note: Cordis Host/Client Dynamic Plugin Runtime
-
-Status: rejected — closed as a proposal: the shipped packages/extensions runtime and its READMEs own the design
-
-English | [中文](2026-08-08-cordis-web-dynamic-packages.zh.md)
-
-## Problem
-
-The model needs to extend the current DSH process temporarily without modifying repository source, rebuilding the application, or refreshing the browser. An extension may run in the Host Node.js process, in a Client browser page, or as one plugin whose Host half retrieves data and whose Client half presents it.
-
-This capability cannot be limited to “execute some code.” Before writing code, the model needs to discover the Services, Events, Builtins, Slots, and theme tokens available on both platforms. The user needs to preview the code before deciding whether Client code may enter the page. A single plugin needs immutable versions, retries after failure, and rollback. Asynchronous runtime errors need to return to the model instead of remaining only in server logs or the browser console.
-
-Combining definition, approval, execution, version switching, capability discovery, and UI state into one action creates states that cannot be explained consistently: whether a successful definition also means a successful run; which version remains successful after a failed update; how long a Tool should wait when no page responds; which historical card owns the business UI after the same Package runs multiple times; and whether page-local Client load state can represent process-wide Host state.
-
-## Proposal
-
-### Core principles
-
-- The Host is the sole process-wide authority for Plugins, Packages, Runs, approvals, and version pointers.
-- The Client stores only the current page's approval interaction, load results, Slot contributions, business views, and page-local errors.
-- Define creates only immutable code versions; Run activates only a defined version.
-- A version switch commits `currentPackageId` only after the target Package completes its required Host/Client activation.
-- Before writing code, the model queries capabilities through Inspect Providers. Inspect results assist coding and are not plugin runtime business data.
-- Dynamic Host and Client code both use restricted plain JavaScript contexts and attach reversible side effects to the Cordis lifecycle.
-- Client code requires user authorization before entering a page. Authorization may cover one Package or future versions of the same Plugin.
-- Tool calls do not wait for approval or browser operations that may occur only after the current turn ends. State stores and model steering report asynchronous outcomes.
-
-### Package responsibilities and dependency direction
-
-Four packages under `packages/self-modification/` implement the dynamic runtime:
-
-| Package | npm package | Responsibility |
-| --- | --- | --- |
-| `tool-cordis` | `@deepseek-ai/dsh-tool-cordis` | Registers the System Prompt, seven model-facing Tools, Host Inspect Providers, `@pluginId` context injection, and Tool presentation metadata |
-| `cordis-host-runner` | `@deepseek-ai/dsh-cordis-host-runner` | Stores the authoritative Registry, allocates IDs, executes Host code, and manages versions, approvals, Runs, private handlers, Inspect routing, and model feedback |
-| `cordis-client-runner` | `@deepseek-ai/dsh-cordis-client-runner` | Synchronizes Inspect manifests in the browser, orchestrates approved Host→Client activation, evaluates Client code, and manages the Guard, Loader/Fiber, timer, styles, and teardown |
-| `ui-cordis` | `@deepseek-ai/dsh-client-ui-cordis` | Renders Define/Run Tool cards, the global Cordis panel, approval controls, version selection, runtime status, and Package-specific business views |
-
-`tool-cordis` depends only on the Host Runner's in-process service and does not import the Client implementation. `ui-cordis` consumes only the Client Runner face and Client-safe wire types and does not import the Host implementation. Existing generated Remote APIs and forwarded events connect Host and Client runtime control; the gateway owns no dynamic Plugin domain logic.
-
-### Domain objects
-
-#### Plugin
-
-A Plugin is a dynamic plugin instance that can be modified over time. It is identified by the branded type `CordisDynamicPluginId`, for example `clock-1`. When creating a Plugin, the model submits only a semantic prefix of 3 to 6 lowercase English letters; the Host appends a process-unique numeric suffix. The model cannot specify the complete `pluginId`.
-
-A Plugin belongs to the Session that defined it. Model-facing Tools can read and operate only Plugins from the current Session. The global Client panel can list Plugins from all Sessions, but each action still executes under the owner Session carried by that row.
-
-#### Package
-
-A Package is an immutable code version under a Plugin. It is identified by `CordisDynamicPackageId`, for example `pkg-2`. It contains a name, a purpose, optional Host code, and optional Client code, with at least one code half present. Every `cordis_define` creates a new Package; an existing Package cannot be modified in place.
-
-One Plugin may own multiple Packages, but at most one physical Run may exist at a time. Whether a Package contains a Host or Client half affects only its activation steps, not its version identity.
-
-#### Plugin Run
-
-A Plugin Run is one concrete activation attempt. It is identified by `CordisDynamicPluginRunId`, for example `run-3`. Every new activation attempt receives a new ID, including an attempt that fails after approval, a retry of the same Package, and a version update. `pluginRunId` associates approval, Host activation, Client loading, private RPC, Tool cards, and errors with the same attempt.
-
-The Host stores the current physical Run separately from `latestRun`. The physical Run is the activation that can currently receive calls and be torn down. `latestRun` records the approval, phase, status of both halves, and diagnostics for the most recent attempt. A failed attempt may leave no live physical Run while remaining available for inspection.
-
-#### Version pointers
-
-- `currentPackageId` is the most recent Package to complete its required activation flow. Stopping the plugin, beginning an update, or failing an update does not clear it.
-- `nextPackageId` is the target Package that is awaiting approval, activating, awaiting a Client, or most recently failed. It is cleared after the target succeeds and is committed as current.
-
-A Host-only Package commits current after the Host successfully establishes its Fiber. A Client-bearing Package commits current after Host activation succeeds and at least one Client successfully establishes the corresponding load. A Fiber that Cordis parks as waiting because a hard dependency is absent is still a successfully established lifecycle object; it is not equivalent to a parse or `apply` failure.
-
-If an update target fails, the old physical Run is not restarted automatically. The previous `currentPackageId` continues to identify the last successful version, and the failed target remains `nextPackageId`. The user or model can retry next, or reactivate current with `mode: "run"` to roll back.
-
-### Host authority and persistence
-
-`DynamicCordisRunnerService` and its internal Registry are the sole authority in the current DSH process. They store:
-
-- each Plugin's Session ownership and immutable Package set;
-- `currentPackageId`, `nextPackageId`, the physical Run, and `latestRun`;
-- per-Package authorization and cross-version Plugin authorization;
-- pending Client activation requests;
-- Host Fibers, Package-private handlers, waiting Services, and recent diagnostics;
-- Host and Client Inspect Registry directories and query routing.
-
-These objects are not written to configuration or disk and are not restored after process restart. The Session Log may retain Tool calls, results, and metadata needed by cards, but it does not replay dynamic code to restore the Registry. Historical cards remain in the conversation after a restart, but their original `pluginId` and `packageId` are no longer runnable.
-
-Runtime state is not written to Session projection as recoverable state. Refreshing a page or opening a new page does not automatically restore Client halves; automatic restoration would reintroduce connection identity, startup baselines, and cross-page consistency protocols, which are outside this design.
-
-### Define, Run, and version switching
-
-`cordis_define` has two modes: creating a Plugin submits `idPrefix`, while modifying an existing Plugin submits its exact `pluginId`. Code always uses `code: { host?, client? }`. Define validates arguments and plain JavaScript syntax, records immutable source, and returns the final IDs. It does not execute `apply`, create approval, change version pointers, or run implicitly.
-
-There is no separate `cordis_update`. `cordis_run` expresses activation intent through `mode`:
-
-| Version relationship | `mode` |
-| --- | --- |
-| No `currentPackageId` exists | `run` |
-| Target equals current, including restart, retry, or rollback | `run` |
-| Target differs from an existing current | `update` |
-| Retry `nextPackageId` after a failed update | `update` |
-
-Run first validates Plugin/Package ownership, the version relationship, and whether another transition is in progress. It then creates `pluginRunId` and writes `latestRun` and `nextPackageId`.
-
-A Host-only Package completes Host activation within the Tool call and returns `running` or a failure synchronously. A Client-bearing Package does not wait for a browser outcome within the Tool call: without authorization it registers approval and returns `awaiting-approval`; with authorization it registers automatic Client activation and returns `starting`. Both results mean that the request exists, not that full activation succeeded.
-
-When target activation actually starts, the Host stops the old physical Run before executing the target Host half. Only after Host success may the Client fetch and load source for the exact `pluginRunId`. Client success commits the version pointers. Any failure is recorded against that attempt, without restarting the old version and presenting it as target success.
-
-`cordis_stop` tears down the current Host/Client Run and pending approval request while retaining the Plugin, Packages, authorization, and version pointers. `cordis_undefine` stops first and then deletes the Plugin, Packages, authorization, and version pointers; historical cards then show only that the Plugin was removed.
-
-### Client approval and authorization
-
-A Package containing Client code requires user authorization before its first activation because model-generated code will run in the user's page. The approval panel offers three actions:
-
-- A single check authorizes the current Package. Later runs of the same Package do not need approval, but a new Package does.
-- A double check authorizes future versions of the current Plugin. New Packages, updates, retries, and rollbacks no longer require per-version approval.
-- Reject ends the current request without executing Host or Client code. The model must not immediately request approval again unless the user asks for it.
-
-Authorization is written to the Host Registry when the user allows it and remains even if a later technical step fails. When the panel runs a Package directly, the user's click itself authorizes that Package.
-
-A row awaiting approval shows only per-Package allow, cross-version allow, and reject; it does not simultaneously offer run, stop, or delete. The panel expands automatically when new approval appears. If auto-expansion fails or the panel is collapsed, the fixed entry and row status still show the pending approval count and state.
-
-### Client activation orchestration
-
-The Host sends Client activation requests through `cordis/request-run`. A request includes only request identity, Session, Plugin, Package, mode, name, purpose, and whether approval is required; it does not broadcast source code.
-
-An authorized page executes the following fixed sequence:
-
-1. Call `runHostHalf` to start the target Host half or bind to the same attempt's already-started Host Run.
-2. After Host success, call `getClientCode` with `pluginId + pluginRunId` to retrieve only the exact current Run's Client source.
-3. The Client Runner evaluates the plugin in the page, establishes its Loader entry/Fiber, and installs its Guard, styles, Slots, and page-local state.
-4. The page reports success, waiting, or failure through `resolveRequestRun` or `settleUserRun`.
-5. The Host accepts the report only for the still-current exact Run, commits current or saves diagnostics, and broadcasts request completion so other pages clear their activities.
-
-Host activation precedes Client activation so that the Client does not start before required Host handlers exist. A page may tear down the Host Run after Client failure only when that request created the Host Run; a page that merely bound to an existing Run does not own it.
-
-The Client Orchestrator stores pending approvals and active orchestration by `pluginId`, so one Plugin cannot run two page activations concurrently. Host inventory can reconstruct omitted pending-approval items and approval-free automatic activation requests.
-
-Client load state is a page-local fact. An active Host does not mean that the current page loaded the Client half. The UI has three primary states: gray “Ready” when no physical Run exists, yellow “Client ready to activate” when the Host runs but the current page has not successfully loaded the Client, and green “Running” when both halves are available in the current page. Approval and failure appear as additional states.
-
-This version does not establish per-connection identity or multi-page quorum. The first still-valid Client success may commit process-wide current; each page's store independently records whether that page loaded the Client.
-
-### Package-private Client-to-Host communication
-
-A dynamic Package uses a private JSON channel for Client-to-Host calls: the Host registers methods for the current Run with `harness.handle(method, handler)`, and the Client calls them with `host.call(method, args)`. Every call is associated with `pluginId + pluginRunId`, and the Host rejects stopped or stale Runs. Arguments and return values must be lossless JSON; functions, React elements, Contexts, Service instances, and class objects are forbidden.
-
-This channel serves only Client-to-Host calls within the same Package. It does not use public Remote Services or `ctx.remote` in dynamic code. The public Remote interface carries only the Runner's own control protocol and does not expose dynamic Packages.
-
-### Dynamic code, Guard, and lifecycle
-
-Host and Client both execute only plain JavaScript function bodies, without TypeScript, JSX, or bundler transformation. The Host executes in `node:vm`; the Client evaluates in a restricted closure. These contexts reduce misuse and provide instructional errors, but they are not security boundaries against malicious code.
-
-By default, the model reads an optional Service through `ctx.get('serviceName')` and checks for `undefined`. A plugin object declares `inject` only when the Service is a hard dependency whose absence must park the Package and whose later arrival must reactivate it. Direct `ctx.serviceName` access is allowed only when the same plugin declares the corresponding inject.
-
-Host and Client `timer` are same-named Cordis Services with the same interface, not global Builtins. A plugin that needs timers must declare `inject: ['timer']`; a timer created inside a React effect returns its disposer as cleanup.
-
-The current Fiber owns every registration and reversible side effect. Event listeners, Services, Tools, handlers, timers, Slots, styles, and theme overrides register through `ctx.effect()`, `ctx.on()`, or official APIs that return disposers. Stopping, updating, failure rollback, or undefining tears down both halves' contributions. Theme overrides are layered by source and return a disposer so unloading restores the previous theme values.
-
-Host, DSH, Cordis, and their Service instances, Event payloads, Slot props, Session/Conversation Snapshots, Tool state, and other runtime objects are internal live data. Dynamic code must not run `JSON.stringify`, `structuredClone`, recursive enumeration, full copying, or whole-object display on these objects or their descendants. It reads only leaf fields needed by the current task and constructs minimal owned data without Host references.
-
-### Inspect Providers and Catalogs
-
-Capability discovery uses three Tools: `cordis_inspect_list` lists Host/Client Provider manifests; `cordis_inspect_query` executes an explicit read-only query on the selected platform; and `cordis_inspect_self` queries the current Session's Plugins, Packages, source, version pointers, and runtime diagnostics.
-
-Host and Client each own a `CordisInspectRegistry`. A Provider registers a platform-unique ID, description, methods, input schemas, and output schemas. Provider methods are explicitly allowlisted queries, not arbitrary Service-method forwarding; the Registry has no layered target and does not automatically turn business Service methods into executable Inspect methods.
-
-The initial Providers are:
-
-| Platform | Provider.method | Data source |
-| --- | --- | --- |
-| Host / Client | `Service.listService` | Static Service Catalog for each platform |
-| Host / Client | `Event.listEvents` | Static Event Catalog for each platform |
-| Host / Client | `Builtin.listBuiltins` | Hand-maintained definitions beside the evaluator/Guard |
-| Host | `Tool.listTools` | Tool Registry actually visible to the current Agent |
-| Client | `Slots.listSubTree` | Static Slot Catalog plus the page's live subtree/occupants |
-| Client | `Theme.listTokens` | Read-only inspect export from ThemeService |
-
-When the Client Registry changes, it synchronizes the complete manifest to the Host without storing duplicate directories per Session. Host queries execute locally. For a Client query, the Host broadcasts a request ID and a page executes the local Provider and responds. The Host accepts only the first successful result that passes output-schema validation; a failed page does not settle the request. If no page succeeds, the Tool remains pending until a later success or Tool-call cancellation.
-
-Inspect data is used only before code is written to confirm capabilities, signatures, types, and mounting protocols. A plugin that needs runtime business data calls the actual Service or listens to the actual Event; it must not cache, display, or depend on Inspect/Catalog results.
-
-`CordisCatalogProjector` generates Host and Client Service and Event Catalogs separately through TypeRT. The Slot AST generator scans `SlotMap`, registration options, standard props, owner props, and referenced types; the Slots Provider merges the static Catalog with the live tree at query time. ThemeService exports theme tokens, Builtins are maintained manually beside the evaluator/Guard, and Tool schemas come from the Registry.
-
-Catalog generation scans real source signatures and then applies a model-visible allowlist. The allowlist may hide Services, members, `@deprecated` APIs, Runner-owned Services, and `cordis/*` control Events, but it must not rewrite method names, parameters, or return types for the remaining APIs. Guard may reject arguments, fix sources, or hide members, but it must respect source signatures.
-
-Model-visible owner JSDoc requires only a complete description, `@param` for every parameter, `@returns` for every non-void return, `@mode` for Events, and descriptions for Slot/props fields. Usage recommendations, counterexamples, and cross-capability choices belong in the Skill rather than duplicated Catalog example fields.
-
-### Model guidance layers
-
-Model guidance has four layers:
-
-- The System Prompt carries the stable runtime model, restrictions of both platforms, lifecycle, approval, version pointers, minimum code rules, and a usage map for the seven Tools. It still supports a minimally correct implementation when the Skill is unavailable.
-- The `cordis-plugin-development` Skill carries requirement navigation, capability composition, recommendations, and counterexamples without copying complete schemas.
-- Each Tool description states only that action's prerequisites, parameter semantics, synchronous or asynchronous result, and next step.
-- Provider/Catalog results supply current exact names, signatures, parameters, Slot props, tokens, and runtime query results.
-
-The System Prompt requires loading the Skill first, then listing/querying capabilities, and only then defining/running code. React examples in the Skill register into a Slot instead of returning a React Element directly from `apply()`. Examples use `React.createElement`, correct `ctx.get()`/`inject`, reversible effects, and minimal JSON RPC.
-
-### `@pluginId` and Tool UI
-
-The input system registers an `@pluginId` mention for the current Session. Selecting it injects only Plugin identity, the default baseline Package, version pointers, the active Run, and the latest status, not source code. The default baseline is selected in order from next, current, and the most recently defined Package. The model must read source through `cordis_inspect_self` before appending a Package in existing mode; an invalid mention must not silently create a replacement Plugin.
-
-The `cordis_define` card presents Host and Client code in two tabs. A `cordis_run` card associates with one exact attempt through `pluginRunId` and reads the Client store to show pending approval, Client ready to activate, running, failed, replaced by a later Run, or Plugin removed.
-
-A Package may register `key: "self"` into `tool.view.cordis`. At runtime, self binds to `pluginId + packageId`; the business Slot key omits `pluginRunId`, while owner props still provide the exact Run identity. The newest Run card for a Package owns the business UI, and earlier cards show that a newer Run exists. Cards react to store changes rather than scanning later Session Log entries or notifying one another.
-
-The global Cordis panel has one fixed entry and groups rows by current and other Sessions. Its title and collapse action remain fixed while only the list scrolls. A normal row can select a Package and run, stop, or delete it. A failed update can retry next or select current to roll back. A pending-approval row exposes only the two allow actions and reject.
-
-### Errors and model feedback
-
-Technical errors crossing Host and Client preserve the original `message` and preserve `stack` when the error object provides it. Structured diagnostics include `pluginId`, `packageId`, `pluginRunId`, and one phase: approval, host-load, host-apply, client-load, client-apply, or client-render.
-
-Host and Client Guards, Host evaluation and handlers, Client evaluation and apply, Slot `onEntryError`, and React ErrorBoundary all return errors to the owning Agent. The Client console also prints the original error object through `console.error`. A rendering error belongs to the exact Run and does not contaminate the immutable Package.
-
-After a model-initiated asynchronous Run succeeds, is rejected, or fails technically, `agent.steer` wakes the owning Agent. A technical failure requires the model to read diagnostics, correct the same Plugin, and retry autonomously. A user rejection forbids an automatic repeat request. A user's manual run, stop, or removal in the panel is supplied through context injection to the next step without waking the model proactively.
-
-## Alternatives considered
-
-**Combine Define and Run.** This removes the previewable “defined but not running” state and mixes syntax errors, approval, runtime errors, and retries into one action. The design therefore uses immutable Define and independent Run actions.
-
-**Use Package ID as Plugin ID.** A single-level ID cannot append immutable versions beneath a stable instance; updates would require stop, undefine, and a new define, while historical cards and `@` references could not retain object identity. The design therefore uses separate Plugin, Package, and Run identities.
-
-**Provide a separate `cordis_update`.** Update has the same loading, approval, UI, diagnostics, and execution semantics as Run, so a separate Tool would duplicate the protocol. It is represented by `cordis_run mode:"update"`.
-
-**Automatically restore the old physical Run after an update failure.** Automatic restoration combines “target failed” and “old version succeeded again” into one result. The design retains the old current pointer without restarting it, so the user explicitly chooses to retry next or run current.
-
-**Block `cordis_run` until user approval and the final Client outcome.** Approval or page interaction may only occur after the current model turn ends. Blocking would deadlock and occupy the Tool indefinitely when no page exists. The Tool returns immediately, while stores, Inspect, and steering report the final outcome.
-
-**Broadcast source from the Host and wait for Client acknowledgements with a timeout.** Broadcasting sends source to every page before authorization. A timeout cannot distinguish no page, a slow page, and no user action, and the Host would need compensating rollback. The protocol broadcasts only metadata, and an authorized page fetches source for the exact Run.
-
-**Automatically restore every Host-active Package when a page starts.** This requires connection identity, a startup baseline, and cross-page consistency. The design accepts page-local Client state and lets the user load again from the panel.
-
-**Connect Package halves through public Remote Services or `ctx.remote`.** This exposes dynamic Packages through the product RPC interface. Package-private `harness.handle`/`host.call` is sufficient for Client-to-Host JSON calls and rejects stale requests by `pluginRunId`.
-
-**Expose every Service method automatically as an Inspect query.** This turns capability discovery into a business-call proxy that bypasses plugin approval and lifecycle. Providers expose only curated read-only queries; the Service Catalog only describes business method signatures.
-
-**Put the complete API in the System Prompt or Skill.** Static text drifts and consumes context. The System Prompt retains stable rules, the Skill provides requirement navigation, and Provider/Catalog results return exact signatures and runtime directories.
-
-**Require Slot owners to register props schemas at runtime.** Slot props already exist in TypeScript types and JSDoc, so duplicate registration creates a second authority. The Slot AST Catalog extracts the static protocol and only merges the live tree at query time.
-
-**Write runtime state to the Session Log and restore it during replay.** Dynamic code and Fibers are process-local objects. Restoration would require re-executing historical code and reinterpreting approval. The Session retains only model-visible records; the Registry and page Runs are not restored.
-
-**Make historical Run cards scan later Session Log entries.** This couples Tool views to the complete log order and later message structure. The page card index/store already tells cards by Package when a later Run replaces them or their Plugin is deleted.
-
-## Acceptance criteria
-
-- A new Plugin can be created only from a 3-to-6-character lowercase English prefix; final Plugin, Package, and Run IDs are allocated by the Host and use branded types.
-- `cordis_define` validates only parameters and plain JavaScript syntax and returns an immutable Package; one Plugin can append versions while old source remains inspectable.
-- `cordis_run` strictly validates run/update; Host-only activation completes synchronously, while a Client-bearing activation returns `awaiting-approval` or `starting` without waiting for the final browser outcome.
-- A single check authorizes only the current Package, and a double check authorizes future versions of the same Plugin. Authorization survives technical failure, while rejection executes neither half.
-- The Host activates first and the Client then fetches source for the exact Run. A Client-bearing Package does not commit current before Client success, and current/next permit retry and rollback after failure.
-- One Plugin has at most one physical Run at a time. Stop tears down both halves while retaining definitions and pointers; undefine deletes every Package, authorization, and state.
-- The current page distinguishes “Ready,” “Client ready to activate,” and “Running,” and a pending-approval row shows only approval actions.
-- `tool.view.cordis` self binds Plugin + Package. The newest Run card for a Package exclusively owns its business UI, while old cards and deleted Plugins have explicit fallback states.
-- Host and Client Guards reject imports, JSX, undeclared Services, and unavailable globals. Services, timers, Slots, styles, Tools, handlers, and theme overrides are torn down with the Run.
-- Package-private RPC permits only lossless JSON from Client to Host and rejects a stale `pluginRunId`.
-- Inspect list returns Host and Client manifests together. Query calls only explicit read-only methods, and a Client query waits for the first schema-valid successful result or cancellation.
-- Service/Event Catalogs are generated per Host/Client and apply allowlists. `@deprecated` APIs, Runner-owned Services, and `cordis/*` control Events are hidden from the model; Slot query merges static props with the live subtree.
-- `cordis_inspect_self` returns layered Plugin lists, Package summaries, and exact source/diagnostics. `@pluginId` does not inject source and keeps updates in the same Plugin.
-- Asynchronous technical failures, Host handlers, Client Guards, and React rendering errors preserve message/stack and steer the owning Agent; user panel actions only inject context into the next step.
-- The System Prompt, Skill, Tool descriptions, and Provider/Catalog layers follow this Note. The Prompt remains sufficient to generate a minimally correct plugin if the Skill is unavailable.
-- Relevant workspaces pass `pnpm run build`; implementation adds Host/Client lifecycle, versioning, approval, Inspect, Guard, Tool-card, and real-application snapshot coverage.
-
-## Risks
-
-- **A process restart loses all dynamic objects.** Historical Tool cards remain, but the Registry is not restored; the user must define again.
-- **Multi-page state is not strongly consistent.** The first valid Client success may commit current while Client loading and rendering state still differs across pages. This version does not introduce connection identity, quorum, or page aggregation.
-- **Client Inspect may remain pending indefinitely.** The Host stores the latest manifest, but without a page successfully executing the Provider it cannot present stale data as a live result. If every page fails, the request waits until cancellation.
-- **Cross-version authorization expands trust.** A double check permits future Packages of the same Plugin without further approval. The UI must clearly distinguish per-Package and cross-version authorization.
-- **A failed update can leave current pointing to an old version that is not running.** Current identifies the last successful version, not the physical Run. UI, Inspect, and prompts must show active, current, and next together.
-- **Restricted contexts are not security sandboxes.** Host Services, files, commands, network access, and Client UI are real capabilities. Allowlists and approval reduce misuse but do not isolate malicious code.
-- **Catalogs, Guards, and source can drift.** Generators, allowlists, and owner JSDoc must be maintained together. Guard hiding rules must not create a second signature.
-- **Builtins require manual declarations.** React, harness, host, styles, and Context methods have no unified scannable source, so injection implementations and Provider definitions must share one maintenance location.
-- **Provider output schemas currently permit broad JSON.** The first version prioritizes Provider ownership, input validation, and Host/Client routing; output schemas can become narrower later.
-- **Host and Client Guards are parallel implementations.** Their available environments and Cordis type interfaces differ, so they remain separate. A shared specification should be extracted only if it removes code without obscuring security policy.
diff --git a/.agents/notes/rejected/architecture/2026-08-08-cordis-web-dynamic-packages.zh.md b/.agents/notes/rejected/architecture/2026-08-08-cordis-web-dynamic-packages.zh.md
deleted file mode 100644
index 269f0f279f..0000000000
--- a/.agents/notes/rejected/architecture/2026-08-08-cordis-web-dynamic-packages.zh.md
+++ /dev/null
@@ -1,270 +0,0 @@
-# Agent Note: Cordis Host/Client 动态插件运行体系
-
-Status: rejected — closed as a proposal: the shipped packages/extensions runtime and its READMEs own the design
-
-[English](2026-08-08-cordis-web-dynamic-packages.md) | 中文
-
-## Problem
-
-模型需要在不修改仓库源码、不重新构建应用、不刷新浏览器的前提下，临时扩展当前 DSH 进程。扩展既可能运行在 Host 的 Node.js 进程，也可能运行在 Client 浏览器页面，还可能由 Host 取数、Client 展示，共同组成一个插件。
-
-这项能力不能只是“执行一段代码”。模型需要在写代码前发现两端允许使用的 Service、Event、Builtin、Slot 和主题 token；用户需要先预览代码，再决定是否允许 Client 代码进入页面；同一个插件需要追加不可变版本、失败后重试或回退；运行后的异步错误需要回到模型，而不是只留在服务端日志或浏览器控制台。
-
-如果把定义、审批、运行、版本切换、能力发现和 UI 状态塞进一个动作，会产生无法稳定解释的状态：定义成功是否等于运行成功，升级失败后哪个版本仍是成功版本，页面没有响应时 Tool 应等待多久，同一个 Package 多次运行时哪张历史卡片承载业务 UI，以及 Client 页面局部装载状态是否能代表 Host 的进程级状态。
-
-## Proposal
-
-### 核心原则
-
-- Host 保存 Plugin、Package、Run、审批和版本指针的唯一进程级权威状态。
-- Client 只保存当前页面的审批交互、装载结果、Slot 贡献、业务视图和页面局部错误。
-- Define 只创建不可变代码版本；Run 只激活一个已定义版本。
-- 版本切换只有在目标 Package 完成要求的 Host/Client 激活后才提交 `currentPackageId`。
-- 模型写代码前通过 Inspect Provider 查询能力；Inspect 结果只辅助编码，不作为插件运行时业务数据。
-- Host 与 Client 动态代码都使用受限的 plain JavaScript 上下文，并把可撤销副作用挂到 Cordis 生命周期。
-- Client 代码进入页面前需要用户授权；授权范围可以是单个 Package，也可以是同一 Plugin 的后续版本。
-- Tool 调用不等待当前轮结束后才可能发生的审批或浏览器操作；异步结局通过状态存储和模型 steering 反馈。
-
-### 包职责与依赖方向
-
-动态运行体系由 `packages/self-modification/` 下四个包组成：
-
-| 包 | npm 包名 | 职责 |
-| --- | --- | --- |
-| `tool-cordis` | `@deepseek-ai/dsh-tool-cordis` | 注册 System Prompt、七个模型 Tool、Host Inspect Provider、`@pluginId` 上下文注入和 Tool 展示元数据 |
-| `cordis-host-runner` | `@deepseek-ai/dsh-cordis-host-runner` | 保存权威 Registry，分配 ID，执行 Host 代码，管理版本、审批、Run、私有 handler、Inspect 路由和模型反馈 |
-| `cordis-client-runner` | `@deepseek-ai/dsh-cordis-client-runner` | 在浏览器同步 Inspect manifest，编排审批后的 Host→Client 激活，求值 Client 代码，管理 Guard、Loader/Fiber、timer、样式和 teardown |
-| `ui-cordis` | `@deepseek-ai/dsh-client-ui-cordis` | 展示 Define/Run Tool 卡片、全局 Cordis 面板、审批控件、版本选择、运行状态和 Package 自定义业务视图 |
-
-`tool-cordis` 只依赖 Host Runner 的进程内服务，不导入 Client 实现。`ui-cordis` 只消费 Client Runner face 和 Client-safe wire 类型，不导入 Host 实现。Host 与 Client 的运行控制通过已有生成 Remote 面和转发事件连接，网关不拥有动态 Plugin 的领域逻辑。
-
-### 领域对象
-
-#### Plugin
-
-Plugin 是可持续修改的动态插件实例，由品牌类型 `CordisDynamicPluginId` 标识，例如 `clock-1`。新建 Plugin 时，模型只提交 3 至 6 位小写英文语义前缀；Host 添加进程内唯一数字后缀。完整 `pluginId` 不能由模型指定。
-
-Plugin 属于定义它的 Session。模型 Tool 只能读取和操作当前 Session 的 Plugin；全局 Client 面板可以列出所有 Session 的 Plugin，但每个动作仍使用该行携带的 owner Session 执行。
-
-#### Package
-
-Package 是 Plugin 下的不可变代码版本，由 `CordisDynamicPackageId` 标识，例如 `pkg-2`。它包含名称、用途、可选 Host 代码和可选 Client 代码，且至少包含一侧。每次 `cordis_define` 都创建新 Package；已有 Package 不允许原地修改。
-
-同一个 Plugin 可以拥有多个 Package，但同一时刻最多只有一个物理 Run。Package 是否含 Host 或 Client 半只决定激活步骤，不改变版本身份。
-
-#### Plugin Run
-
-Plugin Run 是一次具体激活尝试，由 `CordisDynamicPluginRunId` 标识，例如 `run-3`。每次新的激活尝试都会分配新 ID，包括审批后失败、重试同一 Package 和版本更新。`pluginRunId` 把审批、Host 激活、Client 装载、私有 RPC、Tool 卡片和错误关联到同一次尝试。
-
-Host 分开保存当前物理 Run 与 `latestRun`。物理 Run 表示此刻仍可调用和撤销的激活；`latestRun` 表示最近一次尝试的审批、阶段、两侧状态和诊断。一次失败可以没有存活的物理 Run，但仍留下可查询的 attempt。
-
-#### 版本指针
-
-- `currentPackageId` 是最近一次完成要求的激活流程的 Package。停止插件、开始更新或更新失败都不清除它。
-- `nextPackageId` 是正在等待审批、正在激活、等待 Client、或最近失败的目标 Package。目标成功提交为 current 后清除。
-
-Host-only Package 在 Host 成功建立 Fiber 后提交 current。包含 Client 的 Package 在 Host 激活成功且至少一个 Client 成功建立对应装载后提交 current。因硬依赖缺失而被 Cordis park 为 waiting 的 Fiber仍是成功建立的生命周期对象，不等同于解析或 `apply` 失败。
-
-更新目标失败时不自动重启旧物理 Run。旧 `currentPackageId` 继续表示最后成功版本，失败目标保留为 `nextPackageId`。用户或模型可以重试 next，也可以以 `mode: "run"` 重新激活 current 完成回退。
-
-### Host 权威状态与持久性
-
-`DynamicCordisRunnerService` 及其内部 Registry 是当前 DSH 进程内的唯一权威，保存：
-
-- Plugin 的 Session 归属和不可变 Package 集合；
-- `currentPackageId`、`nextPackageId`、物理 Run 和 `latestRun`；
-- 单 Package 授权与 Plugin 跨版本授权；
-- 待处理的 Client 激活请求；
-- Host Fiber、Package 私有 handler、等待中的 Service 和最近诊断；
-- Host 与 Client Inspect Registry 的目录和查询路由。
-
-这些对象不写入配置或磁盘，也不在进程重启后恢复。Session Log 可以保留 Tool 调用、结果和卡片所需元数据，但不会重放动态代码来恢复 Registry。进程重启后历史卡片仍可作为对话记录存在，原 `pluginId` 和 `packageId` 不再可运行。
-
-运行态不作为可恢复状态写入 Session projection。页面刷新或新页面打开不会自动恢复 Client 半；自动恢复会重新引入连接身份、启动期 baseline 和跨页面一致性协议，不属于当前设计。
-
-### Define、Run 与版本切换
-
-`cordis_define` 有两种模式：新建 Plugin 时提交 `idPrefix`；修改现有 Plugin 时提交精确 `pluginId`。代码统一为 `code: { host?, client? }`。Define 只校验参数和 plain JavaScript 语法，记录不可变源码并返回最终 ID。它不执行 `apply`、不产生审批、不改变版本指针，也不隐式运行。
-
-不提供独立 `cordis_update`。`cordis_run` 通过 `mode` 表达激活意图：
-
-| 版本关系 | `mode` |
-| --- | --- |
-| 尚无 `currentPackageId` | `run` |
-| 目标等于 current，包括重启、重试或回退 | `run` |
-| 目标与已有 current 不同 | `update` |
-| 更新失败后重试 `nextPackageId` | `update` |
-
-Run 先验证 Plugin/Package 归属、版本关系和是否已有转换在进行，再创建 `pluginRunId`、写入 `latestRun` 和 `nextPackageId`。
-
-Host-only Package 在 Tool 调用内完成 Host 激活，并同步返回 `running` 或失败。包含 Client 的 Package不在 Tool 调用内等待浏览器终局：未授权时登记审批并返回 `awaiting-approval`；已授权时登记自动 Client 激活并返回 `starting`。这两种返回都表示请求已建立，不表示完整激活成功。
-
-目标真正开始激活时，Host 先停止旧物理 Run，再执行目标 Host 半。Host 成功后才允许 Client 获取精确 `pluginRunId` 对应的源码并装载。Client 成功后 Host 提交版本指针；任何阶段失败都记录到该 attempt，不把旧版本重新启动伪装成目标成功。
-
-`cordis_stop` 撤销当前 Host/Client Run 及待审批请求，但保留 Plugin、Package、授权和版本指针。`cordis_undefine` 先停止，再删除 Plugin、Package、授权和版本指针；删除后历史卡片只显示“插件已移除”。
-
-### Client 审批与授权
-
-包含 Client 代码的 Package 在第一次激活前需要用户授权，因为它将在用户页面中运行模型生成的代码。审批面板提供三个动作：
-
-- 单勾允许当前 Package；同一 Package 后续重跑不再审批，新 Package 仍需审批。
-- 双勾允许当前 Plugin 的后续版本；新 Package、更新、重试和回退不再逐版本审批。
-- 拒绝结束当前请求，不执行 Host 或 Client 代码；模型不得在用户没有新要求时立即重复申请。
-
-授权在用户允许时写入 Host Registry，即使随后发生技术失败也保留。面板直接运行 Package 时，用户点击本身授权该 Package。
-
-待审批行只显示单次允许、跨版本允许和拒绝，不同时提供运行、停止或删除。发现新审批时面板自动展开；自动展开失败或被收起时，固定入口和行状态仍显示待审批数量与状态。
-
-### Client 激活编排
-
-Host 通过 `cordis/request-run` 发送 Client 激活请求。请求只包含请求身份、Session、Plugin、Package、mode、名称、用途和是否需要审批，不广播源码。
-
-获得授权的页面按固定顺序执行：
-
-1. 调用 `runHostHalf`，启动目标 Host 半或绑定同一次 attempt 已启动的 Host Run。
-2. Host 成功后，以 `pluginId + pluginRunId` 调用 `getClientCode`，只取得当前精确 Run 的 Client 源码。
-3. Client Runner 在页面求值插件，建立 Loader entry/Fiber，安装 Guard、样式、Slot 和页面局部状态。
-4. 页面调用 `resolveRequestRun` 或 `settleUserRun` 回报成功、waiting 或失败。
-5. Host 接受仍有效的精确 Run 回报，提交 current 或保存诊断，并广播请求结束，其他页面清理活动。
-
-Host 激活先于 Client，避免 Client 在所需 Host handler 尚未存在时启动。只有本次请求实际创建的 Host Run 才能因本页 Client 失败而撤销；只是绑定既有 Run 的页面没有其所有权。
-
-Client Orchestrator 按 `pluginId` 保存待审批和正在编排的活动，同一个 Plugin 不并发执行两次页面激活。Host inventory 可重建遗漏的待审批项和无需审批的自动激活请求。
-
-Client 装载状态是页面局部事实。Host active 不代表当前页面已装载 Client 半。UI 使用三种主要状态：无物理 Run为灰色“待激活”，Host 已运行但当前页面 Client 未成功装载为黄色“Client 待激活”，当前页面两侧可用为绿色“运行中”。审批中和失败作为额外状态显示。
-
-当前版本不建立 per-connection 身份或多页面法定人数。第一个仍有效的 Client 成功回报可以提交进程级 current；其他页面是否装载由各自页面 store 表示。
-
-### Package 私有 Client→Host 通信
-
-动态 Package 通过私有 JSON 通道从 Client 调用 Host：Host 使用 `harness.handle(method, handler)` 注册当前 Run 的方法，Client 使用 `host.call(method, args)` 调用。每次调用关联 `pluginId + pluginRunId`，Host 拒绝已停止或过期 Run。参数和返回值必须是无损 JSON，不允许函数、React 元素、Context、Service 实例或类对象。
-
-该通道只服务同一 Package 的 Client→Host 调用，不使用公开 Remote Service 或动态代码中的 `ctx.remote`。公开 Remote 面只承载 Runner 自己的控制协议，不向动态 Package 暴露。
-
-### 动态代码、Guard 与生命周期
-
-Host 和 Client 都只执行 plain JavaScript 函数体，不经过 TypeScript、JSX 或 bundler 转译。Host 运行在 `node:vm`，Client 在受限闭包中求值。两端上下文用于减少误用并提供教学错误，不是恶意代码安全边界。
-
-模型默认通过 `ctx.get('serviceName')` 读取可选 Service 并判断 `undefined`。只有 Service 是硬依赖、缺失时 Package 必须 waiting 并在 Service 出现后重新激活时，才在插件对象声明 `inject`。直接访问 `ctx.serviceName` 只在同一插件声明对应 inject 时允许。
-
-Host 与 Client 的 `timer` 都是同名 Cordis Service，使用一致接口，不是全局 Builtin。需要 timer 的插件必须声明 `inject: ['timer']`；React effect 中创建的 timer 把 disposer 作为 cleanup 返回。
-
-所有注册和可撤销副作用由当前 Fiber 拥有。Event listener、Service、Tool、handler、timer、Slot、样式和主题覆盖通过 `ctx.effect()`、`ctx.on()` 或返回 disposer 的官方 API 注册。停止、更新、失败回滚或 undefine 时撤销两端贡献。Theme override 必须按 source 分层并返回 disposer，使卸载后恢复此前主题值。
-
-宿主、DSH、Cordis 及其 Service、Event payload、Slot props、Session/Conversation Snapshot、Tool 状态和其他运行时对象是内部 live data。动态代码不得对这些对象或其子对象执行 `JSON.stringify`、`structuredClone`、递归枚举、全量复制或整体展示；只能读取当前任务所需叶子字段，构造不含宿主引用的最小自有数据。
-
-### Inspect Provider 与 Catalog
-
-能力发现分为三个 Tool：`cordis_inspect_list` 列 Host/Client Provider manifest；`cordis_inspect_query` 执行指定平台的显式只读查询；`cordis_inspect_self` 查询当前 Session 的 Plugin、Package、源码、版本指针和运行诊断。
-
-Host 和 Client 各自拥有 `CordisInspectRegistry`。Provider 注册平台内唯一 ID、说明、method、输入 schema 和输出 schema。Provider method 是显式白名单查询，不是任意 Service 方法透传；Registry 不维护分层 target，也不自动把业务 Service 方法变成可执行 Inspect method。
-
-首批 Provider 为：
-
-| Platform | Provider.method | 数据来源 |
-| --- | --- | --- |
-| Host / Client | `Service.listService` | 各平台 Service 静态 Catalog |
-| Host / Client | `Event.listEvents` | 各平台 Event 静态 Catalog |
-| Host / Client | `Builtin.listBuiltins` | evaluator/Guard 附近的手工定义 |
-| Host | `Tool.listTools` | 当前 Agent 真正可见的 Tool Registry |
-| Client | `Slots.listSubTree` | Slot 静态 Catalog与页面 live subtree/occupants |
-| Client | `Theme.listTokens` | ThemeService 的只读 inspect export |
-
-Client Registry 变化后向 Host 同步完整 manifest，不按 Session 保存重复目录。Host query 本地执行；Client query 由 Host 广播 request ID，页面调用本地 Provider 后回送。Host 只接受第一个通过输出 schema 校验的成功结果；失败页面不抢占请求。没有页面成功回答时 Tool 保持 pending，直到后续成功或 Tool call 取消。
-
-Inspect 数据只用于写代码前确认能力、签名、类型和挂载协议。插件运行时需要业务数据时必须调用实际 Service 或监听实际 Event，不能缓存、展示或依赖 Inspect/Catalog 返回值。
-
-`CordisCatalogProjector` 使用 TypeRT 分别生成 Host/Client Service 与 Event Catalog；Slot AST 生成器扫描 `SlotMap`、注册选项、standard props、owner props 和引用类型；Slots Provider 查询时合并静态 Catalog 与 live tree。Theme token 由 ThemeService 导出，Builtin 在 evaluator/Guard 附近手工维护，Tool schema 来自 Registry。
-
-Catalog 扫描真实源码签名，再应用 model-visible 白名单。白名单可以隐藏 Service、成员、`@deprecated` API、Runner 自身服务和 `cordis/*` 控制 Event，但不能改写剩余 API 的方法名、参数和返回类型。Guard 可以拒绝参数、固定来源或屏蔽成员，但必须尊重源码签名。
-
-模型可见 owner JSDoc 只要求完整 description、每个参数的 `@param`、非 void 返回的 `@returns`、Event 的 `@mode`，以及 Slot/props 字段说明。调用推荐、反例和跨能力选择放入 Skill，不在 Catalog 增加重复 example 字段。
-
-### 模型指导分层
-
-模型指导分为四层：
-
-- System Prompt 保存稳定运行模型、两端限制、生命周期、审批、版本指针、最低代码规范和七个 Tool 的使用地图。Skill 不可用时它仍须支持最低限度正确实现。
-- `cordis-plugin-development` Skill 保存需求导航、能力组合、推荐和反例，不复制完整 schema。
-- 每个 Tool description 只说明该动作的前置条件、参数语义、同步/异步结果和下一步。
-- Provider/Catalog 返回当前精确名称、签名、参数、Slot props、token 和运行时查询结果。
-
-System Prompt 要求先加载 Skill，再 list/query，之后 define/run。Skill 中 React 示例必须注册到 Slot，不能从 `apply()` 直接返回 React Element；示例使用 `React.createElement`、正确 `ctx.get()`/`inject`、可逆 effect 和最小 JSON RPC。
-
-### `@pluginId` 与 Tool UI
-
-输入系统为当前 Session 注册 `@pluginId` mention。选择后只注入 Plugin 身份、默认基准 Package、版本指针、活动 Run 和最近状态，不注入源码。默认基准依次选择 next、current、最近定义的 Package。模型必须先用 `cordis_inspect_self` 读取源码，再以 existing 模式追加 Package；引用失效时不能静默创建替代 Plugin。
-
-`cordis_define` 卡片以 Host/Client 两个子页签展示代码。`cordis_run` 卡片由 `pluginRunId` 关联精确 attempt，并读取 Client store 显示待审批、Client 待激活、运行中、失败、已被后续 Run 替代或 Plugin 已移除。
-
-Package 可以向 `tool.view.cordis` 注册 `key: "self"`。运行时把 self 绑定为 `pluginId + packageId`；业务 Slot key 不含 `pluginRunId`，但 owner props 仍提供精确 Run 身份。同一 Package 最新 Run 卡片承载业务 UI，更早卡片显示已有更新运行。卡片通过 store 响应变化，不扫描后续 Session Log，也不互相通知。
-
-全局 Cordis 面板使用一个固定入口，按当前会话和其他会话分组。面板标题和收起操作固定，只有列表滚动。普通行可选择 Package并运行、停止或删除；失败更新可重试 next 或选择 current 回退；待审批行只提供两个允许动作和拒绝。
-
-### 错误与模型反馈
-
-跨 Host/Client 的技术错误保留原始 `message`，并在错误对象提供时保留 `stack`。结构化诊断包含 `pluginId`、`packageId`、`pluginRunId` 和阶段：approval、host-load、host-apply、client-load、client-apply 或 client-render。
-
-Host/Client Guard、Host 求值与 handler、Client 求值与 apply、Slot `onEntryError` 和 React ErrorBoundary 都把错误回到 owning Agent。Client 控制台同时以 `console.error` 打印原始 error 对象。渲染错误属于精确 Run，不污染不可变 Package。
-
-模型发起的异步 Run 在成功、拒绝或技术失败后使用 `agent.steer` 唤醒 owning Agent。技术失败要求读取诊断、在同一 Plugin 修正并自主重试；用户拒绝则禁止自动重复申请。用户在面板手动运行、停止或移除通过 context injection 告知下一 step，但不主动唤醒模型。
-
-## Alternatives considered
-
-**Define 与 Run 合并。** 这会失去“已定义但未运行”的可预览状态，把语法错误、审批、运行错误和重试混成一个动作，因此拆为不可变 Define 和独立 Run。
-
-**Package ID 同时作为 Plugin ID。** 单层 ID 无法表达稳定实例下追加不可变版本，更新只能 stop、undefine、重新 define，历史卡片和 `@` 引用也无法保持同一对象，因此采用 Plugin、Package、Run 三层身份。
-
-**提供独立 `cordis_update`。** Update 的装载、审批、UI、诊断和 Run 相同，独立 Tool 只复制协议，因此合并到 `cordis_run mode:"update"`。
-
-**更新失败后自动恢复旧物理 Run。** 自动恢复会把“目标失败”和“旧版本重新成功”混成一个结果。当前设计保留旧 current 指针但不自动重启，让用户明确选择重试 next 或 run current。
-
-**让 `cordis_run` 阻塞到用户审批和 Client 终局。** 审批或页面操作可能只能在当前模型轮结束后发生，阻塞会形成死锁，并在无页面时无限占用 Tool。当前设计立即返回，通过 store、Inspect 和 steering 报告终局。
-
-**Host 广播源码并用超时等待 Client ack。** 广播会在授权前把代码发给所有页面；超时无法区分没有页面、页面慢和用户未操作；Host 还要维护补偿式回滚。当前协议只广播元数据，由获准页面按精确 Run 拉取源码。
-
-**页面启动时自动恢复所有 Host active Package。** 这要求连接身份、启动期 baseline 和跨页面一致性。当前设计接受页面局部 Client 状态，用户可在面板重新装载。
-
-**通过公开 Remote Service 或 `ctx.remote` 连接 Package 两半。** 这会把动态 Package 暴露到产品级 RPC 面。Package 私有 `harness.handle`/`host.call` 足以承载 Client→Host JSON 调用，并能按 `pluginRunId` 拒绝陈旧请求。
-
-**把所有 Service 方法自动暴露成 Inspect query。** 这会把能力发现变成业务调用代理，绕过插件审批和生命周期。Provider 只暴露策展的只读查询，Service Catalog 只描述业务方法签名。
-
-**把完整 API 写进 System Prompt 或 Skill。** 固化文本会漂移并占用上下文。System Prompt 保留稳定规则，Skill 负责需求导航，精确签名和运行时目录由 Provider/Catalog 返回。
-
-**要求 Slot owner 在运行时注册 props schema。** Slot props 已存在于 TypeScript 类型和 JSDoc 中，重复注册会制造第二份权威。当前设计用 Slot AST Catalog 提取静态协议，只在查询时合并 live tree。
-
-**把运行态写入 Session Log 并在 replay 恢复。** 动态代码和 Fiber 是进程局部对象，恢复要求重新执行历史代码并重新解释审批。Session 只保留模型可见记录，Registry 和页面 Run 不恢复。
-
-**让历史 Run 卡片扫描后续 Session Log。** 这会让 Tool view 依赖全量日志顺序和后续消息结构。页面 card index/store 已能按 Package 告知旧卡片被替代或 Plugin 被删除。
-
-## Acceptance criteria
-
-- 新 Plugin 只能由 3 至 6 位小写英文前缀创建，最终 Plugin、Package 和 Run ID 由 Host 分配并使用品牌类型。
-- `cordis_define` 只做参数和 plain JavaScript 语法检查，返回不可变 Package；同一 Plugin 可以追加版本，旧源码保持可 inspect。
-- `cordis_run` 严格校验 run/update；Host-only 同步完成，Client-bearing 返回 `awaiting-approval` 或 `starting`，不等待页面终局。
-- 单勾只授权当前 Package，双勾授权同一 Plugin 后续版本；授权在技术失败后仍保留，拒绝不执行两侧代码。
-- Host 先激活，Client 后取精确 Run 源码；Client 成功前不提交 Client-bearing Package 的 current，失败后 current/next 可用于重试和回退。
-- 一个 Plugin 同时最多一个物理 Run；stop 撤销两端贡献但保留定义和指针，undefine 删除全部 Package、授权和状态。
-- 当前页面能区分“待激活”“Client 待激活”和“运行中”，待审批时只显示审批动作。
-- `tool.view.cordis` 的 self 绑定 Plugin + Package；同 Package 最新 Run 卡片独占业务 UI，旧卡片和已删除 Plugin 有明确退化状态。
-- Host/Client Guard 拒绝 import、JSX、未声明 Service 和不可用全局；Service、timer、Slot、样式、Tool、handler 和主题覆盖随 Run teardown。
-- Package 私有 RPC 只允许 Client→Host 无损 JSON，并拒绝陈旧 `pluginRunId`。
-- Inspect list 一次返回 Host/Client manifest；query 只调用显式只读方法，Client 查询等待首个 schema-valid 成功结果或取消。
-- Service/Event Catalog 分 Host/Client 生成并应用白名单，`@deprecated` API、Runner 自身服务和 `cordis/*` 控制 Event 不向模型暴露；Slot query 合并静态 props 与 live subtree。
-- `cordis_inspect_self` 分层返回列表、Package 摘要和精确源码/诊断；`@pluginId` 不直接注入源码且更新留在同一 Plugin。
-- 异步技术失败、Host handler、Client Guard 和 React 渲染错误保留 message/stack 并 steering owning Agent；用户面板操作只注入下一 step context。
-- System Prompt、Skill、Tool description 和 Provider/Catalog 按本 Note 分层，Skill 不可用时 Prompt 仍足以生成最低限度正确的插件。
-- 相关工作区 `pnpm run build` 通过；实现阶段补齐 Host/Client lifecycle、版本、审批、Inspect、Guard、Tool 卡片与真实应用快照覆盖。
-
-## Risks
-
-- **进程重启丢失全部动态对象。** 历史 Tool 卡片仍在，但 Registry 不恢复；用户必须重新 define。
-- **多页面状态不是强一致系统。** 第一个有效 Client 成功结果可以提交 current，各页面的 Client 装载和渲染状态仍可能不同；当前不引入连接身份、法定人数或页面聚合。
-- **Client Inspect 可能长期 pending。** Host 保存最近 manifest，但没有页面成功执行 Provider 时不能用旧数据伪装 live 结果；多个页面都失败时请求等待到取消。
-- **跨版本授权扩大信任范围。** 双勾允许同一 Plugin 后续 Package 无需再次审批；UI 必须清楚区分单次和跨版本授权。
-- **失败更新可能留下 current 指向旧版本但旧版本未运行。** current 表示最后成功版本，不表示当前物理 Run；UI、Inspect 和提示必须同时展示 active、current 和 next。
-- **受限上下文不是安全沙箱。** Host Service、文件、命令、网络和 Client UI 都是真实能力；白名单与审批降低误用，不隔离恶意代码。
-- **Catalog、Guard 和源码可能漂移。** 生成器、白名单和 owner JSDoc 必须共同维护；Guard 的隐藏策略不能产生另一套签名。
-- **Builtin 依赖手工声明。** React、harness、host、styles 和 Context 方法没有统一可扫描入口，注入实现与 Provider 定义必须放在同一维护位置。
-- **Provider 输出 schema 当前允许较宽的 JSON。** 首版优先完成 Provider 所有权、输入校验和 Host/Client 路由；更窄的输出 schema 后续再收紧。
-- **Host 与 Client Guard 存在平行实现。** 两侧开放环境和 Cordis 类型面不同，当前保留各自实现；公共规格只有在能减少代码且不隐藏安全策略时再提取。
diff --git a/.agents/notes/rejected/process/2026-06-11-architectural-conformance.i18n.yaml b/.agents/notes/rejected/process/2026-06-11-architectural-conformance.i18n.yaml
deleted file mode 100644
index 0e5a8660a4..0000000000
--- a/.agents/notes/rejected/process/2026-06-11-architectural-conformance.i18n.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Bilingual-pair consistency record for 2026-06-11-architectural-conformance.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/rejected/process/2026-06-11-architectural-conformance.md
-/agent-note-architectural-conformance-dependency-rules-and-the-adapter-kit:
- en: 708fe0c94db3e25a
- zh: 07437d3cb67a9240
-/agent-note-architectural-conformance-dependency-rules-and-the-adapter-kit/problem:
- en: 2d5d19405f22920b
- zh: 8ca48379706cbe35
-/agent-note-architectural-conformance-dependency-rules-and-the-adapter-kit/proposal:
- en: 81d30d5657ece906
- zh: 1e7c61e5b9229ef6
-/agent-note-architectural-conformance-dependency-rules-and-the-adapter-kit/plan:
- en: 56bb9b7b97ba6bf5
- zh: 2e3f0a70ce391029
-/agent-note-architectural-conformance-dependency-rules-and-the-adapter-kit/acceptance-criteria:
- en: 2953797008c6c120
- zh: 42fd01df8a2a8f0b
-/agent-note-architectural-conformance-dependency-rules-and-the-adapter-kit/risks:
- en: 09eb0e6924573fe0
- zh: 60ca8648ec25afca
diff --git a/.agents/notes/rejected/process/2026-06-11-architectural-conformance.md b/.agents/notes/rejected/process/2026-06-11-architectural-conformance.md
deleted file mode 100644
index 631b032235..0000000000
--- a/.agents/notes/rejected/process/2026-06-11-architectural-conformance.md
+++ /dev/null
@@ -1,36 +0,0 @@
-# Agent Note: Architectural conformance — dependency rules and the adapter kit
-
-Status: rejected — premise gone: plugins depend on dsh-agent-loop by design; dsh-llm/invariant and the hygiene dependency gates own conformance
-
-English | [中文](2026-06-11-architectural-conformance.zh.md)
-
-## Problem
-
-Two architectural guarantees currently live only in prose: (1) nothing depends on the concrete loop package ([the microkernel promise](../../implemented/architecture/2026-06-11-microkernel-event-taxonomy.md)), and (2) every LlmAdapter speaks the chunk protocol correctly. Both should be mechanical ([the quality-gates principle](../../implemented/process/2026-06-11-quality-gates.md)).
-
-## Proposal
-
-**dependency-cruiser** with rules:
-
-- `packages/*` (except agent-loop's own tests and examples/) must not import `@deepseek-ai/dsh-agent-loop`.
-- No cross-package deep imports (`@deepseek-ai/dsh-*/src/...` paths) — public entry points only.
-- No import cycles anywhere in packages/.
-- `vendor/*` must not import from `packages/*`.
-- Layering: dsh-llm imports nothing from other dsh packages; dsh-session only dsh-llm; etc. (the dependency table in packages/README.md, enforced).
-
-**Adapter conformance kit** in dsh-llm (`@deepseek-ai/dsh-llm/conformance`): a reusable vitest suite parameterized by an adapter factory, asserting the chunk-protocol contract — index monotonicity per block, no deltas after `block-end` for an index, exactly one `finish`, usage at most once, every `tool-call-delta` carries the call id, abort honored promptly. Run it against the mocks now; the DeepSeek V4 adapter inherits it on day one. Optionally a dev-mode `strictAdapter()` wrapper enforcing the same at runtime behind a debug flag (pairs with [the dev-mode invariants](../../implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md)).
-
-## Plan
-
-dependency-cruiser config + CI step first (an hour of work, permanent guarantee); the conformance kit lands with its first consumer test against MockAdapter, and is a prerequisite for the V4 adapter phase.
-
-## Acceptance criteria
-
-- dependency-cruiser runs in CI with the rule families above; a violating import fails the build.
-- The conformance kit runs against the mock adapter and both shipping adapters, and a new adapter package inherits the suite by invoking it with its factory.
-
-## Risks
-
-Dep-cruiser rule maintenance as packages are added — keep rules pattern-based (`dsh-*`) rather than enumerated.
-
-
diff --git a/.agents/notes/rejected/process/2026-06-11-architectural-conformance.zh.md b/.agents/notes/rejected/process/2026-06-11-architectural-conformance.zh.md
deleted file mode 100644
index 74af5a377c..0000000000
--- a/.agents/notes/rejected/process/2026-06-11-architectural-conformance.zh.md
+++ /dev/null
@@ -1,36 +0,0 @@
-# Agent Note: 架构一致性——依赖规则与适配器套件
-
-Status: rejected — premise gone: plugins depend on dsh-agent-loop by design; dsh-llm/invariant and the hygiene dependency gates own conformance
-
-[English](2026-06-11-architectural-conformance.md) | 中文
-
-## 问题
-
-目前有两项架构保证仅存在于行文中：（1）没有任何组件依赖具体的 agent loop（智能体循环）包（[微内核承诺](../../implemented/architecture/2026-06-11-microkernel-event-taxonomy.zh.md)）；（2）每个 LlmAdapter 都正确遵循分片协议。二者都应由机制强制执行（[质量门禁原则](../../implemented/process/2026-06-11-quality-gates.zh.md)）。
-
-## 提案
-
-**dependency-cruiser** 配合以下规则：
-
-- `packages/*`（除 agent-loop 自身的测试和 examples/ 外）禁止导入 `@deepseek-ai/dsh-agent-loop`。
-- 禁止跨包深层导入（`@deepseek-ai/dsh-*/src/...` 路径）——只允许使用公开入口点。
-- packages/ 内禁止出现循环依赖。
-- `vendor/*` 禁止从 `packages/*` 导入。
-- 分层：dsh-llm 不导入其他 dsh 包；dsh-session 仅导入 dsh-llm；以此类推（packages/README.md 中的依赖表，强制执行）。
-
-**适配器一致性套件**位于 dsh-llm（`@deepseek-ai/dsh-llm/conformance`）：一个以适配器工厂为参数的可复用 vitest 套件，用于断言分片协议约定，包括每个块内的索引单调递增、某个索引出现 `block-end` 后不再接收增量、恰好出现一个 `finish`、用量至多出现一次、每个 `tool-call-delta` 都携带调用 id，并且及时响应 abort。当前先对 mock 运行；DeepSeek V4 适配器从第一天起继承该套件。还可以选择提供开发模式下的 `strictAdapter()` 包装层，在调试标志开启时于运行时强制执行相同规则（与 [开发模式不变式](../../implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.zh.md) 配对）。
-
-## 计划
-
-先落地 dependency-cruiser 配置与 CI 步骤（约一小时工作量，换来永久保证）；一致性套件随其首个消费方测试（针对 MockAdapter）一起落地，并作为 V4 适配器阶段的前置条件。
-
-## 验收标准
-
-- dependency-cruiser 在 CI 中运行上述规则族；违规导入导致构建失败。
-- 一致性套件对 mock 适配器和两个正式适配器运行，新适配器包通过调用该套件并传入自己的工厂即可继承测试。
-
-## 风险
-
-随着包的增加，dep-cruiser 规则需要维护——规则应基于模式（`dsh-*`）而非逐一枚举。
-
-
diff --git a/.agents/notes/rejected/process/2026-08-04-artifact-first-npm-baseline-publication.i18n.yaml b/.agents/notes/rejected/process/2026-08-04-artifact-first-npm-baseline-publication.i18n.yaml
deleted file mode 100644
index e0c297bfc5..0000000000
--- a/.agents/notes/rejected/process/2026-08-04-artifact-first-npm-baseline-publication.i18n.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-# Bilingual-pair consistency record for 2026-08-04-artifact-first-npm-baseline-publication.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/rejected/process/2026-08-04-artifact-first-npm-baseline-publication.md
-/agent-note-artifact-first-npm-baseline-publication:
- en: d0656ef5ec966473
- zh: 3d7930c502e0fa0a
-/agent-note-artifact-first-npm-baseline-publication/problem:
- en: 262109304a235ff0
- zh: 0399026e9afa9403
-/agent-note-artifact-first-npm-baseline-publication/proposal:
- en: e3324fac080bfa55
- zh: 89e385b4d37df216
-/agent-note-artifact-first-npm-baseline-publication/current-implementation-boundary:
- en: 49678acc335339b1
- zh: fdebfb169e49d34d
-/agent-note-artifact-first-npm-baseline-publication/publication-payload-contract:
- en: 6ad6a8829fe06538
- zh: 70e1507b7c85cb8a
-/agent-note-artifact-first-npm-baseline-publication/artifact-plane-integration-test:
- en: 129d1df710a8c8f7
- zh: 208002598644da1b
-/agent-note-artifact-first-npm-baseline-publication/publication-and-recovery:
- en: f45f84678f8184ae
- zh: 5f87157df6e828b5
-/agent-note-artifact-first-npm-baseline-publication/github-actions-integration:
- en: c376aca1e297c9d2
- zh: 2902f72e6d16e9ae
-/agent-note-artifact-first-npm-baseline-publication/alternatives-considered:
- en: d3b5794ac85b0a19
- zh: 222d054cbb7c8354
-/agent-note-artifact-first-npm-baseline-publication/acceptance-criteria:
- en: fc56f357e3ef7cc5
- zh: ba108d552935f6bc
-/agent-note-artifact-first-npm-baseline-publication/risks:
- en: 7939117bb1674385
- zh: 9768d75303b04bc1
diff --git a/.agents/notes/rejected/process/2026-08-04-artifact-first-npm-baseline-publication.md b/.agents/notes/rejected/process/2026-08-04-artifact-first-npm-baseline-publication.md
deleted file mode 100644
index 1c31717652..0000000000
--- a/.agents/notes/rejected/process/2026-08-04-artifact-first-npm-baseline-publication.md
+++ /dev/null
@@ -1,114 +0,0 @@
-# Agent Note: Artifact-first NPM baseline publication
-
-Status: rejected — superseded by 2026-08-10-npm-release-sequences: numbered versions and pack→protected publish shipped; timestamp versions were not adopted
-
-English | [中文](2026-08-04-artifact-first-npm-baseline-publication.zh.md)
-
-## Problem
-
-Runnable source in the monorepo does not prove that published packages are runnable. Workspace links, TypeScript paths, tsx source loading, and residual `lib/` files in the working tree can supply files or dependencies that are absent from a published tarball. Existing built-artifact tests still read `lib/` directly from the working tree, so they do not verify what `package.json#files` selects or the layout produced by package-manager installation. An execution that succeeds in development mode can therefore be published without a required bundle chunk, declaration, configuration file, or asset.
-
-Publishing many mutually dependent `@deepseek-ai` packages also creates a set-consistency problem. If a script publishes each package immediately after packing it, a later pack or validation failure leaves the first part of an unusable baseline in the registry. The npm registry has no cross-package transaction, so “publish once” cannot promise an atomic commit. It can promise that the complete publication set is packed and validated before any remote write, then published from that immutable set by one resumable orchestration command.
-
-The current baseline also requires a person to derive versions, authenticate, pack, publish, and retry from a local machine. A later GitHub Actions workflow must reuse the same release bundle and validation logic. It must not rebuild a different, untested set of tarballs after publication is approved.
-
-## Proposal
-
-The publication flow uses an immutable release bundle as its boundary. The pack phase builds every target package from one fixed Git commit, creates every tarball, validates tarball contents, and passes an installed-artifact integration test. The publish phase reads only those tarballs and their manifest and is forbidden from rebuilding or repacking.
-
-The target set contains only `@deepseek-ai/*` workspace packages discovered from `packages/*/*/package.json` and `apps/*/package.json`. The root project, `website/`, vendor, Python, and native workspaces are outside this NPM baseline. Discovery must reject duplicate names, mixed base versions, an unexpected publication privacy state, and unknown packages in the bundle instead of relying on another hand-maintained package-name list.
-
-The prerelease version consists of the package stable base version, a second-precision UTC timestamp captured when the command starts, and the target commit's 10-character short SHA: `--`. The dist-tag is derived as `dev-`. For example, base `0.0.1`, time `2026-08-04T00:32:00Z`, and short SHA `` produce version `0.0.1-20260804003200-` and tag `dev-0.0.1`. Retrying one release bundle must retain its version and manifest; repacking creates a version from the new command start time.
-
-The pack phase runs in this order:
-
-1. Resolve the ref to an immutable commit, capture the UTC timestamp, derive the version from that commit's root manifest, and display the commit, timestamp, version, tag, registry, and output path. Both `pack` and `release` wait for Enter at this point before expensive work; `--yes` skips this confirmation for automation.
-2. Install the frozen lockfile in an isolated detached worktree and run source-manifest publication constraints before staging. Uncommitted files and old build output from the caller's working tree must not affect publication.
-3. Stage every target manifest with the derived version, remove its publication-time `private` marker, and rewrite internal workspace dependencies in `dependencies`, `devDependencies`, `optionalDependencies`, and `peerDependencies` to the same exact version.
-4. Build the target commit completely, then run publint and built-package invariants.
-5. Pack every package in the target set without performing a registry write.
-6. Inspect each tarball's package manifest, file inventory, internal dependency versions, name, and version, rejecting missing, duplicate, or extra tarballs.
-7. Generate a release manifest and checksums containing the commit, version, tag, registry, and each package's tarball path, SHA-256, and npm integrity.
-8. Install an isolated consumer from the local tarballs and run the installed-artifact probes available in the current implementation; expand those probes to the complete artifact-plane integration matrix defined below.
-9. Print one directly executable publish command only after the complete set passes. The pack command itself always remains free of remote writes.
-
-The local `release` command composes pack and publish. It first uses the pack confirmation above to fix the expected timestamp and version, then waits for Enter again after a successful pack before publishing the same manifest; `release --yes` skips both confirmations. Separate `pack` and `publish --manifest` operations remain the primitives used by split CI jobs and recovery.
-
-## Current implementation boundary
-
-The checked-in pack command implements fixed-commit staging, exact internal dependency pins, static and tarball payload checks, the immutable manifest, and an isolated npm installation with every release tarball as a local top-level dependency. It runs the installed `dsh --version` and `dsh --dump-default-config` entries under plain Node, then starts the installed default TUI in a POSIX PTY, waits for its `main-session-` ready signal, and exits through `/exit` before printing the publish command. Publish supports integrity-based resumption, separates read-only registry verification from the authenticated identity check, and finishes with a complete remote integrity and dist-tag verification pass.
-
-Pull-request CI does not invoke the pack command; the installed-entry probes are local release checks rather than merge gates. Credential-free CI execution, package-owned probes for every other bin and public runtime entry, workflow-artifact transfer, and the protected publication job remain proposal scope.
-
-## Publication payload contract
-
-Published packages contain only build artifacts required by consumers. `package.json#files` must not include `src` or `lib/types/**/*.d.ts.map`; an independent tarball-content gate must also confirm that no `package/src/**` or `package/**/*.d.ts.map` entry exists, preventing manifest patterns or pack behavior from bypassing the static constraint. Runtime JavaScript, `.d.ts` declarations, configuration, assets, worker files, and dynamic bundle chunks must cover the actual entrypoint closure.
-
-Source manifests may retain `exports["./src/*"]` for this repository's source-plane resolution. That export does not place source in the publication payload and is not a consumer contract of the published package. Static gates must check the source plane and publication payload separately: deleting the source export must not hide broken workspace resolution, and publishing `src` must not repair missing build artifacts.
-
-Every tarball must be free of `workspace:` specifiers, and every internal dependency and peer dependency that points into the publication set must equal the exact derived version; `^`, `~`, and other semver ranges must not cross commit baselines. Except for `exports["./src/*"]`, which is explicitly source-plane-only, every consumer entry declared by the package manifest must point to a file present in the tarball. Dynamic imports, runtime-computed paths, and non-exported assets cannot be validated solely from the manifest and require installed execution.
-
-## Artifact-plane integration test
-
-The integration test runs after all tarballs exist and before any publish. It creates a fresh temporary project outside the monorepo, installs the declared dependency closure through local `.tgz` files from the release manifest, and executes from that installation. The test must use plain Node and package-manager-produced `node_modules`; tsx, tsconfig paths, workspace links, repository source paths, working-tree `lib/`, and the same version from the published registry are forbidden resolution inputs. The test also asserts that critical modules and bins resolve to real paths inside the temporary consumer.
-
-Installation uses the client behavior selected for this publication. Registry uploads must use the `npm` CLI because the private registry accepts only the npm client; pnpm may still orchestrate builds. Tarball tests must neither publish these packages to the real registry first nor repack after testing.
-
-The test covers at least these execution surfaces:
-
-- Installed `@deepseek-ai/dsh` runs `dsh --version` and `dsh --dump-default-config` successfully under plain Node, covering the static CLI entry and one dynamic mode entry.
-- Installed default `dsh` completes one keyless TUI startup in a PTY and exits under test control after reaching a defined ready signal. This path must load the real TUI dynamic chunk, so a missing publication file such as `lib/tui-*.js` fails the gate.
-- Every other published `bin` defines a package-owned smoke command that neither reaches a real service nor modifies user state. Different CLIs are not forced to share `--help`; the test runs the actual installed entry and checks its agreed exit or ready signal.
-- Node-compatible public runtime entries load from the installation. Browser, worker, or host-protocol-only entries use matching isolated fixtures, but their inputs must still be the current tarballs exclusively.
-
-These tests prove executability; they do not replace unit tests, snapshots, real-API e2e, or publint. Test fixtures should reuse behavior assertions from existing built-bin and PTY scenarios while changing the entry to the tarball installation. A test that runs working-tree `lib/bin.js` directly does not satisfy this gate.
-
-## Publication and recovery
-
-The publish command validates the release manifest, every local checksum, the target registry, `npm ping`, and `npm whoami` before uploading tarballs in a deterministic order. It accepts only a manifest created by the pack phase, never workspace directories. The default registry is `https://registry.npm.harnessment.com/`; every publish passes the registry and derived tag explicitly so a user-level `.npmrc` cannot redirect the operation.
-
-npm provides no multi-package atomic transaction, so uploads still occur package by package. The orchestrator reduces the failure surface through idempotent recovery: upload when remote `@` does not exist; skip when it exists with the release manifest's integrity; fail immediately when it exists with different content. Dist-tag inspection reads tag assignments without resolving a default tag's target, so an unrelated dangling tag cannot block recovery. At completion it must confirm every package version's integrity and every dist-tag against the release version. The workflow reports success only when the complete set passes final verification.
-
-If pack, tarball inspection, or installed-artifact integration fails, the registry must receive zero writes. If publish fails after a partial upload, the operator reruns publish with the same release manifest and must not repack into another timestamped version instead of recovering. Only a code or build-input change that requires different tarballs reruns the complete pack and test flow.
-
-## GitHub Actions integration
-
-GitHub Actions separates a credential-free pack-and-test job from a protected publish job. The first checks out the exact commit, invokes the same pack entry used locally, runs tarball-consumer tests, and uploads the complete release bundle as a workflow artifact. The second depends on the first, downloads that workflow artifact, revalidates the manifest and checksums, and invokes the same publish entry. It cannot rebuild after checkout.
-
-Pull requests and ordinary pushes may run the credential-free pack-and-test signal so payload regressions surface before merge. Actual private-registry publication starts as `workflow_dispatch` with only a target ref as input; the pack job creates the UTC timestamp, while the base version, short SHA, tag, registry, and package inventory derive from repository state or version-controlled configuration. Stable-release triggering is outside this baseline proposal.
-
-The registry token is injected only into the publish job, which uses a protected GitHub Environment to govern human approval, allowed branches or tags, and concurrency. The pack-and-test job cannot read publication credentials. The workflow artifact may have a short retention period, but the publish job must use the bundle produced by the same workflow run instead of locating tarballs from an untrusted source by version.
-
-## Alternatives considered
-
-**Publish recursively from the workspace.** Rejected because it interleaves packing and registry writes, cannot prove the complete set before the first write, and allows workspace resolution and caller working-tree state to influence publication.
-
-**Test only built `lib/` in the working tree.** Rejected because that validates the build tree rather than the tarball selected by `package.json#files`. A dynamic chunk present in the working tree but omitted from the tarball is exactly the failure this proposal must catch.
-
-**Run only `dsh --help`.** Rejected because Commander can print help and exit before loading the TUI, Web, or headless dynamic entry. It does not prove the default production startup path is complete.
-
-**Publish `src` and declaration maps to reduce missing-file risk.** Rejected because the source plane is not a production-runtime fallback. Expanding the payload hides bundle-closure errors and turns local debugging outputs into accidental publication contracts.
-
-**Require truly atomic cross-package publication.** Rejected because the npm registry has no such transaction. An immutable release bundle, complete pre-publication validation, integrity comparison, and idempotent recovery provide an implementable boundary while retaining the explicit limitation that partial uploads can be briefly visible.
-
-**Rebuild in the publish job after approval.** Rejected because the tested and uploaded tarballs would lose content identity. The workflow artifact and checksums must carry the test inputs directly into publication.
-
-## Acceptance criteria
-
-- One pack entry discovers every target under `packages/*/*` and `apps/*` from a fixed commit, derives and displays a version from the UTC second and short commit before waiting for Enter, generates the complete release bundle before any registry write, and prints one copyable publish command; `release` waits again after packing, while `--yes` skips both confirmations.
-- Static manifest and tarball-content gates both reject published `src` and `.d.ts.map` while source manifests retain `exports["./src/*"]`.
-- The release bundle records the complete package set, commit, derived version, tag, registry, and per-tarball integrity; every internal dependency is pinned exactly to that version, and publish consumes only that bundle without rebuilding.
-- An isolated integration test installs from local tarballs and starts the installed default `dsh` TUI under plain Node; deleting any required dynamic chunk makes the test fail deterministically.
-- Every published bin and applicable public runtime entry has post-tarball-install execution coverage, with resolution paths proving that no monorepo fallback occurred.
-- Publish safely resumes from the same manifest after partial success: matching integrity is skipped, conflicting integrity is rejected, and final verification requires every version and tag to agree.
-- A credential-free GitHub Actions job creates and tests the bundle, a protected job uploads the identical bundle, and the publication token exists only in the latter.
-
-## Risks
-
-Full packing, installation, and startup add CI time and workflow-artifact volume. The implementation should cache external dependencies and the pnpm store, but it must not cache or reuse installed workspace output for target packages. Safe consumer probes can run in parallel to reduce latency.
-
-Installing every tarball as a temporary project's top-level dependency can hide an undeclared internal dependency. The test generator should install each tested application's declared recursive closure and retain existing dependency gates. For `@deepseek-ai/dsh`, whose dependency surface approaches the full set, package-manifest and static graph checks remain necessary to detect undeclared edges.
-
-Platform-specific optional dependencies, native addons, PTYs, and browser entries may require platform-owned probes. The first phase must cover primary `dsh` startup on the publication Linux runner and one local macOS path, then expand the matrix with the actual publication platforms. Skipping an unstable probe must not move a production path outside the gate.
-
-Recovery cannot remove npm's partial visibility. During a failed publication, the registry may briefly contain only some package versions from the bundle. Operators and automation must treat the final bundle verification, not one successful `npm publish`, as the baseline-availability signal.
diff --git a/.agents/notes/rejected/process/2026-08-04-artifact-first-npm-baseline-publication.zh.md b/.agents/notes/rejected/process/2026-08-04-artifact-first-npm-baseline-publication.zh.md
deleted file mode 100644
index c2822ed0b5..0000000000
--- a/.agents/notes/rejected/process/2026-08-04-artifact-first-npm-baseline-publication.zh.md
+++ /dev/null
@@ -1,114 +0,0 @@
-# Agent Note: 以产物为先的 NPM 基线发布
-
-Status: rejected — superseded by 2026-08-10-npm-release-sequences: numbered versions and pack→protected publish shipped; timestamp versions were not adopted
-
-[English](2026-08-04-artifact-first-npm-baseline-publication.md) | 中文
-
-## 问题
-
-monorepo 中可运行的源码并不能证明发布后的包可运行。workspace link、TypeScript paths、tsx 源码加载和工作树里残留的 `lib/` 都可能补上发布 tarball 中缺失的文件或依赖。即使现有构建产物测试使用普通 Node，它仍直接读取工作树中的 `lib/`，没有验证 `package.json#files` 最终选中了什么，也没有验证包管理器安装后的文件布局。一次开发模式正常的执行因此可能发布为缺少 bundle chunk、声明文件、配置或资源的包。
-
-发布多个互相依赖的 `@deepseek-ai` 包还会产生集合一致性问题。如果脚本每 pack 一个包就立即 publish，那么后续 pack 或验证失败时，注册表中已经存在无法作为完整基线使用的前半组版本。npm 注册表没有跨包事务，因此这里的「一次性发布」不能承诺原子提交，只能承诺在任何远端写入前完整生成并验证发布集合，再由一个可恢复的编排命令发布这个不可变集合。
-
-当前基线还需要人工在本机完成版本派生、认证、pack、发布和重试。后续 GitHub Actions 工作流必须复用同一套发布包与验证逻辑，不能在批准发布后重新构建另一组未经消费方测试的 tarball。
-
-## 提案
-
-发布流程以一个不可变的 release bundle（发布包集合）为边界。pack 阶段从一个确定的 Git commit 构建全部目标包、生成全部 tarball、检查 tarball 内容，并通过安装后集成测试；publish 阶段只读取这组 tarball 及其 manifest（元数据清单），禁止重建或重新 pack。
-
-目标集合只包含 `packages/*/*/package.json` 与 `apps/*/package.json` 中命名为 `@deepseek-ai/*` 的 workspace 包。根项目、`website/`、vendor、Python 与 native workspace 不属于该 NPM 基线。发现机制必须拒绝重复包名、不同基础版本、意外的 `private` 发布状态以及集合中的未知包，而不是维护另一份手工包名列表。
-
-预发布版本由包的稳定基础版本、命令启动时精确到秒的 UTC 时间戳和目标 commit 的 10 位短 SHA 组成：`--`。dist-tag 由基础版本派生为 `dev-`。例如，基础版本 `0.0.1`、时间 `2026-08-04T00:32:00Z` 和短 SHA `` 生成版本 `0.0.1-20260804003200-` 与 tag `dev-0.0.1`。同一 release bundle 的重试必须沿用原版本和 manifest；重新 pack 会按新的命令启动时间生成新版本。
-
-pack 阶段按以下顺序执行：
-
-1. 将 ref 解析成不可变 commit，采集 UTC 时间戳，从该 commit 的根 manifest 派生版本，并显示 commit、时间戳、版本、tag、注册表和输出路径。`pack` 与 `release` 此时都会在昂贵操作开始前等待 Enter；自动化可用 `--yes` 跳过该确认。
-2. 在隔离的 detached worktree 中安装 frozen lockfile，并在暂存前运行源码 manifest 发布约束；调用方工作树中的未提交文件和旧构建输出不得参与发布。
-3. 将所有目标 manifest 暂存为派生版本，移除发布时的 `private` 标记，并把 `dependencies`、`devDependencies`、`optionalDependencies` 与 `peerDependencies` 中的内部 workspace 依赖全部改写为同一精确版本。
-4. 完整构建目标 commit，再运行 publint 和已构建包不变式。
-5. 为目标集合中的每个包执行 pack，但不执行任何注册表写入。
-6. 检查 tarball 内的 package manifest、文件清单、内部依赖版本、包名和版本，并拒绝缺失、重复或额外的 tarball。
-7. 生成包含 commit、版本、tag、注册表、每个包的 tarball 路径、SHA-256 与 npm integrity 的 release manifest 和校验和文件。
-8. 从本地 tarball 安装一个隔离消费方，运行当前实现已有的安装态产物探测，并将这些探测扩展为下文定义的完整产物平面集成测试矩阵。
-9. 仅当整个集合通过时输出一个可直接执行的 publish 命令；pack 命令本身始终保持无远端写入。
-
-本地 `release` 命令组合 pack 与 publish。它先通过上述 pack 确认确定预期时间戳和版本，再在 pack 成功后等待第二次 Enter，随后发布同一 manifest；`release --yes` 跳过两次确认。独立的 `pack` 与 `publish --manifest` 仍是 CI 分 job 和断点恢复使用的基础操作。
-
-## 当前实现边界
-
-已提交的 pack 命令实现了固定 commit 暂存、内部依赖精确固化、静态与 tarball payload 检查、不可变 manifest，以及把每个发布 tarball 都作为本地顶层依赖的隔离 npm 安装。它在输出 publish 命令前，用普通 Node 运行安装后的 `dsh --version` 与 `dsh --dump-default-config` 入口，再在 POSIX PTY 中启动安装后的默认 TUI，等待其 `main-session-` 就绪信号，并通过 `/exit` 退出。Publish 支持按 integrity 恢复，将只读注册表验证与认证身份检查分离，并以完整的远端 integrity 和 dist-tag 验证结束。
-
-PR（Pull Request） CI 不会调用 pack 命令；安装态入口探测属于本地发布检查，而不是合并门禁。免凭据 CI 执行、其他每个 bin 与公开运行时入口的包自有探测、workflow artifact 传递及受保护 publish job 仍属于提案范围。
-
-## 发布 payload 约定
-
-发布包只携带消费方需要的构建产物。`package.json#files` 禁止包含 `src` 和 `lib/types/**/*.d.ts.map`；tarball 内容门禁还要独立确认不存在任何 `package/src/**` 与 `package/**/*.d.ts.map`，避免 manifest pattern 或 pack 行为绕过静态约束。运行时 JS、声明文件 `.d.ts`、配置、资源、worker 文件和 bundle 动态 chunk 必须按实际入口闭包收齐。
-
-源码 manifest 可以保留 `exports["./src/*"]`，供本仓库的源码平面解析使用；该 export 不代表源码会进入发布 payload，也不属于已发布包的消费方约定。静态门禁必须分别检查源码平面与发布 payload，不能通过删除 source export 来掩盖错误的 workspace 解析，也不能通过发布 `src` 来修补缺失的构建产物。
-
-每个 tarball 必须不含 `workspace:` specifier，并且所有指向本次发布集合的内部依赖与对等依赖（peer dependency）都必须精确等于本次派生版本，禁止使用 `^`、`~` 或其他 semver 范围跨越 commit 基线。除了明确仅供源码平面使用的 `exports["./src/*"]`，package manifest 中声明的每个消费方入口都必须指向 tarball 内存在的文件；动态 import、运行时拼接路径和非 export 资源不能只靠 manifest 检查，必须由安装后执行覆盖。
-
-## 产物平面集成测试
-
-集成测试在全部 tarball 生成后、任何 publish 之前运行。它在 monorepo 外创建一个全新临时项目，通过本次 release manifest 中的本地 `.tgz` 文件安装声明依赖闭包，并从安装目录执行。测试必须使用普通 Node 与包管理器生成的 `node_modules`；禁止 tsx、tsconfig paths、workspace link、仓库源码路径、工作树 `lib/` 和已发布注册表中的同版本包参与解析。测试还要断言关键模块与 bin 的真实路径位于临时消费方内。
-
-安装使用本次发布选择的客户端行为。注册表上传必须使用 `npm` CLI（命令行界面），以满足私有注册表只接受 npm 客户端的策略；构建编排仍可使用 pnpm。tarball 测试不得先把这些包发布到真实注册表，也不得在测试后重新 pack。
-
-测试至少覆盖以下执行面：
-
-- `@deepseek-ai/dsh` 安装后的 `dsh --version` 与 `dsh --dump-default-config` 在普通 Node 下成功，分别覆盖静态 CLI 入口和一个动态模式入口。
-- 安装后的默认 `dsh` 在 PTY 中完成一次无密钥 TUI 启动，到达既定 ready 信号后由测试受控退出。这条路径必须加载真实 TUI 动态 chunk，因此缺少类似 `lib/tui-*.js` 的发布文件会使门禁失败。
-- 每个其他已发布 `bin` 都定义一个不会访问真实服务或修改用户状态的包级冒烟命令。不同 CLI 不强制共用 `--help`；测试必须运行其真实安装入口并检查约定的退出或 ready 信号。
-- Node 兼容的公开运行时入口从安装目录加载；浏览器、worker 或必须由宿主协议驱动的入口使用对应的隔离 fixture（测试前置数据），但输入仍只能是本次 tarball。
-
-这些测试验证可执行性，不替代单元测试、快照、真实 API e2e 或 publint。测试 fixture 应复用现有 built-bin 和 PTY 场景的行为断言，但必须把入口改为 tarball 安装结果；直接运行工作树 `lib/bin.js` 的测试不能算作本门禁。
-
-## 发布与恢复
-
-publish 命令先验证 release manifest、所有本地校验和、目标注册表、`npm ping` 和 `npm whoami`，再按确定顺序上传 tarball。命令只接受 pack 阶段生成的 manifest，不接受 workspace 目录作为发布输入。默认注册表为 `https://registry.npm.harnessment.com/`，每次 publish 都显式传入注册表和派生 tag，避免用户级 `.npmrc` 改变目标。
-
-npm 不提供多包原子事务，上传仍会逐包发生。编排器通过幂等恢复缩小失败面：若远端不存在 `@` 就上传；若已存在且 integrity 与 release manifest 相同就跳过；若已存在但内容不同就立即失败。dist-tag 检查只读取 tag 映射，不解析默认 tag 指向的版本，因此即使无关 tag 指向的版本已不存在，也不会阻断恢复。完成后必须逐包确认版本 integrity 和 dist-tag 都指向本次版本，只有整个集合通过最终验证，工作流才报告发布成功。
-
-如果 pack、tarball 检查或安装后集成测试失败，注册表必须保持零写入。如果 publish 在部分上传后失败，操作者使用同一 release manifest 重跑 publish 命令来恢复，不得重新 pack 并生成另一个时间戳版本来代替恢复。修复代码或改变构建输入后需要不同 tarball 时，才重新执行完整 pack 与测试。
-
-## GitHub Actions 集成
-
-GitHub Actions 分为无凭据的 pack-and-test job 与受保护的 publish job。前者检出精确 commit，调用与本地相同的 pack 入口，运行 tarball 消费方测试，并上传完整 release bundle 作为工作流产物。后者依赖前者成功，从工作流产物下载 bundle、重新校验 manifest 和校验和，再调用同一个 publish 入口；它不能检出后重新构建。
-
-PR 与普通 push 可以运行无凭据的 pack-and-test 信号，从而在合并前发现 payload 回归。实际私有注册表发布先通过 `workflow_dispatch` 提供，输入只包括目标 ref；UTC 时间戳由 pack job 生成，基础版本、短 SHA、tag、注册表和包清单都由仓库状态或受版本控制的配置派生。稳定发布触发方式不在本基线提案范围内。
-
-注册表 token 只注入 publish job，并由受保护 GitHub Environment 控制人工批准、允许的分支或 tag 以及并发。pack-and-test job 不得读取发布凭据。工作流产物的保留期可以较短，但 publish job 必须使用同一 workflow run 生成的 bundle，不能按版本号从不受信任的位置寻找 tarball。
-
-## 考虑过的替代方案
-
-**从 workspace 直接递归 publish。** 不采用，因为命令会把 pack 与注册表写入交错，无法在第一次写入前证明整个集合完整，也容易让 workspace 解析与调用方工作树状态影响发布结果。
-
-**只测试工作树中构建后的 `lib/`。** 不采用，因为这验证的是构建树，不是 `package.json#files` 选出的 tarball。工作树中存在而 tarball 中漏掉的动态 chunk 正是本提案必须捕获的失败。
-
-**只运行 `dsh --help`。** 不采用，因为 Commander 可以在加载 TUI、Web 或 headless 动态入口之前输出帮助并退出。它无法证明默认生产启动路径完整。
-
-**把 `src` 和声明映射一起发布以降低漏文件风险。** 不采用，因为源码平面不是生产运行时的后备路径；扩大 payload 会掩盖 bundle 闭包错误，并把本地调试产物变成无意的发布约定。
-
-**要求真正的跨包原子发布。** 不采用，因为 npm 注册表没有相应事务。不可变 release bundle、发布前全量验证、integrity 比对与幂等恢复提供可实现的边界，同时明确保留部分上传短暂可见的限制。
-
-**在批准后由发布 job 重新构建。** 不采用，因为测试通过的 tarball 与实际上传的 tarball 将不再具有内容身份。工作流产物与校验和必须把测试输入直接传给发布步骤。
-
-## 验收标准
-
-- 一个 pack 入口从确定 commit 发现 `packages/*/*` 和 `apps/*` 的全部目标包，以 UTC 秒级时间戳与短 commit 生成并显示版本，再等待 Enter；它在任何注册表写入前生成完整 release bundle，并输出一个可复制的 publish 命令；`release` 在 pack 后再次等待，`--yes` 跳过两次确认。
-- 静态 manifest 门禁和 tarball 内容门禁都拒绝发布 `src` 与 `.d.ts.map`，同时保留源码 manifest 中的 `exports["./src/*"]`。
-- release bundle 记录完整包集合、commit、派生版本、tag、注册表和逐 tarball integrity；所有内部依赖都精确固化到该版本，publish 只消费该 bundle，绝不重建。
-- 一个隔离集成测试从本地 tarball 安装消费方，并用普通 Node 启动安装后的默认 `dsh` TUI；删除任一所需动态 chunk 会使该测试稳定失败。
-- 所有已发布 bin 和适用的公开运行时入口都有 tarball 安装后的执行覆盖，且解析路径证明没有回退到 monorepo。
-- publish 可在部分成功后用同一 manifest 安全重跑；相同 integrity 被跳过，不同 integrity 被拒绝，最终验证要求所有版本与 tag 一致。
-- GitHub Actions 的无凭据 job 生成并测试 bundle，受保护 job 上传完全相同的 bundle，发布 token 只存在于后者。
-
-## 风险
-
-全量 pack、安装和启动会增加 CI 时间与工作流产物体积。实现应缓存外部依赖和 pnpm store，但不得缓存或复用目标包的已安装 workspace 输出；并行执行安全的消费方 probe 可以降低时延。
-
-把所有 tarball 都安装为临时项目的顶层依赖可能掩盖未声明的内部依赖。测试生成器应按被测应用的声明式递归闭包安装，并结合现有依赖门禁；对依赖面接近全集的 `@deepseek-ai/dsh`，仍需依靠 package manifest 与静态图检查发现未声明边。
-
-不同平台的 optional dependency、native addon、PTY 与浏览器入口可能需要平台专属 probe。第一阶段至少在发布所用 Linux runner 和一个本地 macOS 路径上覆盖主 `dsh` 启动，后续矩阵按实际发布平台扩展；不能用跳过不稳定 probe 的方式把生产路径移出门禁。
-
-恢复机制不能消除 npm 的部分可见性。发布失败期间，注册表可能短暂含有本次版本的一部分包；操作者与自动化必须以最终 bundle 验证结果而非单个 `npm publish` 的成功作为基线可用信号。
diff --git a/.agents/notes/rejected/simplification/2026-06-20-fold-session-persistence-interface.i18n.yaml b/.agents/notes/rejected/simplification/2026-06-20-fold-session-persistence-interface.i18n.yaml
index 7e9de72fc1..66f5bee0e5 100644
--- a/.agents/notes/rejected/simplification/2026-06-20-fold-session-persistence-interface.i18n.yaml
+++ b/.agents/notes/rejected/simplification/2026-06-20-fold-session-persistence-interface.i18n.yaml
@@ -12,8 +12,8 @@
en: 8eecfc7bd6c83608
zh: 658fc8e8eac425b7
/agent-note-fold-the-persistence-interface-into-dsh-session/acceptance-criteria:
- en: a141343494939ee4
- zh: 2b9a95f1aadd319f
+ en: c6529542fe47d400
+ zh: 06aa68409bad3823
/agent-note-fold-the-persistence-interface-into-dsh-session/what-we-give-up:
en: 595671143eb17f28
zh: a6f019fb64ba3a90
diff --git a/.agents/notes/rejected/simplification/2026-06-20-fold-session-persistence-interface.md b/.agents/notes/rejected/simplification/2026-06-20-fold-session-persistence-interface.md
index 58c6aa8f5b..65ff3e57b4 100644
--- a/.agents/notes/rejected/simplification/2026-06-20-fold-session-persistence-interface.md
+++ b/.agents/notes/rejected/simplification/2026-06-20-fold-session-persistence-interface.md
@@ -22,7 +22,7 @@ The implementing PR should update the [capability seams](../../implemented/archi
- `dsh-session` exports the persistence service type, coordinator, and contract helpers.
- JSONL and SQLite backend packages depend on `dsh-session` directly.
- `agent-loop` resume uses the session-owned service key.
-- [Session persistence](../../implemented/architecture/2026-06-14-session-persistence.md), [handle-based session persistence](../../implemented/architecture/2026-08-27-handle-based-session-persistence.md), and [package docs](../../../../packages/session/session-persistence/README.md) explain why backend implementations remain separate.
+- [Session persistence](../../../../packages/session/session-persistence/README.md), [handle-based session persistence](../../implemented/architecture/2026-08-27-handle-based-session-persistence.md), and [package docs](../../../../packages/session/session-persistence/README.md) explain why backend implementations remain separate.
## What we give up
diff --git a/.agents/notes/rejected/simplification/2026-06-20-fold-session-persistence-interface.zh.md b/.agents/notes/rejected/simplification/2026-06-20-fold-session-persistence-interface.zh.md
index 9fb53d16fc..877f502764 100644
--- a/.agents/notes/rejected/simplification/2026-06-20-fold-session-persistence-interface.zh.md
+++ b/.agents/notes/rejected/simplification/2026-06-20-fold-session-persistence-interface.zh.md
@@ -22,7 +22,7 @@ Status: rejected — 独立的持久化 Service Definition 包是持久化能力
- `dsh-session` 导出持久化服务类型、协调器和约定辅助工具。
- JSONL 和 SQLite 后端包直接依赖 `dsh-session`。
- `agent-loop` 的恢复功能使用会话包拥有的服务键。
-- [会话持久化](../../implemented/architecture/2026-06-14-session-persistence.zh.md)、[基于句柄的会话持久化](../../implemented/architecture/2026-08-27-handle-based-session-persistence.zh.md)与[包文档](../../../../packages/session/session-persistence/README.zh.md)说明后端实现为何仍保持独立。
+- [会话持久化](../../../../packages/session/session-persistence/README.zh.md)、[基于句柄的会话持久化](../../implemented/architecture/2026-08-27-handle-based-session-persistence.zh.md)与[包文档](../../../../packages/session/session-persistence/README.zh.md)说明后端实现为何仍保持独立。
## 放弃了什么
diff --git a/.agents/notes/rejected/simplification/2026-06-20-truncate-interrupted-turns.i18n.yaml b/.agents/notes/rejected/simplification/2026-06-20-truncate-interrupted-turns.i18n.yaml
index d1a8821362..0510e9d70e 100644
--- a/.agents/notes/rejected/simplification/2026-06-20-truncate-interrupted-turns.i18n.yaml
+++ b/.agents/notes/rejected/simplification/2026-06-20-truncate-interrupted-turns.i18n.yaml
@@ -18,5 +18,5 @@
en: 583aa8d003225c57
zh: 2d90befccf8be0ca
/agent-note-truncate-interrupted-final-turns-on-load/related:
- en: a2af11959bf10ac3
- zh: 402cf5f0c4f019d8
+ en: 5c7d59ca77bb80f3
+ zh: d05db535d6359fcf
diff --git a/.agents/notes/rejected/simplification/2026-06-20-truncate-interrupted-turns.md b/.agents/notes/rejected/simplification/2026-06-20-truncate-interrupted-turns.md
index c4b0084de5..e82da371ef 100644
--- a/.agents/notes/rejected/simplification/2026-06-20-truncate-interrupted-turns.md
+++ b/.agents/notes/rejected/simplification/2026-06-20-truncate-interrupted-turns.md
@@ -31,6 +31,6 @@ A crash can lose real work from the final turn: assistant text, tool calls, and
## Related
-This is a direct simplification of [session persistence](../../implemented/architecture/2026-06-14-session-persistence.md) and the historical [universal turn-enclosure rule](../../archived/architecture/2026-06-15-turn-enclosure-invariant.md). It also removes much of the motivation for durable step boundary events, making [drop durable step boundary events](2026-06-20-drop-durable-step-boundaries.md) smaller.
+This is a direct simplification of [session persistence](../../../../packages/session/session-persistence/README.md) and the historical [universal turn-enclosure rule](../../archived/architecture/2026-06-15-turn-enclosure-invariant.md). It also removes much of the motivation for durable step boundary events, making [drop durable step boundary events](2026-06-20-drop-durable-step-boundaries.md) smaller.
diff --git a/.agents/notes/rejected/simplification/2026-06-20-truncate-interrupted-turns.zh.md b/.agents/notes/rejected/simplification/2026-06-20-truncate-interrupted-turns.zh.md
index ad6c85fc62..6a7bbd6e5a 100644
--- a/.agents/notes/rejected/simplification/2026-06-20-truncate-interrupted-turns.zh.md
+++ b/.agents/notes/rejected/simplification/2026-06-20-truncate-interrupted-turns.zh.md
@@ -31,6 +31,6 @@ Status: rejected — 单个轮次可以包含大量真实工作，包括多个
## 相关
-本提案是对[会话持久化](../../implemented/architecture/2026-06-14-session-persistence.zh.md)与历史上的[通用轮次封闭规则](../../archived/architecture/2026-06-15-turn-enclosure-invariant.md)的直接简化。它还移除了持久化步骤边界事件的大部分动机，使[移除持久化步骤边界事件](2026-06-20-drop-durable-step-boundaries.zh.md)的改动更小。
+本提案是对[会话持久化](../../../../packages/session/session-persistence/README.zh.md)与历史上的[通用轮次封闭规则](../../archived/architecture/2026-06-15-turn-enclosure-invariant.md)的直接简化。它还移除了持久化步骤边界事件的大部分动机，使[移除持久化步骤边界事件](2026-06-20-drop-durable-step-boundaries.zh.md)的改动更小。
diff --git a/.agents/notes/rejected/simplification/2026-07-04-prune-dead-core-spine-api.i18n.yaml b/.agents/notes/rejected/simplification/2026-07-04-prune-dead-core-spine-api.i18n.yaml
deleted file mode 100644
index 810e07aad4..0000000000
--- a/.agents/notes/rejected/simplification/2026-07-04-prune-dead-core-spine-api.i18n.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-04-prune-dead-core-spine-api.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/rejected/simplification/2026-07-04-prune-dead-core-spine-api.md
-/agent-note-prune-dead-public-api-and-result-fields:
- en: 787501dcdb05bf03
- zh: cf13583535e5a444
-/agent-note-prune-dead-public-api-and-result-fields/problem:
- en: 277564591633536c
- zh: ddfbc0231a04b51d
-/agent-note-prune-dead-public-api-and-result-fields/problem/grouped-helper-export-inventory:
- en: 84cb62303daf31bf
- zh: 3478dd10d2a761fc
-/agent-note-prune-dead-public-api-and-result-fields/proposal:
- en: 414aca8de0a22c38
- zh: 9458a8db0cea11e7
-/agent-note-prune-dead-public-api-and-result-fields/alternatives-considered:
- en: e8eecc41540c8d67
- zh: 60110bcdfaba5dad
-/agent-note-prune-dead-public-api-and-result-fields/acceptance-criteria:
- en: ef426fe8180fdfe8
- zh: 7e7f4cdb5d2ce655
-/agent-note-prune-dead-public-api-and-result-fields/risks:
- en: c88948f52999d392
- zh: 3b1b98c54d082ae1
diff --git a/.agents/notes/rejected/simplification/2026-07-04-prune-dead-core-spine-api.md b/.agents/notes/rejected/simplification/2026-07-04-prune-dead-core-spine-api.md
deleted file mode 100644
index 35130b1af2..0000000000
--- a/.agents/notes/rejected/simplification/2026-07-04-prune-dead-core-spine-api.md
+++ /dev/null
@@ -1,62 +0,0 @@
-# Agent Note: Prune dead public API and result fields
-
-Status: rejected — stale 2026-07 inventory: rows were pruned piecemeal or gained callers; a fresh audit must supersede it
-
-English | [中文](2026-07-04-prune-dead-core-spine-api.zh.md)
-
-## Problem
-
-Several package-root exports, result fields, and convenience methods have no production consumer. They survive because tests import internals through public entry points or because a type anticipated a caller that never arrived. Each item is small in isolation, but together they enlarge the SDK contract, generated catalogs, documentation, and regression matrix without enabling a shipped path.
-
-The production corpus is `packages/*/*/src`, example sources/config, and runtime scripts. Tests, package READMEs, and Agent Note prose are evidence of publication but not fixed callers. `cordis_inspect` makes `packages/extensions/tool-cordis/src/api-catalog.ts` model-visible, and `cordis_mount` can invoke injected services through guarded real-service proxies, so catalogued service methods and returned shapes are a genuine dynamic product surface. The table therefore distinguishes absence of a fixed repository caller from unreachability: rows touching catalogued vocabulary intentionally contract what model-written mounts can discover and call, while package-root implementation helpers are not reached through that service façade. Exact-symbol searches produce the following inventory:
-
-| API element | Production evidence | Simplification |
-| --- | --- | --- |
-| `SurfaceManager.invalidate()` | Only its unit test calls it; seeding completes before the lazily-created manager exists and the session never replaces its log reference. | Delete it and its impossible wholesale-replacement contract. |
-| `ToolExecutionResult.callId` | Every hook already receives the immutable `ToolExecution`; the loop and ACP correlate through the call/session event. No consumer reads the duplicate result field. | Remove the field, copy/mismatch guards, and tests that prove the duplicate cannot disagree. |
-| `ReactLoopAgent` root export | Outside-package named imports are tests; production programs against `Agent` and creates/resumes through `ctx.agents`. | Return/interface-type `Agent` and make the concrete loop class package-internal; keep the deliberate synchronous config-only `AgentLoop.create()` path. |
-| `workflow-worker-thread` protocol/runtime/session re-exports and named `WorkerThreadWorkflowEngine` | Every package-name consumer uses the default engine; the workflow Agent Note already defines the worker wire protocol as private. | Keep the default plugin class/config contract; drop the duplicate named class export and keep protocol modules source-private. |
-| `ptc-runtime-worker` protocol/bootstrap re-exports | Outside-package production/e2e consumers use `NodePtcRuntime` and config, not `BootstrapPort`, `PatchableStream`, or worker message/boot types. | Keep the runtime class/config contract and make its wire/bootstrap vocabulary source-private. |
-| ACP `agentOptions` root export | The helper has only same-file and ACP-test consumers; the sole outside-package production consumer mounts the plugin namespace. | Keep `name`, `inject`, `Config`, `AcpConfig`, and `apply`; make `agentOptions` source-private and test it through bridge behavior. |
-| `providerWording` and `completedTurnPrefix` root exports | Each has one same-package production caller; only the balanced-prefix helper has a same-package white-box test. | Make them source-private and test provider behavior. |
-| `depthOf`, `SubagentDepthError`, `waitForExit`, and `exitsWithin` root exports | Production subagent backends consume the in-process runner and subprocess construction/disposal helpers, not these enforcement/test internals. `SENSITIVE_ENV_PATTERN` is excluded because the SDK helper applies it to caller-supplied environments. | Keep depth and exit behavior but make the remaining helpers and error source-private; test through spawn and disposal. Keep the shared credential pattern public. |
-| `LlmError.status` and replay status | Adapters/replay populate it, but production branches on stable error code/message and never reads raw status. | Remove the unread field and replay plumbing while preserving error classification. |
-| `BlockAssembler.push()` return value | Both production callers ignore the returned completed block. | Return `void`; keep the deliberately public `blocks()`/`message()` contract. |
-| `compactRegion`'s separate `session` argument | The fixed caller passes the same object already present as `agent.session`; the model-visible mount API can also call the method, but accepting two identities permits a mounted plugin to provide an incoherent pair. | Keep the manual-region API while deliberately narrowing it to `agent.session` as the one source of truth. |
-| `CompactionResult.startSeq`, `summarySeq`, `endSeq`, and `summary` | The production consumer reads only shadowed range/seq/token accounting; the durable log owns summary and event identity. | Remove the four result echoes while keeping both shared transcript renderers. |
-| `BasicCompactionEngine` estimation/summarization visibility | No outside production caller invokes the five methods; the implemented Agent Note names only `estimateContentTokens()` and `summarize()` as subclass hooks. | Make those two `protected` and the three orchestration-only estimators private. |
-| `CodeLogEntry.source`/`level` and `RunCodeMeta.dispatches` | Every production consumer maps logs to text; no presenter/model path reads the other fields or the persisted dispatch count. | Make ptc-runtime logs strings (or text-only entries) and remove result-meta dispatch plumbing; keep the local counter that mints deterministic dispatch ids. |
-| `PtcRuntime.language` and `PtcRuntime.isolation` | The worker backend supplies the only production values, while PTC mode and every other production caller invoke only `run()`. | Remove the unread descriptors while preserving the worker's language, isolation, budgets, cancellation, and disposal behavior. |
-| `ToolNotFoundError.toolName`, `SystemPrompt.config`, and `BashTask.command` | Each stored public value has no production reader. | Drop the unread field while retaining error messages, resolved configuration behavior, and task lifecycle. |
-| Backend package-root implementation helpers | The exact inventory below is called only through relative same-package imports. Production namespace imports mount the retained plugin contract without reading these properties; named root consumers are tests. | Retain each adapter/provider/service and its config/error contract; stop exporting the listed helper functions/constants at package roots. |
-| Consumer package-root implementation helpers | The exact inventory below has only same-package production callers. Production namespace imports mount plugin contracts without reading helper properties; named root consumers are tests. | Retain plugin contracts and stable error codes; move tests to package-local modules or public behavior and stop exporting the listed helpers at package roots. |
-
-### Grouped helper-export inventory
-
-- `dsh-llm-deepseek`: `httpErrorCode`, `serializeMessages`, `serializeRequest`, `DONE`, `parseSse`, `mapFinishReason`, `mapUsage`, and `translate`; `dsh-llm-pi-ai`: `buildModel`, `mapStopReason`, `mapUsage`, `toPiContext`, and `toStreamChunks`.
-- `dsh-bash-local`: `DEFAULT_GRACE_MS`, `ENV_OVERRIDES`, `killGroup`, `OutputCollector`, and `runBash`; `dsh-bash-sandbox`: `shellQuote`, `classifyDenial`, and `classifyRunnerFailure`; `dsh-sandbox-local`: `bwrapProfileArgs`, `landlockProfileArgs`, and `seatbeltProfileArgs`. The public mutable test-injection fields and their types are outside this proposal.
-- `dsh-fs-local`: `applyLiteralEdit`, `listDirectory`, `probe`, `readForEdit`, `readTextForDiff`, `readWholeText`, `resolveLocalTarget`, `restoreLineEndings`, `streamWholeText`, and `writeFileAtomic`.
-- `dsh-web-fetch-http`: `classifyContentType`, `decoderForCharset`, `isSameOrigin`, `parseCharset`, and `validateFetchUrl`; `dsh-web-search-exa`: `mapExaResponse` and `mapExaResult`; `dsh-web-search-deepseek`: `citationSnippets` and `mapAnthropicResponse`; `dsh-web-search-perplexity`: `mapPerplexityResponse` and `mapPerplexityResult`.
-- `dsh-tool-fs`: `READ_LIMIT`, `STREAM_MIN_SIZE`, `READ_MAX_BYTES`, `READ_MAX_LINE_LENGTH`, `DIFF_CONTEXT`, `applyReadTool`, `parseReadArgs`, `applyWriteTool`, `formatWriteOutput`, `parseWriteArgs`, `applyEditTool`, `formatEditOutput`, `parseEditArgs`, `buildWindow`, `formatReadOutput`, `computeHunkDiffs`, and `diffsFromMeta`.
-- `dsh-tool-web`: `WEB_SEARCH_MAX_RESULTS`, `applyWebSearchTool`, `formatSearchOutput`, `parseSearchArgs`, `presentSearchCall`, `applyWebFetchTool`, `formatFetchOutput`, `parseFetchArgs`, `presentFetchCall`, `renderBody`, and `htmlToMarkdown`; `dsh-tool-call-timeout-policy`: `toolTimeoutResult`; `dsh-compaction-basic`: `resolveConfig`; `dsh-tool-bash`: `renderResult`.
-
-## Proposal
-
-Remove or demote every row as one bounded coordinated public-surface cleanup. Update package READMEs, JSDoc, generated API/event catalogs, type-equivalence records, exports maps where needed, and tests so they exercise the owning public contract instead of preserving test-only entry points. Do not collapse any capability seam, LLM adapter, persistence provider, or lifecycle quiescence contract.
-
-## Alternatives considered
-
-**Keep test conveniences and self-contained results public.** Public helpers can make white-box tests convenient, self-contained result fields can look ergonomic, and future embedders might want the concrete loop or enumeration methods. Those benefits are hypothetical; retaining them makes every implementation and document explain states that no shipped caller can observe. A real consumer can introduce the smallest contract it needs, with its ownership and failure semantics known.
-
-**Keep every catalogued member for model-written mounts.** The self-referential toolset is a real generic consumer route, not generated-doc noise. Its value comes from an accurate, composable service API, however, not from preserving duplicate fields or incoherent argument pairs indefinitely; each catalogued contraction above removes a fact available elsewhere on the same execution, agent, or result and updates the API reference in the same change.
-
-## Acceptance criteria
-
-- Exact-symbol searches show no removed API outside this Agent Note and any implemented-Agent Note amendments.
-- Every API element listed in this Agent Note is absent or demoted as specified; deliberately retained extension/test contracts outside the inventory are unchanged.
-- Tool execution, compaction, both LLM adapters, the persistence provider, workflow isolation, and agent creation/resume retain their shipped behavior.
-- Typecheck, coverage, snapshots, doc-sync, module-graph verification, build, and hygiene pass.
-
-## Risks
-
-Most removals are compile-visible but runtime-neutral. The compaction argument cleanup deliberately forbids a session/context mismatch while retaining the manual-region API. External pre-release embedders and existing model-written mounts may import fewer helpers, pass fewer arguments, or receive narrower result shapes; this is an intentional product-surface contraction, not merely generated-catalog cleanup. The repository is unreleased, so carrying unsupported surface is the larger foundation cost.
diff --git a/.agents/notes/rejected/simplification/2026-07-04-prune-dead-core-spine-api.zh.md b/.agents/notes/rejected/simplification/2026-07-04-prune-dead-core-spine-api.zh.md
deleted file mode 100644
index d2782b733b..0000000000
--- a/.agents/notes/rejected/simplification/2026-07-04-prune-dead-core-spine-api.zh.md
+++ /dev/null
@@ -1,62 +0,0 @@
-# Agent Note: 裁剪无用的公开与结果接口
-
-Status: rejected — stale 2026-07 inventory: rows were pruned piecemeal or gained callers; a fresh audit must supersede it
-
-[English](2026-07-04-prune-dead-core-spine-api.md) | 中文
-
-## 问题
-
-若干包根导出、结果字段和便利方法没有生产消费方。它们之所以存活，要么是因为测试通过公开入口导入了内部实现，要么是因为某个类型预期了一个从未出现的调用者。每一项单独看都很小，但合在一起，它们扩大了 SDK 约定、生成的 catalog、文档和回归矩阵，却没有支撑任何已交付的路径。
-
-生产语料库是 `packages/*/*/src`、示例源码/配置和运行时脚本。测试、包 README 和 Agent Note 行文是发布的证据，但不是固定调用者。`cordis_inspect` 使 `packages/extensions/tool-cordis/src/api-catalog.ts` 对模型可见，`cordis_mount` 可以通过受保护的真实服务代理调用注入的服务，因此 catalog 中的服务方法和返回形状是真正的动态产品接口。下表因此区分「没有固定的仓库调用者」与「不可达」：涉及 catalog 词汇的行有意收缩模型编写的 mount 能发现和调用的内容，而包根实现辅助函数并不通过该服务门面可达。精确符号搜索得出以下清单：
-
-| 接口 | 生产证据 | 简化方式 |
-| --- | --- | --- |
-| `SurfaceManager.invalidate()` | 只有其单元测试调用它；seeding 在惰性创建的 manager 存在之前就已完成，且会话从不替换其日志引用。 | 删除它及其不可能触发的整体替换约定。 |
-| `ToolExecutionResult.callId` | 每个钩子已经接收不可变的 `ToolExecution`；循环和 ACP（Agent Client Protocol）通过调用/会话事件关联。没有消费方读取这个重复的结果字段。 | 移除该字段、复制/不匹配守卫，以及证明该重复不可能不一致的测试。 |
-| `ReactLoopAgent` 根导出 | 包外的命名导入都是测试；生产代码面向 `Agent` 编程，通过 `ctx.agents` 创建/恢复。 | 将返回类型和接口类型设为 `Agent`，将具体循环类改为包内部；保留有意设计的同步、仅配置的 `AgentLoop.create()` 路径。 |
-| `workflow-worker-thread` 的 protocol/runtime/session 再导出与命名的 `WorkerThreadWorkflowEngine` | 所有通过包名导入的消费方都使用默认引擎；工作流 Agent Note 已将 worker 协议格式（wire format）定义为私有。 | 保留默认插件类/配置约定；移除重复的命名类导出，将协议模块保持为源码私有。 |
-| `ptc-runtime-worker` 的 protocol/bootstrap 再导出 | 包外的生产/e2e 消费方使用 `NodePtcRuntime` 和配置，而非 `BootstrapPort`、`PatchableStream` 或 worker 消息/启动类型。 | 保留运行时类/配置约定，将其协议格式/bootstrap 词汇改为源码私有。 |
-| ACP 的 `agentOptions` 根导出 | 该辅助函数只有同文件和 ACP 测试消费方；唯一的包外生产消费方挂载的是插件命名空间。 | 保留 `name`、`inject`、`Config`、`AcpConfig` 和 `apply`；将 `agentOptions` 改为源码私有，通过桥接层行为测试。 |
-| `providerWording` 与 `completedTurnPrefix` 根导出 | 各有一个同包生产调用者；只有 balanced-prefix 辅助函数有一个同包白盒测试。 | 改为源码私有，测试提供方行为。 |
-| `depthOf`、`SubagentDepthError`、`waitForExit` 与 `exitsWithin` 根导出 | 生产 subagent 后端消费的是进程内 runner 和子进程构造/dispose（资源释放）辅助函数，而非这些强制机制和测试内部实现。`SENSITIVE_ENV_PATTERN` 不在其中，因为 SDK helper 会将它应用于调用方传入的环境。 | 保留深度与退出行为，但将剩余辅助函数和 error 改为源码私有；通过 spawn 和 dispose 测试。保持共享凭据正则公开。 |
-| `LlmError.status` 与回放 status | 适配器/回放填充它，但生产分支基于稳定的错误码/消息判断，从不读取原始 status。 | 移除未读字段和回放管道，保留错误分类。 |
-| `BlockAssembler.push()` 返回值 | 两个生产调用者都忽略返回的已完成块。 | 返回 `void`；保留有意公开的 `blocks()`/`message()` 约定。 |
-| `compactRegion` 的独立 `session` 参数 | 固定调用方传入的对象就是 `agent.session` 中已有的对象；模型可见的 mount API 也可以调用该方法，但同时接受两个独立对象，会让挂载的插件传入不一致的组合。 | 保留手动 region API，同时有意将其收窄为以 `agent.session` 为唯一真源。 |
-| `CompactionResult.startSeq`、`summarySeq`、`endSeq` 与 `summary` | 生产消费方只读取 shadowed range/seq/token 统计；持久日志拥有 summary 和事件标识。 | 移除四个结果回显，保留两个共享的 transcript（文本记录）渲染器。 |
-| `BasicCompactionEngine` 的估算/摘要方法可见性 | 没有包外生产调用者调用这五个方法；已实现的 Agent Note 只将 `estimateContentTokens()` 和 `summarize()` 命名为子类钩子。 | 将这两个方法改为 `protected`，其余三个编排专用的估算器改为 private。 |
-| `CodeLogEntry.source`/`level` 与 `RunCodeMeta.dispatches` | 每个生产消费方都将日志映射为文本；没有 presenter/模型路径读取其他字段或持久化的 dispatch 计数。 | 将 ptc-runtime 日志改为字符串（或纯文本条目），移除 result-meta 的 dispatch 管道；保留用于生成确定性 dispatch id 的本地计数器。 |
-| `PtcRuntime.language` 与 `PtcRuntime.isolation` | worker 后端提供唯一的生产值，而 PTC mode 及其他所有生产调用方只调用 `run()`。 | 移除未读描述符，同时保留 worker 的语言、隔离、预算、取消与资源释放行为。 |
-| `ToolNotFoundError.toolName`、`SystemPrompt.config` 与 `BashTask.command` | 每个存储的公开值都没有生产读取者。 | 移除未读字段，保留错误消息、已解析的配置行为和任务生命周期。 |
-| 后端包根实现辅助函数 | 下方精确清单仅通过相对路径的同包导入调用。生产命名空间导入挂载的是保留的插件约定，不读取这些属性；包根命名导入的消费方都是测试。 | 保留每个适配器/提供方/服务及其配置/错误约定；停止在包根导出所列辅助函数/常量。 |
-| 消费方包根实现辅助函数 | 下方精确清单只有同包生产调用者。生产命名空间导入挂载的是插件约定，不读取辅助属性；包根命名导入的消费方都是测试。 | 保留插件约定和稳定的错误码；将测试迁移到包内模块或公开行为，停止在包根导出所列辅助函数。 |
-
-### 分组辅助导出清单
-
-- `dsh-llm-deepseek`：`httpErrorCode`、`serializeMessages`、`serializeRequest`、`DONE`、`parseSse`、`mapFinishReason`、`mapUsage` 与 `translate`；`dsh-llm-pi-ai`：`buildModel`、`mapStopReason`、`mapUsage`、`toPiContext` 与 `toStreamChunks`。
-- `dsh-bash-local`：`DEFAULT_GRACE_MS`、`ENV_OVERRIDES`、`killGroup`、`OutputCollector` 与 `runBash`；`dsh-bash-sandbox`：`shellQuote`、`classifyDenial` 与 `classifyRunnerFailure`；`dsh-sandbox-local`：`bwrapProfileArgs`、`landlockProfileArgs` 与 `seatbeltProfileArgs`。公开的可变测试注入字段及其类型不在本提案范围内。
-- `dsh-fs-local`：`applyLiteralEdit`、`listDirectory`、`probe`、`readForEdit`、`readTextForDiff`、`readWholeText`、`resolveLocalTarget`、`restoreLineEndings`、`streamWholeText` 与 `writeFileAtomic`。
-- `dsh-web-fetch-http`：`classifyContentType`、`decoderForCharset`、`isSameOrigin`、`parseCharset` 与 `validateFetchUrl`；`dsh-web-search-exa`：`mapExaResponse` 与 `mapExaResult`；`dsh-web-search-deepseek`：`citationSnippets` 与 `mapAnthropicResponse`；`dsh-web-search-perplexity`：`mapPerplexityResponse` 与 `mapPerplexityResult`。
-- `dsh-tool-fs`：`READ_LIMIT`、`STREAM_MIN_SIZE`、`READ_MAX_BYTES`、`READ_MAX_LINE_LENGTH`、`DIFF_CONTEXT`、`applyReadTool`、`parseReadArgs`、`applyWriteTool`、`formatWriteOutput`、`parseWriteArgs`、`applyEditTool`、`formatEditOutput`、`parseEditArgs`、`buildWindow`、`formatReadOutput`、`computeHunkDiffs` 与 `diffsFromMeta`。
-- `dsh-tool-web`：`WEB_SEARCH_MAX_RESULTS`、`applyWebSearchTool`、`formatSearchOutput`、`parseSearchArgs`、`presentSearchCall`、`applyWebFetchTool`、`formatFetchOutput`、`parseFetchArgs`、`presentFetchCall`、`renderBody` 与 `htmlToMarkdown`；`dsh-tool-call-timeout-policy`：`toolTimeoutResult`；`dsh-compaction-basic`：`resolveConfig`；`dsh-tool-bash`：`renderResult`。
-
-## 提案
-
-以一次有界的、协调的公开接口清理，移除或降级上述每一行。同步更新包 README、JSDoc、生成的 API/事件 catalog、type-equiv 记录、必要的 exports map 以及测试，使测试通过所属的公开约定验证行为，而非保留仅为测试而存在的入口。不折叠任何能力 seam、LLM（大语言模型）适配器、持久化 provider 或生命周期完全停稳约定。
-
-## 曾考虑的替代方案
-
-**保留测试便利函数和自包含的结果字段为公开。** 公开辅助函数可以让白盒测试更方便，自包含的结果字段看起来更易用，未来的嵌入者可能需要具体循环类或枚举方法。这些好处是假设性的；保留它们会让每处实现和文档都要解释没有已交付调用者能观察到的状态。真正的消费方可以引入它所需的最小约定，其所有权和失败语义明确。
-
-**保留所有 catalog 成员以供模型编写的 mount 使用。** 自引用工具集是一条真实的通用消费路径，而非生成文档的噪音。然而，它的价值来自准确、可组合的服务接口，而非无限期保留重复字段或不一致的参数对；上述每一项 catalog 收缩都移除了在同一次执行、同一个 agent（智能体）或同一结果中其他位置已可获得的事实，并在同一变更中更新 API 参考。
-
-## 验收标准
-
-- 精确符号搜索显示：在本 Agent Note 及任何对已实现 Agent Note 的修正之外，没有被移除的接口。
-- 本 Agent Note 列出的每个接口均按指定方式移除或降级；清单之外有意保留的扩展/测试约定不变。
-- 工具执行、上下文压缩（context compaction）、两个 LLM 适配器、持久化 provider、工作流隔离以及 agent 创建/恢复保持其已交付行为。
-- 类型检查、覆盖率、快照、doc-sync（文档同步门禁）、module-graph 校验、构建和 hygiene 通过。
-
-## 风险
-
-大多数移除在编译时可见但对运行时无影响。上下文压缩参数清理有意禁止会话/上下文不匹配，同时保留手动 region API。外部预发布嵌入者和现有模型编写的 mount 可能导入更少的辅助函数、传递更少的参数或接收更窄的结果形状；这是有意的产品接口收缩，而非仅仅是生成 catalog 的清理。仓库尚未发布，因此承载不受支持的接口才是更大的基础成本。
diff --git a/.agents/notes/rejected/simplification/2026-07-12-prune-unused-skill-registry-api.i18n.yaml b/.agents/notes/rejected/simplification/2026-07-12-prune-unused-skill-registry-api.i18n.yaml
index 334f3c3c9b..17c796828a 100644
--- a/.agents/notes/rejected/simplification/2026-07-12-prune-unused-skill-registry-api.i18n.yaml
+++ b/.agents/notes/rejected/simplification/2026-07-12-prune-unused-skill-registry-api.i18n.yaml
@@ -9,8 +9,8 @@
en: dcd820314b04d01c
zh: c2131cbda05d276c
/agent-note-prune-unused-skill-registry-api/proposal:
- en: 803833583cc47fe4
- zh: f9cc914a2b1acb07
+ en: 6c1220fb96c93ba8
+ zh: c862f046d3794146
/agent-note-prune-unused-skill-registry-api/alternatives-considered:
en: b8f81e90df8b47c2
zh: 04d7b9c5fef53f6d
diff --git a/.agents/notes/rejected/simplification/2026-07-12-prune-unused-skill-registry-api.md b/.agents/notes/rejected/simplification/2026-07-12-prune-unused-skill-registry-api.md
index 23fb016329..fc91f74ee7 100644
--- a/.agents/notes/rejected/simplification/2026-07-12-prune-unused-skill-registry-api.md
+++ b/.agents/notes/rejected/simplification/2026-07-12-prune-unused-skill-registry-api.md
@@ -12,7 +12,7 @@ The skill service's embedded-runtime subsystem has zero production caller of `ct
Remove `SkillRegistry.register()`, `SkillRegistration`, the runtime pseudo-provider and reserved-name rules, runtime revisions/cache branches, and runtime-only source/rank normalization. Tests that need an embedded skill register a small real provider. Retain `providerRevision` as the in-flight discovery epoch, but key completed catalogs by cwd alone: every provider mutation synchronously clears the cache, and the post-await revision comparison already prevents inserting stale work. Remove `whenToUse`, `SkillCandidate.path`, and `SkillDefinition.path` from the skill contract and local-provider copies while retaining provider locator/root paths; retain `metadata`, `disableModelInvocation`, `source`, `provider`, `locator`, and `resourceBase` as either deliberate extension vocabulary or production-consumed fields.
-Amend the skill-system Agent Note, README, JSDoc, catalogs, and tests. Agent-scoped system-prompt sections, tool providers, and variables are explicitly outside this proposal: the [agent-scope contributor contract](../../implemented/architecture/2026-07-08-agent-scope-contexts.md) intentionally allows all three to be registered during `setup(agentCtx)` through the agent-owned context, so absence of a fixed in-repo scoped registration is not evidence of non-consumption.
+Amend the skill-system Agent Note, README, JSDoc, catalogs, and tests. Agent-scoped system-prompt sections, tool providers, and variables are explicitly outside this proposal: the [agent-scope contributor contract](../../../../packages/core/scope/README.md) intentionally allows all three to be registered during `setup(agentCtx)` through the agent-owned context, so absence of a fixed in-repo scoped registration is not evidence of non-consumption.
## Alternatives considered
diff --git a/.agents/notes/rejected/simplification/2026-07-12-prune-unused-skill-registry-api.zh.md b/.agents/notes/rejected/simplification/2026-07-12-prune-unused-skill-registry-api.zh.md
index e1496aab7b..c9b722454f 100644
--- a/.agents/notes/rejected/simplification/2026-07-12-prune-unused-skill-registry-api.zh.md
+++ b/.agents/notes/rejected/simplification/2026-07-12-prune-unused-skill-registry-api.zh.md
@@ -12,7 +12,7 @@ skill（技能）服务的嵌入式运行时子系统中，`ctx.skills.register(
移除 `SkillRegistry.register()`、`SkillRegistration`、运行时伪提供方及保留名称规则、运行时 revision/缓存分支，以及仅用于运行时的 source/rank 规范化逻辑。需要嵌入式 skill 的测试改为注册一个小型真实提供方。保留 `providerRevision` 作为进行中发现操作的 epoch，但已完成的目录缓存仅以 cwd 为键：每次提供方变更同步清除缓存，await 之后的 revision 比较已能阻止插入陈旧结果。从 skill 约定和本地提供方副本中移除 `whenToUse`、`SkillCandidate.path` 与 `SkillDefinition.path`，同时保留提供方的 locator/root 路径；保留 `metadata`、`disableModelInvocation`、`source`、`provider`、`locator` 和 `resourceBase`，因为它们要么是有意开放的扩展词汇，要么是生产消费的字段。
-同步修订 skill 系统 Agent Note、README、JSDoc、目录文件与测试。agent（智能体）作用域的系统提示词段、工具提供方和变量明确不在本提案范围内：[agent 作用域贡献者约定](../../implemented/architecture/2026-07-08-agent-scope-contexts.zh.md)有意允许在 `setup(agentCtx)` 期间通过 agent 拥有的上下文注册这三者，因此仓库内没有固定的作用域注册并不能证明它们未被使用。
+同步修订 skill 系统 Agent Note、README、JSDoc、目录文件与测试。agent（智能体）作用域的系统提示词段、工具提供方和变量明确不在本提案范围内：[agent 作用域贡献者约定](../../../../packages/core/scope/README.zh.md)有意允许在 `setup(agentCtx)` 期间通过 agent 拥有的上下文注册这三者，因此仓库内没有固定的作用域注册并不能证明它们未被使用。
## 曾考虑的替代方案
diff --git a/.agents/notes/rejected/simplification/2026-07-19-fold-compaction-package-split.i18n.yaml b/.agents/notes/rejected/simplification/2026-07-19-fold-compaction-package-split.i18n.yaml
index 7f181e0cc6..627c2b31ef 100644
--- a/.agents/notes/rejected/simplification/2026-07-19-fold-compaction-package-split.i18n.yaml
+++ b/.agents/notes/rejected/simplification/2026-07-19-fold-compaction-package-split.i18n.yaml
@@ -6,8 +6,8 @@
en: 22e69a4c9159be12
zh: c68cd8f8f536dc03
/agent-note-fold-the-single-compaction-backend-into-its-service-package/problem:
- en: 272d8d731bdf45b7
- zh: 7502a76b7d3cd367
+ en: c83a7bcd45d82228
+ zh: 13b4a0f635017335
/agent-note-fold-the-single-compaction-backend-into-its-service-package/proposal:
en: 4db8bc2ee4039e44
zh: e1a8c9714d1c4de0
diff --git a/.agents/notes/rejected/simplification/2026-07-19-fold-compaction-package-split.md b/.agents/notes/rejected/simplification/2026-07-19-fold-compaction-package-split.md
index 17d2ff5b8b..662de3cdc8 100644
--- a/.agents/notes/rejected/simplification/2026-07-19-fold-compaction-package-split.md
+++ b/.agents/notes/rejected/simplification/2026-07-19-fold-compaction-package-split.md
@@ -8,7 +8,7 @@ English | [中文](2026-07-19-fold-compaction-package-split.zh.md)
Compaction is split between `@deepseek-ai/dsh-compaction`, which owns an abstract two-method service and shared types, and `@deepseek-ai/dsh-compaction-basic`, which owns the only complete provider. Shipped configurations load only the basic package, and no production package independently consumes the Service Definition package except that provider.
-The split adds a package manifest, README, project boundary, dependency edge, abstract forwarding class, generated catalog entries, and composition wiring without demonstrating backend substitution. The [capability-seam decision](../../implemented/architecture/2026-06-13-capability-seams.md) requires a real interface, implementation, and consumer rather than a preemptive split; the [compaction decision](../../implemented/feature/2026-06-18-compaction-capability-seam.md) records that its independent consumer was deferred.
+The split adds a package manifest, README, project boundary, dependency edge, abstract forwarding class, generated catalog entries, and composition wiring without demonstrating backend substitution. The [capability-seam decision](../../implemented/architecture/2026-06-13-capability-seams.md) requires a real interface, implementation, and consumer rather than a preemptive split; the [historical compaction decision](../../archived/feature/2026-06-18-compaction-capability-seam.md) records that its independent consumer was deferred.
## Proposal
diff --git a/.agents/notes/rejected/simplification/2026-07-19-fold-compaction-package-split.zh.md b/.agents/notes/rejected/simplification/2026-07-19-fold-compaction-package-split.zh.md
index a981e00965..cc302d2bff 100644
--- a/.agents/notes/rejected/simplification/2026-07-19-fold-compaction-package-split.zh.md
+++ b/.agents/notes/rejected/simplification/2026-07-19-fold-compaction-package-split.zh.md
@@ -8,7 +8,7 @@ Status: rejected — 计划增加更多压缩后端，因此 Service Definition
压缩（compaction）目前拆分在两个包中：`@deepseek-ai/dsh-compaction` 拥有一个含两个方法的抽象服务和共享类型，`@deepseek-ai/dsh-compaction-basic` 拥有唯一的完整提供方。交付配置只加载 basic 包，除了该提供方外，没有生产包独立消费 Service Definition 包。
-该拆分增加了一份包 manifest（元数据清单）、README、项目边界、依赖边、抽象转发类、生成目录项和组合接线，却没有实际的后端替换用例。[能力 seam 决策](../../implemented/architecture/2026-06-13-capability-seams.zh.md)要求接口、实现和消费方都必须真实存在，而不能预先拆分；[压缩决策](../../implemented/feature/2026-06-18-compaction-capability-seam.zh.md)也记录了独立消费方的实现仍被推迟。
+该拆分增加了一份包 manifest（元数据清单）、README、项目边界、依赖边、抽象转发类、生成目录项和组合接线，却没有实际的后端替换用例。[能力 seam 决策](../../implemented/architecture/2026-06-13-capability-seams.zh.md)要求接口、实现和消费方都必须真实存在，而不能预先拆分；[历史压缩决策](../../archived/feature/2026-06-18-compaction-capability-seam.md)也记录了独立消费方的实现仍被推迟。
## 提案
diff --git a/.agents/notes/rejected/simplification/2026-07-19-make-jsonrpc-directional.i18n.yaml b/.agents/notes/rejected/simplification/2026-07-19-make-jsonrpc-directional.i18n.yaml
deleted file mode 100644
index a90825c6c8..0000000000
--- a/.agents/notes/rejected/simplification/2026-07-19-make-jsonrpc-directional.i18n.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# Bilingual-pair consistency record for 2026-07-19-make-jsonrpc-directional.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write .agents/notes/rejected/simplification/2026-07-19-make-jsonrpc-directional.md
-/agent-note-make-json-rpc-completion-and-transport-directional:
- en: ee6e55930abd711c
- zh: 8f42bc9a2ae73653
-/agent-note-make-json-rpc-completion-and-transport-directional/problem:
- en: d464014520aeb2ba
- zh: 8d5b916ec1e52ae2
-/agent-note-make-json-rpc-completion-and-transport-directional/proposal:
- en: 1877df56f4a6c009
- zh: 88945feba13fd7f2
-/agent-note-make-json-rpc-completion-and-transport-directional/implementation-plan:
- en: 98d36962531961b4
- zh: 732397d5ac3e9da5
-/agent-note-make-json-rpc-completion-and-transport-directional/alternatives-considered:
- en: aa128111a837e3ce
- zh: e2e70c0e7ca577f4
-/agent-note-make-json-rpc-completion-and-transport-directional/acceptance-criteria:
- en: c003617f26b1b309
- zh: a0c92fd01a820b9d
-/agent-note-make-json-rpc-completion-and-transport-directional/risks:
- en: 2a4ab79704013a71
- zh: 17722ca6beff0536
diff --git a/.agents/notes/rejected/simplification/2026-07-19-make-jsonrpc-directional.md b/.agents/notes/rejected/simplification/2026-07-19-make-jsonrpc-directional.md
deleted file mode 100644
index 0a4660bbf1..0000000000
--- a/.agents/notes/rejected/simplification/2026-07-19-make-jsonrpc-directional.md
+++ /dev/null
@@ -1,46 +0,0 @@
-# Agent Note: Make JSON-RPC completion and transport directional
-
-Status: rejected — session/prompt became an enqueue receipt without status (2026-07-30-followup-enqueue-and-owned-runs); transport narrowing may be re-proposed alone
-
-English | [中文](2026-07-19-make-jsonrpc-directional.zh.md)
-
-## Problem
-
-The JSON-RPC bridge models both endpoints as symmetric peers although the shipped protocol is directional. The shared transport (now `dsh-sdk-protocol`, used by the server and by the TypeScript SDK client, which exercises the outbound-request/inbound-notification direction) still implements two halves no endpoint uses: server-originated requests and client-originated notifications. The Python SDK sends requests and receives responses or notifications, but it also queues unused inbound server requests and exposes response helpers.
-
-`session/prompt` also reports one settled turn through two protocol shapes. The server emits `session.finished` and then returns the constant `{ accepted: true }`; the Python SDK discards that response and waits for the notification to recover the status. Because the response is written only after the handler returns, the notification necessarily precedes the constant response on the same stream.
-
-The unused halves add pending-request maps, generated IDs, request queues, close-time rejection paths, response helpers, and a second completion waiter without serving a production caller.
-
-## Proposal
-
-Specialize each endpoint to its actual role. The server keeps inbound requests, outbound responses, and outbound notifications; the TypeScript and Python clients keep outbound requests and inbound responses or notifications. Delete the direction no endpoint uses — server-originated requests and client-originated notifications.
-
-Return the settled outcome directly from `session/prompt` as `{ status, reason }` after `agent.whenIdle()`. Delete `session.finished`, the constant acceptance response, and the Python post-response completion loop. `session.event` and subagent notifications still stream before the response, and durable session events remain the source for final-response reconstruction.
-
-## Implementation plan
-
-1. In `packages/sdk/server/src/server.ts`, replace `SessionPromptResult.accepted` with `status: 'ok' | 'error' | 'aborted'` and the captured `TurnEndReason`. `HarnessSdkJsonRpcServer.prompt()` will return `completed` as `ok`, `aborted` as `aborted`, and every other current or merge-extensible reason as `error`; reaching idle without a `turn/end` remains an invariant error. Remove only `session.finished`, leaving `session.event`, `subagent.started`, and `subagent.finished` unchanged.
-2. In `packages/sdk/protocol/src/transport.ts`, narrow the shared class to the directions with consumers — inbound requests/outbound responses (the server) and outbound requests/inbound responses plus inbound notifications (the TypeScript SDK client) — removing only server-originated `request()` use and client-originated notification dispatch, or split the class into a server-side and client-side transport. Request result, method-not-found, and handler-error responses retain their current behavior and remain ordered after notifications emitted by the awaited handler.
-3. In `python/sdk/src/deepseek_harness/client.py`, `models.py`, and `__init__.py`, remove `IncomingRequest`, `_requests`, `notify()`, `next_request()`, `respond()`, and `respond_error()`. Add a public validated `SessionPromptResponse` carrying status and reason, return it from `session_prompt()`, and keep an explicit reader guard that ignores unexpected server-request frames instead of allowing them to match a response waiter.
-4. In `python/sdk/src/deepseek_harness/api.py`, build `TurnResult.status` and a new `TurnResult.reason` from `SessionPromptResponse`, then delete the `session.finished` branch and second completion loop. Keep the subscription open during the request and preserve `_request_raw()`'s final notification drain so the last `turn/end` event and any subagent notification written before the response are collected before `Session.run()` reconstructs the final assistant message.
-5. Replace the symmetric transport-pair cases in `packages/sdk/protocol/tests/transport.spec.ts` with per-direction coverage, and update `server.spec.ts`, `plugin-apply.spec.ts`, and `built-scope-carrier.e2e.ts` for direct outcomes, ordering, overlap, shutdown, and the narrowed fake; update the TypeScript SDK client (`packages/sdk/client`) and its suites for response-based settlement. Update `python/sdk/tests/test_client.py` for response-based settlement, unexpected-request-frame handling, callback and concurrency behavior, and the removed public helpers. Update the JSON-RPC and bilingual Python SDK READMEs, export JSDoc and declarations, `scripts/smoke-python-runtime.py`, and the Python single-executable snapshot.
-
-## Alternatives considered
-
-**Keep a generic symmetric JSON-RPC peer for future methods.** Server-initiated requests may eventually support interactive permissions, but no typed method or production consumer exists. The pre-release protocol can add the smallest required direction when that feature is designed instead of carrying an unexercised peer in the shipped protocol.
-
-**Keep `session.finished` for streaming clients.** Turn settlement is not incremental data: the request response already marks the same boundary and follows all earlier notifications on the ordered stream. A second terminal notification creates two representations that clients must reconcile.
-
-## Acceptance criteria
-
-- The TypeScript endpoint cannot originate requests or consume notifications.
-- The Python endpoint cannot originate notifications or consume server requests.
-- `session/prompt` returns the authoritative `ok`, `error`, or `aborted` outcome and reason after turn settlement.
-- Session events and subagent lifecycle notifications emitted during the turn arrive before the response.
-- Same-session overlap rejection, framing, multibyte input, handler errors, flush, shutdown ordering, and final-response reconstruction retain their behavior.
-- TypeScript bridge tests, Python SDK tests, built JSON-RPC coverage, snapshots, and generated API documentation pass.
-
-## Risks
-
-This deliberately narrows the pre-release wire protocol. Raw clients listening only for `session.finished`, or embedders using the unused symmetric transport methods, must move to the prompt response. A future server-initiated request requires a new typed protocol addition rather than reusing generic dormant machinery.
diff --git a/.agents/notes/rejected/simplification/2026-07-19-make-jsonrpc-directional.zh.md b/.agents/notes/rejected/simplification/2026-07-19-make-jsonrpc-directional.zh.md
deleted file mode 100644
index 706a342d6e..0000000000
--- a/.agents/notes/rejected/simplification/2026-07-19-make-jsonrpc-directional.zh.md
+++ /dev/null
@@ -1,46 +0,0 @@
-# Agent Note: 让 JSON-RPC 完成结果与传输方向单一化
-
-Status: rejected — session/prompt became an enqueue receipt without status (2026-07-30-followup-enqueue-and-owned-runs); transport narrowing may be re-proposed alone
-
-[English](2026-07-19-make-jsonrpc-directional.md) | 中文
-
-## 问题
-
-JSON-RPC 桥接层把两个端点都建模为对称的对等端，但实际协议具有固定方向。共享传输层（现为 `dsh-sdk-protocol`，由服务端与 TypeScript SDK 客户端共用，后者行使出站请求/入站通知方向）仍实现着没有任何端点使用的两个半边：服务端发起的请求与客户端发起的通知。Python SDK 发送请求并接收响应或通知，却还会把来自服务端、但未使用的入站请求放入队列，并公开响应辅助方法。
-
-`session/prompt` 还会用两种协议结构报告同一个已结束轮次。服务端先发出 `session.finished`，再返回常量 `{ accepted: true }`；Python SDK 丢弃该响应，转而等待通知以取得状态。响应只有在处理函数返回后才会写入，因此在同一条有序流上，通知必然先于这个常量响应。
-
-这些未使用的双向能力引入了待处理请求表、生成 ID、请求队列、关闭时的拒绝路径、响应辅助方法和第二套完成等待逻辑，却没有任何生产调用方使用。
-
-## 提案
-
-按实际角色收窄两个端点。服务端保留入站请求、出站响应和出站通知；TypeScript 与 Python 客户端保留出站请求以及入站响应或通知。删除没有任何端点使用的方向——服务端发起的请求与客户端发起的通知。
-
-在 `agent.whenIdle()` 完成后，由 `session/prompt` 直接返回 `{ status, reason }` 作为轮次结果。删除 `session.finished`、常量接纳响应以及 Python 中响应后的完成等待循环。`session.event` 与 subagent 通知仍在响应前流式发出，持久化会话事件仍是最终响应重建的真源。
-
-## 实施计划
-
-1. 在 `packages/sdk/server/src/server.ts` 中，用 `status: 'ok' | 'error' | 'aborted'` 和捕获的 `TurnEndReason` 替换 `SessionPromptResult.accepted`。`HarnessSdkJsonRpcServer.prompt()` 把 `completed` 映射为 `ok`，把 `aborted` 映射为 `aborted`，把其他当前已有或可通过声明合并扩展的原因映射为 `error`；进入空闲状态却没有 `turn/end` 仍视为不变量错误。只删除 `session.finished`，保持 `session.event`、`subagent.started` 和 `subagent.finished` 不变。
-2. 在 `packages/sdk/protocol/src/transport.ts` 中，把共享类收窄到有消费者的方向——入站请求/出站响应（服务端）与出站请求/入站响应及入站通知（TypeScript SDK 客户端）——只删除服务端发起的 `request()` 用法与客户端发起的通知分发，或把该类拆分为服务端与客户端两个传输。请求结果、方法不存在与处理器错误响应保持原有行为，并继续排在被等待处理器发出的通知之后。
-3. 在 `python/sdk/src/deepseek_harness/client.py`、`models.py` 和 `__init__.py` 中，删除 `IncomingRequest`、`_requests`、`notify()`、`next_request()`、`respond()` 和 `respond_error()`。新增公开且经过校验的 `SessionPromptResponse` 来携带状态与原因，由 `session_prompt()` 返回该对象，并保留明确的读取保护：忽略意外的服务端请求帧，避免它们命中响应等待器。
-4. 在 `python/sdk/src/deepseek_harness/api.py` 中，根据 `SessionPromptResponse` 构造 `TurnResult.status` 和新增的 `TurnResult.reason`，再删除 `session.finished` 分支与第二个完成循环。请求期间保持订阅打开，并保留 `_request_raw()` 最后的通知排空步骤，确保写在响应前的最后一条 `turn/end` 事件与任何 subagent 通知，都会在 `Session.run()` 重建最终助手消息之前被收集。
-5. 用按方向的覆盖替换 `packages/sdk/protocol/tests/transport.spec.ts` 中的对称传输对用例，并更新 `server.spec.ts`、`plugin-apply.spec.ts` 和 `built-scope-carrier.e2e.ts`，覆盖直接结果、顺序、重叠、关闭和收窄后的伪实现；同步更新 TypeScript SDK 客户端（`packages/sdk/client`）及其套件以采用基于响应的结束流程。更新 `python/sdk/tests/test_client.py`，覆盖基于响应的结束流程、意外请求帧处理、回调与并发行为，以及已删除的公开辅助方法。同步更新 JSON-RPC README、双语 Python SDK README、导出 JSDoc 与声明、`scripts/smoke-python-runtime.py` 和 Python 单可执行文件快照。
-
-## 备选方案
-
-**为未来方法保留通用的对称 JSON-RPC 对等端。** 服务端发起的请求将来可能用于交互式权限，但没有类型化方法或生产消费方。该功能完成设计后，预发布协议可以增加所需的最小方向，无需提前保留未使用的对等端能力。
-
-**为流式客户端保留 `session.finished`。** 轮次结束不是增量数据：请求响应已经标识同一个边界，并且在有序流中位于先前所有通知之后。第二条终止通知会产生两种结果表示，迫使客户端进行协调。
-
-## 验收标准
-
-- TypeScript 端点无法发起请求，也不消费通知。
-- Python 端点无法发起通知，也不消费服务端请求。
-- 轮次结束后，`session/prompt` 返回权威的 `ok`、`error` 或 `aborted` 状态及其原因。
-- 轮次中发出的会话事件与 subagent 生命周期通知都先于响应到达。
-- 同一会话的重叠拒绝、分帧、多字节输入、处理器错误、flush、关闭顺序与最终响应重建保持原有行为。
-- TypeScript 桥接测试、Python SDK 测试、构建后 JSON-RPC 覆盖、快照和生成的 API 文档全部通过。
-
-## 风险
-
-本提案会刻意收窄预发布协议格式。仅监听 `session.finished` 的原始客户端，以及使用未使用对称传输方法的嵌入方，都必须改为读取请求响应。未来若需要服务端发起请求，应新增类型化协议，而不是复用休眠的通用机制。
diff --git a/.agents/notes/rejected/simplification/2026-07-26-dependency-swaps-rejected-by-nih-audit.i18n.yaml b/.agents/notes/rejected/simplification/2026-07-26-dependency-swaps-rejected-by-nih-audit.i18n.yaml
index 0b54901ab4..ab9a40ab32 100644
--- a/.agents/notes/rejected/simplification/2026-07-26-dependency-swaps-rejected-by-nih-audit.i18n.yaml
+++ b/.agents/notes/rejected/simplification/2026-07-26-dependency-swaps-rejected-by-nih-audit.i18n.yaml
@@ -9,8 +9,8 @@
en: 7b7248fc12313b69
zh: a55e2c3376c401a7
/agent-note-dependency-swaps-rejected-by-the-2026-07-nih-audit/proposal:
- en: 0a8ed95bec08cf62
- zh: 06de9cab1c862ac4
+ en: d95debbdb2a7e730
+ zh: 1edbf6ca992a2319
/agent-note-dependency-swaps-rejected-by-the-2026-07-nih-audit/alternatives-considered:
en: 229a0110ca47384e
zh: 3f86f858d56190c5
diff --git a/.agents/notes/rejected/simplification/2026-07-26-dependency-swaps-rejected-by-nih-audit.md b/.agents/notes/rejected/simplification/2026-07-26-dependency-swaps-rejected-by-nih-audit.md
index 1ea01d96c5..aa95cee133 100644
--- a/.agents/notes/rejected/simplification/2026-07-26-dependency-swaps-rejected-by-nih-audit.md
+++ b/.agents/notes/rejected/simplification/2026-07-26-dependency-swaps-rejected-by-nih-audit.md
@@ -30,7 +30,7 @@ Adopt the following dependency swaps. Rejected — per-item evidence below; a fu
**Data and validation:**
-- **Ajv for the tools JSON Schema validator**: the [schema-DSL note](../../implemented/architecture/2026-07-20-unified-json-value-schema-dsl.md) explicitly rejected accepting a larger schema language; the validator also does realm-intrinsic prototype checks Ajv does not.
+- **Ajv for the tools JSON Schema validator**: the [schema-DSL reference](../../../../packages/core/tools/README.md) explicitly rejected accepting a larger schema language; the validator also does realm-intrinsic prototype checks Ajv does not.
- **`structuredClone` for session `snapshotJsonValue`/`isJsonValue`**: it is a validator + detacher enforcing the lossless-JSON boundary with single-read-per-getter and cross-realm intrinsic checks; `structuredClone` accepts Map/Date/-0 and enforces nothing. Same for the deliberately dependency-free `ptc-runtime-worker` mirror hardened against a model-mutated realm.
- **`fast-deep-equal` for session surface `isDeepEqualJson`** and **`safe-stable-stringify` for repeat-tool-reminder canonicalization**: both swaps work mechanically but each trades ~17–20 commented, tested lines for the first external runtime dependency of a core package — negative net at this size.
- **zod/valibot for durable-event strict decoders** (goal fold, tool-ralph, session): exact-key fail-loud decoders at durable boundaries with event-specific messages; a second schema library beside repo-standard schemastery is a policy change, not a deletion.
@@ -39,8 +39,8 @@ Adopt the following dependency swaps. Rejected — per-item evidence below; a fu
**Filesystem, subprocess, terminal:**
-- **`write-file-atomic` for fs-local/storage-json atomic writes**: the packages lack the private 0700 staging dir, Win32 DACL copy/`ReplaceFileW`, AbortSignal support, and parent-dir fsync — each the point of the hand-roll. The koffi Win32 bindings themselves are justified by the [Windows durable-publish note](../../implemented/architecture/2026-07-05-windows-jsonl-durable-publish.md).
-- **`fzstd`/native zstd packages for JSONL frame scanning**: `node:zlib`'s builtin zstd already does the compression ([zstd note](../../implemented/architecture/2026-07-19-zstandard-jsonl-session-logs.md), which explicitly rejected an external native dependency); the remaining `scanZstdFrames` locates RFC 8878 frame boundaries *without decompressing* for torn-tail repair, which no package exposes.
+- **`write-file-atomic` for fs-local/storage-json atomic writes**: the packages lack the private 0700 staging dir, Win32 DACL copy/`ReplaceFileW`, AbortSignal support, and parent-dir fsync — each the point of the hand-roll. The koffi Win32 bindings themselves are justified by the [Windows durable-publish reference](../../../../packages/session/session-persistence-jsonl/src/win32.ts).
+- **`fzstd`/native zstd packages for JSONL frame scanning**: `node:zlib`'s builtin zstd already does the compression ([zstd reference](../../../../packages/session/session-persistence-jsonl/README.md), which explicitly rejected an external native dependency); the remaining `scanZstdFrames` locates RFC 8878 frame boundaries *without decompressing* for torn-tail repair, which no package exposes.
- **`picomatch`/`tinyglobby`/`ignore` for fs search**: no glob engine exists — both discovery tools shell out to ripgrep per the [bash-backed discovery note](../../archived/feature/2026-07-09-bash-backed-grep-glob-discovery.md).
- **`istextorbinary`/`chardet` for text detection**: the hand-roll is a ~15-line NUL-sample plus fatal `TextDecoder`; heuristic packages are larger and would change which files the model can read (model-visible `FS_NOT_TEXT` drift).
- **`shell-quote` for POSIX single-quoting**: two 1-line quoting helpers with exhaustive tests versus a maintenance-mode package with a CVE history and different escaping output — a safety boundary is the wrong place to save one line.
@@ -62,7 +62,7 @@ Adopt the following dependency swaps. Rejected — per-item evidence below; a fu
**Repo tooling:**
-- **`wireit` for `run-gates.ts`**: could express the `needs:` graph, but allowFailure observational legs and mode-specific concurrency caps have no equivalent, caching must be defensively disabled for a correctness gate runner, and every CI workflow invocation would restructure. The [parallel-gates note](../../implemented/process/2026-07-06-parallel-pre-push-gates.md) accepts a custom scheduler as the cost; keep is defensible.
+- **`wireit` for `run-gates.ts`**: could express the `needs:` graph, but allowFailure observational legs and mode-specific concurrency caps have no equivalent, caching must be defensively disabled for a correctness gate runner, and every CI workflow invocation would restructure. The [parallel-gates reference](../../../../scripts/run-gates.ts) accepts a custom scheduler as the cost; keep is defensible.
- **`@arethetypeswrong/cli` for `verify-node-next-types`**: attw is per-package (100+ invocations vs one fast whole-workspace compile) and does not check the repo-specific explicit-`.ts`-specifier invariant, so the scan half stays regardless. Recorded as considered; keep the script.
- **`syncpack`/`manypkg` for `check-workspace-constraints.ts`**: they cover ~20 lines of range alignment; the load-bearing 200+ lines (computed `files` lists, cordis peer=dev pairing, hierarchy shape) are repo policy no generic engine expresses.
- **`remark-validate-links` for `verify-md-links.ts`**: the gate rides the repo's shared mdast toolchain; adopting remark-cli adds a second markdown stack to delete one small file.
diff --git a/.agents/notes/rejected/simplification/2026-07-26-dependency-swaps-rejected-by-nih-audit.zh.md b/.agents/notes/rejected/simplification/2026-07-26-dependency-swaps-rejected-by-nih-audit.zh.md
index d7140b88a7..943753a5b4 100644
--- a/.agents/notes/rejected/simplification/2026-07-26-dependency-swaps-rejected-by-nih-audit.zh.md
+++ b/.agents/notes/rejected/simplification/2026-07-26-dependency-swaps-rejected-by-nih-audit.zh.md
@@ -30,7 +30,7 @@ Status: rejected — 下列每一项替换在证据上都未达到净简化门
**数据与校验：**
-- **以 Ajv 承担 tools 的 JSON Schema 校验器**：[schema DSL 决策](../../implemented/architecture/2026-07-20-unified-json-value-schema-dsl.zh.md)已明确否决接纳更大的 schema 语言；这个校验器还会做 Ajv 不做的、针对 realm 内建原型的检查。
+- **以 Ajv 承担 tools 的 JSON Schema 校验器**：[schema DSL 参考](../../../../packages/core/tools/README.zh.md)已明确否决接纳更大的 schema 语言；这个校验器还会做 Ajv 不做的、针对 realm 内建原型的检查。
- **以 `structuredClone` 替换会话的 `snapshotJsonValue`/`isJsonValue`**：它是校验器加分离器，以「每个 getter 只读一次」和跨 realm 内建对象检查强制执行无损 JSON 边界；`structuredClone` 接受 Map/Date/-0，什么都不强制。有意保持零依赖、针对被模型篡改的 realm 做过加固的 `ptc-runtime-worker` 镜像实现同理。
- **以 `fast-deep-equal` 替换会话接口面的 `isDeepEqualJson`**、**以 `safe-stable-stringify` 承担 repeat-tool-reminder 的规范化**：两项替换在机械层面都可行，但每一项都是拿约 17–20 行带注释、有测试的代码，去换一个核心包的第一个外部运行时依赖——在这个体量上是净亏损。
- **以 zod/valibot 承担持久事件的严格解码器**（goal fold、tool-ralph、session）：它们是位于持久化边界、键集精确匹配、失败即明确报错、带事件专属报错信息的解码器；在仓库标准 schemastery 之外再放一个 schema 库是政策变更，不是删除。
@@ -39,8 +39,8 @@ Status: rejected — 下列每一项替换在证据上都未达到净简化门
**文件系统、子进程与终端：**
-- **以 `write-file-atomic` 承担 fs-local/storage-json 的原子写**：这些包缺少私有 0700 暂存目录、Win32 DACL 复制/`ReplaceFileW`、AbortSignal 支持和父目录 fsync——每一项都正是手写实现的意义所在。koffi Win32 绑定本身由 [Windows 持久发布决策](../../implemented/architecture/2026-07-05-windows-jsonl-durable-publish.zh.md)提供依据。
-- **以 `fzstd`/原生 zstd 包承担 JSONL 帧扫描**：`node:zlib` 内置的 zstd 已经负责压缩（[zstd 决策](../../implemented/architecture/2026-07-19-zstandard-jsonl-session-logs.zh.md)，其中明确否决了外部原生依赖）；剩下的 `scanZstdFrames` 为撕裂尾部修复*不做解压*地定位 RFC 8878 帧边界，没有任何包公开这项能力。
+- **以 `write-file-atomic` 承担 fs-local/storage-json 的原子写**：这些包缺少私有 0700 暂存目录、Win32 DACL 复制/`ReplaceFileW`、AbortSignal 支持和父目录 fsync——每一项都正是手写实现的意义所在。koffi Win32 绑定本身由 [Windows 持久发布参考](../../../../packages/session/session-persistence-jsonl/src/win32.ts)提供依据。
+- **以 `fzstd`/原生 zstd 包承担 JSONL 帧扫描**：`node:zlib` 内置的 zstd 已经负责压缩（[zstd 参考](../../../../packages/session/session-persistence-jsonl/README.zh.md)，其中明确否决了外部原生依赖）；剩下的 `scanZstdFrames` 为撕裂尾部修复*不做解压*地定位 RFC 8878 帧边界，没有任何包公开这项能力。
- **以 `picomatch`/`tinyglobby`/`ignore` 承担 fs 搜索**：根本不存在 glob 引擎——依照 [bash 承载的发现工具决策](../../archived/feature/2026-07-09-bash-backed-grep-glob-discovery.md)，两个发现类工具都通过 shell 调用 ripgrep。
- **以 `istextorbinary`/`chardet` 承担文本检测**：手写实现是约 15 行的 NUL 采样加 fatal 模式的 `TextDecoder`；启发式包体量更大，还会改变模型能读到哪些文件（模型可见的 `FS_NOT_TEXT` 漂移）。
- **以 `shell-quote` 承担 POSIX 单引号包裹**：两个各 1 行、测试详尽的引号辅助函数，对上一个处于维护模式、有 CVE 历史、转义输出还不一样的包——安全边界不是省一行代码的地方。
@@ -62,7 +62,7 @@ Status: rejected — 下列每一项替换在证据上都未达到净简化门
**仓库工具链：**
-- **以 `wireit` 替换 `run-gates.ts`**：它能表达 `needs:` 图，但 allowFailure 观测支路和按模式设置的并发上限没有等价物，对一个正确性门禁运行器来说缓存必须防御性禁用，而且每一处 CI 工作流调用都要重构。[并行门禁决策](../../implemented/process/2026-07-06-parallel-pre-push-gates.zh.md)把自研调度器认作代价；保留是站得住的。
+- **以 `wireit` 替换 `run-gates.ts`**：它能表达 `needs:` 图，但 allowFailure 观测支路和按模式设置的并发上限没有等价物，对一个正确性门禁运行器来说缓存必须防御性禁用，而且每一处 CI 工作流调用都要重构。[并行门禁说明](../../../../scripts/run-gates.ts)把自研调度器认作代价；保留是站得住的。
- **以 `@arethetypeswrong/cli` 替换 `verify-node-next-types`**：attw 按包运行（100+ 次调用对一次快速的全工作区编译），而且不检查仓库特有的显式 `.ts` 说明符不变式，因此扫描的那一半无论如何都得保留。记录为已考虑；保留脚本。
- **以 `syncpack`/`manypkg` 替换 `check-workspace-constraints.ts`**：它们只覆盖约 20 行的版本范围对齐；承重的 200+ 行（计算生成的 `files` 列表、cordis peer=dev 配对、层级形状）是仓库政策，没有通用引擎能表达。
- **以 `remark-validate-links` 替换 `verify-md-links.ts`**：该门禁搭载仓库共享的 mdast 工具链；采用 remark-cli 等于为删掉一个小文件而增加第二套 markdown 技术栈。
diff --git a/.agents/skills/dsh-code-review/SKILL.md b/.agents/skills/dsh-code-review/SKILL.md
index bc145e212a..484cd1c288 100644
--- a/.agents/skills/dsh-code-review/SKILL.md
+++ b/.agents/skills/dsh-code-review/SKILL.md
@@ -15,7 +15,7 @@ description: Use when reviewing a pull request in the deepseek-harness repo —
- [dsh-prose-standard](../dsh-prose-standard/SKILL.md): required coverage and editorial judgment for comments, docs, prompts, and visible strings.
- [dsh-ci-test-reliability](../dsh-ci-test-reliability/SKILL.md): isolation and regression-proof rules for resource-owning, asynchronous, or flaky tests and fixtures.
- [dsh-client-ui-ux](../dsh-client-ui-ux/SKILL.md): feedback-surface choice, overlay safety, platform window adaptation, and visual token discipline for product-user-visible GUI changes.
-- [docs/testing.md](../../../docs/testing.md) and the [quality-gates Agent Note](../../notes/implemented/process/2026-06-11-quality-gates.md): required test tiers and gates.
+- [docs/testing.md](../../../docs/testing.md) and the [quality-gates reference](../../../docs/testing.md): required test tiers and gates.
- [Agent Notes](../../notes/README.md): design rationale. Treat disagreement with an Agent Note as a design discussion, not an automatic veto.
- For bilingual changes, read [translation-rules.md](../../../docs/i18n/translation-rules.md) and [terminology.md](../../../docs/i18n/terminology.md); the extended translation skill is outside automatic review and runs only on explicit user invocation.
@@ -25,9 +25,8 @@ description: Use when reviewing a pull request in the deepseek-harness repo —
2. **Docs match the code.** Config, defaults, errors, wire fields, events, and public behavior update the package README and JSDoc in the same diff. Comments state non-obvious contracts; flag implementation narration, test walkthroughs, review history, and duplicated rationale for deletion or a link to their one home.
3. **Core type docs match.** Changes to spine or seam vocabulary update the appropriate [subsystems](../../../docs/subsystems/README.md) page and any `type-equiv` entry. Internal types need no catalog entry.
4. **Registrations clean up.** Verify each new registry contribution passes the disposal tests required by [packages/AGENTS.md](../../../packages/AGENTS.md).
-5. **Invariant companions are semantic.** For every touched `./invariant`, require an owner event-stream or mutable-data relationship with independent observations at the point where that package can observe it; service or method presence, plugin metadata or effects, fixed pure examples, and probes that call the same operation they claim to verify belong in load, behavior, or unit tests. When no plausible relationship exists, require the package to omit the companion and publication wiring and record its package-specific reason in the README. Reject empty installers and invented checks ([repository rule](../../../AGENTS.md#conventions); [package invariant rules](../../../packages/AGENTS.md)).
-6. **Required evidence exists.** Verify the author ran the [relevant local checks](../../../AGENTS.md#run-relevant-checks-locally) for the diff and that CI covers the exhaustive matrix; review the semantic gaps neither can detect.
-7. **Client UI copy is locale-owned.** Reject product text embedded in JSX, templates, helper returns, accessibility attributes, or primitive defaults. Require typed dictionary keys, the standard `t` seat or explicit localized props, `verify-client-ui-i18n`, and behavior evidence in each affected locale; preserve user/model/wire data and code tokens verbatim.
+5. **Required evidence exists.** Verify the author ran the [relevant local checks](../../../AGENTS.md#run-relevant-checks-locally) for the diff and that CI covers the exhaustive matrix; review the semantic gaps neither can detect.
+6. **Client UI copy is locale-owned.** Reject product text embedded in JSX, templates, helper returns, accessibility attributes, or primitive defaults. Require typed dictionary keys, the standard `t` seat or explicit localized props, `verify-client-ui-i18n`, and behavior evidence in each affected locale; preserve user/model/wire data and code tokens verbatim.
## Manual checks
@@ -43,7 +42,7 @@ description: Use when reviewing a pull request in the deepseek-harness repo —
- **Real entry path:** tests exercise the shipped Loader, bin, worker, ACP bridge, or subprocess where relevant. A hand-mounted plugin does not catch invalid Loader exports; a function plugin must named-export its namespace and have no default export.
- **Test strength:** assertions fail on the intended regression and verify external state, logs, events, or disposal rather than restating the implementation or trusting an agent's report. Coverage is necessary but not evidence that the scenario is correct.
- **Test reliability:** for a resource-owning, asynchronous, platform-sensitive, or flaky test, apply [dsh-ci-test-reliability](../dsh-ci-test-reliability/SKILL.md) to the real worker/job topology, resource allocation, global-state restoration, synchronization, timeout budget, and quiescent teardown.
-- **Invariant lifecycle and negative controls:** verify candidate observations are rejected before publication where possible, session-backed checks reconstruct durable history after late loading or HMR, and a deliberately invalid case fails through the real runner for the intended rule.
+- **Negative controls:** verify a deliberately invalid case fails through the real runner for each changed acceptance rule.
- **Implemented Agent Notes match shipped reality:** when a PR implements a proposed Agent Note, move and rewrite it as present-tense shipped state in the same diff, then verify paths, names, and mechanisms against the implementation.
- **Transcript changes:** editor-visible or model-visible changes update snapshots or explain why no snapshot applies. Review expected-output diffs as behavior changes, not formatting noise.
- **Bilingual changes:** compare meaning and terminology on both sides; a green pairing hash does not prove translation quality.
diff --git a/.agents/skills/dsh-find-simplifications/SKILL.md b/.agents/skills/dsh-find-simplifications/SKILL.md
index 53444db411..fe98baba29 100644
--- a/.agents/skills/dsh-find-simplifications/SKILL.md
+++ b/.agents/skills/dsh-find-simplifications/SKILL.md
@@ -30,7 +30,7 @@ Use these questions to guide discovery. Read the relevant section of [historical
Start with `rg`, then read the matches. Search exact symbols, property reads and writes, discriminants, event and wire strings, config keys, package names, and both `.method(` and `method(` forms. Tests and declarations can show a contract without proving a shipped producer or consumer.
-Include `packages/*/*/src`, `apps/`, `python/`, runtime scripts, shipped profiles and overlays, package manifests and exports, loader resolution, generated runtime assets, and installed-package consumers. Classify examples and fixtures by their actual entry point rather than directory name. Follow generated catalogs to their consumers: a catalog used by model-written plugin mounts is a dynamic product API, while a documentation-only listing is not a fixed caller. Public third-party extension paths can be intentional despite zero repository call sites.
+Include `packages/*/*/src`, `apps/`, `python/`, runtime scripts, shipped profiles and overlays, package manifests and exports, loader resolution, generated runtime assets, and installed-package consumers. Classify examples and fixtures by their actual entry point rather than directory name. Follow generated catalogs to their consumers: a catalog used by model-written plugin mounts is a dynamic product API, while a documentation-only listing is not a fixed caller. Public third-party extension paths can be intentional despite zero repository call sites. A static unused-code checker must cover manifest-driven loading, generated outputs, and compiler faces without maintaining a parallel per-workspace exception inventory.
For each candidate, record the current owner, effective producer/consumer path, what disappears, what remains, and the strongest reason to retain it. Distinguish:
@@ -46,8 +46,6 @@ For copies, freezes, validators, and callback captures, name the value's origin,
For asynchronous machinery, map each promise, flag, cancellation path, disposer, and reservation to its owner and transition. Collapse mechanisms only when they express the same fact. Preserve synchronous publication and rollback, callback containment, first-terminal-outcome arbitration, worker/process ownership, and dispose-to-quiescence where required. Durable start/end markers can record real facts even when transcript renderers ignore them; dropping interrupted work is a capability loss, not redundant-log cleanup.
-An invariant companion is justified by comparing independently produced observations that can diverge. Checks of service presence, plugin metadata, fixed examples, or the same mutation's return value do not qualify. Removing a companion includes its export, build entry, invariant-only compiler references, dependencies, and tests; record the package-specific omission reason in both READMEs. Keep checks comparing independent event producers, durable history, or mutable data.
-
## Replace infrastructure only for a net reduction
Follow the [dependency policy](../../notes/implemented/process/2026-07-26-dependencies-over-hand-rolling.md). Search existing dependencies and Node builtins at the engine floor before adding a package. Identify the exact implementation and dedicated tests the replacement deletes, its maintenance and transitive cost, and every residual behavior the glue must preserve.
diff --git a/.agents/skills/dsh-find-simplifications/references/historical-patterns.md b/.agents/skills/dsh-find-simplifications/references/historical-patterns.md
index f5f91342e4..a9199a9c82 100644
--- a/.agents/skills/dsh-find-simplifications/references/historical-patterns.md
+++ b/.agents/skills/dsh-find-simplifications/references/historical-patterns.md
@@ -10,7 +10,7 @@ Zero fixed callers is weaker evidence than unreachability. The [skill-registrati
## Reduce distinctions where consumers decide
-Map every public variant to the consumer action it enables. The [model agent-availability decision](../../../notes/implemented/simplification/2026-09-15-model-agent-availability-and-team-targets.md) gives models one usable Team target and projects multiple residency states to the same availability, while internal routing retains Session identity and residency. The [capability-neutral sandbox context](../../../notes/archived/simplification/2026-07-31-capability-neutral-sandbox-policy-context.md) replaces two approximate capability registries with truthful conditional policy wording; exact tool availability remains in tool schemas. The gain includes registration methods, disposal state, invalidation, and combination tests.
+Map every public variant to the consumer action it enables. The [archived model agent-availability decision](../../../notes/archived/simplification/2026-09-15-model-agent-availability-and-team-targets.md) gives models one usable Team target and projects multiple residency states to the same availability, while internal routing retains Session identity and residency. The [capability-neutral sandbox context](../../../notes/archived/simplification/2026-07-31-capability-neutral-sandbox-policy-context.md) replaces two approximate capability registries with truthful conditional policy wording; exact tool availability remains in tool schemas. The gain includes registration methods, disposal state, invalidation, and combination tests.
Do not erase distinct durable facts merely because one renderer ignores them. The [durable step-boundary rejection](../../../notes/rejected/simplification/2026-06-20-drop-durable-step-boundaries.md) retains explicit start and completion facts needed for empty failed steps, crash repair, and inspection. Simplify the projection only when the underlying distinction remains necessary.
@@ -22,13 +22,13 @@ State the loss as clearly as the deletion. The [interrupted-turn truncation reje
## Make assumptions explicit at their consuming operation
-Look for a local default that has acquired shared storage, synchronization, or confirmation machinery. The [explicit Schedule time-zone decision](../../../notes/implemented/simplification/2026-08-09-explicit-schedule-time-zone.md) keeps browser facts on the originating request and requires an explicit zone in the scheduling operation, removing Session defaults and cross-tab conflict state. The [injected-content decision](../../../notes/implemented/simplification/2026-07-20-unwrap-injected-content-envelopes.md) leaves framing with the caller and removes envelope controls threaded through unrelated layers. Both reduce the number of owners that must interpret one assumption.
+Look for a local default that has acquired shared storage, synchronization, or confirmation machinery. The [explicit Schedule time-zone decision](../../../notes/implemented/simplification/2026-08-09-explicit-schedule-time-zone.md) keeps browser facts on the originating request and requires an explicit zone in the scheduling operation, removing Session defaults and cross-tab conflict state. The [archived injected-content decision](../../../notes/archived/simplification/2026-07-20-unwrap-injected-content-envelopes.md) leaves framing with the caller and removes envelope controls threaded through unrelated layers. Both reduce the number of owners that must interpret one assumption.
-Do not move a requirement past the place that must enforce it. The [Host-only Remote input-validation decision](../../../notes/implemented/simplification/2026-09-15-host-only-remote-input-validation.md) removes duplicate Client schema execution but retains Host validation before lookup and business invocation, plus local arity and Context binding checks. Its documented cost is later malformed-input failure and the loss of Client parsing as accidental redaction.
+Do not move a requirement past the place that must enforce it. The [archived Host-only Remote input-validation decision](../../../notes/archived/simplification/2026-09-15-host-only-remote-input-validation.md) removes duplicate Client schema execution but retains Host validation before lookup and business invocation, plus local arity and Context binding checks. Its documented cost is later malformed-input failure and the loss of Client parsing as accidental redaction.
## Derive at use or reuse an existing delivery owner
-For each cache or event subscription, ask when the consumer needs the value and whether an authoritative source already retains it. [Feedback telemetry](../../../notes/archived/simplification/2026-08-06-buffer-free-feedback-telemetry.md) reads the canonical Session prefix at feedback time, deleting a continuously copied pre-feedback buffer and its listeners. [Workspace recency](../../../notes/implemented/simplification/2026-09-10-derived-workspace-recency.md) sorts current summaries instead of persisting promotion history; manual ordering remains independent user state. [Web subagent projections](../../../notes/implemented/simplification/2026-09-08-web-subagent-catalog-projections.md) reuse a shared stream and projection store, removing feature notifications, repeated reads, and a second membership cache.
+For each cache or event subscription, ask when the consumer needs the value and whether an authoritative source already retains it. [Feedback telemetry](../../../notes/archived/simplification/2026-08-06-buffer-free-feedback-telemetry.md) reads the canonical Session prefix at feedback time, deleting a continuously copied pre-feedback buffer and its listeners. [archived Workspace recency](../../../notes/archived/simplification/2026-09-10-derived-workspace-recency.md) sorts current summaries instead of persisting promotion history; manual ordering remains independent user state. [archived Web subagent projections](../../../notes/archived/simplification/2026-09-08-web-subagent-catalog-projections.md) reuse a shared stream and projection store, removing feature notifications, repeated reads, and a second membership cache.
The timing promise determines whether this works. Feedback-time redaction differs from capture-time redaction; manual placement cannot be derived from activity timestamps; an initial historical read may remain necessary when a stream baseline is absent. Name such residual obligations instead of declaring all caches redundant.
diff --git a/.agents/skills/dsh-speed-up-perf/SKILL.md b/.agents/skills/dsh-speed-up-perf/SKILL.md
index fbd5d262e1..f8b5eb6141 100644
--- a/.agents/skills/dsh-speed-up-perf/SKILL.md
+++ b/.agents/skills/dsh-speed-up-perf/SKILL.md
@@ -13,7 +13,7 @@ Read [AGENTS.md](../../../AGENTS.md), [architecture](../../../docs/architecture.
Agree on the user-visible endpoint, workload range, resource constraints, acceptable minor behavior differences, and stopping rule. Keep backend and browser end-to-end measurements separate: a fast history iterator or Client fold does not prove fast transport, paint, scrolling, or input response. Exclude model/network latency when measuring local overhead, and state that exclusion rather than calling the result complete product latency.
-Inspect the exact current base, not just the running checkout. Study final merged diffs, owning source, tests, and resolved review threads; a PR body can describe an abandoned implementation. Separate merged, closed-unmerged, superseded, estimated, and newly measured evidence. The [performance workflow decision and evidence](../../notes/implemented/process/2026-09-06-evidence-driven-performance-skill.md) supply historical leads, not authority to reintroduce their implementations.
+Inspect the exact current base, not just the running checkout. Study final merged diffs, owning source, tests, and resolved review threads; a PR body can describe an abandoned implementation. Separate merged, closed-unmerged, superseded, estimated, and newly measured evidence. The [archived performance workflow decision and evidence](../../notes/archived/process/2026-09-06-evidence-driven-performance-skill.md) supply historical leads, not authority to reintroduce their implementations.
## Survey user paths, then rank candidates
@@ -75,7 +75,7 @@ Change one causal factor at a time. Re-run both the focused scenario and its end
## Preserve behavior and resource ownership
-Performance measurements complement functional evidence; they do not replace it. Run or add the narrow owning tests for output, ordering, paging, stream indexes, errors, cancellation, concurrency, and disposal as applicable. Preserve model-visible/logged equivalence, released-generation immutability, atomic publication, required validation, and writable readiness. Do not silently truncate history, skip tool results, disable invariants, or change lifecycle semantics to reach a number.
+Performance measurements complement functional evidence; they do not replace it. Run or add the narrow owning tests for output, ordering, paging, stream indexes, errors, cancellation, concurrency, and disposal as applicable. Preserve model-visible/logged equivalence, released-generation immutability, atomic publication, required validation, and writable readiness. Do not silently truncate history, skip tool results, or change lifecycle semantics to reach a number.
State any deliberate minor visible difference and verify it through the owning keyless snapshot. For a product-visible GUI change, include the required browser evidence/GIF. Keep functional expectations independent of benchmark internals; benchmark assertions need enough evidence to reach the real endpoint, not a second semantic test suite.
diff --git a/.agents/skills/dsh-trim-cot-leakage/SKILL.md b/.agents/skills/dsh-trim-cot-leakage/SKILL.md
index cd26b03891..f8a852bd66 100644
--- a/.agents/skills/dsh-trim-cot-leakage/SKILL.md
+++ b/.agents/skills/dsh-trim-cot-leakage/SKILL.md
@@ -5,7 +5,7 @@ description: Use when auditing or fixing prose that reads like a leaked reasonin
# Trimming Chain-of-Thought Leakage
-Chain-of-thought leakage is prose whose vantage is the authoring session rather than the repository: it cites artifacts only that session could see, narrates the change instead of the state, or argues with a reviewer who has left. The fix is never deletion alone when a passage carries factual clauses — restate each so it stands at HEAD, then delete the transcript around it; a passage carrying none (an audit code, control-flow narration) is deleted outright. **REQUIRED BACKGROUND:** [dsh-prose-standard](../dsh-prose-standard/SKILL.md) owns the complete-proposition rule this skill applies; the [committed-artifact-citations note](../../notes/implemented/process/2026-08-09-committed-artifact-citations.md) owns the citation rule's rationale. It is guidance, not a script.
+Chain-of-thought leakage is prose whose vantage is the authoring session rather than the repository: it cites artifacts only that session could see, narrates the change instead of the state, or argues with a reviewer who has left. The fix is never deletion alone when a passage carries factual clauses — restate each so it stands at HEAD, then delete the transcript around it; a passage carrying none (an audit code, control-flow narration) is deleted outright. **REQUIRED BACKGROUND:** [dsh-prose-standard](../dsh-prose-standard/SKILL.md) owns the complete-proposition rule this skill applies; the [archived committed-artifact-citations note](../../notes/archived/process/2026-08-09-committed-artifact-citations.md) records the citation rule's historical rationale. It is guidance, not a script.
## The one test
diff --git a/.agents/skills/dsh-trim-cot-leakage/references/recall-batteries.md b/.agents/skills/dsh-trim-cot-leakage/references/recall-batteries.md
index 4802413c4d..8571622df5 100644
--- a/.agents/skills/dsh-trim-cot-leakage/references/recall-batteries.md
+++ b/.agents/skills/dsh-trim-cot-leakage/references/recall-batteries.md
@@ -5,7 +5,7 @@ Probes for [the taxonomy](../SKILL.md#taxonomy), tuned during the 2026-08 purge.
## Invocation rules
- Add `--hidden --glob '!.git/**'` so `.agents/` is searched; ripgrep skips dot-directories by default and the purge's biggest miss risk was Agent Notes.
-- Exclusions go last so a later include cannot re-admit them: `--glob '!vendor/**' --glob '!node_modules/**' --glob '!.agents/notes/archived/**' --glob '!.agents/skills/dsh-trim-cot-leakage/**'` (the skill's own files quote leaked wording as calibration), plus recorded fixture and snapshot directories in scope. The [owning note](../../../notes/implemented/process/2026-08-09-committed-artifact-citations.md) also self-hits through its quoted evidence; judge it as evidence, not usage.
+- Exclusions go last so a later include cannot re-admit them: `--glob '!vendor/**' --glob '!node_modules/**' --glob '!.agents/notes/archived/**' --glob '!.agents/skills/dsh-trim-cot-leakage/**'` (the skill's own files quote leaked wording as calibration), plus recorded fixture and snapshot directories in scope. The [owning reference](../SKILL.md) also self-hits through its quoted evidence; judge it as evidence, not usage.
- Natural-language lines carry `-i` so sentence-initial capitals hit ("This PR adds…", "Probably fine…"); the first line, which matches code patterns, stays case-sensitive — `-i` would turn `\bT\d\b` and `\bP-I\b` into noise.
- Bound complete phrases. `\bthis PR\b` must match "this PR adds" without matching "this project", "this process", or "this provider".
- A zero-hit pattern proves nothing until it matches a known positive, and a noisy pattern proves nothing until it rejects a near-miss negative. Calibrate both before trusting a corpus result.
diff --git a/.agents/skills/record-browser-gif/SKILL.md b/.agents/skills/record-browser-gif/SKILL.md
index b425b35b6f..a16f8294e9 100644
--- a/.agents/skills/record-browser-gif/SKILL.md
+++ b/.agents/skills/record-browser-gif/SKILL.md
@@ -7,7 +7,7 @@ description: Record browser or Web UI interaction demos as optimized GIFs using
Produce a short, truthful UI demonstration as a local GIF, and — only when the task includes attaching it to a pull request — publish it through the attach workflow at the end of this skill. The available browser-control workflow remains preferred. Use [Playwright Videos](https://playwright.dev/docs/videos) when that workflow supports continuous capture at higher frame rates; use the bundled encoder for trimming, playback speed, final hold, dimensions, and size.
-The [evidence-chain decision](../../notes/implemented/process/2026-08-08-browser-gif-evidence-chain.md) owns why one storyboard comes from one isolated run and why publication revalidates both the artifact and the demonstrated pull-request head.
+The [archived evidence-chain decision](../../notes/archived/process/2026-08-08-browser-gif-evidence-chain.md) records why one storyboard comes from one isolated run and why publication revalidates both the artifact and the demonstrated pull-request head.
## Every GUI pull request includes a GIF
@@ -27,7 +27,7 @@ The recording itself is part of the evidence: use a real server booted from that
A GIF for a specific pull request demonstrates that pull request's tree, so stage per pull request:
1. Require a clean worktree, record its exact commit with `git rev-parse HEAD`, then build that recorded tree — here, `pnpm run build && pnpm run build:web`. A GIF recorded against another commit's build misattributes the evidence.
-2. Boot one server per port from that tree with fresh scratch `DSH_HOME`, `DSH_AGENTS_HOME`, workspace, and session state. Give the browser a fresh isolated context or profile as well; if the browser workflow cannot create one, clear that origin's cookies and site storage before navigation so persisted client state cannot affect the evidence. Source the root `.env` for the API key through the application's normal path; never echo the key.
+2. Boot one server per port from that tree with fresh scratch `DSH_HOME`, `DSH_AGENTS_HOME`, workspace, and session state. Give the browser a fresh isolated context or profile as well; if the browser workflow cannot create one, clear that origin's cookies and site storage before navigation so persisted client state cannot affect the evidence. Real API credentials can be available in `~/.dsh/.credentials.yaml` even when `DEEPSEEK_API_KEY` and the root `.env` are absent. With a scratch `DSH_HOME`, use a recording overlay to set the `dsh-credentials-local` provider's `path` to that existing file's absolute path. Let the application's normal credential provider resolve the key; never echo it.
3. Treat one storyboard as one evidence run: every published frame comes from that server and those state roots, workspace, session, and model-backed scenario run. If capture automation fails, discard its frames and rerun from fresh roots; never splice frames from separate runs.
4. When switching between pull requests, stop the old server by PID or an exact match on its command line. A broad `pkill -f` pattern can match and kill the shell that launched it — including your own.
diff --git a/.github/AGENTS.md b/.github/AGENTS.md
index f4f3c5d555..7cc2946f53 100644
--- a/.github/AGENTS.md
+++ b/.github/AGENTS.md
@@ -1,3 +1,3 @@
# AGENTS.md — GitHub Actions
-Run jobs on Windows runners (`windows-*` labels) under native `pwsh`. Native Windows build and process checks contribute to the pull-request `all checks passed` verdict; Wine runs Windows Node on hosted Linux only in `ci-master.yml`. Python runtime CI checks Linux/Windows x64 on pull requests and Linux ARM64 plus both macOS architectures on master pushes; releases retain all five targets ([platform policy](../.agents/notes/implemented/process/2026-09-06-master-only-platform-ci.md)). `ci.yml` is pull-request-only. Master-only platform checks, Linux/Windows self-hosted standbys, and manual runner benchmarks live in `ci-master.yml`, which listens to master pushes and `workflow_dispatch`, not `pull_request`; separating workflow triggers keeps master-only jobs out of PR check panels. The master standbys validate the self-hosted failover targets; preserve the existing per-platform switches (values `selfhosted` for the in-house standbys and `blacksmith` for Blacksmith's hosted runners) and the Dependabot hosted fallback under the `selfhosted` values ([failover runbook](../.agents/notes/implemented/process/2026-07-26-ci-failover-runbook.md), [blacksmith failover leg note](../.agents/notes/implemented/process/2026-09-09-blacksmith-failover-leg.md)).
+Run jobs on Windows runners (`windows-*` labels) under native `pwsh`. Native Windows build and process checks contribute to the pull-request `all checks passed` verdict; Wine runs Windows Node on hosted Linux only in `ci-master.yml`. Python runtime CI checks Linux/Windows x64 on pull requests and Linux ARM64 plus both macOS architectures on master pushes; releases retain all five targets ([platform policy](workflows/ci-master.yml)). `ci.yml` is pull-request-only. Master-only platform checks, Linux/Windows self-hosted standbys, and manual runner benchmarks live in `ci-master.yml`, which listens to master pushes and `workflow_dispatch`, not `pull_request`; separating workflow triggers keeps master-only jobs out of PR check panels. The master standbys validate the self-hosted failover targets; preserve the existing per-platform switches (values `selfhosted` for the in-house standbys and `blacksmith` for Blacksmith's hosted runners) and the Dependabot hosted fallback under the `selfhosted` values ([failover runbook](../.agents/notes/implemented/process/2026-07-26-ci-failover-runbook.md), [blacksmith failover leg note](../.agents/notes/implemented/process/2026-09-09-blacksmith-failover-leg.md)).
diff --git a/.github/issue-management/README.i18n.yaml b/.github/issue-management/README.i18n.yaml
index 0d62118377..e008dab1ab 100644
--- a/.github/issue-management/README.i18n.yaml
+++ b/.github/issue-management/README.i18n.yaml
@@ -18,11 +18,11 @@
en: ad11184112771cc8
zh: cc8c112a76dcf62e
/issue-management/lifecycle-events:
- en: 62bca299f0a5e213
- zh: 8853e01a9e3776ec
+ en: f0e434f0ead4e952
+ zh: c7c62cee2486a3ff
/issue-management/configuration-and-limitations:
- en: 3ef00734bb83737f
- zh: 9d91319c953496dd
+ en: 36cbf0d37f910b04
+ zh: cdab6aef6763941f
/issue-management/module-ownership:
en: e83f694e0be99e69
zh: 85fb201f86af2ce8
diff --git a/.github/issue-management/README.md b/.github/issue-management/README.md
index 49e91859f4..f7dc1a3523 100644
--- a/.github/issue-management/README.md
+++ b/.github/issue-management/README.md
@@ -45,16 +45,18 @@ REST reads use the repository `GITHUB_TOKEN`. Project validation uses a separate
Approval-only and comment-only reviews do not allocate a lifecycle runner. PR pushes and label changes, and Issue assignment changes, do not trigger lifecycle work. Other subscribed Issue events maintain membership, state, and audit comments; exact subscriptions live in the workflow.
-PR opening initializes an empty Project `Start Date` for every referenced Issue, including informational references, using the PR creation date in the configured time zone. This lifecycle operation can add Project membership and needs Project write access; the informational-reference read exemption applies only to PR validation. [Planning-field ownership](../../.agents/notes/implemented/process/2026-09-02-project-local-issue-planning-fields.md) defines date preservation.
+PR opening initializes an empty Project `Start Date` for every referenced Issue, including informational references, using the PR creation date in the configured time zone. This lifecycle operation can add Project membership and needs Project write access; the informational-reference read exemption applies only to PR validation. Existing Start Date values are preserved.
-----
## Configuration and limitations
-[config.json](config.json) selects the repository, Project, field names, statuses, lifecycle actor, and time zone. The policy reads the Project custom single-select `Priority` field, not a native organization Issue Priority field. Maintainers set Project Priority manually; skill guidance that directs edits to native Issue fields does not populate this value. Issue audits remove PR-only kinds and retired label aliases before validating the remaining metadata. There is no field migration or Priority synchronization.
+[config.json](config.json) selects the repository, Project, field names, statuses, lifecycle actor, and time zone. The policy reads the Project custom single-select `Priority` field, not a native organization Issue Priority field. Project-local planning fields need no separate organization Issue Fields permission. Maintainers set Project Priority manually; skill guidance that directs edits to native Issue fields does not populate this value. Issue audits remove PR-only kinds and retired label aliases before validating the remaining metadata. There is no field migration or Priority synchronization.
-Lifecycle processing is event-driven, not a reconciler. Omitted events do not repair Project state, and concurrent Project mutations have no atomic compare-and-swap. Selective evaluation does not redesign required-check authority or guarantee measured Actions-minute savings. The [selective-evaluation decision](../../.agents/notes/implemented/process/2026-09-07-selective-issue-policy-evaluation.md) records the trade-offs.
+Before removing a legacy organization field, compare every value with its Project value, including archived Project items.
+
+Lifecycle processing is event-driven, not a reconciler. Omitted events do not repair Project state, and concurrent Project mutations have no atomic compare-and-swap. Selective evaluation does not redesign required-check authority or guarantee measured Actions-minute savings. The [archived selective-evaluation decision](../../.agents/notes/archived/process/2026-09-07-selective-issue-policy-evaluation.md) records the trade-offs.
-----
diff --git a/.github/issue-management/README.zh.md b/.github/issue-management/README.zh.md
index 8424f90cd2..385eb45bcc 100644
--- a/.github/issue-management/README.zh.md
+++ b/.github/issue-management/README.zh.md
@@ -45,16 +45,18 @@ REST 读取使用仓库 `GITHUB_TOKEN`。Project 校验使用独立的 App token
仅批准或仅评论的评审不分配生命周期 runner。PR 推送与标签变更，以及 Issue 指派变更，不触发生命周期工作。其他已订阅的 Issue 事件维护 Project 归属、状态及审计评论；精确订阅列表由工作流定义。
-PR 打开时，工作流按配置时区中的 PR 创建日期，为每个被引用 Issue（包括信息型引用）初始化空的 Project `Start Date`。此生命周期操作可以添加 Project 归属，并需要 Project 写权限；信息型引用的读取豁免仅适用于 PR 校验。[规划字段归属](../../.agents/notes/implemented/process/2026-09-02-project-local-issue-planning-fields.zh.md)定义日期保留规则。
+PR 打开时，工作流按配置时区中的 PR 创建日期，为每个被引用 Issue（包括信息型引用）初始化空的 Project `Start Date`。此生命周期操作可以添加 Project 归属，并需要 Project 写权限；信息型引用的读取豁免仅适用于 PR 校验。已有 Start Date 值会保留。
-----
## 配置与限制
-[config.json](config.json)选择仓库、Project、字段名、状态、生命周期操作者和时区。策略读取 Project 自定义单选 `Priority` 字段，而非组织原生 Issue Priority 字段。维护者手动设置 Project Priority；指引编辑原生 Issue 字段的 skill 不会填充该值。Issue 审计先移除 PR 专用 kind 标签和已停用的标签别名，再校验其余元数据。不提供字段迁移或 Priority 同步。
+[config.json](config.json)选择仓库、Project、字段名、状态、生命周期操作者和时区。策略读取 Project 自定义单选 `Priority` 字段，而非组织原生 Issue Priority 字段。Project 本地规划字段不需要另行授予组织 Issue Fields 权限。维护者手动设置 Project Priority；指引编辑原生 Issue 字段的 skill 不会填充该值。Issue 审计先移除 PR 专用 kind 标签和已停用的标签别名，再校验其余元数据。不提供字段迁移或 Priority 同步。
-生命周期处理由事件驱动，不是协调器。被省略的事件不会修复 Project 状态，并发 Project mutation 也没有原子比较并交换保护。选择性求值不重新设计必需检查的权威来源，也不保证已测得的 Actions 分钟节省。[选择性求值决策](../../.agents/notes/implemented/process/2026-09-07-selective-issue-policy-evaluation.zh.md)记录取舍。
+删除旧的组织字段前，必须逐一核对其中的值与对应的 Project 值，包括已归档的 Project item。
+
+生命周期处理由事件驱动，不是协调器。被省略的事件不会修复 Project 状态，并发 Project mutation 也没有原子比较并交换保护。选择性求值不重新设计必需检查的权威来源，也不保证已测得的 Actions 分钟节省。[已归档的选择性求值决策](../../.agents/notes/archived/process/2026-09-07-selective-issue-policy-evaluation.md)记录取舍。
-----
diff --git a/.github/preview-sizing/README.i18n.yaml b/.github/preview-sizing/README.i18n.yaml
index d2372d8529..065a63ad3e 100644
--- a/.github/preview-sizing/README.i18n.yaml
+++ b/.github/preview-sizing/README.i18n.yaml
@@ -18,5 +18,5 @@
en: 25ee2f4b26ef7770
zh: 788b7fb4bee6e159
/pr-preview-runner-sizing/dev-note:
- en: 85ac56719e30a350
- zh: f53f31c1b8553cc0
+ en: c3e8959997c4d5d0
+ zh: 109a391915c2bdfb
diff --git a/.github/preview-sizing/README.md b/.github/preview-sizing/README.md
index 142854e582..5fcec8ad2c 100644
--- a/.github/preview-sizing/README.md
+++ b/.github/preview-sizing/README.md
@@ -32,4 +32,4 @@ Runner selection does not alter pull-request events, per-PR cancellation, immuta
## Dev Note
-The [runner decision](../../.agents/notes/implemented/process/2026-09-06-preview-hosted-runner-sizing.md) records measurements, cost estimates, and image/CPU variation. The build-only experiment does not verify production deployment.
+The [archived runner decision](../../.agents/notes/archived/process/2026-09-06-preview-hosted-runner-sizing.md) records measurements, cost estimates, and image/CPU variation. The build-only experiment does not verify production deployment.
diff --git a/.github/preview-sizing/README.zh.md b/.github/preview-sizing/README.zh.md
index a71325189d..43258d716a 100644
--- a/.github/preview-sizing/README.zh.md
+++ b/.github/preview-sizing/README.zh.md
@@ -32,4 +32,4 @@
## 开发备注
-[运行器决策](../../.agents/notes/implemented/process/2026-09-06-preview-hosted-runner-sizing.zh.md) 记录测量、成本估算及镜像/CPU 差异。仅构建实验不验证生产部署。
+[已归档的运行器决策](../../.agents/notes/archived/process/2026-09-06-preview-hosted-runner-sizing.md) 记录测量、成本估算及镜像/CPU 差异。仅构建实验不验证生产部署。
diff --git a/.github/review-ownership/README.md b/.github/review-ownership/README.md
index 2da4c5e2cd..26ae70e6f6 100644
--- a/.github/review-ownership/README.md
+++ b/.github/review-ownership/README.md
@@ -58,6 +58,6 @@ Run `pnpm run test:approval-policy` for policy parsing, effective review decisio
## Dev Note
-[Production blame weighting](../../.agents/notes/implemented/process/2026-09-11-production-blame-approval-weight.md) records the scoring rationale and measured costs.
+[archived Production blame weighting](../../.agents/notes/archived/process/2026-09-11-production-blame-approval-weight.md) records the scoring rationale and measured costs.
-[PR-scoped delegation](../../.agents/notes/implemented/process/2026-09-15-pr-approval-delegation.md) records score ownership and revocation choices.
+[archived PR-scoped delegation](../../.agents/notes/archived/process/2026-09-15-pr-approval-delegation.md) records score ownership and revocation choices.
diff --git a/.github/review-ownership/requirements.txt b/.github/review-ownership/requirements.txt
index a0c04bed92..3429a636c6 100644
--- a/.github/review-ownership/requirements.txt
+++ b/.github/review-ownership/requirements.txt
@@ -1 +1 @@
-Pygments==2.19.2
+Pygments==2.21.0
diff --git a/.github/workflows/build-exe-for-python-sdk.yml b/.github/workflows/build-exe-for-python-sdk.yml
index e53d524ead..9ea51311b6 100644
--- a/.github/workflows/build-exe-for-python-sdk.yml
+++ b/.github/workflows/build-exe-for-python-sdk.yml
@@ -72,7 +72,7 @@ jobs:
version: ${{ steps.version.outputs.version }}
repository-version: ${{ steps.version.outputs.repository-version }}
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
- name: Resolve repository version
id: version
@@ -130,7 +130,7 @@ jobs:
&& 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
timeout-minutes: 5
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
- uses: actions/setup-python@v6.3.0
with:
@@ -145,7 +145,7 @@ jobs:
--package sdk
--output-dir dist-python
- - uses: actions/upload-artifact@v7
+ - uses: actions/upload-artifact@v7.0.1
with:
name: deepseek_harness_sdk-${{ needs.plan.outputs.version }}-py3-none-any.whl
path: dist-python/deepseek_harness_sdk-${{ needs.plan.outputs.version }}-py3-none-any.whl
@@ -168,11 +168,11 @@ jobs:
matrix:
include: ${{ fromJSON(needs.plan.outputs.matrix) }}
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-js-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
@@ -185,7 +185,7 @@ jobs:
# setup-node's built-in pnpm store cache keys on platform AND arch, so
# the Linux architectures sharing runner.os stay on separate caches.
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: 24
cache: pnpm
@@ -199,7 +199,7 @@ jobs:
# Cache pkg's target Node binary; lockfile changes roll the
# exact key while the restore prefix can seed its replacement.
- - uses: actions/cache@v4
+ - uses: actions/cache@v6.1.0
with:
path: ~/.pkg-cache
key: pkg-fetch-${{ matrix.target }}-${{ hashFiles('pnpm-lock.yaml') }}
@@ -232,7 +232,8 @@ jobs:
esac
addon_dir="$(realpath packages/subprocess/subprocess-local/node_modules/node-pty)"
pnpm_setup_root="$(realpath "$(dirname "$(dirname "$PNPM_HOME")")")"
- (cd "$addon_dir" && npm_config_build_from_source=true pnpm run install)
+ # Verification installs would install node-gyp inside the package and package it into the exe.
+ (cd "$addon_dir" && npm_config_build_from_source=true pnpm --config.verifyDepsBeforeRun=false run install)
addon="$addon_dir/build/Release/pty.node"
[ -f "$addon_dir/build/Makefile" ] || {
echo "::error::node-pty install did not generate $addon_dir/build/Makefile"
@@ -259,7 +260,9 @@ jobs:
- name: Build single-exe
env:
DSH_BUILD_CLIENT_PROFILE: official
- run: pnpm exec tsx scripts/build-exe-for-python-sdk.ts --targets=${{ matrix.target }}
+ run: >-
+ pnpm exec tsx scripts/build-exe-for-python-sdk.ts --targets=${{ matrix.target }}
+ ${{ inputs.ci && github.event_name == 'pull_request' && '--artifacts-only' || '' }}
- name: Resolve platform outputs (POSIX)
id: runtime-posix
@@ -308,7 +311,7 @@ jobs:
--runtime-exe "${{ steps.runtime-posix.outputs.exe || steps.runtime-windows.outputs.exe }}"
--output-dir dist-python
- - uses: actions/download-artifact@v8
+ - uses: actions/download-artifact@v8.0.1
with:
name: deepseek_harness_sdk-${{ needs.plan.outputs.version }}-py3-none-any.whl
path: dist-python
@@ -497,7 +500,7 @@ jobs:
env -u PYTHONPATH -u DSH_RUNTIME_MODE /tmp/dsh-sdk/bin/python /work/scripts/smoke-python-runtime.py --scenario sdk-mcp --installed-wheel
'
- - uses: actions/upload-artifact@v7
+ - uses: actions/upload-artifact@v7.0.1
with:
name: ${{ steps.runtime-posix.outputs.wheel || steps.runtime-windows.outputs.wheel }}
path: dist-python/${{ steps.runtime-posix.outputs.wheel || steps.runtime-windows.outputs.wheel }}
diff --git a/.github/workflows/build-preview-cloudflare.yml b/.github/workflows/build-preview-cloudflare.yml
index 80caebdb76..e8ad9bd2ec 100644
--- a/.github/workflows/build-preview-cloudflare.yml
+++ b/.github/workflows/build-preview-cloudflare.yml
@@ -35,15 +35,15 @@ jobs:
runs-on: ubuntu-24.04
name: cloudflare pages preview
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
@@ -57,7 +57,7 @@ jobs:
# Read-only: the preview lane consumes the default-branch cache without
# putting cache upload on its own path.
- - uses: actions/cache/restore@v4
+ - uses: actions/cache/restore@v6.1.0
with:
path: ${{ steps.pnpm-store.outputs.path }}
key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -69,9 +69,9 @@ jobs:
# apps/web consumes workspace packages as built lib products, and
# build:preview packs the image through the packer's installed bin
- # (lib/bin.js), so neither half exists before the full build runs.
+ # (lib/bin.js), so neither half exists before the artifact build runs.
- name: Build workspace
- run: pnpm run build
+ run: pnpm run build --artifacts-only
- name: Build the preview page and pack the VFS image
env:
diff --git a/.github/workflows/ci-master.yml b/.github/workflows/ci-master.yml
index 75410ad410..5feb9fb33c 100644
--- a/.github/workflows/ci-master.yml
+++ b/.github/workflows/ci-master.yml
@@ -48,15 +48,15 @@ jobs:
name: windows node 24 / wine
timeout-minutes: 15
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
@@ -68,7 +68,7 @@ jobs:
store_path=$(PNPM_CONFIG_STORE_DIR="$store_root" pnpm store path --silent)
echo "path=$store_path" >> "$GITHUB_OUTPUT"
- - uses: actions/cache/restore@v4
+ - uses: actions/cache/restore@v6.1.0
with:
path: ${{ steps.pnpm-store.outputs.path }}
key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -80,7 +80,7 @@ jobs:
id: wine-cache-key
run: echo "key=wine-debs-${ImageOS:-linux}-${ImageVersion:-v0}" >> "$GITHUB_OUTPUT"
- - uses: actions/cache@v4
+ - uses: actions/cache@v6.1.0
with:
path: ~/wine-debs
key: ${{ steps.wine-cache-key.outputs.key }}
@@ -139,21 +139,21 @@ jobs:
# github.event.before, so full history is required: depth 2 would miss it
# on multi-commit or force pushes; full fetch is cheap here because
# checkout resolves against the VM's local mirror.
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
# Redirect the Node compile cache (enabled by pnpm and TypeScript) off
- # the root partition's /tmp before the first pnpm call in this lane —
- # see .agents/notes/implemented/process/2026-08-28-ci-node-compile-cache-data-disk.md.
+ # the root partition's /tmp before the first pnpm call in this lane.
+ # see .github/workflows/ci.yml.
- name: Redirect Node compile cache to runner temp
run: echo "NODE_COMPILE_CACHE=${{ runner.temp }}/node-compile-cache" >> "$GITHUB_ENV"
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
@@ -191,13 +191,13 @@ jobs:
name: serial / macos
runs-on: macos-latest
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
@@ -230,7 +230,7 @@ jobs:
runs-on: [self-hosted, dsh-win-ci, windows]
timeout-minutes: 120
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
- name: Enable Developer Mode (symlink support)
shell: pwsh
@@ -238,11 +238,11 @@ jobs:
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock"
/t REG_DWORD /f /v "AllowDevelopmentWithoutDevLicense" /d "1"
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
@@ -356,15 +356,15 @@ jobs:
blacksmith: ''
workload: production-site
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
# The benchmark's Windows lanes deliberately skip the store cache like
# the independent native Windows job; an empty input disables caching.
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
cache: ${{ matrix.platform == 'linux' && 'pnpm' || '' }}
@@ -467,15 +467,15 @@ jobs:
blacksmith: ''
workers: '2'
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
# Unlike the larger-runner suite, both platforms cache the store here:
# the consolidated topology measures cache mechanics as workload.
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
cache: pnpm
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0f79dab45b..c8f2afcf8b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -61,22 +61,21 @@ jobs:
echo "TMPDIR=${{ runner.temp }}" >> "$GITHUB_ENV"
# Fetch complete history so the archive gate can read the trusted PR base from a reused shallow checkout.
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
persist-credentials: false
# Redirect the Node compile cache (enabled by pnpm and TypeScript) off
- # the root partition's /tmp before the first pnpm call in this lane —
- # see .agents/notes/implemented/process/2026-08-28-ci-node-compile-cache-data-disk.md.
+ # the root partition's /tmp before the first pnpm call in this lane.
- name: Redirect Node compile cache to runner temp
run: echo "NODE_COMPILE_CACHE=${{ runner.temp }}/node-compile-cache" >> "$GITHUB_ENV"
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
@@ -91,7 +90,7 @@ jobs:
# Pull requests consume the default-branch cache but do not put cache
# compression and upload on the paid latency-critical path. Skipped
# under failover — see the coverage lane's identical rationale.
- - uses: actions/cache/restore@v4
+ - uses: actions/cache/restore@v6.1.0
if: vars.DSH_CI_FAILOVER_LINUX != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
with:
path: ${{ steps.pnpm-store.outputs.path }}
@@ -138,21 +137,28 @@ jobs:
run: |
echo "TMPDIR=${{ runner.temp }}" >> "$GITHUB_ENV"
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
with:
persist-credentials: false
+ - name: Restore coverage duration history
+ uses: actions/cache/restore@v6.1.0
+ with:
+ path: .coverage-times.json
+ key: coverage-times-Linux-${{ runner.environment }}-${{ vars.DSH_CI_FAILOVER_LINUX || 'enterprise' }}-${{ github.run_id }}-${{ github.run_attempt }}
+ restore-keys: |
+ coverage-times-Linux-${{ runner.environment }}-${{ vars.DSH_CI_FAILOVER_LINUX || 'enterprise' }}-
+
# Redirect the Node compile cache (enabled by pnpm and TypeScript) off
- # the root partition's /tmp before the first pnpm call in this lane —
- # see .agents/notes/implemented/process/2026-08-28-ci-node-compile-cache-data-disk.md.
+ # the root partition's /tmp before the first pnpm call in this lane.
- name: Redirect Node compile cache to runner temp
run: echo "NODE_COMPILE_CACHE=${{ runner.temp }}/node-compile-cache" >> "$GITHUB_ENV"
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
@@ -166,7 +172,7 @@ jobs:
# Self-hosted runners reuse the shared persistent pnpm store.
# Hosted runners restore the remote cache into their ephemeral store.
- - uses: actions/cache/restore@v4
+ - uses: actions/cache/restore@v6.1.0
if: vars.DSH_CI_FAILOVER_LINUX != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
with:
path: ${{ steps.pnpm-store.outputs.path }}
@@ -190,6 +196,13 @@ jobs:
- name: Run exhaustive coverage
run: pnpm run check:ci:coverage
+ - name: Save coverage duration history
+ if: ${{ !cancelled() }}
+ uses: actions/cache/save@v6.1.0
+ with:
+ path: .coverage-times.json
+ key: coverage-times-Linux-${{ runner.environment }}-${{ vars.DSH_CI_FAILOVER_LINUX || 'enterprise' }}-${{ github.run_id }}-${{ github.run_attempt }}
+
node-24-bench:
if: github.event_name == 'pull_request'
runs-on: ubuntu-24.04
@@ -198,15 +211,15 @@ jobs:
# benchmark lane alone instead of joining a concurrent gate aggregate.
timeout-minutes: 20
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
@@ -218,7 +231,7 @@ jobs:
store_path=$(PNPM_CONFIG_STORE_DIR="$store_root" pnpm store path --silent)
echo "path=$store_path" >> "$GITHUB_OUTPUT"
- - uses: actions/cache/restore@v4
+ - uses: actions/cache/restore@v6.1.0
with:
path: ${{ steps.pnpm-store.outputs.path }}
key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -264,21 +277,20 @@ jobs:
echo "TMPDIR=${{ runner.temp }}" >> "$GITHUB_ENV"
echo "PLAYWRIGHT_BROWSERS_PATH=${RUNNER_TEMP%/*}/ms-playwright" >> "$GITHUB_ENV"
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
with:
persist-credentials: false
# Redirect the Node compile cache (enabled by pnpm and TypeScript) off
- # the root partition's /tmp before the first pnpm call in this lane —
- # see .agents/notes/implemented/process/2026-08-28-ci-node-compile-cache-data-disk.md.
+ # the root partition's /tmp before the first pnpm call in this lane.
- name: Redirect Node compile cache to runner temp
run: echo "NODE_COMPILE_CACHE=${{ runner.temp }}/node-compile-cache" >> "$GITHUB_ENV"
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
@@ -295,7 +307,7 @@ jobs:
# hosted cache keys, so each restore-keys fallback hits the matching archived
# entry until it evicts, after which the store is cold. Self-hosted runners
# reuse the shared persistent store instead of restoring the remote archive.
- - uses: actions/cache/restore@v4
+ - uses: actions/cache/restore@v6.1.0
if: vars.DSH_CI_FAILOVER_LINUX != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
with:
path: ${{ steps.pnpm-store.outputs.path }}
@@ -304,7 +316,7 @@ jobs:
${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-
# Self-hosted runners retain their own browser cache between jobs.
- - uses: actions/cache/restore@v4
+ - uses: actions/cache/restore@v6.1.0
if: vars.DSH_CI_FAILOVER_LINUX != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
with:
path: ${{ env.PLAYWRIGHT_BROWSERS_PATH }}
@@ -386,6 +398,7 @@ jobs:
DSH_GATE_FAIL_FAST: '1'
strategy:
fail-fast: false
+ max-parallel: 1
matrix:
include:
- node: '22.19'
@@ -404,7 +417,7 @@ jobs:
runner: ubuntu-latest
gate_concurrency: '1'
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
with:
persist-credentials: false
@@ -416,11 +429,11 @@ jobs:
echo "npm_config_devdir=$RUNNER_TEMP/node-gyp" >> "$GITHUB_ENV"
echo "PNPM_CONFIG_STORE_DIR=$HOME/.local/share/pnpm/store" >> "$GITHUB_ENV"
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
env:
# The runner overwrites RUNNER_* step env before starting JavaScript actions.
NODE_OPTIONS: ${{ runner.environment == 'self-hosted' && '--import=./scripts/ci-compatible-toolcache.mjs' || '' }}
@@ -461,7 +474,7 @@ jobs:
runs-on: ubuntu-latest
name: python 3.10 / keyless SDK
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
- uses: actions/setup-python@v6.3.0
with:
@@ -471,7 +484,7 @@ jobs:
- name: Install uv
run: python -m pip install uv==0.11.23
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: 24
@@ -486,6 +499,7 @@ jobs:
# Linux ARM64 and both macOS architectures run in ci-master.yml.
python-runtime:
if: github.event_name == 'pull_request'
+ needs: python-sdk
name: python runtime / release-shaped matrix
uses: ./.github/workflows/build-exe-for-python-sdk.yml
with:
@@ -514,7 +528,7 @@ jobs:
# A failing build or site aborts the sibling gate on the same runner.
DSH_GATE_FAIL_FAST: '1'
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- name: Enable Developer Mode (symlink support)
@@ -522,10 +536,10 @@ jobs:
run: >-
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock"
/t REG_DWORD /f /v "AllowDevelopmentWithoutDevLicense" /d "1"
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-js-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
- name: Install (immutable)
@@ -582,7 +596,7 @@ jobs:
# multi-minute instrumented run.
DSH_GATE_FAIL_FAST: '1'
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
with:
persist-credentials: false
# Checkout removes the gitignored duration history, so restore it from
@@ -592,24 +606,24 @@ jobs:
# entries are immutable, so the save key is unique per run and the
# restore matches the newest entry through the stable prefix.
- name: Restore coverage duration history
- uses: actions/cache/restore@v4
+ uses: actions/cache/restore@v6.1.0
with:
path: .coverage-times.json
- key: coverage-times-${{ github.run_id }}
+ key: coverage-times-Windows-${{ runner.environment }}-${{ vars.DSH_CI_FAILOVER_WINDOWS || 'enterprise' }}-${{ github.run_id }}-${{ github.run_attempt }}
restore-keys: |
- coverage-times-
+ coverage-times-Windows-${{ runner.environment }}-${{ vars.DSH_CI_FAILOVER_WINDOWS || 'enterprise' }}-
- name: Enable Developer Mode (symlink support)
shell: pwsh
run: >-
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock"
/t REG_DWORD /f /v "AllowDevelopmentWithoutDevLicense" /d "1"
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-js-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
# Node 24 still awaits the cppgc Realm-lifetime backport (#66168).
# 26.10.0 contains nodejs/node#65778; an exact version prevents a
# runner cache from selecting an older Node 26 with the same crash.
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: '26.10.0'
- name: Install (immutable)
@@ -638,10 +652,10 @@ jobs:
# measured durations remain useful even when a partition failed. The
# per-run key keeps every save a fresh immutable cache entry.
if: ${{ !cancelled() }}
- uses: actions/cache/save@v4
+ uses: actions/cache/save@v6.1.0
with:
path: .coverage-times.json
- key: coverage-times-${{ github.run_id }}
+ key: coverage-times-Windows-${{ runner.environment }}-${{ vars.DSH_CI_FAILOVER_WINDOWS || 'enterprise' }}-${{ github.run_id }}-${{ github.run_attempt }}
windows-native-tests:
if: github.event_name == 'pull_request'
@@ -654,7 +668,7 @@ jobs:
name: windows node 24 / native tests
timeout-minutes: 60
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- name: Enable Developer Mode (symlink support)
@@ -662,10 +676,10 @@ jobs:
run: >-
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock"
/t REG_DWORD /f /v "AllowDevelopmentWithoutDevLicense" /d "1"
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-js-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
- name: Install (immutable)
@@ -689,7 +703,7 @@ jobs:
--testTimeout 90000
packages/shell/tool-pwsh/tests/loader.spec.ts
packages/workflow/workflow-ptc/tests/workflow-ptc.spec.ts
- packages/workflow/tool-ralph/tests/integration.spec.ts
+ packages/experimental/tool-ralph/tests/integration.spec.ts
packages/subprocess/subprocess-local/tests/process-exit.spec.ts
# Single stable required check for branch protection: require "all checks
diff --git a/.github/workflows/docs-pages.yml b/.github/workflows/docs-pages.yml
index 6cd25b059d..6c6cc155d4 100644
--- a/.github/workflows/docs-pages.yml
+++ b/.github/workflows/docs-pages.yml
@@ -41,14 +41,14 @@ jobs:
pages: read
steps:
# Complete history: the release scripts read tags.
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
persist-credentials: false
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
cache: pnpm
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 8b3bfc1400..397ac07b45 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -67,11 +67,11 @@ jobs:
# and retry 2; 45m still bounds retry storms against a slow API.
timeout-minutes: 45
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: 24
cache: pnpm
@@ -107,7 +107,7 @@ jobs:
# the built artifact under plain Node, resolving plugins through real package
# exports — the shape a real consumer runs. That requires a prior build.
- name: Build (lib for the e2e example bins)
- run: pnpm run build:official
+ run: ${{ github.event_name == 'pull_request' && 'pnpm run build --artifacts-only --profile official' || 'pnpm run build:official' }}
- name: Prepare Office runtime
run: pnpm run prepare:primary-runtime --target linux-x64 --output .cache/e2e-office
diff --git a/.github/workflows/expected-filenames.yml b/.github/workflows/expected-filenames.yml
index 99c9886e35..12ff5d7bc7 100644
--- a/.github/workflows/expected-filenames.yml
+++ b/.github/workflows/expected-filenames.yml
@@ -22,7 +22,7 @@ jobs:
${{ vars.DSH_CI_FAILOVER_LINUX == 'blacksmith' && 'blacksmith-4vcpu-ubuntu-2404'
|| 'ubuntu-latest' }}
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
- name: Check tracked filenames
run: scripts/check-expected-filenames.sh
diff --git a/.github/workflows/node-addon-system-release.yml b/.github/workflows/node-addon-system-release.yml
index 6c5596232b..fef93c885b 100644
--- a/.github/workflows/node-addon-system-release.yml
+++ b/.github/workflows/node-addon-system-release.yml
@@ -32,7 +32,7 @@ jobs:
outputs:
prebuilds: ${{ steps.matrix.outputs.prebuilds }}
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v7.0.1
- id: matrix
run: echo "prebuilds=$(node ./scripts/github-matrix.mjs release-prebuild)" >> "$GITHUB_OUTPUT"
@@ -45,13 +45,13 @@ jobs:
fail-fast: false
matrix: ${{ fromJson(needs.matrix.outputs.prebuilds) }}
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v7.0.1
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
package_json_file: package.json
- - uses: actions/setup-node@v4
+ - uses: actions/setup-node@v7.0.0
with:
node-version: 24
cache: pnpm
@@ -80,7 +80,7 @@ jobs:
pnpm test:packaging
- name: Upload prebuild artifact
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v7.0.1
with:
name: ${{ matrix.artifact }}
path: native/system/${{ matrix.dir }}/bin/**
@@ -92,13 +92,13 @@ jobs:
needs: build-prebuilds
runs-on: ubuntu-24.04
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v7.0.1
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
package_json_file: package.json
- - uses: actions/setup-node@v4
+ - uses: actions/setup-node@v7.0.0
with:
node-version: 24
cache: pnpm
@@ -116,7 +116,7 @@ jobs:
RELEASE_PUBLISH: ${{ inputs.publish }}
- name: Download prebuild artifacts
- uses: actions/download-artifact@v4
+ uses: actions/download-artifact@v8.0.1
with:
pattern: prebuild-*
path: native/system/.release/prebuild-artifacts
@@ -138,7 +138,7 @@ jobs:
NALR_REQUIRE_LANDLOCK: 1
- name: Upload npm tarballs
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v7.0.1
with:
name: npm-tarballs
path: native/system/dist/npm/*
@@ -157,17 +157,17 @@ jobs:
steps:
# The publish script is the only repository file this job needs, and it
# imports nothing outside Node's builtins, so there is no install step.
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- - uses: actions/setup-node@v4
+ - uses: actions/setup-node@v7.0.0
with:
node-version: 24
registry-url: https://registry.npmjs.org
- name: Download npm tarballs
- uses: actions/download-artifact@v4
+ uses: actions/download-artifact@v8.0.1
with:
name: npm-tarballs
path: native/system/dist/npm
diff --git a/.github/workflows/node-addon-system.yml b/.github/workflows/node-addon-system.yml
index a763a2a8d2..c50411aeba 100644
--- a/.github/workflows/node-addon-system.yml
+++ b/.github/workflows/node-addon-system.yml
@@ -48,7 +48,7 @@ jobs:
outputs:
ci: ${{ steps.matrix.outputs.ci }}
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v7.0.1
- id: matrix
run: echo "ci=$(node ./scripts/github-matrix.mjs ci)" >> "$GITHUB_OUTPUT"
@@ -61,13 +61,15 @@ jobs:
fail-fast: false
matrix: ${{ fromJson(needs.matrix.outputs.ci) }}
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v7.0.1
- - uses: pnpm/action-setup@v4
+ # pnpm v11 ships no darwin-x64 standalone binary, and the pnpm/action-setup
+ # v6 self-update path needs one; this job stays on the v5 npm-install line.
+ - uses: pnpm/action-setup@v5.0.0
with:
package_json_file: package.json
- - uses: actions/setup-node@v4
+ - uses: actions/setup-node@v7.0.0
with:
node-version: 24
cache: pnpm
@@ -125,7 +127,7 @@ jobs:
node:24-alpine
node --test ./test/flock.test.js ./test/package-matrix.test.js
- - uses: actions/setup-node@v4
+ - uses: actions/setup-node@v7.0.0
with:
node-version: 20
@@ -139,7 +141,7 @@ jobs:
node:20-alpine
node --test ./test/flock.test.js ./test/package-matrix.test.js
- - uses: actions/setup-node@v4
+ - uses: actions/setup-node@v7.0.0
with:
node-version: 22
@@ -153,7 +155,7 @@ jobs:
node:22-alpine
node --test ./test/flock.test.js ./test/package-matrix.test.js
- - uses: actions/setup-node@v4
+ - uses: actions/setup-node@v7.0.0
with:
node-version: 26
diff --git a/.github/workflows/pi-ai-provider-e2e.yml b/.github/workflows/pi-ai-provider-e2e.yml
index 255c7654e7..5a4774e705 100644
--- a/.github/workflows/pi-ai-provider-e2e.yml
+++ b/.github/workflows/pi-ai-provider-e2e.yml
@@ -30,11 +30,11 @@ jobs:
name: Azure OpenAI Responses + Anthropic Messages
timeout-minutes: 20
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: 24
cache: pnpm
diff --git a/.github/workflows/python-release.yml b/.github/workflows/python-release.yml
index b756f5bf38..0474ccfe92 100644
--- a/.github/workflows/python-release.yml
+++ b/.github/workflows/python-release.yml
@@ -40,7 +40,7 @@ jobs:
matrix:
python: ['3.10', '3.14']
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
with:
persist-credentials: false
@@ -48,7 +48,7 @@ jobs:
with:
python-version: ${{ matrix.python }}
- - uses: actions/download-artifact@v8
+ - uses: actions/download-artifact@v8.0.1
with:
pattern: deepseek_harness_*
path: dist
@@ -83,7 +83,7 @@ jobs:
outputs:
version: ${{ steps.version.outputs.version }}
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
with:
persist-credentials: false
@@ -134,7 +134,7 @@ jobs:
}
fi
- - uses: actions/download-artifact@v8
+ - uses: actions/download-artifact@v8.0.1
with:
pattern: deepseek_harness_*
path: dist
@@ -175,7 +175,7 @@ jobs:
sha256sum *.whl | sort -k2 > SHA256SUMS
cat SHA256SUMS
- - uses: actions/upload-artifact@v7
+ - uses: actions/upload-artifact@v7.0.1
with:
name: python-release-${{ steps.version.outputs.version }}
path: dist/*
@@ -193,7 +193,7 @@ jobs:
contents: read
id-token: write
steps:
- - uses: actions/download-artifact@v8
+ - uses: actions/download-artifact@v8.0.1
with:
name: python-release-${{ needs.validate.outputs.version }}
path: dist
@@ -228,7 +228,7 @@ jobs:
contents: read
id-token: write
steps:
- - uses: actions/download-artifact@v8
+ - uses: actions/download-artifact@v8.0.1
with:
name: python-release-${{ needs.validate.outputs.version }}
path: dist
diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml
index cdee5ce196..ec03a117de 100644
--- a/.github/workflows/release-publish.yml
+++ b/.github/workflows/release-publish.yml
@@ -21,16 +21,16 @@ jobs:
runs-on: ubuntu-24.04
steps:
# Complete history: the release scripts read tags.
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
persist-credentials: false
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
@@ -42,7 +42,7 @@ jobs:
store_path=$(PNPM_CONFIG_STORE_DIR="$store_root" pnpm store path --silent)
echo "path=$store_path" >> "$GITHUB_OUTPUT"
- - uses: actions/cache/restore@v4
+ - uses: actions/cache/restore@v6.1.0
with:
path: ${{ steps.pnpm-store.outputs.path }}
key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -82,7 +82,7 @@ jobs:
- name: Verify packed install
run: pnpm run release:verify-packed-install --family dsh --from dist/npm --from dist/npm-vendor --from dist/npm-landlock
- - uses: actions/upload-artifact@v4
+ - uses: actions/upload-artifact@v7.0.1
with:
name: dsh-npm-tarballs
path: dist/npm/*
@@ -104,15 +104,15 @@ jobs:
steps:
# Checkout and install carry the release scripts only. There is no build
# step: publication uploads the bytes the pack job produced.
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
registry-url: https://registry.npmjs.org
@@ -120,7 +120,7 @@ jobs:
- name: Install (immutable, no package scripts)
run: pnpm install --frozen-lockfile --ignore-scripts
- - uses: actions/download-artifact@v4
+ - uses: actions/download-artifact@v8.0.1
with:
name: dsh-npm-tarballs
path: dist/npm
diff --git a/.github/workflows/release-vendor-publish.yml b/.github/workflows/release-vendor-publish.yml
index a50a408025..25ec400b27 100644
--- a/.github/workflows/release-vendor-publish.yml
+++ b/.github/workflows/release-vendor-publish.yml
@@ -7,6 +7,12 @@ name: Release publish (vendor)
on:
workflow_dispatch:
+ inputs:
+ dist-tag:
+ description: Optional unused npm channel. Leave empty for latest (stable) or next (prerelease).
+ required: false
+ type: string
+ default: ''
permissions:
contents: read
@@ -21,16 +27,16 @@ jobs:
runs-on: ubuntu-24.04
steps:
# Complete history: the release scripts read tags.
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
persist-credentials: false
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
@@ -42,7 +48,7 @@ jobs:
store_path=$(PNPM_CONFIG_STORE_DIR="$store_root" pnpm store path --silent)
echo "path=$store_path" >> "$GITHUB_OUTPUT"
- - uses: actions/cache/restore@v4
+ - uses: actions/cache/restore@v6.1.0
with:
path: ${{ steps.pnpm-store.outputs.path }}
key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -68,7 +74,7 @@ jobs:
- name: Verify packed install
run: pnpm run release:verify-packed-install --family vendor --from dist/npm-vendor
- - uses: actions/upload-artifact@v4
+ - uses: actions/upload-artifact@v7.0.1
with:
name: vendor-npm-tarballs
path: dist/npm-vendor/*
@@ -87,15 +93,15 @@ jobs:
contents: read
steps:
# Checkout and install carry the release scripts only; no build step.
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
registry-url: https://registry.npmjs.org
@@ -103,7 +109,7 @@ jobs:
- name: Install (immutable, no package scripts)
run: pnpm install --frozen-lockfile --ignore-scripts
- - uses: actions/download-artifact@v4
+ - uses: actions/download-artifact@v8.0.1
with:
name: vendor-npm-tarballs
path: dist/npm-vendor
@@ -111,4 +117,10 @@ jobs:
- name: Publish tarballs
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
- run: pnpm run release:publish --family vendor --from dist/npm-vendor
+ RELEASE_DIST_TAG: ${{ inputs.dist-tag }}
+ run: |
+ args=()
+ if [[ -n "$RELEASE_DIST_TAG" ]]; then
+ args+=(--dist-tag "$RELEASE_DIST_TAG")
+ fi
+ pnpm run release:publish --family vendor --from dist/npm-vendor "${args[@]}"
diff --git a/.github/workflows/release-vendor.yml b/.github/workflows/release-vendor.yml
index 75fb865767..f8bf170c1c 100644
--- a/.github/workflows/release-vendor.yml
+++ b/.github/workflows/release-vendor.yml
@@ -43,7 +43,7 @@ jobs:
|| 'ubuntu-24.04' }}
steps:
# Complete history: the release scripts read tags.
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
persist-credentials: false
@@ -55,11 +55,11 @@ jobs:
echo "npm_config_devdir=${{ runner.temp }}/node-gyp" >> "$GITHUB_ENV"
echo "TMPDIR=${{ runner.temp }}" >> "$GITHUB_ENV"
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
package-manager-cache: false
@@ -72,7 +72,7 @@ jobs:
store_path=$(PNPM_CONFIG_STORE_DIR="$store_root" pnpm store path --silent)
echo "path=$store_path" >> "$GITHUB_OUTPUT"
- - uses: actions/cache/restore@v4
+ - uses: actions/cache/restore@v6.1.0
if: runner.environment == 'github-hosted'
with:
path: ${{ steps.pnpm-store.outputs.path }}
@@ -89,7 +89,7 @@ jobs:
# The vendored packages publish their own sources and build outputs; the
# host build produces what their manifests select.
- name: Build
- run: pnpm run build:lib:host
+ run: ${{ github.event_name == 'pull_request' && 'pnpm exec tsx scripts/compile-referenced-projects.ts host-libraries' || 'pnpm run build:lib:host' }}
# Concurrency here is rehearsal-only: the credentialed publish workflows
# invoke release:pack without the flag and keep the strictly serial path.
@@ -99,7 +99,7 @@ jobs:
- name: Verify packed install
run: pnpm run release:verify-packed-install --family vendor --from dist/npm-vendor
- - uses: actions/upload-artifact@v4
+ - uses: actions/upload-artifact@v7.0.1
with:
name: vendor-npm-tarballs
path: dist/npm-vendor/*
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 633186c8f1..7fd8c9ab8a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -41,7 +41,7 @@ jobs:
&& fromJSON('["self-hosted", "linux", "x64", "vm-backup"]')
|| 'ubuntu-24.04' }}
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
with:
persist-credentials: false
clean: true
@@ -52,11 +52,11 @@ jobs:
echo "npm_config_devdir=${{ runner.temp }}/node-gyp" >> "$GITHUB_ENV"
echo "TMPDIR=${{ runner.temp }}" >> "$GITHUB_ENV"
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
package-manager-cache: false
@@ -69,7 +69,7 @@ jobs:
store_path=$(PNPM_CONFIG_STORE_DIR="$store_root" pnpm store path --silent)
echo "path=$store_path" >> "$GITHUB_OUTPUT"
- - uses: actions/cache/restore@v4
+ - uses: actions/cache/restore@v6.1.0
if: runner.environment == 'github-hosted'
with:
path: ${{ steps.pnpm-store.outputs.path }}
@@ -102,7 +102,7 @@ jobs:
|| 'ubuntu-24.04' }}
steps:
# Complete history: the release scripts read tags.
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
persist-credentials: false
@@ -114,11 +114,11 @@ jobs:
echo "npm_config_devdir=${{ runner.temp }}/node-gyp" >> "$GITHUB_ENV"
echo "TMPDIR=${{ runner.temp }}" >> "$GITHUB_ENV"
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
package-manager-cache: false
@@ -131,7 +131,7 @@ jobs:
store_path=$(PNPM_CONFIG_STORE_DIR="$store_root" pnpm store path --silent)
echo "path=$store_path" >> "$GITHUB_OUTPUT"
- - uses: actions/cache/restore@v4
+ - uses: actions/cache/restore@v6.1.0
if: runner.environment == 'github-hosted'
with:
path: ${{ steps.pnpm-store.outputs.path }}
@@ -146,7 +146,7 @@ jobs:
run: pnpm run release:verify --family dsh
- name: Build
- run: pnpm run build:official
+ run: ${{ github.event_name == 'pull_request' && 'pnpm run build --artifacts-only --profile official' || 'pnpm run build:official' }}
# Concurrency here is rehearsal-only: the credentialed publish workflows
# invoke release:pack without the flag and keep the strictly serial path.
@@ -172,7 +172,7 @@ jobs:
- name: Verify packed install
run: pnpm run release:verify-packed-install --family dsh --from dist/npm --from dist/npm-vendor --from dist/npm-landlock
- - uses: actions/upload-artifact@v4
+ - uses: actions/upload-artifact@v7.0.1
with:
name: dsh-npm-tarballs
path: dist/npm/*
diff --git a/.github/workflows/sandbox.yml b/.github/workflows/sandbox.yml
index 46c6ac71f2..1494b8d1db 100644
--- a/.github/workflows/sandbox.yml
+++ b/.github/workflows/sandbox.yml
@@ -66,11 +66,11 @@ jobs:
|| matrix.os }}
timeout-minutes: 20
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: 24
@@ -146,11 +146,11 @@ jobs:
runs-on: macos-latest
timeout-minutes: 60
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7.0.1
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v5.0.0
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@v7.0.0
with:
node-version: 24
diff --git a/.oxlintrc.json b/.oxlintrc.json
index 348b057bc3..f52fdb1e84 100644
--- a/.oxlintrc.json
+++ b/.oxlintrc.json
@@ -23,6 +23,7 @@
"packages/typert/generator/tests/fixtures/type-model/**", // tsgolint rejects this fixture's preserved project shapes before rules run.
"website/.generated/**",
"vendor/**", // Vendored source keeps upstream style and idioms.
+ "packages/experimental/claude-code-mods/examples/*/{hooks,tests,types}/**", // Claude Code's published example mods and their tests keep the upstream style; see the headers.
"native/**", // The imported landlock-run subtree has its own gates; see native/README.md.
"**/*.js",
"**/*.mjs",
diff --git a/AGENTS.md b/AGENTS.md
index fc94452a0f..38e5ae46cf 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -40,7 +40,6 @@ packages/ @deepseek-ai/dsh- workspaces at packages///
jobs/ background jobs
bundle/ profile bundles
workflow/ workflow execution
- webhook/ webhook ingress
todo/ todo_write tool
plan/ logged planning
goal/ session goals
@@ -48,7 +47,6 @@ packages/ @deepseek-ai/dsh- workspaces at packages///
preset/ agent composition
guard/ loop/tool guards
extensions/ runtime self-modification
- hooks/ Claude Code/Codex bridges
session/ durable sessions
session-query/ browsing/search/export
attachment/ binary attachments
@@ -66,9 +64,8 @@ packages/ @deepseek-ai/dsh- workspaces at packages///
host/ GUI host
client/ GUI client
mcp/ external tools
- experimental/ pre-stable prototypes; public by default with explicit private exceptions
+ experimental/ evaluated capabilities without a product-support commitment
test-support/ test infrastructure
- runtime-diagnostics/ runtime invariants
util/ zero-dependency utilities
python/ Python SDK/runtime (python/README.md)
native/ @deepseek-ai/node-addon-system source (native/README.md)
@@ -79,7 +76,7 @@ scripts/ gates and generators
website/ VitePress documentation projection
```
-Package groups: [packages/README.md](packages/README.md).
+Package groups: [packages/README.md](packages/README.md). [Experimental status](packages/experimental/README.md#status) is independent of optional delivery; nonexperimental packages need product use or an explicit [classification](scripts/product-package-policy.ts).
## Commands
@@ -128,11 +125,10 @@ Real-API tests/demos read `DEEPSEEK_API_KEY`, optional `DEEPSEEK_BASE_URL`, and
## Conventions
-- Packages use `@deepseek-ai/dsh-`; vendor is [rescoped](docs/rescope.md) and `private: true`. Harness packages declare `@deepseek-ai/cordis` in `peerDependencies`/`devDependencies`. Workspace dependency sections use DSH `workspace:*`, vendor/native `workspace:~` ([rules](.agents/notes/implemented/process/2026-09-22-workspace-release-ranges.md)).
+- Packages use `@deepseek-ai/dsh-`; vendor is [rescoped](docs/rescope.md) and `private: true`. Harness packages declare `@deepseek-ai/cordis` in `peerDependencies`/`devDependencies`. Workspace dependency sections use DSH `workspace:*`, vendor/native `workspace:~` ([rules](.agents/notes/implemented/process/2026-08-10-npm-release-sequences.md)).
- ESM everywhere (`"type": "module"`). Use package names across packages and `.ts` in local relative imports. Config subprocesses run built `lib/` under plain Node; source regressions use their declared launcher ([testing policy](docs/testing.md#test-subprocess-launch-modes)). The `dsh` CLI source launch runs through tsx's ESM-only hook (`node --import tsx/esm`); modules it reaches must stay ESM (no CJS-only exports) — Node's native TypeScript modes are unavailable across the engines range ([source-launch contract](.agents/notes/implemented/architecture/2026-07-29-dsh-source-launch-tsx-esm.md)). Raw/Web `cordis.yml` bare plugins must appear in their resolver manifest's `dependencies`; `verify-cordis-config` enforces it.
- **Registrations are effects**: every contribution goes through `ctx.effect()` / `ctx.on()`; a registry's `register()` returns the disposer.
-- **Runtime invariants assert owned relationships.** Publish `./invariant` only when independent observations can diverge. Otherwise omit its source and wiring and record why in its README; empty installers and checks of service presence, plugin metadata, effects, or fixed examples are invalid ([package invariant rules](packages/AGENTS.md)).
-- **Typed events use declaration merging** and merge-extensible maps. Event JSDoc needs `@mode` and payload `@param`; scoped keys absent from payloads need `@dshScopeScan unsupported`. Public service methods document parameters and non-void returns. `SessionEventMap` members are required-on-read by default — builds that do not know a type refuse the log unless the event carries the envelope's `ignorable: true`; only structural format changes bump `SESSION_FORMAT_VERSION` ([mechanism](.agents/notes/implemented/architecture/2026-08-10-session-log-version-mechanism.md)).
+- **Typed events use declaration merging** and merge-extensible maps. Event JSDoc needs `@mode` and payload `@param`. Public service methods document parameters and non-void returns. `SessionEventMap` members are required-on-read by default — builds that do not know a type refuse the log unless the event carries the envelope's `ignorable: true`; only structural format changes bump `SESSION_FORMAT_VERSION` ([mechanism](.agents/notes/implemented/architecture/2026-08-10-session-log-version-mechanism.md)).
- **Switch on discriminant tags.** Closed unions end in `assertNever`; merge-extensible unions fall through a documented default.
- **Waterfall listeners MUST call `next()`** to delegate; returning without it short-circuits the chain ([semantics](docs/cordis-primer.md#cordis-waterfall-semantics)).
- **Model-visible ⟺ logged**: anything that reaches a model request must be reconstructable from the session log; a new model-visible input requires a session event.
@@ -148,7 +144,7 @@ Real-API tests/demos read `DEEPSEEK_API_KEY`, optional `DEEPSEEK_BASE_URL`, and
- **Source plane vs artifact plane, never mixed.** Static gates and tests resolve workspace imports through tsconfig `paths` to `src` and pass on a clean tree; gates consuming built `lib/` declare that dependency ([layout](docs/development.md#typescript-project-layout)).
- **Keep compiler faces explicit.** A package with both Host and Client programs exposes face-specific leaf configs and a solution-only root; repo-wide programs seed a face config, never the root solution ([layout](docs/development.md#typescript-project-layout)).
- **An empty `catch` names the error** and why; keep its `try` to one statement.
-- **Keep comments local.** Do not restate code, expand unrelated comments, or explain distant behavior without local need ([rationale](.agents/notes/implemented/process/2026-08-09-concrete-prose-names-actors-and-recorded-facts.md)).
+- **Keep comments local.** Do not restate code, expand unrelated comments, or explain distant behavior without local need ([rationale](.agents/skills/dsh-prose-standard/SKILL.md)).
- **Ban `prove` + `nance`** ([rule](.agents/notes/implemented/process/2026-08-26-ban-ambiguous-origin-label.md)).
- **Prefer symmetry for parallel values**; unexplained asymmetry usually signals a missed extraction.
- **Tests describe behavior, not correctness.** Change obsolete behavior with its tests; explain why in the PR.
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index b863bd7258..741c98db08 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -36,7 +36,7 @@ External packages installed for runtime use or distributed inside the prebuilt b
| [`@anthropic-ai/sdk`](https://github.com/anthropics/anthropic-sdk-typescript) | MIT |
| [`@babel/code-frame`](https://github.com/babel/babel) | MIT |
| [`@browserbasehq/stagehand`](https://github.com/browserbase/stagehand) | MIT |
-| [`@deepseek-ai/libreoffice-kit`](https://github.com/deepseek-harness/libreoffice-kit) | MPL-2.0 |
+| [`@deepseek-ai/libreoffice-kit`](https://github.com/deepseek-ai/dsh-libreoffice-kit) | MPL-2.0 |
| [`@earendil-works/pi-ai`](https://github.com/earendil-works/pi) | MIT |
| [`@eslint-community/regexpp`](https://github.com/eslint-community/regexpp) | MIT |
| [`@fortune-sheet/core`](https://github.com/ruilisi/fortune-sheet) | MIT |
@@ -78,6 +78,7 @@ External packages installed for runtime use or distributed inside the prebuilt b
| [`big.js`](https://github.com/MikeMcl/big.js) | MIT |
| [`buffer`](https://github.com/feross/buffer) | MIT |
| [`chokidar`](https://github.com/paulmillr/chokidar) | MIT |
+| [`chrome-devtools-frontend`](https://github.com/ChromeDevTools/devtools-frontend) | BSD-3-Clause |
| [`chrome-devtools-mcp`](https://github.com/ChromeDevTools/chrome-devtools-mcp) | Apache-2.0 |
| [`clsx`](https://github.com/lukeed/clsx) | MIT |
| [`commander`](https://github.com/tj/commander.js) | MIT |
@@ -121,6 +122,7 @@ External packages installed for runtime use or distributed inside the prebuilt b
| [`readable-stream`](https://github.com/nodejs/readable-stream) | MIT |
| [`resolve.exports`](https://github.com/lukeed/resolve.exports) | MIT |
| [`semver`](https://github.com/npm/node-semver) | ISC |
+| [`serve-static`](https://github.com/expressjs/serve-static) | MIT |
| [`sharp`](https://github.com/lovell/sharp) | Apache-2.0 |
| [`sherpa-onnx-node`](https://github.com/csukuangfj/sherpa-onnx) | Apache-2.0 |
| [`shiki`](https://github.com/shikijs/shiki) | MIT |
@@ -139,7 +141,7 @@ External packages installed for runtime use or distributed inside the prebuilt b
pnpm applies local patches to the following packages at install time, so shipped artifacts carry modified copies; each patch file is the complete record of the modification:
-- `@earendil-works/pi-ai@0.87.1` — [`patches/@earendil-works__pi-ai@0.87.1.patch`](patches/@earendil-works__pi-ai@0.87.1.patch)
+- `@earendil-works/pi-ai@1.0.2` — [`patches/@earendil-works__pi-ai@1.0.2.patch`](patches/@earendil-works__pi-ai@1.0.2.patch)
- `@electron/osx-sign@1.3.3` — [`patches/@electron__osx-sign@1.3.3.patch`](patches/@electron__osx-sign@1.3.3.patch)
- `@fortune-sheet/core@1.0.4` — [`patches/@fortune-sheet__core@1.0.4.patch`](patches/@fortune-sheet__core@1.0.4.patch)
- `@fortune-sheet/react@1.0.4` — [`patches/@fortune-sheet__react@1.0.4.patch`](patches/@fortune-sheet__react@1.0.4.patch)
@@ -147,6 +149,11 @@ pnpm applies local patches to the following packages at install time, so shipped
- `exceljs@4.4.0` — [`patches/exceljs@4.4.0.patch`](patches/exceljs@4.4.0.patch)
- `node-pty@1.2.0-beta.15` — [`patches/node-pty@1.2.0-beta.15.patch`](patches/node-pty@1.2.0-beta.15.patch)
+## Chrome DevTools frontend
+
+The optional experimental Inspector distributes a locally compiled copy of [chrome-devtools-frontend 1.0.1638082](https://www.npmjs.com/package/chrome-devtools-frontend/v/1.0.1638082), from upstream revision [0e1186138ed519d9659c1874bf6375eca4483c72](https://chromium.googlesource.com/devtools/devtools-frontend/+/0e1186138ed519d9659c1874bf6375eca4483c72). The build includes the Chromium [BSD-3-Clause license](packages/experimental/inspector/assets/devtools/LICENSE) and the third-party license and notice files supplied by the npm source. The Chromium root license does not replace those dependencies' licenses.
+
+
## Official Claude Code platform payloads
The project owner authorizes distribution of every version of the official `@anthropic-ai/claude-agent-sdk` package and the official Claude Code CLI/platform payloads that each version declares through `optionalDependencies`. This identity-scoped authorization does not classify their declared terms as permissive and does not cover any unrelated runtime package; version, declared-license, and payload-set changes still require the ordinary dependency, lockfile, compatibility, terms, and notices review.
@@ -169,7 +176,7 @@ The installed SDK 0.3.263 declares the following optional platform packages. Eac
`@deepseek-ai/libreoffice-kit`, `@deepseek-ai/libreoffice-kit-wasm`, `@deepseek-ai/libreoffice-kit-darwin-arm64`, `@deepseek-ai/libreoffice-kit-darwin-x64`, `@deepseek-ai/libreoffice-kit-win32-arm64`, `@deepseek-ai/libreoffice-kit-win32-x64` declare MPL-2.0, which remains outside the permissive-license allowlist; the notices check accepts only these package identities at those terms. The [distribution decision](.agents/notes/implemented/architecture/2026-09-14-independent-libreoffice-kit.md) records the source obligations.
-The [kit repository](https://github.com/deepseek-harness/libreoffice-kit) supplies the corresponding LibreOffice source pin, modifications, build instructions, Node API, and artifact validation. Its engine packages retain their license and third-party notices; the Node API retains its MPL-2.0 declaration and NOTICE. Recipients must have access to those corresponding sources and notices.
+The [kit repository](https://github.com/deepseek-ai/dsh-libreoffice-kit) supplies the corresponding LibreOffice source pin, modifications, build instructions, Node API, and artifact validation. Its engine packages retain their license and third-party notices; the Node API retains its MPL-2.0 declaration and NOTICE. Recipients must have access to those corresponding sources and notices.
## Development-only npm dependencies
@@ -205,6 +212,7 @@ External packages **directly declared** for development, tests, types, or toolin
| [`@types/react-dom`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
| [`@types/readable-stream`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
| [`@types/semver`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
+| [`@types/serve-static`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
| [`@types/spdx-expression-parse`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
| [`@types/turndown`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
| [`@types/use-sync-external-store`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
diff --git a/apps/cli/composition.md b/apps/cli/composition.md
index e627d9e47d..9888602296 100644
--- a/apps/cli/composition.md
+++ b/apps/cli/composition.md
@@ -64,6 +64,10 @@ flowchart LR
cfg --> plugin_dsh_base_attachment_local
plugin_dsh_base_session_query_sqlite["session-query-sqlite
@deepseek-ai/dsh-session-query-sqlite"]
cfg --> plugin_dsh_base_session_query_sqlite
+ plugin_dsh_base_working_directory["working-directory
@deepseek-ai/dsh-working-directory"]
+ cfg --> plugin_dsh_base_working_directory
+ plugin_dsh_base_tool_working_directory["tool-working-directory
@deepseek-ai/dsh-tool-working-directory"]
+ cfg --> plugin_dsh_base_tool_working_directory
plugin_dsh_base_session_projection["session-projection
@deepseek-ai/dsh-session-projection"]
cfg --> plugin_dsh_base_session_projection
plugin_dsh_base_storage["storage
@deepseek-ai/dsh-storage"]
@@ -112,8 +116,6 @@ flowchart LR
cfg --> plugin_dsh_base_skill
plugin_dsh_base_skill_filesystem["skill-filesystem
@deepseek-ai/dsh-skill-filesystem"]
cfg --> plugin_dsh_base_skill_filesystem
- plugin_dsh_base_skill_badge["skill-badge
@deepseek-ai/dsh-skill-badge"]
- cfg --> plugin_dsh_base_skill_badge
plugin_dsh_base_tool_skill["tool-skill
@deepseek-ai/dsh-tool-skill"]
cfg --> plugin_dsh_base_tool_skill
plugin_dsh_base_commands["commands
@deepseek-ai/dsh-commands"]
@@ -170,8 +172,6 @@ flowchart LR
cfg --> plugin_dsh_base_tool_todo
plugin_dsh_base_tool_goal["tool-goal
@deepseek-ai/dsh-tool-goal"]
cfg --> plugin_dsh_base_tool_goal
- plugin_dsh_base_tool_ralph["tool-ralph
@deepseek-ai/dsh-tool-ralph"]
- cfg --> plugin_dsh_base_tool_ralph
plugin_dsh_base_repeat_tool_reminder["repeat-tool-reminder
@deepseek-ai/dsh-repeat-tool-reminder"]
cfg --> plugin_dsh_base_repeat_tool_reminder
plugin_dsh_base_web["web
@deepseek-ai/dsh-web"]
@@ -228,6 +228,8 @@ flowchart LR
| `session-persistence-jsonl` | `@deepseek-ai/dsh-session-persistence-jsonl` |
| `attachment-local` | `@deepseek-ai/dsh-attachment-local` |
| `session-query-sqlite` | `@deepseek-ai/dsh-session-query-sqlite` |
+| `working-directory` | `@deepseek-ai/dsh-working-directory` |
+| `tool-working-directory` | `@deepseek-ai/dsh-tool-working-directory` |
| `session-projection` | `@deepseek-ai/dsh-session-projection` |
| `storage` | `@deepseek-ai/dsh-storage` |
| `storage-json` | `@deepseek-ai/dsh-storage-json` |
@@ -252,7 +254,6 @@ flowchart LR
| `agent-instructions` | `@deepseek-ai/dsh-agent-instructions` |
| `skill` | `@deepseek-ai/dsh-skill` |
| `skill-filesystem` | `@deepseek-ai/dsh-skill-filesystem` |
-| `skill-badge` | `@deepseek-ai/dsh-skill-badge` |
| `tool-skill` | `@deepseek-ai/dsh-tool-skill` |
| `commands` | `@deepseek-ai/dsh-commands` |
| `command-feedback` | `@deepseek-ai/dsh-command-feedback` |
@@ -281,7 +282,6 @@ flowchart LR
| `image-offload` | `@deepseek-ai/dsh-compaction-image-offload` |
| `tool-todo` | `@deepseek-ai/dsh-tool-todo` |
| `tool-goal` | `@deepseek-ai/dsh-tool-goal` |
-| `tool-ralph` | `@deepseek-ai/dsh-tool-ralph` |
| `repeat-tool-reminder` | `@deepseek-ai/dsh-repeat-tool-reminder` |
| `web` | `@deepseek-ai/dsh-web` |
| `web-search-deepseek` | `@deepseek-ai/dsh-web-search-deepseek` |
diff --git a/apps/cli/package.json b/apps/cli/package.json
index 81494aea52..3da15fcad8 100644
--- a/apps/cli/package.json
+++ b/apps/cli/package.json
@@ -1,7 +1,7 @@
{
"name": "@deepseek-ai/dsh",
"description": "dsh CLI: profile launch, plugin management, and configuration inspection",
- "version": "0.2.0-rc.2",
+ "version": "0.2.1-alpha.1",
"publishConfig": {
"access": "public"
},
@@ -39,13 +39,12 @@
"@deepseek-ai/dsh-compaction-tool-result-pruner": "workspace:*",
"@deepseek-ai/dsh-cordis-client-runner": "workspace:*",
"@deepseek-ai/dsh-experimental-agent-team-profile": "workspace:*",
+ "@deepseek-ai/dsh-experimental-inspector-profile": "workspace:*",
"@deepseek-ai/dsh-fs-local": "workspace:*",
"@deepseek-ai/dsh-goal": "workspace:*",
"@deepseek-ai/dsh-goal-round-driver": "workspace:*",
"@deepseek-ai/dsh-headless": "workspace:*",
"@deepseek-ai/dsh-home-paths": "workspace:*",
- "@deepseek-ai/dsh-hooks-claude-code": "workspace:*",
- "@deepseek-ai/dsh-hooks-codex": "workspace:*",
"@deepseek-ai/dsh-jobs-local": "workspace:*",
"@deepseek-ai/dsh-launch-environment": "workspace:*",
"@deepseek-ai/dsh-mcp-client": "workspace:*",
@@ -78,7 +77,6 @@
"@deepseek-ai/dsh-tool-jobs": "workspace:*",
"@deepseek-ai/dsh-tool-pwsh": "workspace:*",
"@deepseek-ai/dsh-tool-pwsh-persistent": "workspace:*",
- "@deepseek-ai/dsh-tool-ralph": "workspace:*",
"@deepseek-ai/dsh-tool-schedule": "workspace:*",
"@deepseek-ai/dsh-tool-skill": "workspace:*",
"@deepseek-ai/dsh-tool-str-replace-editor": "workspace:*",
@@ -88,12 +86,10 @@
"@deepseek-ai/dsh-tool-web": "workspace:*",
"@deepseek-ai/dsh-tool-workflow": "workspace:*",
"@deepseek-ai/dsh-web-app": "workspace:*",
- "@deepseek-ai/dsh-webhook": "workspace:*",
- "@deepseek-ai/dsh-webhook-github": "workspace:*",
"@deepseek-ai/dsh-workflow-ptc": "workspace:*",
"@deepseek-ai/schemastery": "workspace:~",
"commander": "^15.0.0",
- "js-yaml": "^4.2.0",
+ "js-yaml": "^4.3.2",
"node-addon-require-builtin": "^0.1.6",
"@deepseek-ai/dsh-http-proxy": "workspace:*",
"@deepseek-ai/dsh-mcp-resources": "workspace:*",
@@ -101,9 +97,22 @@
"@deepseek-ai/dsh-atomic-write": "workspace:*",
"@deepseek-ai/dsh-agent-preset": "workspace:*",
"@deepseek-ai/dsh-experimental-voice-input-bundle": "workspace:*",
- "@deepseek-ai/dsh-experimental-auto-review": "workspace:*"
+ "@deepseek-ai/dsh-experimental-auto-review": "workspace:*",
+ "@deepseek-ai/dsh-experimental-cot-translation-bundle": "workspace:*",
+ "@deepseek-ai/dsh-experimental-badge-skill-bundle": "workspace:*",
+ "@deepseek-ai/dsh-experimental-ralph-bundle": "workspace:*",
+ "@deepseek-ai/dsh-experimental-session-titles-bundle": "workspace:*",
+ "@deepseek-ai/dsh-experimental-terminal-bundle": "workspace:*",
+ "@deepseek-ai/dsh-experimental-session-search": "workspace:*",
+ "@deepseek-ai/dsh-experimental-tool-worktree": "workspace:*"
},
"devDependencies": {
+ "@deepseek-ai/dsh-skill-badge": "workspace:*",
+ "@deepseek-ai/dsh-webhook-github": "workspace:*",
+ "@deepseek-ai/dsh-webhook": "workspace:*",
+ "@deepseek-ai/dsh-tool-ralph": "workspace:*",
+ "@deepseek-ai/dsh-hooks-codex": "workspace:*",
+ "@deepseek-ai/dsh-hooks-claude-code": "workspace:*",
"@agentclientprotocol/sdk": "1.4.0",
"@deepseek-ai/dsh-acp": "workspace:*",
"@deepseek-ai/dsh-agent": "workspace:*",
@@ -149,8 +158,8 @@
"@types/js-yaml": "^4.0.9",
"@types/ws": "8.18.1",
"ajv": "^8.20.0",
- "execa": "^10.0.0",
- "ws": "8.21.0"
+ "execa": "^10.0.1",
+ "ws": "8.21.3"
},
"exports": {
"./profile-boot": {
diff --git a/apps/cli/reference/README.i18n.yaml b/apps/cli/reference/README.i18n.yaml
index 7019d0bc1e..da6e0863ff 100644
--- a/apps/cli/reference/README.i18n.yaml
+++ b/apps/cli/reference/README.i18n.yaml
@@ -3,14 +3,14 @@
# After editing either side, bring the other along and re-record with:
# pnpm run verify-translation-pairing --write apps/cli/reference/README.md
/dsh-cli-behavior-reference:
- en: d25712a65d21ab45
- zh: b1c57b706bc64085
+ en: 5a4f43756dae900e
+ zh: d58c479481cfa5fe
/dsh-cli-behavior-reference/profile-boot:
en: e3a159750f5f9ed3
zh: e02d9004fcc239f9
/dsh-cli-behavior-reference/profile-boot/app-arguments:
- en: 241e5525aa09a33b
- zh: 398f853143097154
+ en: be06f11a3b585d0f
+ zh: 28c7ee6e0d86dc3b
/dsh-cli-behavior-reference/profile-boot/config-schema-dump:
en: a356f8a68f3b3685
zh: c718713b5d709295
@@ -18,11 +18,11 @@
en: d6368bf97a02bd57
zh: 2ab7888a108961ce
/dsh-cli-behavior-reference/plugin-management:
- en: 9980ff1600fa9460
- zh: cc66ba45e27b5540
+ en: 8d2cfff9bab7327f
+ zh: 21515ab6e6798504
/dsh-cli-behavior-reference/web-profile:
- en: 12bba432c07573bf
- zh: ab6b365cfb95003f
+ en: 536c6883a0d54b14
+ zh: 6dd2469b71189c87
/dsh-cli-behavior-reference/shared-deployment-behavior:
en: 6a7abc9339e8f37f
zh: 133adb834c8e195d
diff --git a/apps/cli/reference/README.md b/apps/cli/reference/README.md
index ae492f22c8..e8105bab78 100644
--- a/apps/cli/reference/README.md
+++ b/apps/cli/reference/README.md
@@ -4,6 +4,8 @@ English | [中文](README.zh.md)
This reference defines the profile, plugin-management, and config-dump command modes. Argv is parsed once through [`src/args.ts`](../src/args.ts), and [`src/bin.ts`](../src/bin.ts) dynamically imports only the selected runner.
+The [generated command help](../../../docs/cli-help.md) contains complete launcher, plugin-management, and shipped-profile help. Run `pnpm run gen-cli-help` to refresh it; `pnpm run verify-cli-help` checks it against the current CLI.
+
## Profile boot
`dsh ` abbreviates `dsh --profile ` and boots the profile at `$DSH_HOME/profiles/`. The shorthand name must immediately follow `dsh`; `plugin` remains the plugin-management command, so boot a profile with that name using `dsh --profile plugin`. The effective tree is composed over an empty root by applying, in order: each bundle patch named in the profile manifest's `dsh.profile.bundles` list, the profile's own `cordis.patch.yml`, the home-level `$DSH_HOME/cordis.patch.yml` (machine-local preferences shared by every profile, so it outranks the per-profile layer), and each `--patch ` overlay in argv order. Later layers win per row; a patch replaces the targeted row's complete `config` value rather than deep-merging keys, and may insert new rows. The final YAML composition controls whether `dsh-hmr` watches configuration; without HMR, changes require restart. A parse, schema, resolution, or plugin boot failure is reported and exits nonzero. SIGINT and SIGTERM dispose the mounted root before exit.
@@ -33,7 +35,7 @@ The shipped apps own these command lines:
| Profile | Arguments |
|---|---|
-| `web` | `--host`, `--port`, repeatable `--trusted-host`, `--no-open` |
+| `web` | `--host`, `--port`, `--public-url`, repeatable `--trusted-host`, `--no-open` |
| `headless` | the task text, as the positional argument |
| `sdk` | no options; stdio carries the JSON-RPC protocol |
| `sdk-minimal` | no options; stdio carries the same JSON-RPC protocol |
@@ -80,6 +82,8 @@ New directories and files request modes `0700` and `0600` on POSIX. The CLI prin
`dsh plugin --profile ` initializes the profile when missing (shipped template, or `@deepseek-ai/dsh-base` alone for other names), then forwards `` to `pnpm` with the profile directory as working directory — `add`, `remove`, `why`, `update`, and every other pnpm verb work unchanged; pnpm must be on PATH. Relative path specs (`.`, `../plugin`, and their `file:`/`link:` forms) are anchored to the invoking directory first, so `add .` from a plugin checkout installs that checkout, not the profile. After every successful run, `dsh.profile.bundles` is reconciled against the installed state: each dependency resolving to a package whose manifest declares `"dsh": { "bundle": { "patch": "./cordis.patch.yml" } }` joins the layer stack (so an `update` that gains the declaration activates it), a bundle-less dependency stays plain with a one-time warning, and a removed dependency leaves the stack.
+`dsh plugin` reads `--profile` only before the forwarded arguments, which start at the first token it does not recognize, so `--profile ` comes first. When the forwarded arguments begin with the pnpm command, everything after that command reaches pnpm verbatim, including `-h` and `--help`. When they begin with a pnpm option such as `--filter ` or `-r`, a later `-h` or `--help` still prints the forwarder's help instead of pnpm's, so put the pnpm command before them to reach pnpm's help. `-h` or `--help` before any forwarded argument prints the forwarder's own help and exits 0.
+
The Codex and Claude Code subagent providers are separate optional Bundles. Add either package, both in one command, or remove either package independently:
```sh
@@ -104,6 +108,8 @@ Git-hosted plugins that ship sources build during install through their `prepare
`dsh web` uses the profile shorthand. Launcher flags are parsed first; the remaining flags belong to the web app, whose ordinary bundle provider parses them. `--host` and `--port` override the composed values of the rows that carry them, repeatable `--trusted-host` contributes invocation authorities through `ctx.webRuntime.trustedHosts` (a deployment expression concatenates its own authorities), and `--no-open` disables the default-browser handoff for this invocation. The client-plugin HMR receiver is always mounted and stays idle until `pnpm run dev:web` rebuilds client bundles; that command builds once, starts this same launcher, and keeps client bundles rebuilt, or with `--no-serve` runs only the watchers beside a `dsh web` started elsewhere.
+`--public-url ` advertises one HTTP(S) application root — with an optional forwarding prefix — in place of the listener's loopback URL. It grants no trust, so the browser-visible authority still has to be named with `--trusted-host`; [Publish the Web UI behind a reverse proxy](../../../docs/user/guide/public-deployments.md) lists what the proxy in front must provide.
+
```sh
dsh web
dsh web --no-open
@@ -112,7 +118,7 @@ dsh web --dump-config
dsh web --help
```
-The production Web runner needs built package and frontend artifacts (`pnpm run build`). It serves `http://127.0.0.1:3080` by default and, for a local launch, opens that canonical host URL only after the complete Loader tree settles. A non-empty inherited `SSH_CONNECTION` or `SSH_TTY` suppresses the browser handoff because the SSH client or editor owns the local forwarded address; the host URL is still printed. The CLI intentionally does not support `--host 0.0.0.0` and exits with a usage error. Immediately before a local handoff it prints `dsh web: opening the default browser; pass --no-open to disable`; if the operating-system handoff fails, a diagnostic on stderr states the reason, leaves the server running, and names the URL for manual use. `--trusted-host` adds named authorities accepted by the `/api` browser-trust fence.
+The production Web runner needs built package and frontend artifacts (`pnpm run build`). It serves `http://127.0.0.1:3080` by default and, for a local launch, opens that canonical host URL — the advertised root when `--public-url` names one — only after the complete Loader tree settles. A non-empty inherited `SSH_CONNECTION` or `SSH_TTY` suppresses the browser handoff because the SSH client or editor owns the local forwarded address; the host URL is still printed. The CLI intentionally does not support `--host 0.0.0.0` and exits with a usage error. Immediately before a local handoff it prints `dsh web: opening the default browser; pass --no-open to disable`; if the operating-system handoff fails, a diagnostic on stderr states the reason, leaves the server running, and names the URL for manual use. `--trusted-host` adds named authorities accepted by the `/api` browser-trust fence.
Process shutdown gives the plugin tree up to five seconds to dispose. The first `SIGINT`/`SIGTERM` starts that graceful drain — `SIGTERM` is a supervisor's ordinary stop request and exits 0 on every surface, `SIGINT` reports 130; a second signal forces immediate exit. If one-shot normal completion is already stuck in disposal, the first `Ctrl+C` is the escalation and exits immediately instead of being swallowed.
@@ -120,7 +126,7 @@ The base-backed modes treat the invoking directory as the default workspace root
New sessions in base-backed profiles default to the `workspace-write` permission preset. Bash and filesystem mutations are restricted to the session workspace and platform temporary roots; reads and network access are not confined, while process visibility depends on the selected sandbox backend — bwrap runs commands in a private PID namespace that hides host processes, and Landlock and Seatbelt leave host process visibility unchanged. `DSH_PERMISSION_MODE` changes the process fallback. Stored General-settings permissions affect later Web sessions, not an already-open one. The standalone `sdk-minimal` tree instead pins `danger-full-access` and mounts no approval or permission-settings service.
-`DSH_TOOLS_MODE` selects `native`, `ptc`, or `both` for the process; another value fails at boot. The shipped `minimal` agent preset keeps that deployment presentation, fixes the complete system prompt to `You are a helpful software engineer assistant.`, and composes only the platform-selected persistent shell. Select 极简模式 when creating a Web session; every other prompt section and model-facing plugin remains absent from that agent while the shared browser, workspace, persistence, sandbox, and permission host stays in place.
+`DSH_TOOLS_MODE` selects `native` or `ptc` for the process; another value fails at boot. The shipped `minimal` agent preset keeps that deployment presentation, fixes the complete system prompt to `You are a helpful software engineer assistant.`, and composes only the platform-selected persistent shell. Select 极简模式 when creating a Web session; every other prompt section and model-facing plugin remains absent from that agent while the shared browser, workspace, persistence, sandbox, and permission host stays in place.
## Shared deployment behavior
diff --git a/apps/cli/reference/README.zh.md b/apps/cli/reference/README.zh.md
index e1262f1410..2471de196e 100644
--- a/apps/cli/reference/README.zh.md
+++ b/apps/cli/reference/README.zh.md
@@ -4,6 +4,8 @@
本参考定义 profile 启动、插件管理和配置 dump 等命令模式。argv 由 [`src/args.ts`](../src/args.ts) 统一解析一次，[`src/bin.ts`](../src/bin.ts) 只会动态导入选中的运行器。
+[生成的命令帮助](../../../docs/cli-help.zh.md)包含启动器、插件管理和随附 profile 的完整帮助。运行 `pnpm run gen-cli-help` 刷新，运行 `pnpm run verify-cli-help` 检查它是否与当前 CLI 一致。
+
## Profile 启动
@@ -35,7 +37,7 @@ dsh rescue
| Profile | 参数 |
|---|---|
-| `web` | `--host`、`--port`、可重复的 `--trusted-host`、`--no-open` |
+| `web` | `--host`、`--port`、`--public-url`、可重复的 `--trusted-host`、`--no-open` |
| `headless` | 任务文本，作为位置参数 |
| `sdk` | 无选项；stdio 携带 JSON-RPC 协议 |
| `sdk-minimal` | 无选项；stdio 携带相同的 JSON-RPC 协议 |
@@ -82,6 +84,8 @@ dsh --profile web --patch ./extra.yml --dump-config
`dsh plugin --profile ` 在 profile 缺失时先初始化它（有随附模板的用模板，其他名称只装 `@deepseek-ai/dsh-base`），然后以 profile 目录为工作目录，把 `` 转发给 `pnpm`：`add`、`remove`、`why`、`update` 及其他所有 pnpm 子命令都照常可用；pnpm 必须在 PATH 上。相对路径 spec（`.`、`../plugin` 及其 `file:`/`link:` 形式）会先锚定到调用目录，因此在插件 checkout 中执行 `add .` 安装的是该 checkout，而不是 profile。每次成功运行后，系统都会根据当前安装状态更新 `dsh.profile.bundles`：如果某项依赖解析到的包在 manifest 中声明了 `"dsh": { "bundle": { "patch": "./cordis.patch.yml" } }`，该依赖就会加入配置层栈；如果某项依赖在 `update` 后获得该声明，也会随即激活。没有组合包声明的依赖仍作为普通依赖保留，并显示一次性警告；已移除的依赖则从配置层栈中删除。
+`dsh plugin` 只在被转发的参数之前读取 `--profile`；被转发的参数从它无法识别的第一个 token 开始，因此 `--profile ` 必须写在最前面。被转发的参数以 pnpm 命令开头时，该命令之后的所有内容都会原样交给 pnpm，包括 `-h` 和 `--help`。被转发的参数以 `--filter ` 或 `-r` 等 pnpm 选项开头时，后面的 `-h` 或 `--help` 仍会打印转发器的帮助而不是 pnpm 的帮助，因此要查看 pnpm 的帮助，需把 pnpm 命令写在它们之前。在任何被转发的参数之前出现的 `-h` 或 `--help` 会打印转发器自身的帮助并以 0 退出。
+
Codex 与 Claude Code subagent 提供方是两个彼此独立的可选组合包。可以只添加一个包、在同一命令中添加两个包，或独立移除任一包：
```sh
@@ -106,6 +110,8 @@ dsh --profile tui
`dsh web` 使用 profile 简写。启动器先解析自身的 flag，其余 flag 属于 web 应用，由组合包中的普通提供方解析。`--host` 和 `--port` 覆盖承载它们的那些行的组合取值，可重复的 `--trusted-host` 通过 `ctx.webRuntime.trustedHosts` 提供本次调用的 authority（部署表达式会拼接自己的 authority），`--no-open` 则只对本次调用关闭默认浏览器交接。客户端插件 HMR（热模块替换）接收器始终挂载，在 `pnpm run dev:web` 重建客户端 bundle 之前保持空闲；该命令先构建一次，再启动这同一个启动器并持续重建客户端 bundle，加 `--no-serve` 则只运行 watcher、配合别处启动的 `dsh web`。
+`--public-url ` 公告唯一的 HTTP(S) 应用根——可带转发前缀——替代监听器的 loopback URL。它不授予信任，因此浏览器可见的 authority 仍需用 `--trusted-host` 点名；[在反向代理之后发布 Web UI](../../../docs/user/guide/public-deployments.zh.md)列出了前置代理必须提供的内容。
+
```sh
dsh web
dsh web --no-open
@@ -114,7 +120,7 @@ dsh web --dump-config
dsh web --help
```
-生产 Web 运行器需要已构建的包和前端产物（`pnpm run build`）。默认服务地址是 `http://127.0.0.1:3080`；本机启动时，只在完整 Loader 配置树结算后才用默认浏览器打开该规范宿主机 URL。继承的 `SSH_CONNECTION` 或 `SSH_TTY` 非空时会跳过浏览器交接，因为本地转发地址由 SSH 客户端或编辑器持有；宿主机 URL 仍会打印。CLI 有意不支持 `--host 0.0.0.0`，并会以用法错误退出。本机交接前会打印英文提示 `dsh web: opening the default browser; pass --no-open to disable`；若操作系统交接失败，stderr 诊断会说明原因、给出 URL 供手动访问，服务器仍继续运行。`--trusted-host` 可添加 `/api` 浏览器信任围栏接受的具名 authority。
+生产 Web 运行器需要已构建的包和前端产物（`pnpm run build`）。默认服务地址是 `http://127.0.0.1:3080`；本机启动时，只在完整 Loader 配置树结算后才用默认浏览器打开该规范宿主机 URL（配置了 `--public-url` 时即为公告根）。继承的 `SSH_CONNECTION` 或 `SSH_TTY` 非空时会跳过浏览器交接，因为本地转发地址由 SSH 客户端或编辑器持有；宿主机 URL 仍会打印。CLI 有意不支持 `--host 0.0.0.0`，并会以用法错误退出。本机交接前会打印英文提示 `dsh web: opening the default browser; pass --no-open to disable`；若操作系统交接失败，stderr 诊断会说明原因、给出 URL 供手动访问，服务器仍继续运行。`--trusted-host` 可添加 `/api` 浏览器信任围栏接受的具名 authority。
进程关闭时，插件树最多有 5 秒完成 dispose。首次收到 `SIGINT` 或 `SIGTERM` 时会开始优雅排空：`SIGTERM` 是监督进程发出的常规停止请求，在所有运行模式下都以 0 退出；`SIGINT` 则报告 130。第二次收到信号时会立即强制退出。如果一次性运行在正常结束时已经卡在 dispose 阶段，第一次按下 `Ctrl+C` 就会直接升级为强制退出，而不会被忽略。
@@ -122,7 +128,7 @@ dsh web --help
基于 base 的 profile 中，新会话默认使用 `workspace-write` 权限预设。Bash 和文件系统修改仅限于会话 workspace 与平台临时根目录；读取和网络访问不受限制，进程可见性则取决于所选沙箱后端——bwrap 在私有 PID 命名空间中运行命令并隐藏宿主进程，Landlock 与 Seatbelt 保持宿主进程可见性不变。`DSH_PERMISSION_MODE` 更改进程后备值。General settings 中存储的权限影响后续 Web 会话，不改变已打开的会话。独立的 `sdk-minimal` 配置树则固定为 `danger-full-access`，且不挂载 approval 或权限 settings 服务。
-`DSH_TOOLS_MODE` 为进程选择 `native`、`ptc` 或 `both`；其他值会导致启动失败。随附的 `minimal` agent preset 会保留该部署的呈现方式，将完整系统提示词固定为 `You are a helpful software engineer assistant.`，并且仅组合按平台选择的持久 shell。创建 Web 会话时请选择极简模式；该 agent 不包含任何其他提示词段落或面向模型的插件，而共享的浏览器、workspace、持久化、沙箱与权限宿主保持不变。
+`DSH_TOOLS_MODE` 为进程选择 `native` 或 `ptc`；其他值会导致启动失败。随附的 `minimal` agent preset 会保留该部署的呈现方式，将完整系统提示词固定为 `You are a helpful software engineer assistant.`，并且仅组合按平台选择的持久 shell。创建 Web 会话时请选择极简模式；该 agent 不包含任何其他提示词段落或面向模型的插件，而共享的浏览器、workspace、持久化、沙箱与权限宿主保持不变。
## 共享部署行为
diff --git a/apps/cli/src/args.ts b/apps/cli/src/args.ts
index 7adf1913a3..24d6789656 100644
--- a/apps/cli/src/args.ts
+++ b/apps/cli/src/args.ts
@@ -187,6 +187,10 @@ export function parseDshArgs(argv: readonly string[], version: string, manageDes
if (first === 'plugin') {
const plugin = program.command('plugin').description('manage a profile\'s plugins by forwarding the remaining arguments to pnpm in the profile directory')
plugin
+ // Commander copies the launcher's disabled help option into subcommands. The
+ // forwarder restores its own help and stops reading options at forwarded pnpm input.
+ .helpOption('-h, --help', 'show this help')
+ .passThroughOptions()
.requiredOption('--profile ', 'the profile whose plugins to manage (initialized on first use)', selectProfile)
.allowUnknownOption()
.argument('[args...]', 'pnpm arguments, forwarded verbatim (add , remove , why , ...)')
diff --git a/apps/cli/tests/agent-team-headless.e2e.ts b/apps/cli/tests/agent-team-headless.e2e.ts
index 481cfc7332..45e954e40f 100644
--- a/apps/cli/tests/agent-team-headless.e2e.ts
+++ b/apps/cli/tests/agent-team-headless.e2e.ts
@@ -88,11 +88,11 @@ describe('dsh run with Agent Teams enabled', () => {
expect(files).toHaveLength(4)
const logs = await Promise.all(files.map(file => readFile(join(sessions, file), 'utf8')))
const parsed = logs.map(records)
- const workflowChild = parsed.find(log => log.some(record => record.type === 'subagent/descriptor'
- && (record.data as { mode: string }).mode === 'one-shot'))
+ const workflowChild = parsed.find(log => log.some(record => record.type === 'user/message'
+ && JSON.stringify((record.data as { content: unknown }).content) === JSON.stringify([{ type: 'text', text: 'TEAM_WORKFLOW_CHILD' }])))
expect(workflowChild).toBeDefined()
expect(workflowChild!.find(record => record.type === 'subagent/descriptor')?.data)
- .toMatchObject({ mode: 'one-shot', provider: 'spawn' })
+ .toMatchObject({ mode: 'continuable', provider: 'spawn' })
expect(workflowChild!.filter(record => record.type === 'user/message'
&& (record.data as { source: { kind: string } }).source.kind === 'user').map(record => record.data))
.toEqual([expect.objectContaining({ content: [{ type: 'text', text: 'TEAM_WORKFLOW_CHILD' }] })])
diff --git a/apps/cli/tests/args.spec.ts b/apps/cli/tests/args.spec.ts
index 88138f2dec..e255789466 100644
--- a/apps/cli/tests/args.spec.ts
+++ b/apps/cli/tests/args.spec.ts
@@ -120,6 +120,25 @@ describe('parseDshArgs', () => {
// Unknown pnpm flags forward verbatim.
expect(parse(['plugin', '--profile', 'tui', 'add', '--save-dev', 'x']))
.toEqual({ mode: 'plugin', profile: 'tui', args: ['add', '--save-dev', 'x'] })
+ // Options after the pnpm command belong to pnpm, including the forwarder's own names.
+ expect(parse(['plugin', '--profile', 'tui', 'add', '--help']))
+ .toEqual({ mode: 'plugin', profile: 'tui', args: ['add', '--help'] })
+ expect(parse(['plugin', '--profile', 'tui', 'add', '-h', '--profile', 'x']))
+ .toEqual({ mode: 'plugin', profile: 'tui', args: ['add', '-h', '--profile', 'x'] })
+ // A leading pnpm option starts the forwarded arguments before the pnpm command.
+ expect(parse(['plugin', '--profile', 'tui', '--filter', 'x', '--profile', 'y', 'add', 'z']))
+ .toEqual({ mode: 'plugin', profile: 'tui', args: ['--filter', 'x', '--profile', 'y', 'add', 'z'] })
+ expect(exitCode(['plugin', 'add', 'x', '--profile', 'tui'])).toBe(1)
+ expect(exitCode(['plugin', '--filter', 'x', 'add', '--profile', 'tui'])).toBe(1)
+ })
+
+ it.each([
+ ['plugin', '--help'], ['plugin', '-h'], ['plugin', '--profile', 'tui', '--help'],
+ ['plugin', '--profile', 'tui', '--filter', 'x', 'add', '--help'],
+ ])('prints the plugin forwarder help for %j', (...argv: string[]) => {
+ const stdout = vi.spyOn(process.stdout, 'write').mockReturnValue(true)
+ expect(exitCode(argv)).toBe(0)
+ expect(stdout.mock.calls.map(([chunk]) => String(chunk)).join('')).toContain('Usage: dsh plugin [options] [args...]')
})
it.each(['desktop', 'Desktop', 'DESKTOP'])('permits installed Desktop plugin commands for %s', (profile) => {
diff --git a/apps/cli/tests/built-bin.e2e.ts b/apps/cli/tests/built-bin.e2e.ts
index b26b3e538c..09a0f39b1f 100644
--- a/apps/cli/tests/built-bin.e2e.ts
+++ b/apps/cli/tests/built-bin.e2e.ts
@@ -372,6 +372,7 @@ describe.skipIf(!existsSync(dshBin))('dsh BUILT bin (node lib/bin.js, no tsx)',
expect(web.stderr).toBe('')
expect(web.stdout).toContain('Usage: dsh --profile web')
expect(web.stdout).toContain('--port ')
+ expect(web.stdout).toContain('--public-url ')
expect(web.stdout).not.toContain('dsh web: http://')
const wildcardHost = await runBuiltBin(['web', '--host', '0.0.0.0'], {
@@ -1248,6 +1249,9 @@ describe.skipIf(!existsSync(dshBin))('dsh BUILT bin (node lib/bin.js, no tsx)',
['plugin-package-inventory-deepseek', '@deepseek-ai/dsh-plugin-package-inventory-deepseek'],
['llm-deepseek', '@deepseek-ai/dsh-llm-deepseek-api-key'],
['sandbox', '@deepseek-ai/dsh-sandbox-local'],
+ ['filesystem', '@deepseek-ai/dsh-fs-local'],
+ ['working-directory', '@deepseek-ai/dsh-working-directory'],
+ ['tool-working-directory', '@deepseek-ai/dsh-tool-working-directory'],
['session-projection', '@deepseek-ai/dsh-session-projection'],
['sandbox-policy', '@deepseek-ai/dsh-sandbox-policy'],
['subprocess', '@deepseek-ai/dsh-subprocess-local'],
@@ -1264,11 +1268,6 @@ describe.skipIf(!existsSync(dshBin))('dsh BUILT bin (node lib/bin.js, no tsx)',
['agent', '@deepseek-ai/dsh-agent'],
['llm-retry', '@deepseek-ai/dsh-llm-retry'],
['jobs', '@deepseek-ai/dsh-jobs-local'],
- ['invariants', '@deepseek-ai/dsh-invariants'],
- ['session-invariant', '@deepseek-ai/dsh-session/invariant'],
- ['agent-invariant', '@deepseek-ai/dsh-agent/invariant'],
- ['scope-invariant', '@deepseek-ai/dsh-scope/invariant'],
- ['agent-loop-invariant', '@deepseek-ai/dsh-agent-loop/invariant'],
['agent-loop', '@deepseek-ai/dsh-agent-loop'],
['persistent-bash', '@deepseek-ai/dsh-tool-bash-persistent'],
['persistent-pwsh', '@deepseek-ai/dsh-tool-pwsh-persistent'],
diff --git a/apps/cli/tests/dsh-badge.expected.e2e.ts b/apps/cli/tests/dsh-badge.expected.e2e.ts
index ca70622be2..a1f456c5b5 100644
--- a/apps/cli/tests/dsh-badge.expected.e2e.ts
+++ b/apps/cli/tests/dsh-badge.expected.e2e.ts
@@ -5,7 +5,7 @@ const binScript = fileURLToPath(new URL('./fixtures/dsh-badge/snapshot.ts', impo
const configPath = fileURLToPath(new URL('./fixtures/dsh-badge/cordis.yml', import.meta.url))
const defaultConfigPath = fileURLToPath(new URL('./fixtures/dsh-badge/default.cordis.yml', import.meta.url))
const tsconfigPath = fileURLToPath(new URL('../../../tsconfig.json', import.meta.url))
-const badgeAssetsPath = fileURLToPath(new URL('../../../packages/skill/skill-badge/assets/', import.meta.url))
+const badgeAssetsPath = fileURLToPath(new URL('../../../packages/experimental/skill-badge/assets/', import.meta.url))
describe('dsh badge assembled snapshot', () => {
it('advertises and loads the opt-in bundled skill through the shipped app', async () => {
diff --git a/apps/cli/tests/expected/dump-config-schema.json b/apps/cli/tests/expected/dump-config-schema.json
index ce57b82073..29f03673a0 100644
--- a/apps/cli/tests/expected/dump-config-schema.json
+++ b/apps/cli/tests/expected/dump-config-schema.json
@@ -445,6 +445,13 @@
]
}
},
+ {
+ "not": {
+ "required": [
+ "preset"
+ ]
+ }
+ },
{
"anyOf": [
{
@@ -494,6 +501,13 @@
]
}
},
+ {
+ "not": {
+ "required": [
+ "preset"
+ ]
+ }
+ },
{
"anyOf": [
{
@@ -543,6 +557,13 @@
]
}
},
+ {
+ "not": {
+ "required": [
+ "preset"
+ ]
+ }
+ },
{
"anyOf": [
{
@@ -578,6 +599,11 @@
"properties": {
"insert": {
"$ref": "#/$defs/entryList"
+ },
+ "preset": {
+ "type": "string",
+ "pattern": "\\S",
+ "description": "Outer preset row id. The remaining patch fields apply to its current config.plugins list; a missing or unaddressable preset fails composition."
}
},
"description": "An insert appends entries, optionally inside the group identified by id. Other patches replace supplied fields; config is replaced wholesale, not deep-merged. A truthy name asserts the existing plugin name rather than renaming it. Unknown targets and non-insert patches without a nonempty id are warned and skipped."
diff --git a/apps/cli/tests/fixtures/dsh-badge/cordis.yml b/apps/cli/tests/fixtures/dsh-badge/cordis.yml
index dd419b684f..e67020c176 100644
--- a/apps/cli/tests/fixtures/dsh-badge/cordis.yml
+++ b/apps/cli/tests/fixtures/dsh-badge/cordis.yml
@@ -1,5 +1,6 @@
-- id: skill-badge
- disabled: false
+- insert:
+ - id: skill-badge
+ name: '@deepseek-ai/dsh-skill-badge'
- id: skill-filesystem
config:
diff --git a/apps/cli/tests/fixtures/dsh-badge/snapshot.ts b/apps/cli/tests/fixtures/dsh-badge/snapshot.ts
index 4c2331ed0b..c84912a9f1 100644
--- a/apps/cli/tests/fixtures/dsh-badge/snapshot.ts
+++ b/apps/cli/tests/fixtures/dsh-badge/snapshot.ts
@@ -11,9 +11,16 @@ const overlayPath = process.argv[2]
if (overlayPath === undefined) throw new Error('dsh-badge snapshot requires an overlay path')
const rootConfigPath = fileURLToPath(new URL('../../../../../packages/bundle/base/tests/fixtures/root.cordis.yml', import.meta.url))
const basePatchPath = fileURLToPath(new URL('../../../../../packages/bundle/base/cordis.patch.yml', import.meta.url))
+// The fixture owns the optional provider; the base bundle has no dependency on it.
+const overlays = loadOverlayPatches('dsh-badge-snapshot', overlayPath).map(patch => patch.insert === undefined ? patch : {
+ ...patch,
+ insert: patch.insert.map(row => row.name === '@deepseek-ai/dsh-skill-badge'
+ ? { ...row, name: import.meta.resolve('@deepseek-ai/dsh-skill-badge') }
+ : row),
+})
const ctx = await boot('dsh-badge-snapshot', rootConfigPath, [
...loadOverlayPatches('dsh-badge-snapshot', basePatchPath),
- ...loadOverlayPatches('dsh-badge-snapshot', overlayPath),
+ ...overlays,
])
try {
diff --git a/apps/cli/tests/github-webhook-real.e2e.ts b/apps/cli/tests/github-webhook-real.e2e.ts
index 78ad62c968..4c23211d81 100644
--- a/apps/cli/tests/github-webhook-real.e2e.ts
+++ b/apps/cli/tests/github-webhook-real.e2e.ts
@@ -4,15 +4,16 @@ import type { ChildProcess } from 'node:child_process'
import { spawn } from 'node:child_process'
import { createHmac, randomUUID } from 'node:crypto'
import { existsSync } from 'node:fs'
-import { mkdir, mkdtemp, realpath, rm } from 'node:fs/promises'
+import { mkdir, mkdtemp, readFile, realpath, rm, symlink, writeFile } from 'node:fs/promises'
import { createServer } from 'node:net'
import type { AddressInfo } from 'node:net'
import { tmpdir } from 'node:os'
-import { join } from 'node:path'
+import { dirname, join } from 'node:path'
import { setTimeout as delay } from 'node:timers/promises'
import { fileURLToPath } from 'node:url'
import { describe, expect, it } from 'vitest'
import WebSocket from 'ws'
+import { initProfile, PROFILE_TEMPLATES } from '@deepseek-ai/dsh-app-boot'
const REPO_ROOT = fileURLToPath(new URL('../../..', import.meta.url))
const BUILT_BIN = join(REPO_ROOT, 'apps/cli/lib/bin.js')
@@ -357,6 +358,18 @@ describe.skipIf(!process.env.DEEPSEEK_API_KEY)('GitHub webhook through the real
const workspacePath = join(root, 'workspace')
await mkdir(workspacePath)
const canonicalWorkspacePath = await realpath(workspacePath)
+ const profile = join(root, '.dsh/profiles/web')
+ initProfile(profile, PROFILE_TEMPLATES.web!.bundles)
+ const manifestPath = join(profile, 'package.json')
+ const manifest = JSON.parse(await readFile(manifestPath, 'utf8')) as { dependencies: Record }
+ for (const name of ['@deepseek-ai/dsh-webhook', '@deepseek-ai/dsh-webhook-github']) {
+ const directory = dirname(fileURLToPath(import.meta.resolve(`${name}/package.json`)))
+ const link = join(profile, 'node_modules', name)
+ await mkdir(dirname(link), { recursive: true })
+ await symlink(directory, link, 'junction')
+ manifest.dependencies[name] = `file:${directory}`
+ }
+ await writeFile(manifestPath, `${JSON.stringify(manifest)}\n`)
const webhookPort = await freePort()
const child = spawn(process.execPath, [
BUILT_BIN,
diff --git a/apps/cli/tests/optional-bundle-transitions.e2e.ts b/apps/cli/tests/optional-bundle-transitions.e2e.ts
new file mode 100644
index 0000000000..78d0e45813
--- /dev/null
+++ b/apps/cli/tests/optional-bundle-transitions.e2e.ts
@@ -0,0 +1,349 @@
+/** Optional bundles through the shipped Web Loader, live package manager, and real Agent loop. */
+import { randomUUID } from 'node:crypto'
+import { existsSync } from 'node:fs'
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import type { Context } from '@deepseek-ai/cordis'
+import type { Agent, AgentHandle } from '@deepseek-ai/dsh-agent'
+import type { ProfileContext } from '@deepseek-ai/dsh-app-boot'
+import { LlmAdapter, ToolCallId, createUserMessage } from '@deepseek-ai/dsh-llm'
+import type { GenerateOptions, LlmResolvedModelInfo, StreamChunk } from '@deepseek-ai/dsh-llm'
+import { SessionId } from '@deepseek-ai/dsh-session'
+import type {} from '@deepseek-ai/dsh-agent-preset-registry'
+import type {} from '@deepseek-ai/dsh-hmr'
+import type {} from '@deepseek-ai/dsh-plugin-manager'
+import type {} from '@deepseek-ai/dsh-permission-presets'
+import type {} from '@deepseek-ai/dsh-session-title-llm'
+import type {} from '@deepseek-ai/dsh-skill'
+import type {} from '@deepseek-ai/dsh-tools'
+import { afterAll, afterEach, beforeAll, describe, expect, it } from 'vitest'
+import { textResponse, toolCallResponse } from '../../../packages/core/agent-loop/tests/mock-adapter.ts'
+
+const root = fileURLToPath(new URL('../../..', import.meta.url))
+const installAnchor = join(root, 'apps/cli/package.json')
+const bundles = {
+ search: '@deepseek-ai/dsh-experimental-session-search',
+ ralph: '@deepseek-ai/dsh-experimental-ralph-bundle',
+ terminal: '@deepseek-ai/dsh-experimental-terminal-bundle',
+ badge: '@deepseek-ai/dsh-experimental-badge-skill-bundle',
+ titles: '@deepseek-ai/dsh-experimental-session-titles-bundle',
+} as const
+type Response = StreamChunk[] | ((request: GenerateOptions) => StreamChunk[])
+
+/** Only the external model is scripted; tools and child Agents use the shipped implementations. */
+class BundleModel extends LlmAdapter {
+ readonly requests: GenerateOptions[] = []
+ readonly scripts = new Map()
+ private titleNumber = 0
+
+ override resolveModel(provider: string, model: string): Promise {
+ return Promise.resolve({ provider, id: model, name: model })
+ }
+
+ async * stream(request: GenerateOptions): AsyncIterable {
+ this.requests.push(request)
+ if (request.purpose === 'session-title') {
+ yield* textResponse(`Bundle title ${String(++this.titleNumber)}`)
+ return
+ }
+ if (request.tools?.some(tool => tool.name === 'structured_output')) {
+ yield* toolCallResponse(`report-${randomUUID()}`, 'structured_output', {
+ status: 'complete', summary: 'OPTIONAL_RALPH_DONE', evidence: ['The scripted worker completed.'], nextSteps: [], blocker: '',
+ })
+ return
+ }
+ const response = this.scripts.get(request.sessionId ?? '')?.shift()
+ if (response === undefined) throw new Error(`No scripted model response for ${String(request.sessionId)}`)
+ yield* typeof response === 'function' ? response(request) : response
+ }
+}
+
+describe.skipIf(!existsSync(join(root, 'apps/cli/lib/bin.js')))('Official optional bundle transitions', { retry: 0 }, () => {
+ let ctx: Context
+ let temporary: string
+ let workspace: string
+ const model = new BundleModel()
+ const handles = new Set()
+ const selected = new Set()
+ let originalEnvironment: Record = {}
+
+ beforeAll(async () => {
+ temporary = await mkdtemp(join(tmpdir(), 'dsh-optional-bundles-'))
+ workspace = join(temporary, 'workspace')
+ await mkdir(workspace)
+ const home = join(temporary, 'home')
+ const values = {
+ DSH_HOME: home, DSH_AGENTS_HOME: join(temporary, 'agents'), DSH_BUNDLED_SKILL_DIR: join(temporary, 'skills'),
+ DSH_TELEMETRY_DISABLED: '1', TMUX: '', TMUX_PANE: '',
+ }
+ originalEnvironment = Object.fromEntries(Object.keys(values).map(key => [key, process.env[key]]))
+ Object.assign(process.env, values)
+ const require = createRequire(import.meta.url)
+ const app = require(join(root, 'packages/boot/app-boot/lib/index.js')) as typeof import('@deepseek-ai/dsh-app-boot')
+ const cmdline = require(join(root, 'packages/boot/cmdline/lib/index.js')) as typeof import('@deepseek-ai/dsh-cmdline')
+ const directory = join(home, 'profiles', 'web')
+ app.initProfile(directory, ['@deepseek-ai/dsh-base', '@deepseek-ai/dsh-web-app'])
+ await writeFile(join(directory, 'cordis.yml'), '[]\n')
+ await writeFile(join(directory, 'cordis.patch.yml'), JSON.stringify([
+ { id: 'agent-default-model', config: { provider: 'bundle-test', model: 'scripted' } },
+ ]))
+ const profile = app.loadProfileDirectory('bundle-test', directory, installAnchor)
+ const profileContext: ProfileContext = {
+ name: 'web', dir: directory, patchPath: profile.patchPath, installAnchor, cwd: workspace, home,
+ startedBundles: profile.layers.map(layer => layer.packageName), overlays: [], telemetryDisabledEnv: '1',
+ }
+ const resolution = await app.createRuntimeResolution({ installAnchor, home, profile })
+ const listeners = new Set<() => void>()
+ let ready = false
+ ctx = await app.boot('bundle-test', join(directory, 'cordis.yml'), app.readProfilePatches('bundle-test', profileContext), async (owner) => {
+ owner.provide('profileContext', profileContext)
+ owner.provide('appReady', { onReady: (listener) => {
+ if (ready) { listener(); return () => {} }
+ listeners.add(listener)
+ return () => { listeners.delete(listener) }
+ } })
+ await owner.plugin(app.PluginPackages, { resolution })
+ cmdline.provideCmdline(owner, { args: ['--no-open', '--port', '0'], exit: (code) => { throw new Error(`Web command exited ${String(code)}`) } })
+ })
+ ready = true
+ for (const listener of listeners) listener()
+ listeners.clear()
+ ctx.llm.registerAdapter(['bundle-test'], model)
+ expect(ctx.get('hmr')).toBeDefined()
+ }, 120_000)
+
+ afterEach(async () => {
+ for (const handle of handles) await handle.dispose()
+ handles.clear()
+ for (const name of [...selected]) {
+ expect(await ctx.pluginManager.setBundleEnabled(name, false)).toMatchObject({ application: 'applied' })
+ selected.delete(name)
+ }
+ }, 120_000)
+
+ afterAll(async () => {
+ try {
+ for (const handle of handles) await handle.dispose()
+ await ctx?.fiber.dispose()
+ } finally {
+ for (const [key, value] of Object.entries(originalEnvironment)) {
+ if (value === undefined) Reflect.deleteProperty(process.env, key)
+ else process.env[key] = value
+ }
+ if (temporary !== undefined) await rm(temporary, { recursive: true, force: true })
+ }
+ }, 120_000)
+
+ async function agent(preset = 'standard', cwd = workspace): Promise {
+ const handle = await ctx.agents.create({
+ sessionId: SessionId(`optional-${preset}-${randomUUID()}`), meta: { cwd, agentPreset: preset },
+ agentOptions: { provider: 'bundle-test', model: 'scripted' },
+ setup: scoped => ctx.agentPresets.mount(scoped, preset).then(() => undefined),
+ })
+ handles.add(handle)
+ ctx.permissionPresets.set(handle.agent.session, 'danger-full-access')
+ return handle
+ }
+
+ async function turn(owner: Agent, prompt: string, responses: Response[]): Promise {
+ model.scripts.set(owner.session.id, [...responses])
+ owner.followup(createUserMessage({ content: [{ type: 'text', text: prompt }], source: { kind: 'user' } }))
+ await owner.whenIdle()
+ expect(model.scripts.get(owner.session.id)).toEqual([])
+ }
+
+ async function select(name: string, enabled: boolean): Promise {
+ if (enabled) selected.add(name)
+ const result = await ctx.pluginManager.setBundleEnabled(name, enabled)
+ if (!enabled && result.application === 'applied') selected.delete(name)
+ expect(result, JSON.stringify(result)).toMatchObject({ changed: true, application: 'applied' })
+ }
+
+ const names = (owner?: Agent) => ctx.tools.schemas(owner).map(tool => tool.name).sort()
+ const toolResult = (owner: Agent, callId: string) => owner.session.deriveMessages()
+ .flatMap(message => message.role === 'tool' && message.toolCallId === callId ? message.content : [])
+ .flatMap(block => block.type === 'text' ? [block.text] : []).join('\n')
+
+ it('keeps the default host and minimal tool catalogs while every optional bundle is off', async () => {
+ const minimal = await agent('minimal')
+ const standard = await agent()
+ expect(names()).toEqual(['working_directory'])
+ expect(names(minimal.agent)).toEqual([process.platform === 'win32' ? 'pwsh' : 'bash', 'working_directory'])
+ for (const name of ['str_replace_editor', 'session_search', 'terminal_open', 'ralph']) expect(names(standard.agent)).not.toContain(name)
+ expect((await ctx.skills.list({ cwd: workspace, scope: standard.agent })).some(skill => skill.name === 'dsh-badge')).toBe(false)
+ })
+
+ it('generates and executes the PTC SDK for the selected search bundle', async () => {
+ await select(bundles.search, true)
+ const coded = await agent('ptc')
+ const native = await agent('cordis')
+ const minimal = await agent('minimal')
+ const assembly = await ctx.systemPrompt.assemble({ scope: coded.agent })
+ expect(assembly.tools.map(tool => tool.name)).toEqual(['run_code'])
+ expect(assembly.sections.find(section => section.name === 'tools:sdk')?.text).toContain('session_trace')
+ expect(names(native.agent)).toContain('session_search')
+ expect(names(minimal.agent)).toEqual([process.platform === 'win32' ? 'pwsh' : 'bash', 'working_directory'])
+ await turn(coded.agent, 'Read this session lineage through run_code.', [
+ toolCallResponse('ptc-search', 'run_code', {
+ code: 'console.log(await tools.session_trace({}));',
+ description: 'Read the current session lineage',
+ }), textResponse('PTC_SEARCH_DONE'),
+ ])
+ expect(toolResult(coded.agent, 'ptc-search')).toContain(coded.agent.session.id)
+ expect(coded.agent.session.snapshotEvents().some(event => event.type === 'tool/ptc-dispatch' && event.data.name === 'session_trace')).toBe(true)
+ await select(bundles.search, false)
+ })
+
+ it('searches persisted conversation content only through the selected search bundle', async () => {
+ const seed = await agent()
+ await turn(seed.agent, 'Remember OPTIONAL_SEARCH_MARKER for a later session.', [textResponse('Recorded the marker.')])
+ const seedId = seed.agent.session.id
+ await seed.dispose()
+ handles.delete(seed)
+ const live = await agent()
+ await turn(live.agent, 'Keep OPTIONAL_SEARCH_MARKER in this live session.', [textResponse('Live marker recorded.')])
+ const otherWorkspace = join(temporary, 'other-workspace')
+ await mkdir(otherWorkspace)
+ const foreign = await agent('standard', otherWorkspace)
+ await turn(foreign.agent, 'Keep OPTIONAL_SEARCH_MARKER in the other workspace.', [textResponse('Other marker recorded.')])
+ await select(bundles.search, true)
+ expect(names(live.agent)).not.toContain('session_search')
+ const searcher = await agent()
+ await turn(searcher.agent, 'Find the previous marker in session history.', [
+ toolCallResponse('search-history', 'session_search', { query: 'OPTIONAL_SEARCH_MARKER' }), textResponse('SEARCH_DONE'),
+ ])
+ expect(toolResult(searcher.agent, 'search-history')).toContain(seedId)
+ expect(toolResult(searcher.agent, 'search-history')).toContain(live.agent.session.id)
+ expect(toolResult(searcher.agent, 'search-history')).not.toContain(foreign.agent.session.id)
+ expect(toolResult(searcher.agent, 'search-history')).toContain('OPTIONAL_SEARCH_MARKER')
+ await select(bundles.search, false)
+ expect(names((await agent()).agent)).not.toContain('session_search')
+ await turn(searcher.agent, 'Search the marker again using the retained capability.', [
+ toolCallResponse('search-retained', 'session_search', { query: 'OPTIONAL_SEARCH_MARKER' }), textResponse('RETAINED_SEARCH_DONE'),
+ ])
+ expect(toolResult(searcher.agent, 'search-retained')).toContain(seedId)
+ const sessionId = searcher.agent.session.id
+ await searcher.dispose()
+ handles.delete(searcher)
+ const reopened = await ctx.agents.resume({ resumeSessionId: sessionId, setup: scoped => ctx.agentPresets.mount(scoped, 'standard').then(() => undefined) })
+ handles.add(reopened)
+ expect(names(reopened.agent)).not.toContain('session_search')
+ })
+
+ it('loads the actual badge asset only while its bundle is selected', async () => {
+ const owner = await agent()
+ const load = (callId: string) => ctx.tools.execute({
+ callId: ToolCallId(callId), name: 'skill', arguments: { name: 'dsh-badge' },
+ agent: owner.agent, signal: new AbortController().signal,
+ })
+ expect((await load('badge-before')).isError).toBe(true)
+ await select(bundles.badge, true)
+ await turn(owner.agent, 'Load the dsh badge skill.', [
+ toolCallResponse('badge-on', 'skill', { name: 'dsh-badge' }), textResponse('BADGE_DONE'),
+ ])
+ expect(toolResult(owner.agent, 'badge-on')).toContain('powered by dsh')
+ expect(toolResult(owner.agent, 'badge-on')).toContain('dsh-badge.png')
+ const minimal = await agent('minimal')
+ expect((await ctx.skills.list({ cwd: workspace, scope: minimal.agent })).map(skill => skill.name)).toContain('dsh-badge')
+ expect(names(minimal.agent)).toEqual([process.platform === 'win32' ? 'pwsh' : 'bash', 'working_directory'])
+ await select(bundles.badge, false)
+ expect((await load('badge-after')).isError).toBe(true)
+ })
+
+ it('runs and closes a real persistent terminal delivered by its bundle', async () => {
+ await select(bundles.terminal, true)
+ const owner = await agent()
+ const target = join(workspace, 'terminal-output.txt')
+ let terminalId: string | undefined
+ const id = () => {
+ if (terminalId === undefined) throw new Error('terminal_open returned no terminal id')
+ return terminalId
+ }
+ await turn(owner.agent, 'Use a persistent terminal to retain a variable, write its value, and close the terminal.', [
+ toolCallResponse('terminal-open', 'terminal_open', { type: 'shell', name: 'optional', cwd: workspace }),
+ (request) => {
+ terminalId = /started terminal session (pty-\d+)/.exec(JSON.stringify(request.messages))?.[1]
+ return toolCallResponse('terminal-set', 'terminal_send', {
+ sessionId: id(), text: process.platform === 'win32' ? "$env:DSH_OPTIONAL = 'TERMINAL_BUNDLE_OK'" : 'export DSH_OPTIONAL=TERMINAL_BUNDLE_OK',
+ })
+ },
+ () => toolCallResponse('terminal-write', 'terminal_send', {
+ sessionId: id(), text: process.platform === 'win32'
+ ? `Set-Content -NoNewline -Path '${target.replaceAll("'", "''")}' -Value $env:DSH_OPTIONAL`
+ : `printf '%s' "$DSH_OPTIONAL" > ${JSON.stringify(target)}`,
+ }),
+ () => toolCallResponse('terminal-close', 'terminal_close', { sessionId: id() }),
+ textResponse('TERMINAL_DONE'),
+ ])
+ expect(await readFile(target, 'utf8')).toBe('TERMINAL_BUNDLE_OK')
+ expect(toolResult(owner.agent, 'terminal-close')).toContain('closed terminal session')
+ await select(bundles.terminal, false)
+ expect(names((await agent()).agent)).not.toContain('terminal_open')
+ })
+
+ it('runs a real fresh-Agent Ralph workflow through the selected bundle', async () => {
+ await select(bundles.ralph, true)
+ const owner = await agent()
+ await turn(owner.agent, 'The human explicitly requests one Ralph loop.', [
+ toolCallResponse('ralph-run', 'ralph', { objective: 'Report completion with the structured output tool.', maxRounds: 1 }),
+ textResponse('RALPH_DONE'),
+ ])
+ expect(toolResult(owner.agent, 'ralph-run')).toContain('Ralph worker reported completion after 1 round')
+ expect(toolResult(owner.agent, 'ralph-run')).toContain('OPTIONAL_RALPH_DONE')
+ expect(model.requests.some(request => request.sessionId !== owner.agent.session.id && request.tools?.some(tool => tool.name === 'structured_output'))).toBe(true)
+ await select(bundles.ralph, false)
+ expect(names((await agent()).agent)).not.toContain('ralph')
+ })
+
+ it('switches title cadence off/on/off through the live manager', async () => {
+ const titleRequests = (owner: Agent) => owner.session.snapshotEvents().filter(event => event.type === 'session/title-llm-request')
+ const first = await agent()
+ await turn(first.agent, 'First title prompt.', [textResponse('ONE')])
+ await expect.poll(() => titleRequests(first.agent).length).toBe(1)
+ await turn(first.agent, 'Second title prompt.', [textResponse('TWO')])
+ expect(titleRequests(first.agent)).toHaveLength(1)
+ await select(bundles.titles, true)
+ const following = await agent()
+ await turn(following.agent, 'Start a growing conversation.', [textResponse('ONE')])
+ await expect.poll(() => titleRequests(following.agent).length).toBe(1)
+ expect(titleRequests(following.agent)[0]?.data.titleProvider).toBe('session-title-all-prompts-llm')
+ await expect.poll(() => ctx.sessionTitle.get(following.agent.session)?.source.kind).toBe('provider')
+ await turn(following.agent, 'Continue the growing conversation.', [textResponse('TWO')])
+ await expect.poll(() => titleRequests(following.agent).length).toBe(2)
+ expect(titleRequests(following.agent).every(event => event.data.titleProvider === 'session-title-all-prompts-llm')).toBe(true)
+ await select(bundles.titles, false)
+ const restored = await agent()
+ await turn(restored.agent, 'Restore first-prompt titles.', [textResponse('ONE')])
+ await expect.poll(() => titleRequests(restored.agent).length).toBe(1)
+ await turn(restored.agent, 'The title stays on the first prompt.', [textResponse('TWO')])
+ expect(titleRequests(restored.agent)).toHaveLength(1)
+ expect(titleRequests(restored.agent)[0]?.data.titleProvider).toBe('session-title-first-prompt-llm')
+ })
+
+ it('composes all five bundles while leaving minimal and host tools unchanged', async () => {
+ for (const name of Object.values(bundles)) await select(name, true)
+ let coded: Agent | undefined
+ for (const preset of ['standard', 'cordis', 'ptc']) {
+ const owner = await agent(preset)
+ expect(names(owner.agent)).toEqual(expect.arrayContaining(['session_search', 'terminal_open', 'ralph']))
+ if (preset === 'ptc') coded = owner.agent
+ }
+ if (coded === undefined) throw new Error('the PTC Agent was not created')
+ await turn(coded, 'Read this session lineage and load the badge through one program.', [
+ toolCallResponse('combined-program', 'run_code', {
+ code: 'console.log(await tools.session_trace({})); console.log(await tools.skill({ name: "dsh-badge" }));',
+ description: 'Use optional session search and badge together',
+ }), textResponse('COMBINED_DONE'),
+ ])
+ expect(toolResult(coded, 'combined-program')).toContain(coded.session.id)
+ expect(toolResult(coded, 'combined-program')).toContain('dsh-badge')
+ const minimal = await agent('minimal')
+ expect(names(minimal.agent)).toEqual([process.platform === 'win32' ? 'pwsh' : 'bash', 'working_directory'])
+ expect(names()).toEqual(['working_directory'])
+ for (const name of [...Object.values(bundles)].reverse()) await select(name, false)
+ expect(names((await agent()).agent)).not.toContain('session_search')
+ })
+})
diff --git a/apps/cli/tests/profiles/acp/tests/fixtures/image-offload.cordis.yml b/apps/cli/tests/profiles/acp/tests/fixtures/image-offload.cordis.yml
index 21a9ead728..7059fa886e 100644
--- a/apps/cli/tests/profiles/acp/tests/fixtures/image-offload.cordis.yml
+++ b/apps/cli/tests/profiles/acp/tests/fixtures/image-offload.cordis.yml
@@ -36,7 +36,7 @@
name: '@deepseek-ai/dsh-system-prompt'
config:
personaPrefix: |
- You are a coding assistant powered by the {{model}} model. Your working directory is {{cwd}}.
+ You are a coding assistant powered by the {{model}} model.
Keep answers brief and factual.
diff --git a/apps/cli/tests/profiles/acp/tests/goal-expected/goal-round-driver/session.expected.jsonl b/apps/cli/tests/profiles/acp/tests/goal-expected/goal-round-driver/session.expected.jsonl
index 6cd9ea429c..19495490be 100644
--- a/apps/cli/tests/profiles/acp/tests/goal-expected/goal-round-driver/session.expected.jsonl
+++ b/apps/cli/tests/profiles/acp/tests/goal-expected/goal-round-driver/session.expected.jsonl
@@ -1,4 +1,4 @@
-{"type":"session","version":3,"id":"{{sessionId}}","createdAt":0,"cwd":"{{cwd}}","isSeeded":false,"delegationDepth":0}
+{"type":"session","version":4,"id":"{{sessionId}}","createdAt":0,"cwd":"{{cwd}}","isSeeded":false,"delegationDepth":0}
{"type":"permission/preset","data":{"preset":"danger-full-access"}}
{"type":"sandbox/mode","data":{"mode":"danger-full-access"}}
{"type":"approval/policy","data":{"policy":"never"}}
@@ -6,21 +6,21 @@
{"type":"turn/start","data":{"turn":1}}
{"type":"agent/inbox/spliced","data":{"target":"next-turn","start":0,"removedCount":1,"inserted":[]}}
{"type":"step/start","data":{"turn":1,"step":1}}
-{"type":"system/message","data":{"turn":1,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"plugin","plugin":"@deepseek-ai/dsh-system-prompt"},"id":"{{sessionId}}"}},"surfaceOp":"append"}
+{"type":"system/message","data":{"turn":1,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"system-prompt"},"id":"{{sessionId}}"}},"surfaceOp":"append"}
{"type":"user/message","data":{"content":[{"type":"text","text":"Create a durable two-round goal for the ACP snapshot, inspect it, then report readiness."}],"source":{"kind":"user"},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
-{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations.\n\nApproval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."}],"source":{"kind":"plugin","plugin":"@deepseek-ai/dsh-system-prompt","form":"snapshot","sections":[{"name":"sandbox:policy","text":"Current DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations."},{"name":"approval:policy","text":"Approval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
+{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent working directory: \"{{cwd}}\".\n\nCurrent DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations.\n\nApproval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"working-directory:current","text":"Current working directory: \"{{cwd}}\"."},{"name":"sandbox:policy","text":"Current DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations."},{"name":"approval:policy","text":"Approval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
{"type":"request/header","data":{"header":{"config":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"tools":"{{tools}}"},"reason":"initial"}}
{"type":"request/context","data":{"provider":"deepseek-official","model":"deepseek-v4-flash"}}
{"type":"session/title","data":{"title":"Create a durable two-round goal","messageSeqs":[8],"source":{"kind":"fallback"}}}
{"type":"assistant/message","data":{"turn":1,"step":1,"message":{"role":"assistant","content":[{"type":"tool-call","id":"call_goal_create","name":"create_goal","arguments":"{\"objective\":\"Finish the ACP goal-round-driver snapshot proof\",\"max_goal_rounds\":2}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{sessionId}}"},"usage":{"inputTokens":20,"outputTokens":8},"stream":[{"type":"chunk","time":0,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"tool-call-chunks","time0":0,"index":0,"dt":[],"id":"call_goal_create","name":"create_goal","args":["{\"objective\":\"Finish the ACP goal-round-driver snapshot proof\",\"max_goal_rounds\":2}"]},{"type":"chunk","time":0,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"call_goal_create","name":"create_goal","arguments":"{\"objective\":\"Finish the ACP goal-round-driver snapshot proof\",\"max_goal_rounds\":2}"}}},{"type":"chunk","time":0,"chunk":{"type":"usage","usage":{"inputTokens":20,"outputTokens":8}}},{"type":"chunk","time":0,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
{"type":"tool/call","data":{"turn":1,"step":1,"callId":"call_goal_create","name":"create_goal","arguments":"{\"objective\":\"Finish the ACP goal-round-driver snapshot proof\",\"max_goal_rounds\":2}"}}
{"type":"goal/change","data":{"kind":"goal/change","version":1,"operation":"create","goal":{"id":"goal-{{sessionId}}","revision":1,"objective":"Finish the ACP goal-round-driver snapshot proof","phase":"active","maxGoalRounds":2},"roundsStarted":0,"createdAt":0,"updatedAt":0}}
-{"type":"tool/result","data":{"turn":1,"step":1,"message":{"source":{"kind":"tool","callId":"call_goal_create"},"content":[{"type":"tool-result","toolCallId":"call_goal_create","content":[{"type":"text","text":"{\"goal\":{\"id\":\"goal-{{sessionId}}\",\"revision\":1,\"objective\":\"Finish the ACP goal-round-driver snapshot proof\",\"phase\":\"active\",\"roundsStarted\":0,\"maxGoalRounds\":2},\"activation\":\"armed\"}"}],"isError":false}],"role":"user","id":"{{sessionId}}"}},"sourceEventSeqs":[14],"surfaceOp":"append"}
+{"type":"tool/result","data":{"turn":1,"step":1,"message":{"role":"tool","source":{"kind":"tool","callId":"call_goal_create"},"toolCallId":"call_goal_create","content":[{"type":"text","text":"{\"goal\":{\"id\":\"goal-{{sessionId}}\",\"revision\":1,\"objective\":\"Finish the ACP goal-round-driver snapshot proof\",\"phase\":\"active\",\"roundsStarted\":0,\"maxGoalRounds\":2},\"activation\":\"armed\"}"}],"isError":false,"id":"{{sessionId}}"}},"sourceEventSeqs":[14],"surfaceOp":"append"}
{"type":"step/end","data":{"turn":1,"step":1}}
{"type":"step/start","data":{"turn":1,"step":2}}
{"type":"assistant/message","data":{"turn":1,"step":2,"message":{"role":"assistant","content":[{"type":"tool-call","id":"call_goal_get","name":"get_goal","arguments":"{}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{sessionId}}"},"usage":{"inputTokens":30,"outputTokens":4},"stream":[{"type":"chunk","time":0,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"tool-call-chunks","time0":0,"index":0,"dt":[],"id":"call_goal_get","name":"get_goal","args":["{}"]},{"type":"chunk","time":0,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"call_goal_get","name":"get_goal","arguments":"{}"}}},{"type":"chunk","time":0,"chunk":{"type":"usage","usage":{"inputTokens":30,"outputTokens":4}}},{"type":"chunk","time":0,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
{"type":"tool/call","data":{"turn":1,"step":2,"callId":"call_goal_get","name":"get_goal","arguments":"{}"}}
-{"type":"tool/result","data":{"turn":1,"step":2,"message":{"source":{"kind":"tool","callId":"call_goal_get"},"content":[{"type":"tool-result","toolCallId":"call_goal_get","content":[{"type":"text","text":"{\"goal\":{\"id\":\"goal-{{sessionId}}\",\"revision\":1,\"objective\":\"Finish the ACP goal-round-driver snapshot proof\",\"phase\":\"active\",\"roundsStarted\":0,\"maxGoalRounds\":2},\"activation\":\"armed\"}"}],"isError":false}],"role":"user","id":"{{sessionId}}"}},"sourceEventSeqs":[20],"surfaceOp":"append"}
+{"type":"tool/result","data":{"turn":1,"step":2,"message":{"role":"tool","source":{"kind":"tool","callId":"call_goal_get"},"toolCallId":"call_goal_get","content":[{"type":"text","text":"{\"goal\":{\"id\":\"goal-{{sessionId}}\",\"revision\":1,\"objective\":\"Finish the ACP goal-round-driver snapshot proof\",\"phase\":\"active\",\"roundsStarted\":0,\"maxGoalRounds\":2},\"activation\":\"armed\"}"}],"isError":false,"id":"{{sessionId}}"}},"sourceEventSeqs":[20],"surfaceOp":"append"}
{"type":"step/end","data":{"turn":1,"step":2}}
{"type":"step/start","data":{"turn":1,"step":3}}
{"type":"assistant/message","data":{"turn":1,"step":3,"message":{"role":"assistant","content":[{"type":"text","text":"GOAL READY"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{sessionId}}"},"usage":{"inputTokens":35,"outputTokens":2},"stream":[{"type":"chunk","time":0,"chunk":{"type":"block-start","index":0,"blockType":"text"}},{"type":"text-chunks","time0":0,"index":0,"dt":[],"texts":["GOAL READY"]},{"type":"chunk","time":0,"chunk":{"type":"block-end","index":0,"block":{"type":"text","text":"GOAL READY"}}},{"type":"chunk","time":0,"chunk":{"type":"usage","usage":{"inputTokens":35,"outputTokens":2}}},{"type":"chunk","time":0,"chunk":{"type":"finish","reason":{"kind":"stop"}}}]},"surfaceOp":"append"}
diff --git a/apps/cli/tests/profiles/acp/tests/goal-expected/goal-wrapup/session.expected.jsonl b/apps/cli/tests/profiles/acp/tests/goal-expected/goal-wrapup/session.expected.jsonl
index 5aa8425050..7e3a02fce9 100644
--- a/apps/cli/tests/profiles/acp/tests/goal-expected/goal-wrapup/session.expected.jsonl
+++ b/apps/cli/tests/profiles/acp/tests/goal-expected/goal-wrapup/session.expected.jsonl
@@ -1,4 +1,4 @@
-{"type":"session","version":3,"id":"{{sessionId}}","createdAt":0,"cwd":"{{cwd}}","isSeeded":false,"delegationDepth":0}
+{"type":"session","version":4,"id":"{{sessionId}}","createdAt":0,"cwd":"{{cwd}}","isSeeded":false,"delegationDepth":0}
{"type":"permission/preset","data":{"preset":"danger-full-access"}}
{"type":"sandbox/mode","data":{"mode":"danger-full-access"}}
{"type":"approval/policy","data":{"policy":"never"}}
@@ -6,16 +6,16 @@
{"type":"turn/start","data":{"turn":1}}
{"type":"agent/inbox/spliced","data":{"target":"next-turn","start":0,"removedCount":1,"inserted":[]}}
{"type":"step/start","data":{"turn":1,"step":1}}
-{"type":"system/message","data":{"turn":1,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"plugin","plugin":"@deepseek-ai/dsh-system-prompt"},"id":"{{sessionId}}"}},"surfaceOp":"append"}
+{"type":"system/message","data":{"turn":1,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"system-prompt"},"id":"{{sessionId}}"}},"surfaceOp":"append"}
{"type":"user/message","data":{"content":[{"type":"text","text":"Create a durable goal for the wrap-up snapshot, then report readiness."}],"source":{"kind":"user"},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
-{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations.\n\nApproval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."}],"source":{"kind":"plugin","plugin":"@deepseek-ai/dsh-system-prompt","form":"snapshot","sections":[{"name":"sandbox:policy","text":"Current DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations."},{"name":"approval:policy","text":"Approval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
+{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent working directory: \"{{cwd}}\".\n\nCurrent DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations.\n\nApproval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"working-directory:current","text":"Current working directory: \"{{cwd}}\"."},{"name":"sandbox:policy","text":"Current DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations."},{"name":"approval:policy","text":"Approval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
{"type":"request/header","data":{"header":{"config":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"tools":"{{tools}}"},"reason":"initial"}}
{"type":"request/context","data":{"provider":"deepseek-official","model":"deepseek-v4-flash"}}
{"type":"session/title","data":{"title":"Create a durable goal for","messageSeqs":[8],"source":{"kind":"fallback"}}}
{"type":"assistant/message","data":{"turn":1,"step":1,"message":{"role":"assistant","content":[{"type":"tool-call","id":"call_goal_create","name":"create_goal","arguments":"{\"objective\":\"Finish the ACP goal wrap-up snapshot proof\",\"max_goal_rounds\":2}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{sessionId}}"},"usage":{"inputTokens":20,"outputTokens":8},"stream":[{"type":"chunk","time":0,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"tool-call-chunks","time0":0,"index":0,"dt":[],"id":"call_goal_create","name":"create_goal","args":["{\"objective\":\"Finish the ACP goal wrap-up snapshot proof\",\"max_goal_rounds\":2}"]},{"type":"chunk","time":0,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"call_goal_create","name":"create_goal","arguments":"{\"objective\":\"Finish the ACP goal wrap-up snapshot proof\",\"max_goal_rounds\":2}"}}},{"type":"chunk","time":0,"chunk":{"type":"usage","usage":{"inputTokens":20,"outputTokens":8}}},{"type":"chunk","time":0,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
{"type":"tool/call","data":{"turn":1,"step":1,"callId":"call_goal_create","name":"create_goal","arguments":"{\"objective\":\"Finish the ACP goal wrap-up snapshot proof\",\"max_goal_rounds\":2}"}}
{"type":"goal/change","data":{"kind":"goal/change","version":1,"operation":"create","goal":{"id":"goal-{{sessionId}}","revision":1,"objective":"Finish the ACP goal wrap-up snapshot proof","phase":"active","maxGoalRounds":2},"roundsStarted":0,"createdAt":0,"updatedAt":0}}
-{"type":"tool/result","data":{"turn":1,"step":1,"message":{"source":{"kind":"tool","callId":"call_goal_create"},"content":[{"type":"tool-result","toolCallId":"call_goal_create","content":[{"type":"text","text":"{\"goal\":{\"id\":\"goal-{{sessionId}}\",\"revision\":1,\"objective\":\"Finish the ACP goal wrap-up snapshot proof\",\"phase\":\"active\",\"roundsStarted\":0,\"maxGoalRounds\":2},\"activation\":\"armed\"}"}],"isError":false}],"role":"user","id":"{{sessionId}}"}},"sourceEventSeqs":[14],"surfaceOp":"append"}
+{"type":"tool/result","data":{"turn":1,"step":1,"message":{"role":"tool","source":{"kind":"tool","callId":"call_goal_create"},"toolCallId":"call_goal_create","content":[{"type":"text","text":"{\"goal\":{\"id\":\"goal-{{sessionId}}\",\"revision\":1,\"objective\":\"Finish the ACP goal wrap-up snapshot proof\",\"phase\":\"active\",\"roundsStarted\":0,\"maxGoalRounds\":2},\"activation\":\"armed\"}"}],"isError":false,"id":"{{sessionId}}"}},"sourceEventSeqs":[14],"surfaceOp":"append"}
{"type":"step/end","data":{"turn":1,"step":1}}
{"type":"step/start","data":{"turn":1,"step":2}}
{"type":"assistant/message","data":{"turn":1,"step":2,"message":{"role":"assistant","content":[{"type":"text","text":"GOAL READY"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{sessionId}}"},"usage":{"inputTokens":28,"outputTokens":2},"stream":[{"type":"chunk","time":0,"chunk":{"type":"block-start","index":0,"blockType":"text"}},{"type":"text-chunks","time0":0,"index":0,"dt":[],"texts":["GOAL READY"]},{"type":"chunk","time":0,"chunk":{"type":"block-end","index":0,"block":{"type":"text","text":"GOAL READY"}}},{"type":"chunk","time":0,"chunk":{"type":"usage","usage":{"inputTokens":28,"outputTokens":2}}},{"type":"chunk","time":0,"chunk":{"type":"finish","reason":{"kind":"stop"}}}]},"surfaceOp":"append"}
@@ -30,12 +30,12 @@
{"type":"assistant/message","data":{"turn":2,"step":1,"message":{"role":"assistant","content":[{"type":"tool-call","id":"call_goal_complete","name":"update_goal","arguments":"{\"goal_id\":\"goal-{{sessionId}}\",\"revision\":1,\"action\":\"complete\"}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{sessionId}}"},"usage":{"inputTokens":40,"outputTokens":9},"stream":[{"type":"chunk","time":0,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"tool-call-chunks","time0":0,"index":0,"dt":[],"id":"call_goal_complete","name":"update_goal","args":["{\"goal_id\":\"goal-{{sessionId}}\",\"revision\":1,\"action\":\"complete\"}"]},{"type":"chunk","time":0,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"call_goal_complete","name":"update_goal","arguments":"{\"goal_id\":\"goal-{{sessionId}}\",\"revision\":1,\"action\":\"complete\"}"}}},{"type":"chunk","time":0,"chunk":{"type":"usage","usage":{"inputTokens":40,"outputTokens":9}}},{"type":"chunk","time":0,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
{"type":"tool/call","data":{"turn":2,"step":1,"callId":"call_goal_complete","name":"update_goal","arguments":"{\"goal_id\":\"goal-{{sessionId}}\",\"revision\":1,\"action\":\"complete\"}"}}
{"type":"goal/change","data":{"kind":"goal/change","version":1,"operation":"complete","goal":{"id":"goal-{{sessionId}}","revision":2,"objective":"Finish the ACP goal wrap-up snapshot proof","phase":"complete","maxGoalRounds":2},"roundsStarted":1,"createdAt":0,"updatedAt":0}}
-{"type":"tool/result","data":{"turn":2,"step":1,"message":{"source":{"kind":"tool","callId":"call_goal_complete"},"content":[{"type":"tool-result","toolCallId":"call_goal_complete","content":[{"type":"text","text":"{\"goal\":{\"id\":\"goal-{{sessionId}}\",\"revision\":2,\"objective\":\"Finish the ACP goal wrap-up snapshot proof\",\"phase\":\"complete\",\"roundsStarted\":1,\"maxGoalRounds\":2},\"activation\":\"disarmed\"}"}],"isError":false}],"role":"user","id":"{{sessionId}}"}},"sourceEventSeqs":[29],"surfaceOp":"append"}
-{"type":"agent/inbox/spliced","data":{"target":"next-step","start":0,"inserted":[{"content":[{"type":"text","text":"\nObjective: \"Finish the ACP goal wrap-up snapshot proof\"\nThe goal is marked complete and this autonomous run is ending. Write the closing message to the user now: state the outcome, summarize what was done and how it was verified, and point to the concrete results (files, commits, or other artifacts). Report only what earlier rounds and tool results in this session actually establish; when a detail is not in the session, say so instead of inventing it. Note anything the user should review or do next. Address the user directly. Do not call any more tools in this run; further work waits for the user's next instruction.\n"}],"source":{"kind":"plugin","plugin":"tool-goal","form":"notice","summary":"complete: Finish the ACP goal wrap-up snapshot proof"},"role":"user","id":"{{sessionId}}"}]}}
+{"type":"tool/result","data":{"turn":2,"step":1,"message":{"role":"tool","source":{"kind":"tool","callId":"call_goal_complete"},"toolCallId":"call_goal_complete","content":[{"type":"text","text":"{\"goal\":{\"id\":\"goal-{{sessionId}}\",\"revision\":2,\"objective\":\"Finish the ACP goal wrap-up snapshot proof\",\"phase\":\"complete\",\"roundsStarted\":1,\"maxGoalRounds\":2},\"activation\":\"disarmed\"}"}],"isError":false,"id":"{{sessionId}}"}},"sourceEventSeqs":[29],"surfaceOp":"append"}
+{"type":"agent/inbox/spliced","data":{"target":"next-step","start":0,"inserted":[{"content":[{"type":"text","text":"\nObjective: \"Finish the ACP goal wrap-up snapshot proof\"\nThe goal is marked complete and this autonomous run is ending. Write the closing message to the user now: state the outcome, summarize what was done and how it was verified, and point to the concrete results (files, commits, or other artifacts). Report only what earlier rounds and tool results in this session actually establish; when a detail is not in the session, say so instead of inventing it. Note anything the user should review or do next. Address the user directly. Do not call any more tools in this run; further work waits for the user's next instruction.\n"}],"source":{"kind":"tool-goal","form":"notice","summary":"complete: Finish the ACP goal wrap-up snapshot proof"},"role":"user","id":"{{sessionId}}"}]}}
{"type":"step/end","data":{"turn":2,"step":1}}
{"type":"agent/inbox/spliced","data":{"target":"next-step","start":0,"removedCount":1,"inserted":[]}}
{"type":"step/start","data":{"turn":2,"step":2}}
-{"type":"user/message","data":{"content":[{"type":"text","text":"\nObjective: \"Finish the ACP goal wrap-up snapshot proof\"\nThe goal is marked complete and this autonomous run is ending. Write the closing message to the user now: state the outcome, summarize what was done and how it was verified, and point to the concrete results (files, commits, or other artifacts). Report only what earlier rounds and tool results in this session actually establish; when a detail is not in the session, say so instead of inventing it. Note anything the user should review or do next. Address the user directly. Do not call any more tools in this run; further work waits for the user's next instruction.\n"}],"source":{"kind":"plugin","plugin":"tool-goal","form":"notice","summary":"complete: Finish the ACP goal wrap-up snapshot proof"},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
+{"type":"user/message","data":{"content":[{"type":"text","text":"\nObjective: \"Finish the ACP goal wrap-up snapshot proof\"\nThe goal is marked complete and this autonomous run is ending. Write the closing message to the user now: state the outcome, summarize what was done and how it was verified, and point to the concrete results (files, commits, or other artifacts). Report only what earlier rounds and tool results in this session actually establish; when a detail is not in the session, say so instead of inventing it. Note anything the user should review or do next. Address the user directly. Do not call any more tools in this run; further work waits for the user's next instruction.\n"}],"source":{"kind":"tool-goal","form":"notice","summary":"complete: Finish the ACP goal wrap-up snapshot proof"},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
{"type":"assistant/message","data":{"turn":2,"step":2,"message":{"role":"assistant","content":[{"type":"text","text":"GOAL WRAP-UP: the snapshot objective is achieved and this closing message reaches the user."}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{sessionId}}"},"usage":{"inputTokens":52,"outputTokens":14},"stream":[{"type":"chunk","time":0,"chunk":{"type":"block-start","index":0,"blockType":"text"}},{"type":"text-chunks","time0":0,"index":0,"dt":[],"texts":["GOAL WRAP-UP: the snapshot objective is achieved and this closing message reaches the user."]},{"type":"chunk","time":0,"chunk":{"type":"block-end","index":0,"block":{"type":"text","text":"GOAL WRAP-UP: the snapshot objective is achieved and this closing message reaches the user."}}},{"type":"chunk","time":0,"chunk":{"type":"usage","usage":{"inputTokens":52,"outputTokens":14}}},{"type":"chunk","time":0,"chunk":{"type":"finish","reason":{"kind":"stop"}}}]},"surfaceOp":"append"}
{"type":"step/end","data":{"turn":2,"step":2}}
{"type":"turn/end","data":{"turn":2,"reason":{"kind":"completed"}}}
diff --git a/apps/cli/tests/profiles/acp/tests/image-offload.expected.e2e.ts b/apps/cli/tests/profiles/acp/tests/image-offload.expected.e2e.ts
index 59195c7669..259ba7341e 100644
--- a/apps/cli/tests/profiles/acp/tests/image-offload.expected.e2e.ts
+++ b/apps/cli/tests/profiles/acp/tests/image-offload.expected.e2e.ts
@@ -139,7 +139,8 @@ it('pins Messages Files offload and inline fallback in assembled requests', asyn
const fileImage = { type: 'image', source: { type: 'file', file_id: 'file-api-snapshot-1' } }
const offloadedImage = `[image omitted to fit request image limits; ${attachmentId}.${normalizedAccess}]`
const imageHandle = `Image ${attachmentId}; request preview 1x1px.${normalizedAccess}`
- const runtimeContext = 'Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\n'
+ const runtimeContext = (cwd: string): string => 'Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\n'
+ + `Current working directory: ${JSON.stringify(cwd)}.\n\n`
+ 'Current DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations.\n\n'
+ 'Approval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`).'
const messages = requests[0]?.messages as { content?: unknown }[] | undefined
@@ -151,7 +152,7 @@ it('pins Messages Files offload and inline fallback in assembled requests', asyn
{ type: 'text', text: imageHandle },
fileImage,
{ type: 'text', text: ', then use read_image on red.png and reply with DONE.' },
- { type: 'text', text: runtimeContext },
+ { type: 'text', text: runtimeContext(result.cwd) },
])
const followup = requests[1]?.messages as Array<{ role: string; content: Array> }>
@@ -202,7 +203,7 @@ it('pins Messages Files offload and inline fallback in assembled requests', asyn
{ type: 'text', text: `Image ${attachmentId}; request preview 1x1px.${fallbackAccess}` },
{ type: 'image', source: { type: 'base64', media_type: 'image/png', data: image } },
{ type: 'text', text: ', then use read_image on red.png and reply with DONE.' },
- { type: 'text', text: runtimeContext },
+ { type: 'text', text: runtimeContext(fallback.cwd) },
])
} finally {
await new Promise(resolve => server.close(() => { resolve() }))
diff --git a/apps/cli/tests/profiles/fixtures/official-installer-observer.mjs b/apps/cli/tests/profiles/fixtures/official-installer-observer.mjs
new file mode 100644
index 0000000000..5ca8db1ac6
--- /dev/null
+++ b/apps/cli/tests/profiles/fixtures/official-installer-observer.mjs
@@ -0,0 +1,117 @@
+/** Observe ordinary manager operations in an installed Web profile without starting native agents. */
+import { existsSync } from 'node:fs'
+import { readFile, readdir, stat } from 'node:fs/promises'
+import { basename, join } from 'node:path'
+
+export const name = 'official-installer-observer'
+export const inject = ['pluginManager', 'agentPresets', 'subagents', 'sessions', 'appReady']
+
+let lastStage = 'none'
+
+/** Report one stage on the child's stdout, which the test forwards when it fails. */
+function note(stage) {
+ lastStage = stage
+ process.stdout.write(`PACKED_OFFICIAL_STEP=${stage} ${String(Date.now())}\n`)
+}
+
+// A run that never finishes must name its stage in the parent's log even when the child is killed at its deadline.
+setInterval(() => { note(`stalled-at ${lastStage}`) }, 30_000).unref()
+
+export function apply(ctx, config) {
+ let active = true
+ note('applied')
+ const stop = ctx.appReady.onReady(() => {
+ note('ready')
+ void exercise(ctx, config).then(
+ value => { if (active) process.stdout.write(`PACKED_OFFICIAL_RESULT=${JSON.stringify({ value })}\n`) },
+ error => { if (active) process.stdout.write(`PACKED_OFFICIAL_RESULT=${JSON.stringify({ error: String(error) })}\n`) },
+ )
+ })
+ ctx.effect(() => () => { active = false; stop() }, 'packed-official-observer')
+}
+
+function applied(stage, result) {
+ if (result.application !== 'applied') throw new Error(`${stage}: ${JSON.stringify(result)}`)
+}
+
+/**
+ * Run one operation under a bound, so a stalled manager operation reports what it waits for instead of
+ * holding the whole child until its timeout. pnpm 11.7.0 can print its result and never exit
+ * (pnpm#12297, fixed in 11.23.0); the run record names the process that stayed alive.
+ * @param label - the operation being run.
+ * @param operation - the manager call to await.
+ * @param boundMs - the time the operation may take.
+ * @param profile - the isolated profile directory the operation writes.
+ * @returns The operation's own result.
+ */
+async function bounded(label, operation, boundMs, profile) {
+ let timer
+ const expiry = new Promise((_resolve, reject) => {
+ timer = setTimeout(() => { reject(new Error(`${label} did not settle within ${String(boundMs)}ms`)) }, boundMs)
+ })
+ try {
+ return await Promise.race([operation(), expiry])
+ } catch (error) {
+ if (!String(error).includes('did not settle')) throw error
+ const locks = await readdir(profile).then(files => files.filter(file => file.endsWith('.lock')).join(',') || 'none', () => 'none')
+ const record = await readFile(join(profile, '.plugin-manager', 'run.json'), 'utf8')
+ .then(text => JSON.parse(text), () => undefined)
+ const pid = record?.pid
+ const alive = pid === undefined ? false : (() => { try { process.kill(pid, 0); return true } catch { return false } })()
+ const state = alive && existsSync(`/proc/${String(pid)}/status`)
+ ? await readFile(`/proc/${String(pid)}/status`, 'utf8').then(text => text.split('\n').filter(line => /^(State|Threads):/u.test(line)).join(' '), () => '')
+ : ''
+ const cmdline = alive && existsSync(`/proc/${String(pid)}/cmdline`)
+ ? await readFile(`/proc/${String(pid)}/cmdline`, 'utf8').then(text => text.replaceAll('\0', ' ').trim().slice(0, 120), () => '')
+ : ''
+ throw new Error(`${String(error)}\nprofile-locks=${locks}\npnpm-run pid=${String(pid)} alive=${String(alive)} ${state} ${cmdline}`)
+ } finally { clearTimeout(timer) }
+}
+
+async function exercise(ctx, config) {
+ note('list-initial')
+ const initial = await ctx.pluginManager.listBundles()
+ note('listed-initial')
+ const steps = []
+ for (const name of config.packages) {
+ const spec = initial.find(bundle => bundle.name === name)?.installTarget?.spec
+ if (spec === undefined) throw new Error(`No catalog installation target for ${name}`)
+ const options = { enabled: true, saveExact: true, registry: config.registry }
+ note(`install ${name}`)
+ let install = await ctx.pluginManager.installBundle(spec, options)
+ const approval = install.pendingBuilds
+ if (approval?.length) install = await ctx.pluginManager.installBundle(spec, { ...options, approvedBuilds: approval })
+ note(`installed ${name}`)
+ applied(`install ${name}`, install)
+ const manifest = JSON.parse(await readFile(join(config.profile, 'package.json'), 'utf8'))
+ const installed = (await ctx.pluginManager.listBundles()).find(bundle => bundle.name === name)
+ // A transitive repository package the registry served, absent from npm at this version.
+ const localDependency = JSON.parse(await readFile(join(config.profile, 'node_modules', config.localDependency, 'package.json'), 'utf8')).version
+ const provider = name.endsWith('-codex') ? 'codex' : 'claude-code'
+ const providerEnabled = ctx.subagents.list().includes(provider)
+ const nativeDir = join(config.profile, 'node_modules', config.nativePackages[name])
+ const binaryName = `${provider === 'codex' ? 'codex' : 'claude'}${process.platform === 'win32' ? '.exe' : ''}`
+ const nativeBinary = (await readdir(nativeDir, { recursive: true })).find(path => basename(path) === binaryName)
+ const nativeArtifact = nativeBinary !== undefined && (await stat(join(nativeDir, nativeBinary))).size > 0
+ const presets = await ctx.agentPresets.list()
+ const beforeUnavailable = await readFile(join(config.profile, 'package.json'), 'utf8')
+ note(`unavailable ${name}`)
+ const unavailable = await ctx.pluginManager.installBundle(`${name}@9999.0.0`, options)
+ note(`unavailable-done ${name}`)
+ const unchangedAfterUnavailable = beforeUnavailable === await readFile(join(config.profile, 'package.json'), 'utf8')
+ const off = await ctx.pluginManager.setBundleEnabled(name, false)
+ applied(`disable ${name}`, off)
+ const disabled = (await ctx.pluginManager.listBundles()).find(bundle => bundle.name === name)
+ const on = await ctx.pluginManager.setBundleEnabled(name, true)
+ applied(`enable ${name}`, on)
+ const enabled = (await ctx.pluginManager.listBundles()).find(bundle => bundle.name === name)
+ note(`remove ${name}`)
+ const removed = await bounded(`remove ${name}`, () => ctx.pluginManager.removeBundle(name), 90_000, config.profile)
+ note(`removed ${name}`)
+ applied(`remove ${name}`, removed)
+ const absent = (await ctx.pluginManager.listBundles()).find(bundle => bundle.name === name)
+ steps.push({ name, install, savedVersion: manifest.dependencies?.[name], installed, localDependency, providerEnabled, nativeArtifact,
+ presets, unavailable, unchangedAfterUnavailable, off, disabled, on, enabled, removed, absent })
+ }
+ return { initial, steps, sessionCount: ctx.sessions.list().length }
+}
diff --git a/apps/cli/tests/profiles/headless/goal-snapshot.patch.yml b/apps/cli/tests/profiles/headless/goal-snapshot.patch.yml
index 7db9691a6c..3778da03de 100644
--- a/apps/cli/tests/profiles/headless/goal-snapshot.patch.yml
+++ b/apps/cli/tests/profiles/headless/goal-snapshot.patch.yml
@@ -24,6 +24,9 @@
- insert:
- id: llm-replay
name: '@deepseek-ai/dsh-llm-replay'
+ config:
+ providers:
+ - id: deepseek-official
- id: session-log-deepseek
config:
diff --git a/apps/cli/tests/profiles/headless/subagent-inheritance-snapshot.patch.yml b/apps/cli/tests/profiles/headless/subagent-inheritance-snapshot.patch.yml
index e41c1f97f2..d347a9cfe4 100644
--- a/apps/cli/tests/profiles/headless/subagent-inheritance-snapshot.patch.yml
+++ b/apps/cli/tests/profiles/headless/subagent-inheritance-snapshot.patch.yml
@@ -29,6 +29,9 @@
- id: replay
name: '@deepseek-ai/dsh-llm-replay'
+ - id: await-subagents
+ name: '../../../../../packages/test-support/session-snapshot/tests/fixtures/subagent-settlement-barrier.ts'
+
# Publish the persisted agent before the driver selects the single root.
- id: resumed-agent
name: './tests/fixtures/subagent-inheritance-agent.ts'
diff --git a/apps/cli/tests/profiles/headless/subagent-settlement-snapshot.patch.yml b/apps/cli/tests/profiles/headless/subagent-settlement-snapshot.patch.yml
index 498c600d7b..2b4b636ecb 100644
--- a/apps/cli/tests/profiles/headless/subagent-settlement-snapshot.patch.yml
+++ b/apps/cli/tests/profiles/headless/subagent-settlement-snapshot.patch.yml
@@ -24,6 +24,9 @@
- insert:
- id: llm-replay
name: '@deepseek-ai/dsh-llm-replay'
+ config:
+ providers:
+ - id: deepseek-official
# Hold the parent's second step until the manager notice enters its inbox.
- id: settlement-fence
diff --git a/apps/cli/tests/profiles/headless/tests/coding-task.e2e.ts b/apps/cli/tests/profiles/headless/tests/coding-task.e2e.ts
index bb0b4297b8..531510393e 100644
--- a/apps/cli/tests/profiles/headless/tests/coding-task.e2e.ts
+++ b/apps/cli/tests/profiles/headless/tests/coding-task.e2e.ts
@@ -55,7 +55,7 @@ describe.skipIf(!process.env.DEEPSEEK_API_KEY)('coding task: fix a failing test
expect(before.status).not.toBe(0)
ctx = await codingHarness(workdir, { personaPrefix: SYSTEM_PROMPT })
- const agent = await ctx.agentLoop.create(SessionId('e2e-task'), { provider: 'deepseek-official', model: 'deepseek-v4-flash' })
+ const agent = await ctx.agentLoop.create(SessionId('e2e-task'), { provider: 'deepseek-official', model: 'deepseek-v4-flash' }, { cwd: workdir })
agent.followup(createUserMessage({
content: [{
diff --git a/apps/cli/tests/profiles/headless/tests/compaction.e2e.ts b/apps/cli/tests/profiles/headless/tests/compaction.e2e.ts
index bf2d550bcc..b3e5cdb79e 100644
--- a/apps/cli/tests/profiles/headless/tests/compaction.e2e.ts
+++ b/apps/cli/tests/profiles/headless/tests/compaction.e2e.ts
@@ -49,7 +49,7 @@ describe.skipIf(!process.env.DEEPSEEK_API_KEY)('compaction: a long session compa
},
persistenceRoot: join(workdir, '.sessions'),
})
- const agent = await ctx.agentLoop.create(SessionId('e2e-compaction'), { provider: 'deepseek-official', model: 'deepseek-v4-flash' })
+ const agent = await ctx.agentLoop.create(SessionId('e2e-compaction'), { provider: 'deepseek-official', model: 'deepseek-v4-flash' }, { cwd: workdir })
// Completed read turns cannot collapse into one retained parallel tool group.
for (let i = 1; i <= 4; i++) {
diff --git a/apps/cli/tests/profiles/headless/tests/expected/goal-tools/stream-json.expected.jsonl b/apps/cli/tests/profiles/headless/tests/expected/goal-tools/stream-json.expected.jsonl
index 36fe8fd2d4..ab06b02706 100644
--- a/apps/cli/tests/profiles/headless/tests/expected/goal-tools/stream-json.expected.jsonl
+++ b/apps/cli/tests/profiles/headless/tests/expected/goal-tools/stream-json.expected.jsonl
@@ -4,11 +4,11 @@
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"step/start","seq":6,"time":0,"data":{"turn":1,"step":1}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"system/message","seq":7,"time":0,"data":{"turn":1,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"system-prompt"},"id":"{{sessionId}}"}},"surfaceOp":"append"}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"user/message","seq":8,"time":0,"data":{"content":[{"type":"text","text":"Probe strict-schema fillers against missing-goal revision 1, then create a durable goal to finish the snapshot proof and inspect it."}],"source":{"kind":"user"},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}}
-{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"user/message","seq":9,"time":0,"data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable.\n\nApproval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"sandbox:policy","text":"Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable."},{"name":"approval:policy","text":"Approval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}}
+{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"user/message","seq":9,"time":0,"data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent working directory: \"{{cwd}}\".\n\nCurrent DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable.\n\nApproval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"working-directory:current","text":"Current working directory: \"{{cwd}}\"."},{"name":"sandbox:policy","text":"Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable."},{"name":"approval:policy","text":"Approval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"request/header","seq":10,"time":0,"data":{"header":{"config":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"tools":"{{tools}}"},"reason":"initial"}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"request/context","seq":11,"time":0,"data":{"provider":"deepseek-official","model":"deepseek-v4-flash"}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"session/title","seq":12,"time":0,"data":{"title":"Probe strict-schema fillers against miss","messageSeqs":[8],"source":{"kind":"fallback"}}}}
-{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"session/title-llm-request","seq":13,"time":0,"data":{"titleProvider":"session-title-first-prompt-llm","messageSeqs":[8],"route":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"system":"Create a concise title for an AI coding-assistant session from the supplied human messages.\nReturn only the title on one line, **in plain text of natural language**, with no quotes, prefix, explanation, Markdown, XML, or terminal control codes. No code is allowed.\nUse the language of the messages.\nAim for about 5 words in non-CJK languages or 10 CJK characters.","messages":[{"content":[{"type":"text","text":"Generate the session title from this JSON array of human messages:\n[{\"seq\":8,\"text\":\"Probe strict-schema fillers against missing-goal revision 1, then create a durable goal to finish the snapshot proof and inspect it.\"}]"}],"source":{"kind":"dsh-session-title-llm"},"role":"user","id":"{{sessionId}}"}],"maxTokens":64}}}
+{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"session/title-llm-request","seq":13,"time":0,"data":{"titleProvider":"session-title-first-prompt-llm","messageSeqs":[8],"route":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"system":"Create a concise title for an AI coding-assistant session from the supplied human messages.\nReturn only the title on one line, **in plain text of natural language**, with no quotes, prefix, explanation, Markdown, XML, or terminal control codes. No code is allowed.\nUse the language of the messages.\nAim for about 5 words in non-CJK languages or 10 CJK characters.\nIf the messages give little to name, still return a short best-effort title, such as Greeting, instead of explaining.","messages":[{"content":[{"type":"text","text":"Generate the session title from this JSON array of human messages:\n[{\"seq\":8,\"text\":\"Probe strict-schema fillers against missing-goal revision 1, then create a durable goal to finish the snapshot proof and inspect it.\"}]"}],"source":{"kind":"dsh-session-title-llm"},"role":"user","id":"{{sessionId}}"}],"maxTokens":4096}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"assistant/message","seq":14,"time":0,"data":{"turn":1,"step":1,"message":{"role":"assistant","content":[{"type":"tool-call","id":"call_goal_probe","name":"update_goal","arguments":"{\"goal_id\":\"missing-goal\",\"revision\":1,\"action\":\"pause\",\"objective\":\"\",\"max_goal_rounds\":0,\"blocked_reason\":\"\"}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{sessionId}}"},"usage":{"inputTokens":15,"outputTokens":6},"stream":[{"type":"chunk","time":0,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"tool-call-chunks","time0":0,"index":0,"dt":[],"id":"call_goal_probe","name":"update_goal","args":["{\"goal_id\":\"missing-goal\",\"revision\":1,\"action\":\"pause\",\"objective\":\"\",\"max_goal_rounds\":0,\"blocked_reason\":\"\"}"]},{"type":"chunk","time":0,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"call_goal_probe","name":"update_goal","arguments":"{\"goal_id\":\"missing-goal\",\"revision\":1,\"action\":\"pause\",\"objective\":\"\",\"max_goal_rounds\":0,\"blocked_reason\":\"\"}"}}},{"type":"chunk","time":0,"chunk":{"type":"usage","usage":{"inputTokens":15,"outputTokens":6}}},{"type":"chunk","time":0,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"tool/call","seq":15,"time":0,"data":{"turn":1,"step":1,"callId":"call_goal_probe","name":"update_goal","arguments":"{\"goal_id\":\"missing-goal\",\"revision\":1,\"action\":\"pause\",\"objective\":\"\",\"max_goal_rounds\":0,\"blocked_reason\":\"\"}"}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"session/title","seq":16,"time":0,"data":{"title":"Goal tool snapshot","messageSeqs":[8],"source":{"kind":"provider","provider":"session-title-first-prompt-llm","model":{"provider":"deepseek-official","model":"deepseek-v4-flash"}}}}}
diff --git a/apps/cli/tests/profiles/headless/tests/expected/headless-profile/session.expected.jsonl b/apps/cli/tests/profiles/headless/tests/expected/headless-profile/session.expected.jsonl
index cdbefb5d8f..708e720d48 100644
--- a/apps/cli/tests/profiles/headless/tests/expected/headless-profile/session.expected.jsonl
+++ b/apps/cli/tests/profiles/headless/tests/expected/headless-profile/session.expected.jsonl
@@ -1,26 +1,26 @@
-{"type":"session","id":"{{session:1}}","createdAt":0,"cwd":"{{cwd}}","isSeeded":false,"delegationDepth":0}
+{"type":"session","version":4,"id":"{{sessionId}}","createdAt":0,"cwd":"{{cwd}}","isSeeded":false,"delegationDepth":0}
{"type":"permission/preset","data":{"preset":"danger-full-access"}}
{"type":"sandbox/mode","data":{"mode":"danger-full-access"}}
{"type":"approval/policy","data":{"policy":"never"}}
-{"type":"agent/inbox/spliced","data":{"target":"next-turn","start":0,"inserted":[{"content":[{"type":"text","text":"Prove the product headless profile path with one real tool round trip."}],"source":{"kind":"user"},"role":"user","id":"{{message:1}}"}]}}
+{"type":"agent/inbox/spliced","data":{"target":"next-turn","start":0,"inserted":[{"content":[{"type":"text","text":"Prove the product headless profile path with one real tool round trip."}],"source":{"kind":"user"},"role":"user","id":"{{sessionId}}"}]}}
{"type":"turn/start","data":{"turn":1}}
{"type":"agent/inbox/spliced","data":{"target":"next-turn","start":0,"removedCount":1,"inserted":[]}}
{"type":"step/start","data":{"turn":1,"step":1}}
-{"type":"system/message","data":{"turn":1,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"system-prompt"},"id":"{{message:2}}"}},"surfaceOp":"append"}
-{"type":"user/message","data":{"content":[{"type":"text","text":"Prove the product headless profile path with one real tool round trip."}],"source":{"kind":"user"},"role":"user","id":"{{message:1}}"},"surfaceOp":"append"}
-{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations.\n\nApproval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"sandbox:policy","text":"Current DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations."},{"name":"approval:policy","text":"Approval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."}]},"role":"user","id":"{{message:3}}"},"surfaceOp":"append"}
+{"type":"system/message","data":{"turn":1,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"system-prompt"},"id":"{{sessionId}}"}},"surfaceOp":"append"}
+{"type":"user/message","data":{"content":[{"type":"text","text":"Prove the product headless profile path with one real tool round trip."}],"source":{"kind":"user"},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
+{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent working directory: \"{{cwd}}\".\n\nCurrent DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations.\n\nApproval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"working-directory:current","text":"Current working directory: \"{{cwd}}\"."},{"name":"sandbox:policy","text":"Current DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations."},{"name":"approval:policy","text":"Approval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
{"type":"request/header","data":{"header":{"config":{"provider":"cli-mock","model":"cli-mock","reasoningEffort":"high"},"adapterDefaults":{"reasoningEffort":true},"tools":"{{tools}}"},"reason":"initial"}}
{"type":"request/context","data":{"provider":"cli-mock","model":"cli-mock"}}
{"type":"session/title","data":{"title":"Prove the product headless profile","messageSeqs":[8],"source":{"kind":"fallback"}}}
-{"type":"session/title-llm-request","data":{"titleProvider":"session-title-first-prompt-llm","messageSeqs":[8],"route":{"provider":"cli-mock","model":"cli-mock"},"system":"Create a concise title for an AI coding-assistant session from the supplied human messages.\nReturn only the title on one line, **in plain text of natural language**, with no quotes, prefix, explanation, Markdown, XML, or terminal control codes. No code is allowed.\nUse the language of the messages.\nAim for about 5 words in non-CJK languages or 10 CJK characters.","messages":[{"content":[{"type":"text","text":"Generate the session title from this JSON array of human messages:\n[{\"seq\":8,\"text\":\"Prove the product headless profile path with one real tool round trip.\"}]"}],"source":{"kind":"dsh-session-title-llm"},"role":"user","id":"{{message:4}}"}],"maxTokens":64}}
-{"type":"assistant/message","data":{"turn":1,"step":1,"message":{"role":"assistant","content":[{"type":"reasoning","text":"Inspecting the task before the tool call."},{"type":"tool-call","id":"cli-smoke-call","name":"bash","arguments":"{\"command\":\"printf CLI_TOOL_ROUND_TRIP\",\"description\":\"Prove the CLI tool round trip.\"}"}],"source":{"kind":"model","provider":"cli-mock","model":"cli-mock"},"id":"{{message:5}}"},"usage":{"inputTokens":11,"outputTokens":3,"cacheReadTokens":2},"stream":[{"type":"chunk","time":0,"chunk":{"type":"block-start","index":0,"blockType":"reasoning"}},{"type":"reasoning-chunks","time0":0,"index":0,"dt":[],"texts":["Inspecting the task before the tool call."]},{"type":"chunk","time":0,"chunk":{"type":"block-end","index":0,"block":{"type":"reasoning","text":"Inspecting the task before the tool call."}}},{"type":"chunk","time":0,"chunk":{"type":"block-start","index":1,"blockType":"tool-call"}},{"type":"tool-call-chunks","time0":0,"index":1,"dt":[],"id":"cli-smoke-call","name":"bash","args":["{\"command\":\"printf CLI_TOOL_ROUND_TRIP\",\"description\":\"Prove the CLI tool round trip.\"}"]},{"type":"chunk","time":0,"chunk":{"type":"block-end","index":1,"block":{"type":"tool-call","id":"cli-smoke-call","name":"bash","arguments":"{\"command\":\"printf CLI_TOOL_ROUND_TRIP\",\"description\":\"Prove the CLI tool round trip.\"}"}}},{"type":"chunk","time":0,"chunk":{"type":"usage","usage":{"inputTokens":11,"outputTokens":3,"cacheReadTokens":2}}},{"type":"chunk","time":0,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"session/title-llm-request","data":{"titleProvider":"session-title-first-prompt-llm","messageSeqs":[8],"route":{"provider":"cli-mock","model":"cli-mock"},"system":"Create a concise title for an AI coding-assistant session from the supplied human messages.\nReturn only the title on one line, **in plain text of natural language**, with no quotes, prefix, explanation, Markdown, XML, or terminal control codes. No code is allowed.\nUse the language of the messages.\nAim for about 5 words in non-CJK languages or 10 CJK characters.\nIf the messages give little to name, still return a short best-effort title, such as Greeting, instead of explaining.","messages":[{"content":[{"type":"text","text":"Generate the session title from this JSON array of human messages:\n[{\"seq\":8,\"text\":\"Prove the product headless profile path with one real tool round trip.\"}]"}],"source":{"kind":"dsh-session-title-llm"},"role":"user","id":"{{sessionId}}"}],"maxTokens":4096,"reasoningEffort":"off"}}
+{"type":"assistant/message","data":{"turn":1,"step":1,"message":{"role":"assistant","content":[{"type":"reasoning","text":"Inspecting the task before the tool call."},{"type":"tool-call","id":"cli-smoke-call","name":"bash","arguments":"{\"command\":\"printf CLI_TOOL_ROUND_TRIP\",\"description\":\"Prove the CLI tool round trip.\"}"}],"source":{"kind":"model","provider":"cli-mock","model":"cli-mock"},"id":"{{sessionId}}"},"usage":{"inputTokens":11,"outputTokens":3,"cacheReadTokens":2},"stream":[{"type":"chunk","time":0,"chunk":{"type":"block-start","index":0,"blockType":"reasoning"}},{"type":"reasoning-chunks","time0":0,"index":0,"dt":[],"texts":["Inspecting the task before the tool call."]},{"type":"chunk","time":0,"chunk":{"type":"block-end","index":0,"block":{"type":"reasoning","text":"Inspecting the task before the tool call."}}},{"type":"chunk","time":0,"chunk":{"type":"block-start","index":1,"blockType":"tool-call"}},{"type":"tool-call-chunks","time0":0,"index":1,"dt":[],"id":"cli-smoke-call","name":"bash","args":["{\"command\":\"printf CLI_TOOL_ROUND_TRIP\",\"description\":\"Prove the CLI tool round trip.\"}"]},{"type":"chunk","time":0,"chunk":{"type":"block-end","index":1,"block":{"type":"tool-call","id":"cli-smoke-call","name":"bash","arguments":"{\"command\":\"printf CLI_TOOL_ROUND_TRIP\",\"description\":\"Prove the CLI tool round trip.\"}"}}},{"type":"chunk","time":0,"chunk":{"type":"usage","usage":{"inputTokens":11,"outputTokens":3,"cacheReadTokens":2}}},{"type":"chunk","time":0,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
{"type":"tool/call","data":{"turn":1,"step":1,"callId":"cli-smoke-call","name":"bash","arguments":"{\"command\":\"printf CLI_TOOL_ROUND_TRIP\",\"description\":\"Prove the CLI tool round trip.\"}"}}
-{"type":"job/registered","data":{"executionId":"{{id:1}}","jobId":"bash-1","owner":"{{session:1}}","kind":"bash","label":"printf CLI_TOOL_ROUND_TRIP","startedAt":0,"toolCall":{"callId":"cli-smoke-call","rootCallId":"cli-smoke-call"}}}
-{"type":"job/settled","data":{"executionId":"{{id:1}}","jobId":"bash-1","owner":"{{session:1}}","kind":"bash","label":"printf CLI_TOOL_ROUND_TRIP","startedAt":0,"toolCall":{"callId":"cli-smoke-call","rootCallId":"cli-smoke-call"},"finishedAt":0,"status":"completed","cause":"producer","terminationConfirmed":true,"detail":"exit code: 0"}}
-{"type":"tool/result","data":{"turn":1,"step":1,"message":{"role":"tool","source":{"kind":"tool","callId":"cli-smoke-call"},"toolCallId":"cli-smoke-call","content":[{"type":"text","text":"CLI_TOOL_ROUND_TRIP"}],"isError":false,"id":"{{message:6}}"}},"sourceEventSeqs":[15],"surfaceOp":"append"}
+{"type":"job/registered","data":{"executionId":"{{sessionId}}","jobId":"bash-1","owner":"{{sessionId}}","kind":"bash","label":"printf CLI_TOOL_ROUND_TRIP","startedAt":0,"toolCall":{"callId":"cli-smoke-call","rootCallId":"cli-smoke-call"}}}
+{"type":"job/settled","data":{"executionId":"{{sessionId}}","jobId":"bash-1","owner":"{{sessionId}}","kind":"bash","label":"printf CLI_TOOL_ROUND_TRIP","startedAt":0,"toolCall":{"callId":"cli-smoke-call","rootCallId":"cli-smoke-call"},"finishedAt":0,"status":"completed","cause":"producer","terminationConfirmed":true,"detail":"exit code: 0"}}
+{"type":"tool/result","data":{"turn":1,"step":1,"message":{"role":"tool","source":{"kind":"tool","callId":"cli-smoke-call"},"toolCallId":"cli-smoke-call","content":[{"type":"text","text":"CLI_TOOL_ROUND_TRIP"}],"isError":false,"id":"{{sessionId}}"},"meta":{"cwd":"{{cwd}}"}},"sourceEventSeqs":[15],"surfaceOp":"append"}
{"type":"step/end","data":{"turn":1,"step":1}}
{"type":"step/start","data":{"turn":1,"step":2}}
{"type":"request/header","data":{"header":{"config":{"provider":"cli-mock","model":"cli-mock","reasoningEffort":"off"},"tools":"{{tools}}"},"reason":"change"}}
-{"type":"assistant/message","data":{"turn":1,"step":2,"message":{"role":"assistant","content":[{"type":"text","text":"CLI tool round trip complete: CLI_TOOL_ROUND_TRIP"}],"source":{"kind":"model","provider":"cli-mock","model":"cli-mock"},"id":"{{message:7}}"},"usage":{"inputTokens":7,"outputTokens":5,"reasoningTokens":1},"stream":[{"type":"chunk","time":0,"chunk":{"type":"block-start","index":0,"blockType":"text"}},{"type":"text-chunks","time0":0,"index":0,"dt":[],"texts":["CLI tool round trip complete: CLI_TOOL_ROUND_TRIP"]},{"type":"chunk","time":0,"chunk":{"type":"block-end","index":0,"block":{"type":"text","text":"CLI tool round trip complete: CLI_TOOL_ROUND_TRIP"}}},{"type":"chunk","time":0,"chunk":{"type":"usage","usage":{"inputTokens":7,"outputTokens":5,"reasoningTokens":1}}},{"type":"chunk","time":0,"chunk":{"type":"finish","reason":{"kind":"stop"}}}]},"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":2,"message":{"role":"assistant","content":[{"type":"text","text":"CLI tool round trip complete: CLI_TOOL_ROUND_TRIP"}],"source":{"kind":"model","provider":"cli-mock","model":"cli-mock"},"id":"{{sessionId}}"},"usage":{"inputTokens":7,"outputTokens":5,"reasoningTokens":1},"stream":[{"type":"chunk","time":0,"chunk":{"type":"block-start","index":0,"blockType":"text"}},{"type":"text-chunks","time0":0,"index":0,"dt":[],"texts":["CLI tool round trip complete: CLI_TOOL_ROUND_TRIP"]},{"type":"chunk","time":0,"chunk":{"type":"block-end","index":0,"block":{"type":"text","text":"CLI tool round trip complete: CLI_TOOL_ROUND_TRIP"}}},{"type":"chunk","time":0,"chunk":{"type":"usage","usage":{"inputTokens":7,"outputTokens":5,"reasoningTokens":1}}},{"type":"chunk","time":0,"chunk":{"type":"finish","reason":{"kind":"stop"}}}]},"surfaceOp":"append"}
{"type":"step/end","data":{"turn":1,"step":2}}
{"type":"turn/end","data":{"turn":1,"reason":{"kind":"completed"}}}
diff --git a/apps/cli/tests/profiles/headless/tests/expected/invalid-credential/stream-json.expected.jsonl b/apps/cli/tests/profiles/headless/tests/expected/invalid-credential/stream-json.expected.jsonl
index 0f7431a36e..6ea0d43a17 100644
--- a/apps/cli/tests/profiles/headless/tests/expected/invalid-credential/stream-json.expected.jsonl
+++ b/apps/cli/tests/profiles/headless/tests/expected/invalid-credential/stream-json.expected.jsonl
@@ -4,11 +4,11 @@
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"step/start","seq":6,"time":0,"data":{"turn":1,"step":1}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"system/message","seq":7,"time":0,"data":{"turn":1,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"system-prompt"},"id":"{{sessionId}}"}},"surfaceOp":"append"}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"user/message","seq":8,"time":0,"data":{"content":[{"type":"text","text":"say pong"}],"source":{"kind":"user"},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}}
-{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"user/message","seq":9,"time":0,"data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable.\n\nApproval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"sandbox:policy","text":"Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable."},{"name":"approval:policy","text":"Approval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}}
+{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"user/message","seq":9,"time":0,"data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent working directory: \"{{cwd}}\".\n\nCurrent DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable.\n\nApproval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"working-directory:current","text":"Current working directory: \"{{cwd}}\"."},{"name":"sandbox:policy","text":"Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable."},{"name":"approval:policy","text":"Approval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"request/header","seq":10,"time":0,"data":{"header":{"config":{"provider":"deepseek-official","model":"deepseek-v4-flash","maxTokens":256000,"reasoningEffort":"high"},"adapterDefaults":{"reasoningEffort":true,"maxTokens":true},"tools":"{{tools}}"},"reason":"initial"}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"request/context","seq":11,"time":0,"data":{"provider":"deepseek-official","model":"deepseek-v4-flash","contextWindow":1000000}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"session/title","seq":12,"time":0,"data":{"title":"say pong","messageSeqs":[8],"source":{"kind":"fallback"}}}}
-{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"session/title-llm-request","seq":13,"time":0,"data":{"titleProvider":"session-title-first-prompt-llm","messageSeqs":[8],"route":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"system":"Create a concise title for an AI coding-assistant session from the supplied human messages.\nReturn only the title on one line, **in plain text of natural language**, with no quotes, prefix, explanation, Markdown, XML, or terminal control codes. No code is allowed.\nUse the language of the messages.\nAim for about 5 words in non-CJK languages or 10 CJK characters.","messages":[{"content":[{"type":"text","text":"Generate the session title from this JSON array of human messages:\n[{\"seq\":8,\"text\":\"say pong\"}]"}],"source":{"kind":"dsh-session-title-llm"},"role":"user","id":"{{sessionId}}"}],"maxTokens":64}}}
+{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"session/title-llm-request","seq":13,"time":0,"data":{"titleProvider":"session-title-first-prompt-llm","messageSeqs":[8],"route":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"system":"Create a concise title for an AI coding-assistant session from the supplied human messages.\nReturn only the title on one line, **in plain text of natural language**, with no quotes, prefix, explanation, Markdown, XML, or terminal control codes. No code is allowed.\nUse the language of the messages.\nAim for about 5 words in non-CJK languages or 10 CJK characters.\nIf the messages give little to name, still return a short best-effort title, such as Greeting, instead of explaining.","messages":[{"content":[{"type":"text","text":"Generate the session title from this JSON array of human messages:\n[{\"seq\":8,\"text\":\"say pong\"}]"}],"source":{"kind":"dsh-session-title-llm"},"role":"user","id":"{{sessionId}}"}],"maxTokens":4096,"reasoningEffort":"off"}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"assistant/attempt","seq":14,"time":0,"data":{"turn":1,"step":1,"stream":[{"type":"chunk","time":0,"chunk":{"type":"finish","reason":{"kind":"error","failure":{"message":"llm-deepseek: the API key resolved from DEEPSEEK_API_KEY contains characters no HTTP header can carry; set DEEPSEEK_API_KEY to the raw key alone (the web Models page writes it)","code":"INVALID_CREDENTIAL"}}}}]}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"step/end","seq":15,"time":0,"data":{"turn":1,"step":1}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"turn/end","seq":16,"time":0,"data":{"turn":1,"reason":{"kind":"error","error":{"message":"llm-deepseek: the API key resolved from DEEPSEEK_API_KEY contains characters no HTTP header can carry; set DEEPSEEK_API_KEY to the raw key alone (the web Models page writes it)","code":"INVALID_CREDENTIAL"}}}}}
diff --git a/apps/cli/tests/profiles/headless/tests/expected/missing-credential/stream-json.expected.jsonl b/apps/cli/tests/profiles/headless/tests/expected/missing-credential/stream-json.expected.jsonl
index e8f421ae70..f24d221b96 100644
--- a/apps/cli/tests/profiles/headless/tests/expected/missing-credential/stream-json.expected.jsonl
+++ b/apps/cli/tests/profiles/headless/tests/expected/missing-credential/stream-json.expected.jsonl
@@ -4,11 +4,11 @@
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"step/start","seq":6,"time":0,"data":{"turn":1,"step":1}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"system/message","seq":7,"time":0,"data":{"turn":1,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"system-prompt"},"id":"{{sessionId}}"}},"surfaceOp":"append"}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"user/message","seq":8,"time":0,"data":{"content":[{"type":"text","text":"say pong"}],"source":{"kind":"user"},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}}
-{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"user/message","seq":9,"time":0,"data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable.\n\nApproval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"sandbox:policy","text":"Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable."},{"name":"approval:policy","text":"Approval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}}
+{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"user/message","seq":9,"time":0,"data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent working directory: \"{{cwd}}\".\n\nCurrent DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable.\n\nApproval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"working-directory:current","text":"Current working directory: \"{{cwd}}\"."},{"name":"sandbox:policy","text":"Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable."},{"name":"approval:policy","text":"Approval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"request/header","seq":10,"time":0,"data":{"header":{"config":{"provider":"deepseek-official","model":"deepseek-v4-flash","maxTokens":256000,"reasoningEffort":"high"},"adapterDefaults":{"reasoningEffort":true,"maxTokens":true},"tools":"{{tools}}"},"reason":"initial"}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"request/context","seq":11,"time":0,"data":{"provider":"deepseek-official","model":"deepseek-v4-flash","contextWindow":1000000}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"session/title","seq":12,"time":0,"data":{"title":"say pong","messageSeqs":[8],"source":{"kind":"fallback"}}}}
-{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"session/title-llm-request","seq":13,"time":0,"data":{"titleProvider":"session-title-first-prompt-llm","messageSeqs":[8],"route":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"system":"Create a concise title for an AI coding-assistant session from the supplied human messages.\nReturn only the title on one line, **in plain text of natural language**, with no quotes, prefix, explanation, Markdown, XML, or terminal control codes. No code is allowed.\nUse the language of the messages.\nAim for about 5 words in non-CJK languages or 10 CJK characters.","messages":[{"content":[{"type":"text","text":"Generate the session title from this JSON array of human messages:\n[{\"seq\":8,\"text\":\"say pong\"}]"}],"source":{"kind":"dsh-session-title-llm"},"role":"user","id":"{{sessionId}}"}],"maxTokens":64}}}
+{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"session/title-llm-request","seq":13,"time":0,"data":{"titleProvider":"session-title-first-prompt-llm","messageSeqs":[8],"route":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"system":"Create a concise title for an AI coding-assistant session from the supplied human messages.\nReturn only the title on one line, **in plain text of natural language**, with no quotes, prefix, explanation, Markdown, XML, or terminal control codes. No code is allowed.\nUse the language of the messages.\nAim for about 5 words in non-CJK languages or 10 CJK characters.\nIf the messages give little to name, still return a short best-effort title, such as Greeting, instead of explaining.","messages":[{"content":[{"type":"text","text":"Generate the session title from this JSON array of human messages:\n[{\"seq\":8,\"text\":\"say pong\"}]"}],"source":{"kind":"dsh-session-title-llm"},"role":"user","id":"{{sessionId}}"}],"maxTokens":4096,"reasoningEffort":"off"}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"assistant/attempt","seq":14,"time":0,"data":{"turn":1,"step":1,"stream":[{"type":"chunk","time":0,"chunk":{"type":"finish","reason":{"kind":"error","failure":{"message":"llm-deepseek: no API key for provider route \"deepseek-official\"; store DEEPSEEK_API_KEY through the credentials service (the web Models page writes it), or export DEEPSEEK_API_KEY in the launching environment","code":"MISSING_CREDENTIAL"}}}}]}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"step/end","seq":15,"time":0,"data":{"turn":1,"step":1}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"turn/end","seq":16,"time":0,"data":{"turn":1,"reason":{"kind":"error","error":{"message":"llm-deepseek: no API key for provider route \"deepseek-official\"; store DEEPSEEK_API_KEY through the credentials service (the web Models page writes it), or export DEEPSEEK_API_KEY in the launching environment","code":"MISSING_CREDENTIAL"}}}}}
diff --git a/apps/cli/tests/profiles/headless/tests/expected/provider-retry/stream-json.expected.jsonl b/apps/cli/tests/profiles/headless/tests/expected/provider-retry/stream-json.expected.jsonl
index bce6fb173d..a667224c5f 100644
--- a/apps/cli/tests/profiles/headless/tests/expected/provider-retry/stream-json.expected.jsonl
+++ b/apps/cli/tests/profiles/headless/tests/expected/provider-retry/stream-json.expected.jsonl
@@ -4,11 +4,11 @@
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"step/start","seq":6,"time":0,"data":{"turn":1,"step":1}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"system/message","seq":7,"time":0,"data":{"turn":1,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"system-prompt"},"id":"{{sessionId}}"}},"surfaceOp":"append"}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"user/message","seq":8,"time":0,"data":{"content":[{"type":"text","text":"retry the transient provider failure"}],"source":{"kind":"user"},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}}
-{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"user/message","seq":9,"time":0,"data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable.\n\nApproval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"sandbox:policy","text":"Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable."},{"name":"approval:policy","text":"Approval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}}
+{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"user/message","seq":9,"time":0,"data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent working directory: \"{{cwd}}\".\n\nCurrent DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable.\n\nApproval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"working-directory:current","text":"Current working directory: \"{{cwd}}\"."},{"name":"sandbox:policy","text":"Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable."},{"name":"approval:policy","text":"Approval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"request/header","seq":10,"time":0,"data":{"header":{"config":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"tools":"{{tools}}"},"reason":"initial"}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"request/context","seq":11,"time":0,"data":{"provider":"deepseek-official","model":"deepseek-v4-flash"}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"session/title","seq":12,"time":0,"data":{"title":"retry the transient provider failure","messageSeqs":[8],"source":{"kind":"fallback"}}}}
-{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"session/title-llm-request","seq":13,"time":0,"data":{"titleProvider":"session-title-first-prompt-llm","messageSeqs":[8],"route":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"system":"Create a concise title for an AI coding-assistant session from the supplied human messages.\nReturn only the title on one line, **in plain text of natural language**, with no quotes, prefix, explanation, Markdown, XML, or terminal control codes. No code is allowed.\nUse the language of the messages.\nAim for about 5 words in non-CJK languages or 10 CJK characters.","messages":[{"content":[{"type":"text","text":"Generate the session title from this JSON array of human messages:\n[{\"seq\":8,\"text\":\"retry the transient provider failure\"}]"}],"source":{"kind":"dsh-session-title-llm"},"role":"user","id":"{{sessionId}}"}],"maxTokens":64}}}
+{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"session/title-llm-request","seq":13,"time":0,"data":{"titleProvider":"session-title-first-prompt-llm","messageSeqs":[8],"route":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"system":"Create a concise title for an AI coding-assistant session from the supplied human messages.\nReturn only the title on one line, **in plain text of natural language**, with no quotes, prefix, explanation, Markdown, XML, or terminal control codes. No code is allowed.\nUse the language of the messages.\nAim for about 5 words in non-CJK languages or 10 CJK characters.\nIf the messages give little to name, still return a short best-effort title, such as Greeting, instead of explaining.","messages":[{"content":[{"type":"text","text":"Generate the session title from this JSON array of human messages:\n[{\"seq\":8,\"text\":\"retry the transient provider failure\"}]"}],"source":{"kind":"dsh-session-title-llm"},"role":"user","id":"{{sessionId}}"}],"maxTokens":4096}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"assistant/attempt","seq":14,"time":0,"data":{"turn":1,"step":1,"stream":[{"type":"chunk","time":0,"chunk":{"type":"finish","reason":{"kind":"error","failure":{"message":"snapshot transient failure","code":"RATE_LIMIT","status":429}}}}]}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"llm/retry","seq":15,"time":0,"data":{"retryId":"{{sessionId}}","turn":1,"step":1,"provider":"deepseek-official","mode":"normal","policyKey":"[\"normal\",1,[\"RATE_LIMIT\"],1,1,0]","retry":1,"maxRetries":1,"delayMs":1,"failure":{"message":"snapshot transient failure","code":"RATE_LIMIT","status":429}}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"llm/retry-started","seq":16,"time":0,"data":{"retryId":"{{sessionId}}","turn":1,"step":1,"retry":1}}}
diff --git a/apps/cli/tests/profiles/headless/tests/expected/semantic-checkpoint/session.expected.jsonl b/apps/cli/tests/profiles/headless/tests/expected/semantic-checkpoint/session.expected.jsonl
index 3db7f52dd3..2afe21d157 100644
--- a/apps/cli/tests/profiles/headless/tests/expected/semantic-checkpoint/session.expected.jsonl
+++ b/apps/cli/tests/profiles/headless/tests/expected/semantic-checkpoint/session.expected.jsonl
@@ -18,7 +18,7 @@
{"type":"step/start","data":{"turn":2,"step":1}}
{"type":"system/message","data":{"turn":2,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"system-prompt"},"id":"{{sessionId}}"}},"sourceEventSeqs":[2],"surfaceOp":{"op":"replace","startSeq":2,"endSeq":2}}
{"type":"user/message","data":{"content":[{"type":"text","text":"Continue safely from the interrupted operation."}],"source":{"kind":"user"},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
-{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable.\n\nApproval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"sandbox:policy","text":"Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable."},{"name":"approval:policy","text":"Approval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
+{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent working directory: \"{{cwd}}\".\n\nCurrent DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable.\n\nApproval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"working-directory:current","text":"Current working directory: \"{{cwd}}\"."},{"name":"sandbox:policy","text":"Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable."},{"name":"approval:policy","text":"Approval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
{"type":"request/header","data":{"header":{"config":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"tools":"{{tools}}"},"reason":"initial","startsSeries":true}}
{"type":"request/context","data":{"provider":"deepseek-official","model":"deepseek-v4-flash"}}
{"type":"session/title","data":{"title":"Perform one side-effecting remote mutati","messageSeqs":[3],"source":{"kind":"fallback"}}}
diff --git a/apps/cli/tests/profiles/headless/tests/expected/subagent-diagnostic/parent.expected.jsonl b/apps/cli/tests/profiles/headless/tests/expected/subagent-diagnostic/parent.expected.jsonl
index b210549cfa..5ea5179b2e 100644
--- a/apps/cli/tests/profiles/headless/tests/expected/subagent-diagnostic/parent.expected.jsonl
+++ b/apps/cli/tests/profiles/headless/tests/expected/subagent-diagnostic/parent.expected.jsonl
@@ -16,7 +16,7 @@
{"type":"step/start","data":{"turn":2,"step":1}}
{"type":"system/message","data":{"turn":2,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"system-prompt"},"id":"{{sessionId}}"}},"sourceEventSeqs":[2],"surfaceOp":{"op":"replace","startSeq":2,"endSeq":2}}
{"type":"user/message","data":{"content":[{"type":"text","text":"Call list_agents once and report what it shows."}],"source":{"kind":"user"},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
-{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable.\n\nApproval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"sandbox:policy","text":"Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable."},{"name":"approval:policy","text":"Approval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
+{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent working directory: \"{{cwd}}\".\n\nCurrent DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable.\n\nApproval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"working-directory:current","text":"Current working directory: \"{{cwd}}\"."},{"name":"sandbox:policy","text":"Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable."},{"name":"approval:policy","text":"Approval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
{"type":"request/header","data":{"header":{"config":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"tools":"{{tools}}"},"reason":"initial","startsSeries":true}}
{"type":"request/context","data":{"provider":"deepseek-official","model":"deepseek-v4-flash"}}
{"type":"session/title","data":{"title":"Start a background job.","messageSeqs":[3],"source":{"kind":"fallback"}}}
diff --git a/apps/cli/tests/profiles/headless/tests/expected/subagent-inheritance/child.expected.jsonl b/apps/cli/tests/profiles/headless/tests/expected/subagent-inheritance/child.expected.jsonl
index 70c1834115..00868634d4 100644
--- a/apps/cli/tests/profiles/headless/tests/expected/subagent-inheritance/child.expected.jsonl
+++ b/apps/cli/tests/profiles/headless/tests/expected/subagent-inheritance/child.expected.jsonl
@@ -1,20 +1,20 @@
-{"type":"session","version":3,"id":"{{sessionId}}","createdAt":0,"cwd":"{{cwd}}","parentSession":"{{sessionId}}","isSeeded":false,"origin":"subagent","delegationDepth":1}
+{"type":"session","version":4,"id":"{{sessionId}}","createdAt":0,"cwd":"{{cwd}}","parentSession":"{{sessionId}}","isSeeded":false,"origin":"subagent","delegationDepth":1}
+{"type":"subagent/descriptor","data":{"version":3,"mode":"continuable","provider":"spawn","label":"Delegated write probe","agentProvider":"deepseek-official","agentModel":"deepseek-v4-flash","agentReasoningEffort":"low"}}
{"type":"sandbox/mode","data":{"mode":"read-only","source":"delegation"}}
{"type":"approval/policy","data":{"policy":"never","source":"delegation"}}
-{"type":"agent/inbox/spliced","data":{"target":"next-turn","start":0,"inserted":[{"content":[{"type":"text","text":"Use the write tool exactly once with file_path set to exactly the relative path inherited.txt and content escaped. If the write is denied, reply with the single word CHILD_DENIED and the denial marker line; do not retry and do not request escalation. If it succeeds, reply CHILD_WROTE."}],"source":{"kind":"user"},"role":"user","id":"{{sessionId}}"}]}}
+{"type":"agent/inbox/spliced","data":{"target":"next-turn","start":0,"inserted":[{"content":[{"type":"text","text":"Use the write tool exactly once with file_path set to exactly the relative path inherited.txt and content escaped. If the write is denied, reply with the single word CHILD_DENIED and the denial marker line; do not retry and do not request escalation. If it succeeds, reply CHILD_WROTE."},{"type":"text","text":"Your parent agent id is \"{{sessionId}}\". Before you finish, send your result to that agent with send_message({ agent_id: \"{{sessionId}}\", message: \"\" }). The parent shares your workspace but does not automatically receive your transcript, tool output, or reasoning. Send earlier messages as well when a finding changes what the parent should do next; sending a message does not end your turn."}],"source":{"kind":"user"},"role":"user","id":"{{sessionId}}"}]}}
{"type":"turn/start","data":{"turn":1}}
{"type":"agent/inbox/spliced","data":{"target":"next-turn","start":0,"removedCount":1,"inserted":[]}}
-{"type":"subagent/descriptor","data":{"version":3,"mode":"one-shot","provider":"spawn","label":"Delegated write probe"}}
{"type":"step/start","data":{"turn":1,"step":1}}
-{"type":"system/message","data":{"turn":1,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"plugin","plugin":"@deepseek-ai/dsh-system-prompt"},"id":"{{sessionId}}"}},"surfaceOp":"append"}
-{"type":"user/message","data":{"content":[{"type":"text","text":"Use the write tool exactly once with file_path set to exactly the relative path inherited.txt and content escaped. If the write is denied, reply with the single word CHILD_DENIED and the denial marker line; do not retry and do not request escalation. If it succeeds, reply CHILD_WROTE."}],"source":{"kind":"user"},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
-{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent DSH file policy: read-only. Any available operation enforced by the DSH file sandbox cannot modify files in the standing mode. Do not refuse a required modification from this policy alone: try an available tool normally and follow any denial and escalation guidance it returns.\n\nApproval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`).\n\nYou are a delegated subagent: your permission scope was fixed when you were started and cannot be widened from inside this session — operations that require approval are rejected automatically. When the task needs access beyond that scope, do not retry the denied operation; state the limitation in your reply so the delegating agent can handle it."}],"source":{"kind":"plugin","plugin":"@deepseek-ai/dsh-system-prompt","form":"snapshot","sections":[{"name":"sandbox:policy","text":"Current DSH file policy: read-only. Any available operation enforced by the DSH file sandbox cannot modify files in the standing mode. Do not refuse a required modification from this policy alone: try an available tool normally and follow any denial and escalation guidance it returns."},{"name":"approval:policy","text":"Approval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."},{"name":"subagent:delegation","text":"You are a delegated subagent: your permission scope was fixed when you were started and cannot be widened from inside this session — operations that require approval are rejected automatically. When the task needs access beyond that scope, do not retry the denied operation; state the limitation in your reply so the delegating agent can handle it."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
+{"type":"system/message","data":{"turn":1,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"system-prompt"},"id":"{{sessionId}}"}},"surfaceOp":"append"}
+{"type":"user/message","data":{"content":[{"type":"text","text":"Use the write tool exactly once with file_path set to exactly the relative path inherited.txt and content escaped. If the write is denied, reply with the single word CHILD_DENIED and the denial marker line; do not retry and do not request escalation. If it succeeds, reply CHILD_WROTE."},{"type":"text","text":"Your parent agent id is \"{{sessionId}}\". Before you finish, send your result to that agent with send_message({ agent_id: \"{{sessionId}}\", message: \"\" }). The parent shares your workspace but does not automatically receive your transcript, tool output, or reasoning. Send earlier messages as well when a finding changes what the parent should do next; sending a message does not end your turn."}],"source":{"kind":"user"},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
+{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent working directory: \"{{cwd}}\".\n\nCurrent DSH file policy: read-only. Any available operation enforced by the DSH file sandbox cannot modify files in the standing mode. Do not refuse a required modification from this policy alone: try an available tool normally and follow any denial and escalation guidance it returns.\n\nApproval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`).\n\nYou are a delegated subagent: your permission scope was fixed when you were started and cannot be widened from inside this session — operations that require approval are rejected automatically. When the task needs access beyond that scope, do not retry the denied operation; state the limitation in your reply so the delegating agent can handle it."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"working-directory:current","text":"Current working directory: \"{{cwd}}\"."},{"name":"sandbox:policy","text":"Current DSH file policy: read-only. Any available operation enforced by the DSH file sandbox cannot modify files in the standing mode. Do not refuse a required modification from this policy alone: try an available tool normally and follow any denial and escalation guidance it returns."},{"name":"approval:policy","text":"Approval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."},{"name":"subagent:delegation","text":"You are a delegated subagent: your permission scope was fixed when you were started and cannot be widened from inside this session — operations that require approval are rejected automatically. When the task needs access beyond that scope, do not retry the denied operation; state the limitation in your reply so the delegating agent can handle it."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
{"type":"request/header","data":{"header":{"config":{"provider":"deepseek-official","model":"deepseek-v4-flash","reasoningEffort":"low"},"tools":"{{tools}}"},"reason":"initial"}}
{"type":"request/context","data":{"provider":"deepseek-official","model":"deepseek-v4-flash"}}
{"type":"session/title","data":{"title":"Use the write tool exactly","messageSeqs":[8],"source":{"kind":"fallback"}}}
{"type":"assistant/message","data":{"turn":1,"step":1,"message":{"role":"assistant","content":[{"type":"tool-call","id":"child-write","name":"write","arguments":"{\"file_path\": \"inherited.txt\", \"content\": \"escaped\"}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{sessionId}}"},"usage":{"inputTokens":10,"outputTokens":5},"stream":[{"type":"chunk","time":0,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"tool-call-chunks","time0":0,"index":0,"dt":[],"id":"child-write","name":"write","args":["{\"file_path\": \"inherited.txt\", \"content\": \"escaped\"}"]},{"type":"chunk","time":0,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"child-write","name":"write","arguments":"{\"file_path\": \"inherited.txt\", \"content\": \"escaped\"}"}}},{"type":"chunk","time":0,"chunk":{"type":"usage","usage":{"inputTokens":10,"outputTokens":5}}},{"type":"chunk","time":0,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
{"type":"tool/call","data":{"turn":1,"step":1,"callId":"child-write","name":"write","arguments":"{\"file_path\": \"inherited.txt\", \"content\": \"escaped\"}"}}
-{"type":"tool/result","data":{"turn":1,"step":1,"message":{"source":{"kind":"tool","callId":"child-write"},"content":[{"type":"tool-result","toolCallId":"child-write","content":[{"type":"text","text":"Error: [sandbox: file access denied under read-only mode]\n[sandbox: escalation available — retry this exact operation once with sandbox_permissions (the narrowest wider mode that suffices) + justification; the approval prompt asks the user]"}],"isError":true}],"role":"user","id":"{{sessionId}}"},"error":{"name":"FsError","code":"FS_SANDBOX_DENIED"}},"sourceEventSeqs":[14],"surfaceOp":"append"}
+{"type":"tool/result","data":{"turn":1,"step":1,"message":{"role":"tool","source":{"kind":"tool","callId":"child-write"},"toolCallId":"child-write","content":[{"type":"text","text":"Error: [sandbox: file access denied under read-only mode]\n[sandbox: escalation available — retry this exact operation once with sandbox_permissions (the narrowest wider mode that suffices) + justification; the approval prompt asks the user]"}],"isError":true,"id":"{{sessionId}}"},"error":{"name":"FsError","code":"FS_SANDBOX_DENIED"}},"sourceEventSeqs":[14],"surfaceOp":"append"}
{"type":"step/end","data":{"turn":1,"step":1}}
{"type":"step/start","data":{"turn":1,"step":2}}
{"type":"assistant/message","data":{"turn":1,"step":2,"message":{"role":"assistant","content":[{"type":"text","text":"CHILD_DENIED [sandbox: file access denied under read-only mode]"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{sessionId}}"},"usage":{"inputTokens":10,"outputTokens":5},"stream":[{"type":"chunk","time":0,"chunk":{"type":"block-start","index":0,"blockType":"text"}},{"type":"text-chunks","time0":0,"index":0,"dt":[],"texts":["CHILD_DENIED [sandbox: file access denied under read-only mode]"]},{"type":"chunk","time":0,"chunk":{"type":"block-end","index":0,"block":{"type":"text","text":"CHILD_DENIED [sandbox: file access denied under read-only mode]"}}},{"type":"chunk","time":0,"chunk":{"type":"usage","usage":{"inputTokens":10,"outputTokens":5}}},{"type":"chunk","time":0,"chunk":{"type":"finish","reason":{"kind":"stop"}}}]},"surfaceOp":"append"}
diff --git a/apps/cli/tests/profiles/headless/tests/expected/subagent-inheritance/parent.expected.jsonl b/apps/cli/tests/profiles/headless/tests/expected/subagent-inheritance/parent.expected.jsonl
index f4077c4510..1cee326a29 100644
--- a/apps/cli/tests/profiles/headless/tests/expected/subagent-inheritance/parent.expected.jsonl
+++ b/apps/cli/tests/profiles/headless/tests/expected/subagent-inheritance/parent.expected.jsonl
@@ -16,17 +16,20 @@
{"type":"step/start","data":{"turn":2,"step":1}}
{"type":"system/message","data":{"turn":2,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"system-prompt"},"id":"{{sessionId}}"}},"sourceEventSeqs":[2],"surfaceOp":{"op":"replace","startSeq":2,"endSeq":2}}
{"type":"user/message","data":{"content":[{"type":"text","text":"Delegate the write probe to a subagent."}],"source":{"kind":"user"},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
-{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent DSH file policy: read-only. Any available operation enforced by the DSH file sandbox cannot modify files in the standing mode. Do not refuse a required modification from this policy alone: try an available tool normally and follow any denial and escalation guidance it returns.\n\nApproval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"sandbox:policy","text":"Current DSH file policy: read-only. Any available operation enforced by the DSH file sandbox cannot modify files in the standing mode. Do not refuse a required modification from this policy alone: try an available tool normally and follow any denial and escalation guidance it returns."},{"name":"approval:policy","text":"Approval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
-{"type":"request/header","data":{"header":{"config":{"provider":"deepseek-official","model":"deepseek-v4-flash","reasoningEffort":"low"},"tools":["bash","create_goal","edit","exit_plan_mode","get_goal","glob","grep","interrupt_agent","job_kill","job_list","job_output","list_agents","read","read_image","send_message","skill","subagent","subagent_fork","todo_write","update_goal","web_fetch","web_search","workflow","write"]},"reason":"resume","startsSeries":true}}
-{"type":"developer/message","data":{"turn":2,"step":1,"message":{"source":{"kind":"tool-registry"},"content":[{"type":"tool-addition","toolName":"bash"},{"type":"tool-addition","toolName":"create_goal"},{"type":"tool-addition","toolName":"edit"},{"type":"tool-addition","toolName":"exit_plan_mode"},{"type":"tool-addition","toolName":"get_goal"},{"type":"tool-addition","toolName":"glob"},{"type":"tool-addition","toolName":"grep"},{"type":"tool-addition","toolName":"interrupt_agent"},{"type":"tool-addition","toolName":"job_kill"},{"type":"tool-addition","toolName":"job_list"},{"type":"tool-addition","toolName":"job_output"},{"type":"tool-addition","toolName":"list_agents"},{"type":"tool-addition","toolName":"read"},{"type":"tool-addition","toolName":"read_image"},{"type":"tool-addition","toolName":"send_message"},{"type":"tool-addition","toolName":"skill"},{"type":"tool-addition","toolName":"subagent"},{"type":"tool-addition","toolName":"subagent_fork"},{"type":"tool-addition","toolName":"todo_write"},{"type":"tool-addition","toolName":"update_goal"},{"type":"tool-addition","toolName":"web_fetch"},{"type":"tool-addition","toolName":"web_search"},{"type":"tool-addition","toolName":"workflow"},{"type":"tool-addition","toolName":"write"}],"role":"developer","id":"{{sessionId}}"},"headerSeq":18},"surfaceOp":"append"}
+{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent working directory: \"{{cwd}}\".\n\nCurrent DSH file policy: read-only. Any available operation enforced by the DSH file sandbox cannot modify files in the standing mode. Do not refuse a required modification from this policy alone: try an available tool normally and follow any denial and escalation guidance it returns.\n\nApproval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"working-directory:current","text":"Current working directory: \"{{cwd}}\"."},{"name":"sandbox:policy","text":"Current DSH file policy: read-only. Any available operation enforced by the DSH file sandbox cannot modify files in the standing mode. Do not refuse a required modification from this policy alone: try an available tool normally and follow any denial and escalation guidance it returns."},{"name":"approval:policy","text":"Approval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
+{"type":"request/header","data":{"header":{"config":{"provider":"deepseek-official","model":"deepseek-v4-flash","reasoningEffort":"low"},"tools":["bash","create_goal","edit","exit_plan_mode","get_goal","glob","grep","interrupt_agent","job_kill","job_list","job_output","list_agents","read","read_image","send_message","skill","subagent","subagent_fork","todo_write","update_goal","web_fetch","web_search","workflow","working_directory","write"]},"reason":"resume","startsSeries":true}}
+{"type":"developer/message","data":{"turn":2,"step":1,"message":{"source":{"kind":"tool-registry"},"content":[{"type":"tool-addition","toolName":"bash"},{"type":"tool-addition","toolName":"create_goal"},{"type":"tool-addition","toolName":"edit"},{"type":"tool-addition","toolName":"exit_plan_mode"},{"type":"tool-addition","toolName":"get_goal"},{"type":"tool-addition","toolName":"glob"},{"type":"tool-addition","toolName":"grep"},{"type":"tool-addition","toolName":"interrupt_agent"},{"type":"tool-addition","toolName":"job_kill"},{"type":"tool-addition","toolName":"job_list"},{"type":"tool-addition","toolName":"job_output"},{"type":"tool-addition","toolName":"list_agents"},{"type":"tool-addition","toolName":"read"},{"type":"tool-addition","toolName":"read_image"},{"type":"tool-addition","toolName":"send_message"},{"type":"tool-addition","toolName":"skill"},{"type":"tool-addition","toolName":"subagent"},{"type":"tool-addition","toolName":"subagent_fork"},{"type":"tool-addition","toolName":"todo_write"},{"type":"tool-addition","toolName":"update_goal"},{"type":"tool-addition","toolName":"web_fetch"},{"type":"tool-addition","toolName":"web_search"},{"type":"tool-addition","toolName":"workflow"},{"type":"tool-addition","toolName":"working_directory"},{"type":"tool-addition","toolName":"write"}],"role":"developer","id":"{{sessionId}}"},"headerSeq":18},"surfaceOp":"append"}
{"type":"request/context","data":{"provider":"deepseek-official","model":"deepseek-v4-flash"}}
{"type":"session/title","data":{"title":"Tighten this session to read-only.","messageSeqs":[3],"source":{"kind":"fallback"}}}
{"type":"assistant/message","data":{"turn":2,"step":1,"message":{"role":"assistant","content":[{"type":"tool-call","id":"delegate-write","name":"subagent","arguments":"{\"description\": \"Delegated write probe\", \"prompt\": \"Use the write tool exactly once with file_path set to exactly the relative path inherited.txt and content escaped. If the write is denied, reply with the single word CHILD_DENIED and the denial marker line; do not retry and do not request escalation. If it succeeds, reply CHILD_WROTE.\"}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{sessionId}}"},"usage":{"inputTokens":10,"outputTokens":5},"stream":[{"type":"chunk","time":0,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"tool-call-chunks","time0":0,"index":0,"dt":[],"id":"delegate-write","name":"subagent","args":["{\"description\": \"Delegated write probe\", \"prompt\": \"Use the write tool exactly once with file_path set to exactly the relative path inherited.txt and content escaped. If the write is denied, reply with the single word CHILD_DENIED and the denial marker line; do not retry and do not request escalation. If it succeeds, reply CHILD_WROTE.\"}"]},{"type":"chunk","time":0,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"delegate-write","name":"subagent","arguments":"{\"description\": \"Delegated write probe\", \"prompt\": \"Use the write tool exactly once with file_path set to exactly the relative path inherited.txt and content escaped. If the write is denied, reply with the single word CHILD_DENIED and the denial marker line; do not retry and do not request escalation. If it succeeds, reply CHILD_WROTE.\"}"}}},{"type":"chunk","time":0,"chunk":{"type":"usage","usage":{"inputTokens":10,"outputTokens":5}}},{"type":"chunk","time":0,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
{"type":"tool/call","data":{"turn":2,"step":1,"callId":"delegate-write","name":"subagent","arguments":"{\"description\": \"Delegated write probe\", \"prompt\": \"Use the write tool exactly once with file_path set to exactly the relative path inherited.txt and content escaped. If the write is denied, reply with the single word CHILD_DENIED and the denial marker line; do not retry and do not request escalation. If it succeeds, reply CHILD_WROTE.\"}"}}
-{"type":"subagent/catalog","data":{"version":0,"childId":"{{sessionId}}","childCreatedAt":0,"mode":"one-shot","label":"Delegated write probe"}}
-{"type":"tool/result","data":{"turn":2,"step":1,"message":{"role":"tool","source":{"kind":"tool","callId":"delegate-write"},"toolCallId":"delegate-write","content":[{"type":"text","text":"CHILD_DENIED [sandbox: file access denied under read-only mode]"}],"isError":false,"id":"{{sessionId}}"}},"sourceEventSeqs":[23],"surfaceOp":"append"}
+{"type":"subagent/catalog","data":{"version":0,"childId":"{{sessionId}}","childCreatedAt":0,"mode":"continuable","label":"Delegated write probe"}}
+{"type":"agent/inbox/spliced","data":{"target":"next-step","start":0,"inserted":[{"content":[{"type":"text","text":"Background subagent {{sessionId}} finished and will do no further work unless you send it more."},{"type":"text","text":"Its closing message:"},{"type":"text","text":"CHILD_DENIED [sandbox: file access denied under read-only mode]"}],"source":{"kind":"subagent-settled","form":"notice","summary":"Background subagent {{sessionId}} finished and will do no further work unless you send it more.","senderSessionId":"{{sessionId}}"},"role":"user","id":"{{sessionId}}"}]}}
+{"type":"tool/result","data":{"turn":2,"step":1,"message":{"role":"tool","source":{"kind":"tool","callId":"delegate-write"},"toolCallId":"delegate-write","content":[{"type":"text","text":"started subagent {{sessionId}}"}],"isError":false,"id":"{{sessionId}}"}},"sourceEventSeqs":[23],"surfaceOp":"append"}
{"type":"step/end","data":{"turn":2,"step":1}}
+{"type":"agent/inbox/spliced","data":{"target":"next-step","start":0,"removedCount":1,"inserted":[]}}
{"type":"step/start","data":{"turn":2,"step":2}}
+{"type":"user/message","data":{"content":[{"type":"text","text":"Background subagent {{sessionId}} finished and will do no further work unless you send it more."},{"type":"text","text":"Its closing message:"},{"type":"text","text":"CHILD_DENIED [sandbox: file access denied under read-only mode]"}],"source":{"kind":"subagent-settled","form":"notice","summary":"Background subagent {{sessionId}} finished and will do no further work unless you send it more.","senderSessionId":"{{sessionId}}"},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
{"type":"assistant/message","data":{"turn":2,"step":2,"message":{"role":"assistant","content":[{"type":"text","text":"The delegated child was denied by the sandbox. PARENT_DONE"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{sessionId}}"},"usage":{"inputTokens":10,"outputTokens":5},"stream":[{"type":"chunk","time":0,"chunk":{"type":"block-start","index":0,"blockType":"text"}},{"type":"text-chunks","time0":0,"index":0,"dt":[],"texts":["The delegated child was denied by the sandbox. PARENT_DONE"]},{"type":"chunk","time":0,"chunk":{"type":"block-end","index":0,"block":{"type":"text","text":"The delegated child was denied by the sandbox. PARENT_DONE"}}},{"type":"chunk","time":0,"chunk":{"type":"usage","usage":{"inputTokens":10,"outputTokens":5}}},{"type":"chunk","time":0,"chunk":{"type":"finish","reason":{"kind":"stop"}}}]},"surfaceOp":"append"}
{"type":"step/end","data":{"turn":2,"step":2}}
{"type":"turn/end","data":{"turn":2,"reason":{"kind":"completed"}}}
diff --git a/apps/cli/tests/profiles/headless/tests/expected/subagent-settlement/child.expected.jsonl b/apps/cli/tests/profiles/headless/tests/expected/subagent-settlement/child.expected.jsonl
index 520e96bbc0..1b82a99cf0 100644
--- a/apps/cli/tests/profiles/headless/tests/expected/subagent-settlement/child.expected.jsonl
+++ b/apps/cli/tests/profiles/headless/tests/expected/subagent-settlement/child.expected.jsonl
@@ -1,4 +1,4 @@
-{"type":"session","version":3,"id":"{{sessionId}}","createdAt":0,"cwd":"{{cwd}}","parentSession":"{{sessionId}}","isSeeded":false,"origin":"subagent","delegationDepth":1}
+{"type":"session","version":4,"id":"{{sessionId}}","createdAt":0,"cwd":"{{cwd}}","parentSession":"{{sessionId}}","isSeeded":false,"origin":"subagent","delegationDepth":1}
{"type":"subagent/descriptor","data":{"version":3,"mode":"continuable","provider":"spawn","label":"Return child result","agentProvider":"deepseek-official","agentModel":"deepseek-v4-flash"}}
{"type":"sandbox/mode","data":{"mode":"workspace-write","source":"delegation"}}
{"type":"approval/policy","data":{"policy":"never","source":"delegation"}}
@@ -6,9 +6,9 @@
{"type":"turn/start","data":{"turn":1}}
{"type":"agent/inbox/spliced","data":{"target":"next-turn","start":0,"removedCount":1,"inserted":[]}}
{"type":"step/start","data":{"turn":1,"step":1}}
-{"type":"system/message","data":{"turn":1,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"plugin","plugin":"@deepseek-ai/dsh-system-prompt"},"id":"{{sessionId}}"}},"surfaceOp":"append"}
+{"type":"system/message","data":{"turn":1,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"system-prompt"},"id":"{{sessionId}}"}},"surfaceOp":"append"}
{"type":"user/message","data":{"content":[{"type":"text","text":"Reply with exactly CHILD_RESULT and nothing else. Do not call send_message."},{"type":"text","text":"Your parent agent id is \"{{sessionId}}\". Before you finish, send your result to that agent with send_message({ agent_id: \"{{sessionId}}\", message: \"\" }). The parent shares your workspace but does not automatically receive your transcript, tool output, or reasoning. Send earlier messages as well when a finding changes what the parent should do next; sending a message does not end your turn."}],"source":{"kind":"user"},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
-{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable.\n\nApproval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`).\n\nYou are a delegated subagent: your permission scope was fixed when you were started and cannot be widened from inside this session — operations that require approval are rejected automatically. When the task needs access beyond that scope, do not retry the denied operation; state the limitation in your reply so the delegating agent can handle it."}],"source":{"kind":"plugin","plugin":"@deepseek-ai/dsh-system-prompt","form":"snapshot","sections":[{"name":"sandbox:policy","text":"Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable."},{"name":"approval:policy","text":"Approval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."},{"name":"subagent:delegation","text":"You are a delegated subagent: your permission scope was fixed when you were started and cannot be widened from inside this session — operations that require approval are rejected automatically. When the task needs access beyond that scope, do not retry the denied operation; state the limitation in your reply so the delegating agent can handle it."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
+{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent working directory: \"{{cwd}}\".\n\nCurrent DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable.\n\nApproval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`).\n\nYou are a delegated subagent: your permission scope was fixed when you were started and cannot be widened from inside this session — operations that require approval are rejected automatically. When the task needs access beyond that scope, do not retry the denied operation; state the limitation in your reply so the delegating agent can handle it."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"working-directory:current","text":"Current working directory: \"{{cwd}}\"."},{"name":"sandbox:policy","text":"Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable."},{"name":"approval:policy","text":"Approval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."},{"name":"subagent:delegation","text":"You are a delegated subagent: your permission scope was fixed when you were started and cannot be widened from inside this session — operations that require approval are rejected automatically. When the task needs access beyond that scope, do not retry the denied operation; state the limitation in your reply so the delegating agent can handle it."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
{"type":"request/header","data":{"header":{"config":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"tools":"{{tools}}"},"reason":"initial"}}
{"type":"request/context","data":{"provider":"deepseek-official","model":"deepseek-v4-flash"}}
{"type":"session/title","data":{"title":"Reply with exactly CHILD_RESULT and","messageSeqs":[8],"source":{"kind":"fallback"}}}
diff --git a/apps/cli/tests/profiles/headless/tests/expected/subagent-settlement/parent.override.json b/apps/cli/tests/profiles/headless/tests/expected/subagent-settlement/parent.override.json
index 336bcafb3b..91428bb387 100644
--- a/apps/cli/tests/profiles/headless/tests/expected/subagent-settlement/parent.override.json
+++ b/apps/cli/tests/profiles/headless/tests/expected/subagent-settlement/parent.override.json
@@ -33,8 +33,8 @@
"kind": "chunks",
"chunks": [
{ "type": "block-start", "index": 0, "blockType": "text" },
- { "type": "text-delta", "index": 0, "text": "PARENT_RECEIVED_CHILD_RESULT" },
- { "type": "block-end", "index": 0, "block": { "type": "text", "text": "PARENT_RECEIVED_CHILD_RESULT" } },
+ { "type": "text-delta", "index": 0, "text": "PARENT_RECEIVED_SETTLEMENT_NOTICE" },
+ { "type": "block-end", "index": 0, "block": { "type": "text", "text": "PARENT_RECEIVED_SETTLEMENT_NOTICE" } },
{ "type": "usage", "usage": { "inputTokens": 10, "outputTokens": 5 } },
{ "type": "finish", "reason": { "kind": "stop" } }
]
diff --git a/apps/cli/tests/profiles/headless/tests/expected/subagent-settlement/stream-json.expected.jsonl b/apps/cli/tests/profiles/headless/tests/expected/subagent-settlement/stream-json.expected.jsonl
index 3c8e6615eb..f06a75700f 100644
--- a/apps/cli/tests/profiles/headless/tests/expected/subagent-settlement/stream-json.expected.jsonl
+++ b/apps/cli/tests/profiles/headless/tests/expected/subagent-settlement/stream-json.expected.jsonl
@@ -1,19 +1,19 @@
-{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"agent/inbox/spliced","seq":3,"time":0,"data":{"target":"next-turn","start":0,"inserted":[{"content":[{"type":"text","text":"Start one continuable background subagent and answer from its completion notice. Do not call list_agents, send_message, job_output, or job_list."}],"source":{"kind":"user"},"role":"user","id":"{{sessionId}}"}]}}}
+{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"agent/inbox/spliced","seq":3,"time":0,"data":{"target":"next-turn","start":0,"inserted":[{"content":[{"type":"text","text":"Start one continuable subagent and acknowledge its completion notice. Do not call list_agents or send_message."}],"source":{"kind":"user"},"role":"user","id":"{{sessionId}}"}]}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"turn/start","seq":4,"time":0,"data":{"turn":1}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"agent/inbox/spliced","seq":5,"time":0,"data":{"target":"next-turn","start":0,"removedCount":1,"inserted":[]}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"step/start","seq":6,"time":0,"data":{"turn":1,"step":1}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"system/message","seq":7,"time":0,"data":{"turn":1,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"system-prompt"},"id":"{{sessionId}}"}},"surfaceOp":"append"}}
-{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"user/message","seq":8,"time":0,"data":{"content":[{"type":"text","text":"Start one continuable background subagent and answer from its completion notice. Do not call list_agents, send_message, job_output, or job_list."}],"source":{"kind":"user"},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}}
-{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"user/message","seq":9,"time":0,"data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable.\n\nApproval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"sandbox:policy","text":"Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable."},{"name":"approval:policy","text":"Approval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}}
+{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"user/message","seq":8,"time":0,"data":{"content":[{"type":"text","text":"Start one continuable subagent and acknowledge its completion notice. Do not call list_agents or send_message."}],"source":{"kind":"user"},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}}
+{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"user/message","seq":9,"time":0,"data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent working directory: \"{{cwd}}\".\n\nCurrent DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable.\n\nApproval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"working-directory:current","text":"Current working directory: \"{{cwd}}\"."},{"name":"sandbox:policy","text":"Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable."},{"name":"approval:policy","text":"Approval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"request/header","seq":10,"time":0,"data":{"header":{"config":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"tools":"{{tools}}"},"reason":"initial"}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"request/context","seq":11,"time":0,"data":{"provider":"deepseek-official","model":"deepseek-v4-flash"}}}
-{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"session/title","seq":12,"time":0,"data":{"title":"Start one continuable background subagen","messageSeqs":[8],"source":{"kind":"fallback"}}}}
-{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"session/title-llm-request","seq":13,"time":0,"data":{"titleProvider":"session-title-first-prompt-llm","messageSeqs":[8],"route":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"system":"Create a concise title for an AI coding-assistant session from the supplied human messages.\nReturn only the title on one line, **in plain text of natural language**, with no quotes, prefix, explanation, Markdown, XML, or terminal control codes. No code is allowed.\nUse the language of the messages.\nAim for about 5 words in non-CJK languages or 10 CJK characters.","messages":[{"content":[{"type":"text","text":"Generate the session title from this JSON array of human messages:\n[{\"seq\":8,\"text\":\"Start one continuable background subagent and answer from its completion notice. Do not call list_agents, send_message, job_output, or job_list.\"}]"}],"source":{"kind":"dsh-session-title-llm"},"role":"user","id":"{{sessionId}}"}],"maxTokens":64}}}
+{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"session/title","seq":12,"time":0,"data":{"title":"Start one continuable subagent and","messageSeqs":[8],"source":{"kind":"fallback"}}}}
+{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"session/title-llm-request","seq":13,"time":0,"data":{"titleProvider":"session-title-first-prompt-llm","messageSeqs":[8],"route":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"system":"Create a concise title for an AI coding-assistant session from the supplied human messages.\nReturn only the title on one line, **in plain text of natural language**, with no quotes, prefix, explanation, Markdown, XML, or terminal control codes. No code is allowed.\nUse the language of the messages.\nAim for about 5 words in non-CJK languages or 10 CJK characters.\nIf the messages give little to name, still return a short best-effort title, such as Greeting, instead of explaining.","messages":[{"content":[{"type":"text","text":"Generate the session title from this JSON array of human messages:\n[{\"seq\":8,\"text\":\"Start one continuable subagent and acknowledge its completion notice. Do not call list_agents or send_message.\"}]"}],"source":{"kind":"dsh-session-title-llm"},"role":"user","id":"{{sessionId}}"}],"maxTokens":4096}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"assistant/message","seq":14,"time":0,"data":{"turn":1,"step":1,"message":{"role":"assistant","content":[{"type":"tool-call","id":"start-child","name":"subagent","arguments":"{\"description\":\"Return child result\",\"prompt\":\"Reply with exactly CHILD_RESULT and nothing else. Do not call send_message.\"}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{sessionId}}"},"usage":{"inputTokens":10,"outputTokens":5},"stream":[{"type":"chunk","time":0,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"tool-call-chunks","time0":0,"index":0,"dt":[],"id":"start-child","name":"subagent","args":["{\"description\":\"Return child result\",\"prompt\":\"Reply with exactly CHILD_RESULT and nothing else. Do not call send_message.\"}"]},{"type":"chunk","time":0,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"start-child","name":"subagent","arguments":"{\"description\":\"Return child result\",\"prompt\":\"Reply with exactly CHILD_RESULT and nothing else. Do not call send_message.\"}"}}},{"type":"chunk","time":0,"chunk":{"type":"usage","usage":{"inputTokens":10,"outputTokens":5}}},{"type":"chunk","time":0,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"tool/call","seq":15,"time":0,"data":{"turn":1,"step":1,"callId":"start-child","name":"subagent","arguments":"{\"description\":\"Return child result\",\"prompt\":\"Reply with exactly CHILD_RESULT and nothing else. Do not call send_message.\"}"}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"session/title","seq":16,"time":0,"data":{"title":"Subagent settlement","messageSeqs":[8],"source":{"kind":"provider","provider":"session-title-first-prompt-llm","model":{"provider":"deepseek-official","model":"deepseek-v4-flash"}}}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"subagent/catalog","seq":17,"time":0,"data":{"version":0,"childId":"{{sessionId}}","childCreatedAt":0,"mode":"continuable","label":"Return child result"}}}
-{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"tool/result","seq":18,"time":0,"data":{"turn":1,"step":1,"message":{"source":{"kind":"tool","callId":"start-child"},"content":[{"type":"text","text":"started subagent {{sessionId}}"}],"role":"tool","toolCallId":"start-child","isError":false,"id":"{{sessionId}}"}},"sourceEventSeqs":[15],"surfaceOp":"append"}}
+{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"tool/result","seq":18,"time":0,"data":{"turn":1,"step":1,"message":{"role":"tool","source":{"kind":"tool","callId":"start-child"},"toolCallId":"start-child","content":[{"type":"text","text":"started subagent {{sessionId}}"}],"isError":false,"id":"{{sessionId}}"}},"sourceEventSeqs":[15],"surfaceOp":"append"}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"step/end","seq":19,"time":0,"data":{"turn":1,"step":1}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"agent/inbox/spliced","seq":20,"time":0,"data":{"target":"next-step","start":0,"inserted":[{"content":[{"type":"text","text":"Background subagent {{sessionId}} finished and will do no further work unless you send it more."},{"type":"text","text":"Its closing message:"},{"type":"text","text":"CHILD_RESULT"}],"source":{"kind":"subagent-settled","form":"notice","summary":"Background subagent {{sessionId}} finished and will do no further work unless you send it more.","senderSessionId":"{{sessionId}}"},"role":"user","id":"{{sessionId}}"}]}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"step/start","seq":21,"time":0,"data":{"turn":1,"step":2}}}
@@ -22,7 +22,7 @@
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"agent/inbox/spliced","seq":24,"time":0,"data":{"target":"next-step","start":0,"removedCount":1,"inserted":[]}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"step/start","seq":25,"time":0,"data":{"turn":1,"step":3}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"user/message","seq":26,"time":0,"data":{"content":[{"type":"text","text":"Background subagent {{sessionId}} finished and will do no further work unless you send it more."},{"type":"text","text":"Its closing message:"},{"type":"text","text":"CHILD_RESULT"}],"source":{"kind":"subagent-settled","form":"notice","summary":"Background subagent {{sessionId}} finished and will do no further work unless you send it more.","senderSessionId":"{{sessionId}}"},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}}
-{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"assistant/message","seq":27,"time":0,"data":{"turn":1,"step":3,"message":{"role":"assistant","content":[{"type":"text","text":"PARENT_RECEIVED_CHILD_RESULT"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{sessionId}}"},"usage":{"inputTokens":10,"outputTokens":5},"stream":[{"type":"chunk","time":0,"chunk":{"type":"block-start","index":0,"blockType":"text"}},{"type":"text-chunks","time0":0,"index":0,"dt":[],"texts":["PARENT_RECEIVED_CHILD_RESULT"]},{"type":"chunk","time":0,"chunk":{"type":"block-end","index":0,"block":{"type":"text","text":"PARENT_RECEIVED_CHILD_RESULT"}}},{"type":"chunk","time":0,"chunk":{"type":"usage","usage":{"inputTokens":10,"outputTokens":5}}},{"type":"chunk","time":0,"chunk":{"type":"finish","reason":{"kind":"stop"}}}]},"surfaceOp":"append"}}
+{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"assistant/message","seq":27,"time":0,"data":{"turn":1,"step":3,"message":{"role":"assistant","content":[{"type":"text","text":"PARENT_RECEIVED_SETTLEMENT_NOTICE"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{sessionId}}"},"usage":{"inputTokens":10,"outputTokens":5},"stream":[{"type":"chunk","time":0,"chunk":{"type":"block-start","index":0,"blockType":"text"}},{"type":"text-chunks","time0":0,"index":0,"dt":[],"texts":["PARENT_RECEIVED_SETTLEMENT_NOTICE"]},{"type":"chunk","time":0,"chunk":{"type":"block-end","index":0,"block":{"type":"text","text":"PARENT_RECEIVED_SETTLEMENT_NOTICE"}}},{"type":"chunk","time":0,"chunk":{"type":"usage","usage":{"inputTokens":10,"outputTokens":5}}},{"type":"chunk","time":0,"chunk":{"type":"finish","reason":{"kind":"stop"}}}]},"surfaceOp":"append"}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"step/end","seq":28,"time":0,"data":{"turn":1,"step":3}}}
{"type":"session_event","sessionId":"{{sessionId}}","event":{"type":"turn/end","seq":29,"time":0,"data":{"turn":1,"reason":{"kind":"completed"}}}}
-{"type":"result","sessionId":"{{sessionId}}","output":"PARENT_RECEIVED_CHILD_RESULT","usage":{"inputTokens":30,"outputTokens":15}}
+{"type":"result","sessionId":"{{sessionId}}","output":"PARENT_RECEIVED_SETTLEMENT_NOTICE","usage":{"inputTokens":30,"outputTokens":15}}
diff --git a/apps/cli/tests/profiles/headless/tests/expected/workspace-context-resume/offline-edit/session.expected.jsonl b/apps/cli/tests/profiles/headless/tests/expected/workspace-context-resume/offline-edit/session.expected.jsonl
index 7dc7407bff..5ed8464fb7 100644
--- a/apps/cli/tests/profiles/headless/tests/expected/workspace-context-resume/offline-edit/session.expected.jsonl
+++ b/apps/cli/tests/profiles/headless/tests/expected/workspace-context-resume/offline-edit/session.expected.jsonl
@@ -17,7 +17,7 @@
{"type":"system/message","data":{"turn":2,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"system-prompt"},"id":"{{sessionId}}"}},"sourceEventSeqs":[2],"surfaceOp":{"op":"replace","startSeq":2,"endSeq":2}}
{"type":"user/message","data":{"content":[{"type":"text","text":"Acknowledge the current workspace instruction."}],"source":{"kind":"user"},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
{"type":"user/message","data":{"content":[{"type":"text","text":"\nUpdated instructions from: AGENTS.md\n\nThis file changed after it was loaded. Use the following content instead of the previously loaded instructions from this file.\n\nNew workspace instruction after offline edit.\n\n"}],"source":{"kind":"agent-instructions","form":"instructions","changes":[{"action":"replace","scope":".\u0000AGENTS.md","path":"AGENTS.md","digest":"d8375b516f158718bd3463bc8eb7ed42c011b29f"}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
-{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable.\n\nApproval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"sandbox:policy","text":"Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable."},{"name":"approval:policy","text":"Approval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
+{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent working directory: \"{{cwd}}\".\n\nCurrent DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable.\n\nApproval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"working-directory:current","text":"Current working directory: \"{{cwd}}\"."},{"name":"sandbox:policy","text":"Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable."},{"name":"approval:policy","text":"Approval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
{"type":"request/header","data":{"header":{"config":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"tools":"{{tools}}"},"reason":"initial","startsSeries":true}}
{"type":"request/context","data":{"provider":"deepseek-official","model":"deepseek-v4-flash"}}
{"type":"session/title","data":{"title":"Remember the workspace instruction.","messageSeqs":[3],"source":{"kind":"fallback"}}}
diff --git a/apps/cli/tests/profiles/headless/tests/expected/workspace-context-resume/precedence-change/session.expected.jsonl b/apps/cli/tests/profiles/headless/tests/expected/workspace-context-resume/precedence-change/session.expected.jsonl
index 76af22df23..f52d5f06e9 100644
--- a/apps/cli/tests/profiles/headless/tests/expected/workspace-context-resume/precedence-change/session.expected.jsonl
+++ b/apps/cli/tests/profiles/headless/tests/expected/workspace-context-resume/precedence-change/session.expected.jsonl
@@ -17,7 +17,7 @@
{"type":"system/message","data":{"turn":2,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"system-prompt"},"id":"{{sessionId}}"}},"sourceEventSeqs":[2],"surfaceOp":{"op":"replace","startSeq":2,"endSeq":2}}
{"type":"user/message","data":{"content":[{"type":"text","text":"Acknowledge the current workspace instruction."}],"source":{"kind":"user"},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
{"type":"user/message","data":{"content":[{"type":"text","text":"\nThis complete workspace instruction baseline replaces all earlier workspace instruction baselines. The following workspace instructions may be relevant to your work. Use them as guidance when applicable. More specific instructions take precedence over broader ones. They do not override system, developer, or direct user instructions.\n\nInstructions from: AGENTS.md\n\nCurrent AGENTS rule.\n\n\nInstructions from: CLAUDE.md\n\nCurrent CLAUDE rule.\n\n"}],"source":{"kind":"agent-instructions","form":"instructions","baseline":true,"baselineIdentity":"{\"projectRoot\":\"\",\"projectRootMarkers\":[\".git\"],\"maxBytes\":65536,\"maxSourceBytes\":1048576,\"instructionFileCandidates\":[\"AGENTS.md\",\"CLAUDE.md\"],\"localInstructionFileCandidates\":[\"AGENTS.local.md\",\"CLAUDE.local.md\"]}","changes":[{"action":"set","scope":".\u0000AGENTS.md","path":"AGENTS.md","digest":"7f53d2327837129750aef117f9754a001c46cf68"},{"action":"set","scope":".\u0000CLAUDE.md","path":"CLAUDE.md","digest":"5b1e9e3fd759eee6b43ceff899e47fb10c64701a"}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
-{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable.\n\nApproval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"sandbox:policy","text":"Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable."},{"name":"approval:policy","text":"Approval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
+{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent working directory: \"{{cwd}}\".\n\nCurrent DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable.\n\nApproval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"working-directory:current","text":"Current working directory: \"{{cwd}}\"."},{"name":"sandbox:policy","text":"Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable."},{"name":"approval:policy","text":"Approval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}]},"role":"user","id":"{{sessionId}}"},"surfaceOp":"append"}
{"type":"request/header","data":{"header":{"config":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"tools":"{{tools}}"},"reason":"initial","startsSeries":true}}
{"type":"request/context","data":{"provider":"deepseek-official","model":"deepseek-v4-flash"}}
{"type":"session/title","data":{"title":"Remember the workspace instruction.","messageSeqs":[3],"source":{"kind":"fallback"}}}
diff --git a/apps/cli/tests/profiles/headless/tests/full-loop.e2e.ts b/apps/cli/tests/profiles/headless/tests/full-loop.e2e.ts
index bbacf9dc15..c8051b05ea 100644
--- a/apps/cli/tests/profiles/headless/tests/full-loop.e2e.ts
+++ b/apps/cli/tests/profiles/headless/tests/full-loop.e2e.ts
@@ -29,7 +29,7 @@ describe.skipIf(!process.env.DEEPSEEK_API_KEY)('full loop: real model + real bas
it('runs a bash command on request and reports its output', async () => {
workdir = await mkdtemp(join(tmpdir(), 'dsh-full-loop-e2e-'))
ctx = await codingHarness(workdir, { personaPrefix: SYSTEM_PROMPT })
- const agent = await ctx.agentLoop.create(SessionId('e2e-loop'), { provider: 'deepseek-official', model: 'deepseek-v4-flash' })
+ const agent = await ctx.agentLoop.create(SessionId('e2e-loop'), { provider: 'deepseek-official', model: 'deepseek-v4-flash' }, { cwd: workdir })
agent.followup(createUserMessage({ content: [{ type: 'text', text: 'Run `echo e2e-ok` with the bash tool and tell me its exact output.' }], source: { kind: 'user' } }))
await waitForIdle(ctx, agent)
diff --git a/apps/cli/tests/profiles/headless/tests/harness.ts b/apps/cli/tests/profiles/headless/tests/harness.ts
index c07b4b73fd..cf51dc23a6 100644
--- a/apps/cli/tests/profiles/headless/tests/harness.ts
+++ b/apps/cli/tests/profiles/headless/tests/harness.ts
@@ -66,6 +66,7 @@ export interface CodingHarnessOptions {
export async function codingHarness(workdir: string, options: CodingHarnessOptions = {}): Promise {
const ctx = new Context()
await mountAgentLoopTestDependencies(ctx, {
+ workingDirectory: true,
systemPrompt: { personaPrefix: options.personaPrefix ?? '' },
})
await ctx.plugin(AgentLoop, { agents: [] })
diff --git a/apps/cli/tests/profiles/headless/tests/headless.expected.e2e.ts b/apps/cli/tests/profiles/headless/tests/headless.expected.e2e.ts
index 1c4f3d175e..7a46b1dc89 100644
--- a/apps/cli/tests/profiles/headless/tests/headless.expected.e2e.ts
+++ b/apps/cli/tests/profiles/headless/tests/headless.expected.e2e.ts
@@ -47,11 +47,21 @@ const headlessSessionExpected = join(goldensDir, 'headless-profile', 'session.ex
const headlessReasoningExpected = join(goldensDir, 'headless-profile', 'reasoning.stderr.expected.txt')
const headlessFailureExpected = join(goldensDir, 'headless-profile', 'stderr.expected.txt')
const refreshing = process.env.DSH_SNAPSHOT === 'refresh'
+/** The shipped base bundle's title output cap, which marks a title request's `max_tokens`. */
+const TITLE_MAX_TOKENS = 4096
interface JsonObject {
[key: string]: unknown
}
+/** Framed user text that distinguishes the auxiliary title request from a main request. */
+const TITLE_PROMPT_MARKER = 'Generate the session title from this JSON array of human messages'
+
+/** Whether one recorded request body is the auxiliary title request. */
+function isTitleRequest(request: JsonObject): boolean {
+ return JSON.stringify(request['messages'] ?? null).includes(TITLE_PROMPT_MARKER)
+}
+
interface PersistedLog {
readonly content: string
readonly header: JsonObject
@@ -100,7 +110,7 @@ async function deepseekDefaultsServer(
const write = (): void => {
// One-shot teardown may cancel background title work after the main response.
if (keepAlives-- > 0
- || (options.waitForTitleRequest === true && !requests.some(request => request.max_tokens === 64))) {
+ || (options.waitForTitleRequest === true && !requests.some(isTitleRequest))) {
response.write(': keep-alive\n\n')
timer = setTimeout(write, 60)
return
@@ -258,7 +268,9 @@ describe('headless stream-json snapshots', () => {
const actual = logs[0]
if (actual === undefined) throw new Error('the headless profile did not persist its session')
const context = contextFromLogs([actual.content])
- const session = normalizeSessionSnapshots([actual.content], context)[0]!
+ const session = normalizeSessionSnapshot(actual.content, context)
+ const titleRequest = parseJsonl(session).find(event => event.type === 'session/title-llm-request')
+ expect(titleRequest?.data).toMatchObject({ reasoningEffort: 'off', maxTokens: TITLE_MAX_TOKENS })
if (refreshing) await writeFile(headlessSessionExpected, session)
await expectSessionSnapshot(session, context, headlessSessionExpected)
expect(session).toContain(task)
@@ -610,7 +622,8 @@ describe('headless stream-json snapshots', () => {
expect(server.requests).toHaveLength(2)
expect(server.paths).toEqual(['/v1/messages', '/v1/messages'])
const agentRequest = server.requests.find(request => request.max_tokens === 256_000)
- const titleRequest = server.requests.find(request => request.max_tokens === 64)
+ const titleRequest = server.requests.find(isTitleRequest)
+ expect(titleRequest?.max_tokens).toBe(TITLE_MAX_TOKENS)
expect(agentRequest?.output_config).toEqual({ effort: 'low' })
expect(titleRequest).toBeDefined()
const header = (parseJsonl(result.stdout)
@@ -659,7 +672,10 @@ describe('headless stream-json snapshots', () => {
}
const title = await fetch(server.url, {
method: 'POST',
- body: JSON.stringify({ max_tokens: 64 }),
+ body: JSON.stringify({
+ max_tokens: TITLE_MAX_TOKENS,
+ messages: [{ role: 'user', content: [{ type: 'text', text: TITLE_PROMPT_MARKER }] }],
+ }),
})
for (;;) {
const chunk = await reader.read()
@@ -699,10 +715,10 @@ describe('headless stream-json snapshots', () => {
expect(result.stderr).toBe('')
expect(server.requests).toHaveLength(2)
- const agentRequest = server.requests.find(request => request.max_tokens === 1024)
- const titleRequest = server.requests.find(request => request.max_tokens === 64)
+ const agentRequest = server.requests.find(request => !isTitleRequest(request))
+ const titleRequest = server.requests.find(isTitleRequest)
expect(agentRequest).not.toHaveProperty('max_completion_tokens')
- expect(titleRequest).toBeDefined()
+ expect(titleRequest?.max_tokens).toBe(TITLE_MAX_TOKENS)
const header = (parseJsonl(result.stdout)
.map(record => record.event)
.find((event): event is JsonObject => (
@@ -752,12 +768,12 @@ describe('headless stream-json snapshots', () => {
const parent = logs.find(log => typeof log.header.parentSession !== 'string')
if (parent === undefined) throw new Error('Agent Teams snapshot did not persist its Lead')
const rows = parseJsonl(parent.content)
- const workflowChild = logs.find(log => parseJsonl(log.content).some(row => row.type === 'subagent/descriptor'
- && (row.data as JsonObject).mode === 'one-shot'))
+ const workflowChild = logs.find(log => parseJsonl(log.content).some(row => row.type === 'user/message'
+ && JSON.stringify((row.data as JsonObject).content) === JSON.stringify([{ type: 'text', text: 'TEAM_WORKFLOW_CHILD' }])))
if (workflowChild === undefined) throw new Error('Team profile did not persist its workflow child')
const workflowRows = parseJsonl(workflowChild.content)
expect(workflowRows.find(row => row.type === 'subagent/descriptor')?.data)
- .toMatchObject({ mode: 'one-shot', provider: 'spawn' })
+ .toMatchObject({ mode: 'continuable', provider: 'spawn' })
expect(workflowRows.filter(row => row.type === 'user/message'
&& ((row.data as JsonObject).source as JsonObject).kind === 'user').map(row => row.data))
.toEqual([expect.objectContaining({ content: [{ type: 'text', text: 'TEAM_WORKFLOW_CHILD' }] })])
@@ -958,13 +974,13 @@ describe('headless stream-json snapshots', () => {
await expectHeadlessStream(normalized, streamExpected)
}, LOADER_SMOKE_TEST_TIMEOUT_MS)
- it('delivers a continuable child result without parent polling', async () => {
+ it('notifies the parent when a continuable child settles without polling', async () => {
const parentReplay = join(settlementScenarioDir, 'parent.replay.jsonl')
const parentOverride = join(settlementScenarioDir, 'parent.override.json')
const childReplay = join(settlementScenarioDir, 'child.replay.jsonl')
const childExpected = join(settlementScenarioDir, 'child.expected.jsonl')
const streamExpected = join(settlementScenarioDir, 'stream-json.expected.jsonl')
- const task = 'Start one continuable background subagent and answer from its completion notice. Do not call list_agents, send_message, job_output, or job_list.'
+ const task = 'Start one continuable subagent and acknowledge its completion notice. Do not call list_agents or send_message.'
let runCwd = ''
const result = await runLoaderSmoke({
label: 'continuable settlement headless stream-json snapshot',
@@ -1007,6 +1023,10 @@ describe('headless stream-json snapshots', () => {
})
})
expect(notices).toHaveLength(1)
+ expect(notices[0]).toMatchObject({
+ source: { kind: 'subagent-settled', form: 'notice', senderSessionId: child.header.id },
+ })
+ expect(JSON.stringify(notices[0])).toContain('finished and will do no further work unless you send it more.')
expect(JSON.stringify(notices[0])).toContain('CHILD_RESULT')
const context = contextFromLogs([parent.content, child.content])
@@ -1022,7 +1042,7 @@ describe('headless stream-json snapshots', () => {
const records = parseJsonl(result.stdout)
expect(records.at(-1)).toMatchObject({
type: 'result',
- output: 'PARENT_RECEIVED_CHILD_RESULT',
+ output: 'PARENT_RECEIVED_SETTLEMENT_NOTICE',
})
const normalized = normalizeHeadlessStream(result.stdout, runCwd)
if (refreshing) await writeFile(streamExpected, normalized)
diff --git a/apps/cli/tests/profiles/headless/tests/ptc.e2e.ts b/apps/cli/tests/profiles/headless/tests/ptc.e2e.ts
index 48e8f9fc9f..806f081a77 100644
--- a/apps/cli/tests/profiles/headless/tests/ptc.e2e.ts
+++ b/apps/cli/tests/profiles/headless/tests/ptc.e2e.ts
@@ -3,15 +3,15 @@ import { tmpdir } from 'node:os'
import { join } from 'node:path'
import { afterEach, describe, expect, it, onTestFinished, vi } from 'vitest'
import { Context } from '@deepseek-ai/cordis'
-import LlmRuntime, { createUserMessage, ToolCallId, HarnessError } from '@deepseek-ai/dsh-llm'
+import { createUserMessage, ToolCallId, HarnessError } from '@deepseek-ai/dsh-llm'
import SessionStore, { SessionId } from '@deepseek-ai/dsh-session'
import type { SessionEvent } from '@deepseek-ai/dsh-session'
-import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
-import ToolRuntime, { RUN_CODE_NAME, defineTool } from '@deepseek-ai/dsh-tools'
+import { RUN_CODE_NAME, defineTool } from '@deepseek-ai/dsh-tools'
import type { ToolExecutionResult } from '@deepseek-ai/dsh-tools'
-import AgentRegistry, { type Agent } from '@deepseek-ai/dsh-agent'
+import type { Agent } from '@deepseek-ai/dsh-agent'
import AgentLoop from '@deepseek-ai/dsh-agent-loop'
+import { mountAgentLoopTestDependencies } from '@deepseek-ai/dsh-agent-loop-testkit'
import SessionProjectionRegistry from '@deepseek-ai/dsh-session-projection'
import { LocalBashExecutor } from '@deepseek-ai/dsh-bash-local'
import * as BashEnvPlugin from '@deepseek-ai/dsh-shell-env'
@@ -55,12 +55,11 @@ afterEach(async () => {
async function ptcModeHarness(cwd: string): Promise {
const harness = new Context()
- await harness.plugin(LlmRuntime)
- await harness.plugin(SessionStore)
- await harness.plugin(SessionProjectionRegistry)
- await harness.plugin(SystemPrompt, { personaPrefix: PERSONA })
- await harness.plugin(ToolRuntime, { mode: 'ptc' })
- await harness.plugin(AgentRegistry)
+ await mountAgentLoopTestDependencies(harness, {
+ workingDirectory: true,
+ systemPrompt: { personaPrefix: PERSONA },
+ tools: { mode: 'ptc' },
+ })
await harness.plugin(AgentLoop, { agents: [] })
await harness.plugin(LlmDeepSeek)
if (harness.get('subprocess') === undefined) await harness.plugin(LocalSubprocessRuntime)
@@ -73,13 +72,12 @@ async function ptcModeHarness(cwd: string): Promise {
async function workspacePtcModeHarness(): Promise {
const harness = new Context()
- await harness.plugin(LlmRuntime)
- await harness.plugin(SessionStore)
- await harness.plugin(SessionProjectionRegistry)
- await harness.plugin(SystemPrompt, { personaPrefix: PERSONA })
- await harness.plugin(ToolRuntime, { mode: 'ptc' })
- await harness.plugin(AgentRegistry)
await harness.plugin(LocalFileSystem, { cwd: '/' })
+ await mountAgentLoopTestDependencies(harness, {
+ workingDirectory: true,
+ systemPrompt: { personaPrefix: PERSONA },
+ tools: { mode: 'ptc' },
+ })
await harness.plugin(ToolFs)
await harness.plugin(AgentInstructions, { maxBytes: 65536 })
await harness.plugin(AgentLoop, { agents: [] })
@@ -131,8 +129,7 @@ async function mountRuntime(harness: Context): Promise {
/** Keyless real-process harness for direct typed-binding acceptance tests. */
async function typedPtcModeHarness(): Promise {
const harness = new Context()
- await harness.plugin(SystemPrompt)
- await harness.plugin(ToolRuntime, { mode: 'ptc' })
+ await mountAgentLoopTestDependencies(harness, { workingDirectory: true, tools: { mode: 'ptc' } })
await mountRuntime(harness)
return harness
}
@@ -298,7 +295,8 @@ describe('PTC mode typed values: keyless real-process contracts', () => {
const agent = {
id: SessionId('ptc-cordis'),
session: ctx.sessions.create(SessionId('ptc-cordis'), { meta: { cwd: process.cwd() } }),
- } as unknown as Agent
+ ctx,
+ } as Agent
const value = completion(await runCode(ctx, `
const listed = await tools.cordis_inspect_list({});
@@ -328,7 +326,7 @@ describe.skipIf(!process.env.DEEPSEEK_API_KEY)('PTC mode: real model writes a pr
it('collapses the wire tool list to [run_code], bridges sub-calls, and returns curated output', async () => {
workdir = await mkdtemp(join(tmpdir(), 'dsh-ptc-e2e-'))
ctx = await ptcModeHarness(workdir)
- const agent = await ctx.agentLoop.create(SessionId('e2e-ptc'), { provider: 'deepseek-official', model: 'deepseek-v4-flash' })
+ const agent = await ctx.agentLoop.create(SessionId('e2e-ptc'), { provider: 'deepseek-official', model: 'deepseek-v4-flash' }, { cwd: workdir })
agent.followup(createUserMessage({
content: [{
diff --git a/apps/cli/tests/profiles/headless/tests/subagent-inheritance.expected.e2e.ts b/apps/cli/tests/profiles/headless/tests/subagent-inheritance.expected.e2e.ts
index 4b5970cd9f..52df6db0d9 100644
--- a/apps/cli/tests/profiles/headless/tests/subagent-inheritance.expected.e2e.ts
+++ b/apps/cli/tests/profiles/headless/tests/subagent-inheritance.expected.e2e.ts
@@ -3,7 +3,7 @@
* its child log and confines a real write under a wider deployment default.
*/
-import { readFile, readdir, writeFile } from 'node:fs/promises'
+import { readFile, readdir, realpath, writeFile } from 'node:fs/promises'
import { join } from 'node:path'
import { fileURLToPath } from 'node:url'
import { Context } from '@deepseek-ai/cordis'
@@ -111,8 +111,8 @@ describe('parent-only override inheritance snapshot', () => {
DSH_SNAPSHOT_CHILD_FILES: childReplay,
},
prepare: async (runCwd) => {
- cwd = runCwd
- await seedReadOnlyParent(join(runCwd, '.sessions'), runCwd)
+ cwd = await realpath(runCwd)
+ await seedReadOnlyParent(join(cwd, '.sessions'), cwd)
},
inspect: async (runCwd) => {
// THE physical fact: the child's write never reached the disk. Under
@@ -132,11 +132,12 @@ describe('parent-only override inheritance snapshot', () => {
const childRecords = child.trimEnd().split('\n').map(
line => JSON.parse(line) as Record,
)
- expect(childRecords[1]).toMatchObject({
+ expect(childRecords.find(record => record.type === 'sandbox/mode')).toMatchObject({
type: 'sandbox/mode',
- seq: SessionSeq(0),
data: { mode: 'read-only', source: 'delegation' },
})
+ expect(childRecords.findIndex(record => record.type === 'sandbox/mode'))
+ .toBeLessThan(childRecords.findIndex(record => record.type === 'turn/start'))
const runtimeContexts = (content: string): string[] => content.trimEnd().split('\n').flatMap((line) => {
const record = JSON.parse(line) as {
diff --git a/apps/cli/tests/profiles/headless/tests/todo-write.e2e.ts b/apps/cli/tests/profiles/headless/tests/todo-write.e2e.ts
index 4ff5fef99c..ce688b60bd 100644
--- a/apps/cli/tests/profiles/headless/tests/todo-write.e2e.ts
+++ b/apps/cli/tests/profiles/headless/tests/todo-write.e2e.ts
@@ -27,7 +27,7 @@ describe.skipIf(!process.env.DEEPSEEK_API_KEY)('todo_write: real model records a
it('appends a todo/write event with the model-produced task list', async () => {
workdir = await mkdtemp(join(tmpdir(), 'dsh-todo-write-e2e-'))
ctx = await codingHarness(workdir, { personaPrefix: TODO_SYSTEM_PROMPT })
- const agent = await ctx.agentLoop.create(SessionId('e2e-todo'), { provider: 'deepseek-official', model: 'deepseek-v4-flash' })
+ const agent = await ctx.agentLoop.create(SessionId('e2e-todo'), { provider: 'deepseek-official', model: 'deepseek-v4-flash' }, { cwd: workdir })
agent.followup(createUserMessage({
content: [{ type: 'text', text:
diff --git a/apps/cli/tests/profiles/headless/tests/workspace-context-resume.expected.e2e.ts b/apps/cli/tests/profiles/headless/tests/workspace-context-resume.expected.e2e.ts
index b873ad7d77..aa6da3ad23 100644
--- a/apps/cli/tests/profiles/headless/tests/workspace-context-resume.expected.e2e.ts
+++ b/apps/cli/tests/profiles/headless/tests/workspace-context-resume.expected.e2e.ts
@@ -79,7 +79,6 @@ async function seedVisibleBaseline(
content: file.content,
})), { maxBytes: 65536 })
const config = resolveConfig({
- dshHome: join(cwd, '.dsh'),
maxBytes: 65536,
...options.instructionFileCandidates === undefined
? {}
diff --git a/apps/cli/tests/profiles/headless/workspace-context-resume-snapshot.patch.yml b/apps/cli/tests/profiles/headless/workspace-context-resume-snapshot.patch.yml
index 6507b366d6..42a63474af 100644
--- a/apps/cli/tests/profiles/headless/workspace-context-resume-snapshot.patch.yml
+++ b/apps/cli/tests/profiles/headless/workspace-context-resume-snapshot.patch.yml
@@ -11,7 +11,6 @@
- id: agent-instructions
config:
maxBytes: 65536
- dshHome: !!js process.cwd() + '/.dsh'
- id: session-persistence-jsonl
config:
diff --git a/apps/cli/tests/profiles/official-installer-packed.e2e.ts b/apps/cli/tests/profiles/official-installer-packed.e2e.ts
new file mode 100644
index 0000000000..3062b5c5b8
--- /dev/null
+++ b/apps/cli/tests/profiles/official-installer-packed.e2e.ts
@@ -0,0 +1,199 @@
+/** Install actual packed Official providers through the ordinary manager in a source-independent Web process. */
+import { existsSync, globSync, readdirSync, readFileSync, statSync } from 'node:fs'
+import { readFile, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { createInterface } from 'node:readline'
+import { fileURLToPath } from 'node:url'
+import { execa } from 'execa'
+import yaml from 'js-yaml'
+import { expect, it, onTestFinished } from 'vitest'
+import type { BundleInfo, ChangeResult } from '@deepseek-ai/dsh-plugin-manager'
+import { getDshRuntimeVersion } from '../../../../packages/boot/app-boot/src/plugin-compatibility.ts'
+import { generateOfficialBundleCatalog } from '../../../../scripts/gen-official-bundle-catalog.ts'
+import {
+ REGISTRY_MANIFEST_FILE,
+ createRegistryManifest,
+ hostPlatform,
+ packBundleArtifacts,
+ readReleaseMembers,
+ readWorkspacePackages,
+ selectBundleDependencies,
+ sourceEvidence,
+ startBundleRegistry,
+ verifyBuiltBundles,
+ writeRegistryManifest,
+} from '../../../../scripts/local-bundle-registry.ts'
+import { assertInstalledTree, createPackedInstallation } from './packed-installation.ts'
+
+const root = fileURLToPath(new URL('../../../..', import.meta.url))
+const packages = ['@deepseek-ai/dsh-subagent-claude-code', '@deepseek-ai/dsh-subagent-codex']
+const built = existsSync(join(root, 'apps/cli/lib/bin.js'))
+ && packages.every(name => existsSync(join(root, 'packages/subagent', name.slice('@deepseek-ai/dsh-'.length), 'lib/index.js')))
+
+interface Observation {
+ initial: BundleInfo[]
+ sessionCount: number
+ steps: Array<{
+ name: string
+ install: ChangeResult
+ savedVersion: string
+ installed: BundleInfo
+ providerEnabled: boolean
+ nativeArtifact: boolean
+ localDependency: string
+ presets: Array<{ id: string; broken?: string }>
+ unavailable: ChangeResult
+ unchangedAfterUnavailable: boolean
+ off: ChangeResult
+ disabled: BundleInfo
+ on: ChangeResult
+ enabled: BundleInfo
+ removed: ChangeResult
+ absent: BundleInfo
+ }>
+}
+
+/**
+ * Read the tail of the newest plugin-manager pnpm log, for a failure the child cannot report itself.
+ * @param profile - isolated profile directory.
+ * @returns The last log lines, or a marker when no run logged anything.
+ */
+function pnpmLogTail(profile: string): string {
+ const logs = join(profile, '.plugin-manager', 'logs')
+ const newest = existsSync(logs)
+ ? readdirSync(logs, { withFileTypes: true }).filter(entry => entry.isDirectory())
+ .map(entry => join(logs, entry.name, 'pnpm.log'))
+ .filter(path => existsSync(path))
+ .sort((left, right) => statSync(right).mtimeMs - statSync(left).mtimeMs)[0]
+ : undefined
+ if (newest === undefined) return '--- plugin-manager log: none ---'
+ return `--- ${newest} ---\n${readFileSync(newest, 'utf8').split('\n').slice(-40).join('\n')}`
+}
+
+it.skipIf(!built)('installs the exported registry\'s local closure and switches Official bundles through the generic manager', {
+ // Real packing of two dependency closures, an isolated product installation, and an isolated plugin installation
+ // own this budget; no native model request runs.
+ timeout: 900_000,
+ retry: 0,
+}, async () => {
+ // The product under test is a real source-independent installation that ships neither provider, so both stay
+ // available to the Official catalog and only the local registry can supply them.
+ const fixture = await createPackedInstallation('dsh-official-packed-', [])
+ const { temporary, installation, home, profile, environment } = fixture
+
+ // The registry packs and serves the catalog's own local dependency closure; no checkout link or file: override
+ // stands in for a package the registry should answer.
+ const entries = generateOfficialBundleCatalog(root).map(entry => entry.packageName)
+ const workspace = readWorkspacePackages(root)
+ verifyBuiltBundles({ entries, packages: workspace })
+ const selection = selectBundleDependencies({ entries, packages: workspace, platform: hostPlatform() })
+ const runDirectory = join(temporary, 'registry')
+ const artifacts = await packBundleArtifacts({
+ root, destination: runDirectory, members: selection.members, release: readReleaseMembers(root),
+ })
+ const version = artifacts.find(artifact => artifact.name === packages[0])?.version
+ if (version === undefined) throw new Error('the local registry packed no claude-code provider')
+ for (const name of packages) expect(artifacts.find(artifact => artifact.name === name), name).toMatchObject({ version })
+ await writeRegistryManifest(join(runDirectory, REGISTRY_MANIFEST_FILE), createRegistryManifest({
+ buildId: 'packed-e2e',
+ source: sourceEvidence(root, getDshRuntimeVersion()),
+ entries,
+ workspaceNames: selection.workspaceNames,
+ artifacts,
+ }))
+ const registry = await startBundleRegistry({
+ directory: runDirectory, artifacts, workspaceNames: selection.workspaceNames,
+ })
+ onTestFinished(() => registry.close())
+
+ await writeFile(join(profile, 'package.json'), JSON.stringify({ name: 'packed-official-profile', private: true, dependencies: {},
+ dsh: { profile: { bundles: ['@deepseek-ai/dsh-base', '@deepseek-ai/dsh-web-app'] } },
+ }))
+ // Only the settings a real profile gets. No override, ignore list, or scoped .npmrc may route a package around the
+ // registry, so every dependency of the packed bundles is answered by this run or by its fixed upstream redirect.
+ await writeFile(join(profile, 'pnpm-workspace.yaml'), 'packages:\n - .\n\nnodeLinker: hoisted\nautoInstallPeers: false\n')
+ const userConfig = join(temporary, 'empty.npmrc')
+ await writeFile(userConfig, '')
+ environment.npm_config_userconfig = userConfig
+ const observer = join(temporary, 'official-installer-observer.mjs')
+ await writeFile(observer, await readFile(new URL('./fixtures/official-installer-observer.mjs', import.meta.url), 'utf8'))
+ const patch = join(temporary, 'official-installer.patch.yml')
+ await writeFile(patch, yaml.dump([{ insert: [{ id: 'official-installer-observer', name: observer,
+ config: {
+ registry: registry.url,
+ profile,
+ packages,
+ localDependency: '@deepseek-ai/dsh-brand',
+ nativePackages: {
+ // The Agent SDK publishes a musl variant of its Linux artifact, which is what pnpm installs there.
+ '@deepseek-ai/dsh-subagent-claude-code': `@anthropic-ai/claude-agent-sdk-${process.platform}-${process.arch}${hostPlatform().libc?.[0] === 'musl' ? '-musl' : ''}`,
+ '@deepseek-ai/dsh-subagent-codex': `@openai/codex-${process.platform}-${process.arch}`,
+ },
+ },
+ }] }]))
+ const child = execa(process.execPath, [join(installation, 'node_modules/@deepseek-ai/dsh/lib/bin.js'),
+ 'web', '--patch', patch, '--no-open', '--port', '0'], {
+ cwd: temporary, env: environment, extendEnv: false, reject: false, timeout: 240_000,
+ })
+ if (child.stdout === null) throw new Error('installed Web process has no stdout')
+ const lines = createInterface({ input: child.stdout })
+ // A failure in the body must stay the reported one: teardown asserts only when the body
+ // passed, so a Web process that does not exit cannot replace the real error.
+ let failure: unknown
+ try {
+ const observed = await new Promise((resolveObservation, reject) => {
+ lines.on('line', (line) => {
+ if (!line.startsWith('PACKED_OFFICIAL_RESULT=')) return
+ const report = JSON.parse(line.slice('PACKED_OFFICIAL_RESULT='.length)) as { value?: Observation; error?: string }
+ if (report.error !== undefined) reject(new Error(report.error))
+ else if (report.value !== undefined) resolveObservation(report.value)
+ })
+ void child.then((result) => { reject(new Error(`Web process exited before observation:\n${result.stdout}\n${result.stderr}`)) })
+ })
+ for (const name of packages) expect(observed.initial.find(entry => entry.name === name)).toMatchObject({
+ official: true, availability: 'missing', installed: false, enabled: false, installTarget: { spec: `${name}@${version}`, version },
+ })
+ expect(observed.steps).toHaveLength(packages.length)
+ for (const step of observed.steps) {
+ expect(step.install, JSON.stringify(step.install)).toMatchObject({ application: 'applied', enabled: true, version })
+ expect(step.savedVersion).toBe(version)
+ expect(step.installed).toMatchObject({ official: true, availability: 'profile', enabled: true, installed: true, version })
+ expect(step.installed.rows.filter(row => row.preset !== undefined).map(row => row.preset).sort())
+ .toEqual(['preset-cordis', 'preset-ptc', 'preset-standard'])
+ expect(step.providerEnabled).toBe(true)
+ expect(step.nativeArtifact).toBe(true)
+ // A transitive repository package the closure needs can only have come from this run's artifacts.
+ expect(step.localDependency).toBe(version)
+ expect(step.presets.every(preset => preset.broken === undefined)).toBe(true)
+ expect(step.unavailable).toMatchObject({ application: 'failed', stage: 'install' })
+ expect(step.unchangedAfterUnavailable).toBe(true)
+ expect(step.off).toMatchObject({ application: 'applied' })
+ expect(step.disabled).toMatchObject({ official: true, installed: true, enabled: false })
+ expect(step.on).toMatchObject({ application: 'applied' })
+ expect(step.enabled).toMatchObject({ official: true, installed: true, enabled: true })
+ expect(step.removed, JSON.stringify(step.removed)).toMatchObject({ application: 'applied' })
+ expect(step.absent).toMatchObject({ official: true, availability: 'missing', enabled: false, installed: false })
+ }
+ expect(observed.sessionCount).toBe(0)
+ expect(globSync('sessions/**/*.jsonl*', { cwd: home })).toEqual([])
+ await assertInstalledTree(profile)
+ // The completed run records every package it served, so a failure can be matched to the exact checkout.
+ const record = JSON.parse(await readFile(join(runDirectory, REGISTRY_MANIFEST_FILE), 'utf8')) as { buildId: string; packages: unknown[] }
+ expect(record.buildId).toBe('packed-e2e')
+ expect(record.packages).toHaveLength(selection.members.length)
+ expect(record.packages).toEqual(expect.arrayContaining([expect.objectContaining({ name: packages[0], version })]))
+ } catch (error) {
+ // The manager's own pnpm output names a stalled or refused operation, which the child's stdout cannot show.
+ failure = error instanceof Error ? new Error(`${error.message}\n\n${pnpmLogTail(profile)}`) : error
+ } finally {
+ lines.close()
+ child.kill('SIGTERM')
+ const result = await child
+ if (failure === undefined) {
+ // The installed Web process stops on SIGTERM within its own budget; a timed-out child is a teardown defect.
+ expect(result.timedOut, `${result.stdout}\n${result.stderr}`).toBe(false)
+ expect(result.exitCode === 0 || result.signal === 'SIGTERM', result.stderr).toBe(true)
+ }
+ }
+ if (failure !== undefined) throw failure
+})
diff --git a/apps/cli/tests/profiles/packed-installation.ts b/apps/cli/tests/profiles/packed-installation.ts
new file mode 100644
index 0000000000..6cfcd2ebb0
--- /dev/null
+++ b/apps/cli/tests/profiles/packed-installation.ts
@@ -0,0 +1,190 @@
+/** Pack and install a source-independent product for idle Web-profile integration tests. */
+import { createRequire } from 'node:module'
+import { existsSync, globSync } from 'node:fs'
+import { lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpath, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { dirname, join, relative, resolve, sep } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { execa } from 'execa'
+import yaml from 'js-yaml'
+import { expect, onTestFinished } from 'vitest'
+import { pnpmCommand } from '../../../../scripts/release/process.ts'
+import { packedWorkspaceClosure, type WorkspacePackage } from '../../../../packages/sandbox/sandbox-local/tests/packed-workspace-closure.ts'
+
+const root = fileURLToPath(new URL('../../../..', import.meta.url))
+
+/** Capture workspace dependency links without following their targets. */
+async function workspaceLinks(directories: string[]): Promise> {
+ const links: Record = {}
+ for (const directory of directories) {
+ const modules = join(directory, 'node_modules')
+ links[modules] = existsSync(modules) ? 'directory' : 'absent'
+ if (!existsSync(modules)) continue
+ for (const entry of await readdir(modules, { withFileTypes: true })) {
+ const path = join(modules, entry.name)
+ const paths = entry.name.startsWith('@') && entry.isDirectory()
+ ? (await readdir(path)).map(name => join(path, name)) : [path]
+ for (const dependency of paths) {
+ const stat = await lstat(dependency)
+ links[dependency] = stat.isSymbolicLink() ? await readlink(dependency) : stat.isDirectory() ? 'directory' : 'file'
+ }
+ }
+ }
+ return links
+}
+
+/** Reject workspace links throughout an installed dependency tree.
+ * @param directory - Installation or profile whose links must remain inside its own tree.
+ */
+export async function assertInstalledTree(directory: string): Promise {
+ const installedRoot = await realpath(directory)
+ const visited = new Set()
+ const visit = async (path: string): Promise => {
+ const resolved = await realpath(path)
+ expect(resolved === installedRoot || resolved.startsWith(installedRoot + sep), `${path} escapes its installation`).toBe(true)
+ if (visited.has(resolved)) return
+ visited.add(resolved)
+ for (const entry of await readdir(path, { withFileTypes: true })) {
+ const child = join(path, entry.name)
+ if (entry.isSymbolicLink()) {
+ // Removed packages can leave dangling .bin shims; those links must also stay inside the profile.
+ const target = existsSync(child) ? await realpath(child) : resolve(dirname(child), await readlink(child))
+ expect(target.startsWith(installedRoot + sep), `${child} escapes its installation`).toBe(true)
+ } else if (entry.isDirectory()) await visit(child)
+ }
+ }
+ await visit(directory)
+}
+
+/** Actual tarballs and an isolated installed CLI, with an initially empty Web profile. */
+export interface PackedInstallation {
+ temporary: string
+ installation: string
+ home: string
+ profile: string
+ archives: string
+ environment: NodeJS.ProcessEnv
+ tarballs: Map
+ members: Map
+ externalVersions: Record
+ packageCommand: (args: string[], cwd: string) => Promise<{ stdout: string; stderr: string }>
+}
+
+/** Build the packed product closure and additional packages without changing workspace dependency links.
+ * Native confinement and Session-writing operations are outside this idle-profile fixture.
+ * @param temporaryPrefix - Unique temporary-directory prefix identifying the owning test.
+ * @param extraPackages - Additional workspace packages to pack without installing in the product.
+ * @returns Isolated installation paths, tarballs, environment, and checked pnpm invocation.
+ */
+export async function createPackedInstallation(temporaryPrefix: string, extraPackages: readonly string[]): Promise {
+ const temporary = await realpath(await mkdtemp(join(tmpdir(), temporaryPrefix)))
+ onTestFinished(() => rm(temporary, { recursive: true, force: true }))
+ const installation = join(temporary, 'installation')
+ const home = join(temporary, 'home')
+ const profile = join(home, 'profiles', 'web')
+ const archives = join(temporary, 'archives')
+ await mkdir(profile, { recursive: true })
+ await mkdir(archives)
+ const environment: NodeJS.ProcessEnv = Object.fromEntries(Object.entries(process.env).filter(([key]) => (
+ !/KEY|SECRET|TOKEN|PASSWORD/.test(key) && key !== 'NODE_OPTIONS' && key !== 'NODE_PATH'
+ )))
+ Object.assign(environment, {
+ DSH_HOME: home,
+ DSH_AGENTS_HOME: join(temporary, 'agents'),
+ DSH_TELEMETRY_DISABLED: '1',
+ CI: 'true',
+ })
+ const [pnpm, ...prefix] = pnpmCommand()
+ const packageCommand = async (args: string[], cwd: string) => {
+ const result = await execa(pnpm, [...prefix, ...args], {
+ cwd, env: environment, extendEnv: false, timeout: 180_000, reject: false,
+ })
+ expect(result.timedOut, `${result.stdout}\n${result.stderr}`).toBe(false)
+ expect(result.signal, result.stderr).toBeUndefined()
+ expect(result.exitCode, `${result.stdout}\n${result.stderr}`).toBe(0)
+ return result
+ }
+ const packages = new Map()
+ for (const path of globSync([
+ 'apps/*/package.json', 'packages/*/*/package.json', 'vendor/*/package.json', 'native/system/packages/*/package.json',
+ ], { cwd: root })) {
+ const manifest = JSON.parse(await readFile(join(root, path), 'utf8')) as Record
+ if (typeof manifest.name !== 'string') throw new Error(`${path} has no package name`)
+ packages.set(manifest.name, { name: manifest.name, manifest, directory: dirname(join(root, path)) })
+ }
+ const sourceDirectories = [root, ...[...packages.values()].map(member => member.directory)]
+ const initialLinks = await workspaceLinks(sourceDirectories)
+ onTestFinished(async () => { expect(await workspaceLinks(sourceDirectories)).toEqual(initialLinks) })
+ const closure = packedWorkspaceClosure('@deepseek-ai/dsh', packages)
+ // These idle-profile tests create no Session or confined process. The native
+ // platform packages load lazily for those operations and have separate smokes.
+ const supportsIdleProfile = (member: WorkspacePackage) => (
+ !member.name.startsWith('@deepseek-ai/node-addon-system-')
+ && (!Array.isArray(member.manifest.os) || member.manifest.os.includes(process.platform))
+ && (!Array.isArray(member.manifest.cpu) || member.manifest.cpu.includes(process.arch))
+ )
+ const runtimeMembers = closure.filter(supportsIdleProfile)
+ const members = new Map(runtimeMembers.map(member => [member.name, member]))
+ for (const name of extraPackages) {
+ for (const member of packedWorkspaceClosure(name, packages).filter(supportsIdleProfile)) members.set(member.name, member)
+ }
+ // Packing reads package-owned files; installation never runs in the workspace.
+ await packageCommand([
+ 'pack', '--recursive', '--workspace-concurrency=4',
+ ...[...members.keys()].map(name => `--filter=${name}`), '--pack-destination', archives,
+ ], root)
+ const tarballs = new Map([...members.values()].map((member) => {
+ if (typeof member.manifest.version !== 'string') throw new Error(`${member.name} has no version`)
+ const name = member.name.replaceAll('/', '-').replace('@', '')
+ const archive = join(archives, `${name}-${member.manifest.version}.tgz`)
+ expect(existsSync(archive), `missing packed payload for ${member.name}`).toBe(true)
+ return [member.name, archive]
+ }))
+ const workspaceSettings = yaml.load(await readFile(join(root, 'pnpm-workspace.yaml'), 'utf8')) as {
+ allowBuilds: Record
+ patchedDependencies: Record
+ minimumReleaseAgeExclude: string[]
+ overrides: Record
+ }
+ const externalVersions: Record = {}
+ for (const member of members.values()) {
+ const require = createRequire(join(member.directory, 'package.json'))
+ for (const section of ['dependencies', 'optionalDependencies', 'peerDependencies']) {
+ const dependencies = member.manifest[section] as Record | undefined
+ for (const [name, range] of Object.entries(dependencies ?? {})) {
+ if (range.startsWith('workspace:')) continue
+ const manifest = require.resolve.paths(name)?.map(path => join(path, name, 'package.json')).find(path => existsSync(path))
+ if (manifest === undefined) continue
+ const installed = JSON.parse(await readFile(manifest, 'utf8')) as { version: string }
+ externalVersions[`${name}@${range}`] = installed.version
+ }
+ }
+ }
+ await mkdir(installation)
+ for (const path of Object.values(workspaceSettings.patchedDependencies)) {
+ await mkdir(dirname(join(installation, path)), { recursive: true })
+ await writeFile(join(installation, path), await readFile(join(root, path)))
+ }
+ await writeFile(join(installation, 'package.json'), JSON.stringify({
+ name: 'packed-product-installation', private: true,
+ dependencies: Object.fromEntries(runtimeMembers.map(member => [member.name, `file:${tarballs.get(member.name)!}`])),
+ }))
+ await writeFile(join(installation, 'pnpm-workspace.yaml'), yaml.dump({
+ packages: ['.'], nodeLinker: 'hoisted', autoInstallPeers: false, allowUnusedPatches: true,
+ ignoredOptionalDependencies: closure.filter(member => !members.has(member.name)).map(member => member.name),
+ allowBuilds: {
+ ...workspaceSettings.allowBuilds,
+ [`@deepseek-ai/dsh-subprocess-local@file:${relative(installation, tarballs.get('@deepseek-ai/dsh-subprocess-local')!).split(sep).join('/')}`]: true,
+ },
+ patchedDependencies: workspaceSettings.patchedDependencies,
+ minimumReleaseAgeExclude: workspaceSettings.minimumReleaseAgeExclude,
+ overrides: {
+ ...workspaceSettings.overrides,
+ ...externalVersions,
+ ...Object.fromEntries(runtimeMembers.map(member => [member.name, `file:${tarballs.get(member.name)!}`])),
+ },
+ }))
+ await packageCommand(['install', '--prefer-offline', '--no-frozen-lockfile'], installation)
+ await assertInstalledTree(installation)
+ return { temporary, installation, home, profile, archives, environment, tarballs, members, externalVersions, packageCommand }
+}
diff --git a/apps/cli/tests/profiles/sdk/dynamic-tool-cache.e2e.ts b/apps/cli/tests/profiles/sdk/dynamic-tool-cache.e2e.ts
index e90f5b4b54..3bdc2e1cc5 100644
--- a/apps/cli/tests/profiles/sdk/dynamic-tool-cache.e2e.ts
+++ b/apps/cli/tests/profiles/sdk/dynamic-tool-cache.e2e.ts
@@ -40,6 +40,35 @@ function totalInput(usage: TokenUsage): number {
return usage.inputTokens + (usage.cacheReadTokens ?? 0) + (usage.cacheWriteTokens ?? 0)
}
+/** Tool calls the fixture recorded, in execution order. */
+async function recordedCalls(path: string): Promise {
+ return (await readFile(path, 'utf8')).trim().split('\n')
+}
+
+/**
+ * Assert the model called `earlier` and then `later`. The model owns its plan beyond the required
+ * calls, so extra add/remove cycles it chooses to make are legitimate and are not counted here.
+ */
+function expectCalledBefore(calls: string[], earlier: string, later: string): void {
+ const earlierIndex = calls.indexOf(earlier)
+ expect(earlierIndex, `${earlier} was never called`).toBeGreaterThanOrEqual(0)
+ const laterIndex = calls.indexOf(later, earlierIndex + 1)
+ expect(laterIndex, `${later} was never called after ${earlier}`).toBeGreaterThan(earlierIndex)
+}
+
+/**
+ * Net tool-registry change between two consecutive requests, matching how the agent loop derives
+ * a `developer/message` from the difference between the current and previous request headers.
+ */
+function registryChanges(previous: ObservedRequest, request: ObservedRequest): { type: string; toolName: string }[] {
+ const before = new Set(previous.body.tools?.map(tool => tool.name))
+ const after = new Set(request.body.tools?.map(tool => tool.name))
+ return [
+ ...[...after].filter(name => !before.has(name)).map(toolName => ({ type: 'tool-addition', toolName })),
+ ...[...before].filter(name => !after.has(name)).map(toolName => ({ type: 'tool-removal', toolName })),
+ ]
+}
+
describe.skipIf(!process.env.DEEPSEEK_API_KEY)('SDK native tool updates with real DeepSeek', () => {
it.each([false, true])('keeps the preceding conversation cached after a tool addition (prompt update: %s)', { retry: 0 }, async (updatePrompt) => {
const root = await mkdtemp(join(tmpdir(), 'dsh-sdk-tool-cache-'))
@@ -80,9 +109,10 @@ describe.skipIf(!process.env.DEEPSEEK_API_KEY)('SDK native tool updates with rea
await run(`Keep these reference records. Do not call tools. Reply READY.\n${records}`)
await run('Keep the reference records. Do not call tools. Reply READY.')
expect(await run(`Use cache_tool_control with action add. After it returns, call ${sampleTool} exactly once and report the generated sample label. This is synthetic example data for this run. Call these separately in order.`)).toContain(sampleLabel)
- expect(await readFile(callsPath, 'utf8')).toBe('add\nsample\n')
- expect(await run('Use cache_tool_control with action remove. After it returns, reply REMOVED and do not call the sample tool.')).toContain('REMOVED')
- expect(await readFile(callsPath, 'utf8')).toBe('add\nsample\nremove\n')
+ expectCalledBefore(await recordedCalls(callsPath), 'add', 'sample')
+ expect(await run('Use cache_tool_control with action remove. Whether it removes the sample tool or reports that it is not registered, reply REMOVED and do not call the sample tool.')).toContain('REMOVED')
+ const calls = await recordedCalls(callsPath)
+ expectCalledBefore(calls, 'sample', 'remove')
const requests = (await readFile(evidencePath, 'utf8')).trim().split('\n').map(line => JSON.parse(line) as ObservedRequest)
expect(events.filter(event => event.type === 'assistant/attempt')).toHaveLength(0)
@@ -113,9 +143,15 @@ describe.skipIf(!process.env.DEEPSEEK_API_KEY)('SDK native tool updates with rea
expect(added.body.messages.flatMap(message => message.content)).toContainEqual({ type: 'tool_addition', tool: { type: 'tool_reference', name: sampleTool } })
expect(removed.body.tools?.map(tool => tool.name)).toEqual(['cache_tool_control'])
expect(removed.body.messages.flatMap(message => message.content).some(block => block.type === 'tool_addition')).toBe(false)
- expect(events.filter(event => event.type === 'developer/message').map(event => event.data.message.content)).toEqual([
- [{ type: 'tool-addition', toolName: sampleTool }],
- [{ type: 'tool-removal', toolName: sampleTool }],
- ])
+ // Transcript registry history is derived from the tool lists the provider saw, not from call
+ // counts: a model-chosen extra add/remove cycle changes both sides or neither.
+ const expectedRegistryHistory = requests.slice(1).flatMap((request, index) => {
+ const previous = requests[index]
+ if (previous === undefined) throw new Error('Missing preceding request')
+ const content = registryChanges(previous, request)
+ return content.length > 0 ? [content] : []
+ })
+ expect(events.filter(event => event.type === 'developer/message').map(event => event.data.message.content))
+ .toEqual(expectedRegistryHistory)
})
})
diff --git a/apps/cli/tests/profiles/sdk/fixtures/subagent-dsh-sdk-release-on-job-output.ts b/apps/cli/tests/profiles/sdk/fixtures/subagent-dsh-sdk-release-on-job-output.ts
deleted file mode 100644
index 554f62dcb1..0000000000
--- a/apps/cli/tests/profiles/sdk/fixtures/subagent-dsh-sdk-release-on-job-output.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-/** Release the gated background SDK child only after job_output starts waiting. */
-
-import { writeFileSync } from 'node:fs'
-import type { Context } from '@deepseek-ai/cordis'
-
-export const name = 'subagent-dsh-sdk-release-on-job-output'
-export const inject = ['tools']
-
-/**
- * Register the test-only execution-order barrier.
- * @param ctx - parent runtime context carrying the tool execution waterfall.
- */
-export function apply(ctx: Context): void {
- ctx.on('tools/execute', async (exec, next) => {
- const delegated = next()
- if (exec.name === 'job_output') {
- writeFileSync('.dsh-sdk-background-release', 'release\n')
- }
- return delegated
- }, { prepend: true })
-}
diff --git a/apps/cli/tests/profiles/sdk/keyless-smoke.e2e.ts b/apps/cli/tests/profiles/sdk/keyless-smoke.e2e.ts
index 56dec2af4b..64c1c20ab3 100644
--- a/apps/cli/tests/profiles/sdk/keyless-smoke.e2e.ts
+++ b/apps/cli/tests/profiles/sdk/keyless-smoke.e2e.ts
@@ -303,6 +303,7 @@ describe('Python SDK dsh profile keyless smoke', () => {
expect(tools.map(tool => tool.name)).toEqual([
process.platform === 'win32' ? 'pwsh' : 'bash',
...(editorEnabled ? ['str_replace_editor'] : []),
+ 'working_directory',
])
expect(modelRequests).toHaveLength(editorEnabled ? 3 : 1)
if (editorEnabled) {
diff --git a/apps/cli/tests/profiles/sdk/office-cli.e2e.ts b/apps/cli/tests/profiles/sdk/office-cli.e2e.ts
index cc851efd23..d94a88a304 100644
--- a/apps/cli/tests/profiles/sdk/office-cli.e2e.ts
+++ b/apps/cli/tests/profiles/sdk/office-cli.e2e.ts
@@ -108,7 +108,7 @@ it.skipIf(!process.env.DEEPSEEK_API_KEY || process.platform === 'win32')(`agent
expect(existsSync(decoyMarker), 'the agent must not invoke system Office when the bundled CLI is supplied').toBe(false)
expect(commandText, 'the skill supplies an entry; searching for other Office binaries is unnecessary').not.toMatch(/(?:which|whereis|command -v|find).{0,100}(?:libreoffice|soffice)/iu)
const capabilities = JSON.parse(await readFile(join(root, 'capabilities.json'), 'utf8')) as { runtime: { version: string; cliPath: string } }
- expect(capabilities.runtime.version).toBe('0.1.1')
+ expect(capabilities.runtime.version).toBe('0.1.5')
expect(capabilities.runtime.cliPath).toMatch(/lib[/\\]cli\.js$/u)
const pdf = await readFile(join(root, 'result.pdf'))
expect(pdf.subarray(0, 5).toString()).toBe('%PDF-')
diff --git a/apps/cli/tests/profiles/web/tests/public-url.expected.e2e.ts b/apps/cli/tests/profiles/web/tests/public-url.expected.e2e.ts
new file mode 100644
index 0000000000..5ed381e1d0
--- /dev/null
+++ b/apps/cli/tests/profiles/web/tests/public-url.expected.e2e.ts
@@ -0,0 +1,221 @@
+/** Built Web-profile acceptance for the advertised public root and browser authentication behind a prefix-stripping proxy. */
+
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { request as httpRequest, type IncomingMessage } from 'node:http'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { createInterface } from 'node:readline'
+import { Readable } from 'node:stream'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+import { execa } from 'execa'
+import { describe, expect, it } from 'vitest'
+import { startPrefixProxy } from '../../../../../../apps/web/tests/prefix-proxy.ts'
+import { PROCESS_SHUTDOWN_TIMEOUT_MS } from '../../../../src/process-shutdown.ts'
+
+const repoRoot = fileURLToPath(new URL('../../../../../../', import.meta.url))
+const dshBin = join(repoRoot, 'apps/cli/lib/bin.js')
+const builtArtifactsExist = existsSync(dshBin)
+
+/** Browser-facing mount the reference proxy serves and strips. */
+const MOUNT = '/tools/dsh/'
+
+/** One live Web child, as `execa` types it. */
+type WebChild = ReturnType
+
+/** Settled result of a stopped child, carrying the stderr a case asserts on. */
+type StoppedWeb = Awaited
+
+/** Start one keyless Web process with an outer lifetime deadline. */
+function spawnWeb(root: string, patch: string, interrupt: string, flags: string[]) {
+ return execa(process.execPath, [
+ dshBin,
+ '--profile', 'web',
+ '--patch', patch,
+ '--no-open',
+ '--port', '0',
+ ...flags,
+ ], {
+ cwd: root,
+ env: {
+ ...process.env,
+ DEEPSEEK_API_KEY: 'keyless-web-public-url-no-call',
+ DSH_AGENTS_HOME: join(root, '.agents'),
+ DSH_HOME: join(root, 'home'),
+ DSH_TELEMETRY_DISABLED: '1',
+ NODE_NO_WARNINGS: '1',
+ WEB_INTERRUPT_FILE: interrupt,
+ },
+ input: '',
+ reject: false,
+ timeout: 90_000,
+ killSignal: 'SIGKILL',
+ })
+}
+
+/** One booted Web process: its child, bound port, printed startup URL, and bounded stop. */
+interface RunningWeb {
+ child: WebChild
+ port: number
+ startup: URL
+ /** Stop the child within the shutdown deadline; every caller shares the one settlement. */
+ stop(): Promise
+}
+
+/**
+ * Boot the built CLI and wait for its `dsh web:` line and bound listener port.
+ * The marker plugin also polls for the interrupt file and emits `SIGTERM` on
+ * the child's own process, because Windows has no deliverable SIGTERM.
+ */
+async function bootWeb(root: string, flags: string[]): Promise {
+ const marker = join(root, 'listen-port.mjs')
+ const interrupt = join(root, 'interrupt')
+ writeFileSync(marker, [
+ "import { existsSync } from 'node:fs'",
+ "export const name = 'public-url-listen-port'",
+ "export const inject = ['webServer']",
+ 'export function apply(ctx) {',
+ " console.log('public-url-listen-port: ' + ctx.webServer.port)",
+ ' const heartbeat = setInterval(() => {',
+ ' if (!existsSync(process.env.WEB_INTERRUPT_FILE)) return',
+ ' clearInterval(heartbeat)',
+ " process.emit('SIGTERM')",
+ ' }, 20)',
+ ' ctx.effect(() => () => { clearInterval(heartbeat) })',
+ '}',
+ '',
+ ].join('\n'))
+ const patch = join(root, 'extra.yml')
+ writeFileSync(patch, `- insert:\n - name: ${JSON.stringify(pathToFileURL(marker).href)}\n`)
+ const child = spawnWeb(root, patch, interrupt, flags)
+ const lines = createInterface({ input: child.stdout })
+ const ready = Promise.withResolvers()
+ let stopping: Promise | undefined
+ let port: number | undefined
+ let startup: URL | undefined
+ const announced = (): void => {
+ if (port === undefined || startup === undefined) return
+ ready.resolve({ child, port, startup, stop: () => stopping ??= stop(child, interrupt) })
+ }
+ lines.on('line', (line) => {
+ if (line.startsWith('public-url-listen-port: ')) port = Number(line.slice('public-url-listen-port: '.length))
+ if (line.startsWith('dsh web: http')) startup = new URL(line.slice('dsh web: '.length))
+ announced()
+ })
+ void child.then((result) => {
+ ready.reject(new Error(`Web exited before readiness (code ${String(result.exitCode)})\n${result.stderr}`))
+ })
+ let deadline: NodeJS.Timeout | undefined
+ const expired = new Promise((_resolve, reject) => {
+ deadline = setTimeout(() => { reject(new Error('Web profile did not print its URL line and bound port')) }, 60_000)
+ })
+ try {
+ return await Promise.race([ready.promise, expired])
+ } catch (error) {
+ child.kill('SIGKILL')
+ await child
+ throw error
+ } finally {
+ clearTimeout(deadline)
+ lines.close()
+ }
+}
+
+/** Boot one Web process in a private root, run `scenario`, then always stop it and remove the root. */
+async function withWeb(flags: string[], scenario: (web: RunningWeb) => Promise): Promise {
+ const root = mkdtempSync(join(tmpdir(), 'dsh-web-public-url-'))
+ let web: RunningWeb | undefined
+ try {
+ web = await bootWeb(root, flags)
+ await scenario(web)
+ } finally {
+ try {
+ if (web !== undefined) await web.stop()
+ } finally {
+ rmSync(root, { recursive: true, force: true })
+ }
+ }
+}
+
+/** Ask the child to shut down through its interrupt marker within a bounded grace period, then force-kill it. */
+async function stop(child: WebChild, interrupt: string) {
+ writeFileSync(interrupt, '')
+ const deadline = setTimeout(() => { child.kill('SIGKILL') }, PROCESS_SHUTDOWN_TIMEOUT_MS * 2)
+ try {
+ return await child
+ } finally {
+ clearTimeout(deadline)
+ }
+}
+
+/** Assert the child reached its own clean exit rather than the fixture's deadline. */
+function expectCleanExit(stopped: StoppedWeb): void {
+ expect(stopped.timedOut, stopped.stderr).toBe(false)
+ expect(stopped.signal, stopped.stderr).toBeUndefined()
+ expect(stopped.exitCode, stopped.stderr).toBe(0)
+}
+
+/**
+ * One HTTP request that connects to an explicit transport address while
+ * presenting an explicit browser-facing authority, as a proxy would.
+ */
+async function request(
+ dial: string, port: number, path: string, host: string, method: 'GET' | 'POST', cookie?: string,
+): Promise {
+ const { promise, resolve, reject } = Promise.withResolvers()
+ const req = httpRequest({
+ host: dial, port, path, method,
+ headers: { host, 'content-type': 'application/json', ...cookie === undefined ? {} : { cookie } },
+ }, resolve)
+ req.once('error', reject)
+ req.setTimeout(10_000, () => { req.destroy(new Error('HTTP request timed out')) })
+ req.end(method === 'POST'
+ ? JSON.stringify({ type: 'client-request', rpcId: 'public-url', method: 'session/create', payload: { args: { request: {} } } })
+ : undefined)
+ const response = await promise
+ const headers = new Headers()
+ for (let i = 0; i < response.rawHeaders.length; i += 2) {
+ headers.append(response.rawHeaders[i]!, response.rawHeaders[i + 1]!)
+ }
+ return new Response(Readable.toWeb(response) as ReadableStream, { status: response.statusCode!, headers })
+}
+
+/** Establish the browser session needed by the protected API, keeping the minted cookie's own attributes. */
+async function exchange(
+ dial: string, port: number, path: string, host: string,
+): Promise<{ cookie: string; setCookie: string }> {
+ const response = await request(dial, port, path, host, 'GET')
+ const setCookie = response.headers.get('set-cookie')
+ await response.arrayBuffer()
+ if (setCookie === null) throw new Error(`entry returned ${String(response.status)} without a browser cookie`)
+ return { cookie: setCookie.split(';', 1)[0]!, setCookie }
+}
+
+describe.skipIf(!builtArtifactsExist)('dsh Web profile advertised public root', () => {
+ it('serves authenticated requests at the advertised mount and at loopback', async () => {
+ await withWeb(['--public-url', `http://gateway.example${MOUNT.slice(0, -1)}`, '--trusted-host', 'gateway.example'], async (web) => {
+ expect(web.startup.origin).toBe('http://gateway.example')
+ expect(web.startup.pathname).toBe(MOUNT)
+ expect(web.startup.searchParams.get('token')).not.toBeNull()
+ const proxy = await startPrefixProxy({ prefix: MOUNT })
+ try {
+ proxy.setTarget(web.port)
+ const entries = [
+ { dial: '127.0.0.1', port: proxy.port, prefix: MOUNT, host: web.startup.host },
+ { dial: '127.0.0.1', port: web.port, prefix: '/', host: `127.0.0.1:${String(web.port)}` },
+ ]
+ for (const entry of entries) {
+ const { cookie } = await exchange(entry.dial, entry.port, `${entry.prefix}${web.startup.search}`, entry.host)
+ const response = await request(entry.dial, entry.port, `${entry.prefix}api/session/create`, entry.host, 'POST', cookie)
+ expect(response.status).toBe(200)
+ expect(await response.json()).toMatchObject({ result: { ok: true } })
+ }
+ const foreign = await request('127.0.0.1', proxy.port, `${MOUNT}api/session/create`, 'evil.example', 'POST')
+ expect(foreign.status).toBe(403)
+ await foreign.arrayBuffer()
+ } finally {
+ await proxy.close()
+ }
+ expectCleanExit(await web.stop())
+ })
+ })
+})
diff --git a/apps/cli/tests/profiles/web/tests/runtime-roster-isolation.spec.ts b/apps/cli/tests/profiles/web/tests/runtime-roster-isolation.spec.ts
new file mode 100644
index 0000000000..06f0c67f86
--- /dev/null
+++ b/apps/cli/tests/profiles/web/tests/runtime-roster-isolation.spec.ts
@@ -0,0 +1,38 @@
+/** Runtime evidence keeps retained experimental names visible through installed aliases. */
+
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { expect, it, onTestFinished } from 'vitest'
+import { EXPERIMENTAL_PACKAGE_NAME_EXCEPTIONS } from '../../../../../../scripts/experimental-package-policy.ts'
+import { experimentalRuntimeReferences } from './runtime-roster-isolation.ts'
+import type { RuntimeRoster } from './runtime-roster.ts'
+
+it.each(Object.values(EXPERIMENTAL_PACKAGE_NAME_EXCEPTIONS))('finds retained experimental package %s in real roster fields', (name) => {
+ const root = mkdtempSync(join(tmpdir(), 'dsh-runtime-roster-policy-'))
+ onTestFinished(() => { rmSync(root, { recursive: true, force: true }) })
+ const directory = join(root, 'node_modules/ordinary-alias')
+ mkdirSync(directory, { recursive: true })
+ writeFileSync(join(directory, 'package.json'), JSON.stringify({ name }))
+ const module = pathToFileURL(join(directory, 'index.js')).href
+ const subpath = `${name}/client`
+ const external = `${name}/external`
+ const injected = `${name}/injected`
+ const batched = `${name}/batch`
+ const roster: RuntimeRoster = {
+ entries: [{ id: 'entry', name, state: 1 }],
+ plugins: [{ name: 'plugin', owner: subpath, state: 1, modules: [module] }],
+ modules: [module],
+ client: {
+ rev: 'fixture',
+ entries: [{ id: 'ordinary-client', url: '/client.js', rev: 'fixture', inject: [injected], external: [external] }],
+ batches: [{ phase: 'application', url: '/batch.js', rev: 'fixture', entries: [batched] }],
+ },
+ }
+ expect(experimentalRuntimeReferences(roster)).toEqual([name, subpath, module, external, injected, batched].sort())
+ writeFileSync(join(directory, 'package.json'), JSON.stringify({ name: `${name}-unrelated` }))
+ expect(experimentalRuntimeReferences({
+ entries: [], plugins: [], modules: [module], client: { rev: 'fixture', entries: [], batches: [] },
+ })).toEqual([])
+})
diff --git a/apps/cli/tests/profiles/web/tests/runtime-roster-isolation.ts b/apps/cli/tests/profiles/web/tests/runtime-roster-isolation.ts
new file mode 100644
index 0000000000..a79e358c2b
--- /dev/null
+++ b/apps/cli/tests/profiles/web/tests/runtime-roster-isolation.ts
@@ -0,0 +1,24 @@
+/** Experimental identity checks over independently observed built Web runtime records. */
+
+import { fileURLToPath } from 'node:url'
+import { hasExperimentalPackageReference, isExperimentalPackageName } from '../../../../../../scripts/experimental-package-policy.ts'
+import { modulePackage } from './runtime-roster.ts'
+import type { RuntimeRoster } from './runtime-roster.ts'
+
+/**
+ * Locate experimental package identities and experimental source/artifact paths in runtime evidence.
+ * @param roster - independently collected Web runtime records.
+ * @returns diagnostic evidence for every forbidden package reference.
+ */
+export function experimentalRuntimeReferences(roster: RuntimeRoster): string[] {
+ const references = new Set([
+ ...roster.entries.map(entry => entry.name),
+ ...roster.plugins.flatMap(plugin => [plugin.owner ?? '', ...plugin.modules]),
+ ...roster.modules,
+ ...roster.client.entries.flatMap(entry => [entry.id, ...entry.inject ?? [], ...entry.external ?? []]),
+ ...roster.client.batches.flatMap(batch => batch.entries),
+ ])
+ return [...references].filter(reference => hasExperimentalPackageReference(reference)
+ || (reference.startsWith('file:') && (fileURLToPath(reference).replaceAll('\\', '/').includes('/packages/experimental/')
+ || isExperimentalPackageName(modulePackage(reference) ?? '')))).sort()
+}
diff --git a/apps/cli/tests/profiles/web/tests/runtime-roster.ts b/apps/cli/tests/profiles/web/tests/runtime-roster.ts
index f6156fd1da..4e48203d03 100644
--- a/apps/cli/tests/profiles/web/tests/runtime-roster.ts
+++ b/apps/cli/tests/profiles/web/tests/runtime-roster.ts
@@ -75,21 +75,3 @@ export function runtimeRoster(ctx: Context): RuntimeRoster {
client: ctx.clientModules.graph(),
}
}
-
-/**
- * Locate experimental package identities and experimental source/artifact paths in runtime evidence.
- * @param roster - independently collected Web runtime records.
- * @returns diagnostic evidence for every forbidden package reference.
- */
-export function experimentalRuntimeReferences(roster: RuntimeRoster): string[] {
- const references = new Set([
- ...roster.entries.map(entry => entry.name),
- ...roster.plugins.flatMap(plugin => [plugin.owner ?? '', ...plugin.modules]),
- ...roster.modules,
- ...roster.client.entries.flatMap(entry => [entry.id, ...entry.inject ?? [], ...entry.external ?? []]),
- ...roster.client.batches.flatMap(batch => batch.entries),
- ])
- return [...references].filter(reference => reference.includes('@deepseek-ai/dsh-experimental-')
- || (reference.startsWith('file:') && (fileURLToPath(reference).replaceAll('\\', '/').includes('/packages/experimental/')
- || modulePackage(reference)?.startsWith('@deepseek-ai/dsh-experimental-')))).sort()
-}
diff --git a/apps/cli/tests/profiles/web/tests/web-default-isolation.expected.e2e.ts b/apps/cli/tests/profiles/web/tests/web-default-isolation.expected.e2e.ts
index ef0f10cc1d..7563a323aa 100644
--- a/apps/cli/tests/profiles/web/tests/web-default-isolation.expected.e2e.ts
+++ b/apps/cli/tests/profiles/web/tests/web-default-isolation.expected.e2e.ts
@@ -3,7 +3,8 @@
import { FiberState } from '@deepseek-ai/cordis'
import type { WebBootGraph } from '@deepseek-ai/dsh-client-modules/client'
import { expect, it } from 'vitest'
-import { experimentalRuntimeReferences, modulePackage } from './runtime-roster.ts'
+import { modulePackage } from './runtime-roster.ts'
+import { experimentalRuntimeReferences } from './runtime-roster-isolation.ts'
import { withDefaultWeb, webGet } from './default-web-process.ts'
const experimentalName = '@deepseek-ai/dsh-experimental-client-ui-agent-team'
diff --git a/apps/cli/tests/profiles/webhook-packed.e2e.ts b/apps/cli/tests/profiles/webhook-packed.e2e.ts
new file mode 100644
index 0000000000..3844ceb22b
--- /dev/null
+++ b/apps/cli/tests/profiles/webhook-packed.e2e.ts
@@ -0,0 +1,104 @@
+/** Exercise the published webhook example from an isolated installed Web profile. */
+import { createHmac } from 'node:crypto'
+import { existsSync, globSync } from 'node:fs'
+import { readFile, writeFile } from 'node:fs/promises'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { execa } from 'execa'
+import yaml from 'js-yaml'
+import { expect, it } from 'vitest'
+import { assertInstalledTree, createPackedInstallation } from './packed-installation.ts'
+
+const root = fileURLToPath(new URL('../../../..', import.meta.url))
+const adapter = '@deepseek-ai/dsh-webhook-github'
+const runtime = '@deepseek-ai/dsh-webhook'
+const built = existsSync(join(root, 'apps/cli/lib/bin.js'))
+ && existsSync(join(root, 'packages/experimental/webhook-github/lib/index.js'))
+const secret = 'packed-webhook-test-secret'
+
+it.skipIf(!built)('loads the packed GitHub example with its explicitly installed runtime peer', {
+ // Packing and installing the complete product closure owns this budget; no model request runs.
+ timeout: 360_000,
+ retry: 0,
+}, async () => {
+ const { temporary, installation, home, profile, environment, tarballs, members, externalVersions, packageCommand }
+ = await createPackedInstallation('dsh-webhook-packed-', [runtime, adapter])
+ Object.assign(environment, { DSH_GITHUB_WEBHOOK_SECRET: secret, DSH_GITHUB_WEBHOOK_PORT: '0' })
+ expect(existsSync(join(installation, 'node_modules', runtime))).toBe(false)
+ expect(existsSync(join(installation, 'node_modules', adapter))).toBe(false)
+ await writeFile(join(profile, 'package.json'), JSON.stringify({
+ name: 'packed-webhook-profile', private: true, dependencies: {},
+ dsh: { profile: { bundles: ['@deepseek-ai/dsh-base', '@deepseek-ai/dsh-web-app'] } },
+ }))
+ const profileDependencies = new Set([runtime, adapter])
+ for (const name of profileDependencies) {
+ const member = members.get(name)
+ if (member === undefined) throw new Error(`missing packed dependency ${name}`)
+ for (const [dependency, range] of Object.entries(member.manifest.dependencies as Record | undefined ?? {})) {
+ if (range.startsWith('workspace:')) profileDependencies.add(dependency)
+ }
+ }
+ await writeFile(join(profile, 'pnpm-workspace.yaml'), yaml.dump({
+ packages: ['.'], nodeLinker: 'hoisted', autoInstallPeers: false,
+ overrides: {
+ ...externalVersions,
+ ...Object.fromEntries([...profileDependencies].map(name => [name, `file:${tarballs.get(name)!}`])),
+ },
+ }))
+ const adapterArchive = tarballs.get(adapter)
+ const runtimeArchive = tarballs.get(runtime)
+ if (adapterArchive === undefined || runtimeArchive === undefined) throw new Error('webhook tarballs were not packed')
+ await packageCommand(['add', runtimeArchive, adapterArchive, '--prefer-offline', '--ignore-scripts'], profile)
+ const manifest = JSON.parse(await readFile(join(profile, 'package.json'), 'utf8')) as { dependencies: Record }
+ expect(Object.keys(manifest.dependencies).sort()).toEqual([runtime, adapter].sort())
+ await assertInstalledTree(profile)
+
+ const example = join(profile, 'node_modules', adapter, 'examples/github-review/cordis.yml')
+ expect(existsSync(example)).toBe(true)
+ expect(existsSync(join(dirname(example), 'github-ready-review-rule.mjs'))).toBe(true)
+ const observer = join(temporary, 'observe-ingress.mjs')
+ await writeFile(observer, `export const name = 'observe-packed-ingress'
+export const inject = ['webServer', 'webhookRuntime']
+export function apply(ctx) {
+ process.stdout.write('PACKED_WEBHOOK_READY=http://127.0.0.1:' + ctx.webServer.port + '\\n')
+}
+`)
+ const patch = join(temporary, 'test.patch.yml')
+ await writeFile(patch, yaml.dump([
+ { id: 'session-telemetry-otel', disabled: true },
+ { id: 'github-webhook-ingress', insert: [{ id: 'observe-packed-ingress', name: observer }] },
+ ]))
+ const child = execa(process.execPath, [
+ join(installation, 'node_modules/@deepseek-ai/dsh/lib/bin.js'), 'web', '--patch', example, '--patch', patch, '--no-open', '--port', '0',
+ ], { cwd: temporary, env: environment, extendEnv: false, reject: false, timeout: 90_000 })
+ try {
+ const ready = new Promise((resolveReady, rejectReady) => {
+ let output = ''
+ child.stdout?.on('data', (chunk: Buffer) => {
+ output += chunk.toString()
+ const origin = /PACKED_WEBHOOK_READY=(http:\/\/127\.0\.0\.1:\d+)/.exec(output)?.[1]
+ if (origin !== undefined && output.includes('dsh web: ')) resolveReady(origin)
+ })
+ void child.then((result) => {
+ rejectReady(new Error(`Web profile exited before readiness:\n${result.stdout}\n${result.stderr}`))
+ })
+ })
+ const origin = await ready
+ expect((await fetch(`${origin}/api`, { signal: AbortSignal.timeout(10_000) })).status).toBe(404)
+ const body = JSON.stringify({ zen: 'A signed ping does not start an Agent.' })
+ const response = await fetch(`${origin}/github`, {
+ method: 'POST', body, signal: AbortSignal.timeout(10_000),
+ headers: {
+ 'content-type': 'application/json', 'x-github-event': 'ping', 'x-github-delivery': 'packed-ping',
+ 'x-hub-signature-256': `sha256=${createHmac('sha256', secret).update(body).digest('hex')}`,
+ },
+ })
+ expect(response.status, await response.text()).toBe(202)
+ } finally {
+ child.kill('SIGTERM')
+ const result = await child
+ expect(result.timedOut, `${result.stdout}\n${result.stderr}`).toBe(false)
+ expect(result.exitCode === 0 || result.signal === 'SIGTERM', result.stderr).toBe(true)
+ }
+ expect(globSync('sessions/**/*.jsonl*', { cwd: home })).toEqual([])
+})
diff --git a/apps/cli/tests/web-agent-presets.e2e.ts b/apps/cli/tests/web-agent-presets.e2e.ts
index 079aa6dbce..6fa2861ce0 100644
--- a/apps/cli/tests/web-agent-presets.e2e.ts
+++ b/apps/cli/tests/web-agent-presets.e2e.ts
@@ -13,15 +13,17 @@ import {
loadProfile,
PluginPackages,
type Profile,
+ type ProfilePatch,
} from '@deepseek-ai/dsh-app-boot'
import { provideCmdline } from '@deepseek-ai/dsh-cmdline'
import { SessionId, SessionLogOffset } from '@deepseek-ai/dsh-session'
import type { Agent } from '@deepseek-ai/dsh-agent'
import type { PatchOptions } from '@deepseek-ai/cordis-plugin-include'
-import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+import { afterAll, beforeAll, describe, expect, it, onTestFinished, vi } from 'vitest'
import { dump, load } from 'js-yaml'
import { entryListSchema } from '@deepseek-ai/cordis-plugin-include'
import { bundlePatchPaths, composeEntries } from '@deepseek-ai/dsh-app-boot'
+import { createPluginProfile } from '../../desktop/src/project-manager.ts'
/** Profile entry ids whose volatile fields these scenarios edit through Settings. */
const SETTINGS_NAMESPACE = 'agent-preset-registry'
const SUBAGENT_MODEL_SELECTION_SETTINGS_NAMESPACE = 'subagent-model-selection-settings'
@@ -61,9 +63,10 @@ const MINIMAL_BASH_DESCRIPTION = `Run commands in a bash shell
*/
async function bootWeb(
profileHome: string,
- extra: PatchOptions[] = [],
+ extra: ProfilePatch[] = [],
profilePackages: readonly string[] = [],
profileBundles?: readonly string[],
+ surface: 'web' | 'desktop' | 'spec' = 'spec',
): Promise {
const storageRoot = join(profileHome, 'storages')
const overrides: PatchOptions[] = [
@@ -90,10 +93,12 @@ async function bootWeb(
// agent's capabilities, which is all this file asserts.
{ id: 'web-runtime', disabled: true },
{ id: 'session-telemetry-otel', disabled: true },
+ { id: 'desktop-product-telemetry', disabled: true },
+ { id: 'product-analytics', disabled: true },
// A deployment-level skill on the host registry's GLOBAL layer — the same
// registration shape a repository plugin's skill root uses. The layered
// skills test below proves it reaches preset-composed agents.
- { id: 'skill-badge', disabled: false },
+ { insert: [{ id: 'skill-badge', name: import.meta.resolve('@deepseek-ai/dsh-skill-badge') }] },
{ id: 'modules', disabled: true },
// The physical Connection row owns the disabled HTTP server. bootWeb
// supplies only its in-process registries so Host services still prove
@@ -120,9 +125,10 @@ async function bootWeb(
...extra,
]
const home = profileHome
- const profileDir = join(home, 'profiles', 'spec')
+ const profileDir = join(home, 'profiles', surface)
await mkdir(profileDir, { recursive: true })
- if (profileBundles === undefined) initProfile(profileDir, ['@deepseek-ai/dsh-base', '@deepseek-ai/dsh-web-app'])
+ if (surface === 'desktop') createPluginProfile(profileDir)
+ else if (profileBundles === undefined) initProfile(profileDir, ['@deepseek-ai/dsh-base', '@deepseek-ai/dsh-web-app'])
// Product Bundles are installed into the Profile, not the dsh app. Model
// pnpm's package link for only the selected products; their own production
// dependencies resolve from the linked workspace packages, while shared
@@ -134,7 +140,7 @@ async function bootWeb(
await symlink(packageDir, link, 'junction')
}
let profile: Profile = { skippedBundles: [],
- name: 'spec',
+ name: surface,
dir: profileDir,
layers: [],
patchPath: join(profileDir, 'cordis.patch.yml'),
@@ -150,7 +156,7 @@ async function bootWeb(
dependencies: Object.fromEntries(profileBundles.map(name => [name, 'workspace:*'])),
dsh: { profile: { bundles: profileBundles } },
}, null, 2) + '\n')
- profile = loadProfile('dsh-test', 'spec', INSTALL_ANCHOR, home, { userLayer: false })
+ profile = loadProfile('dsh-test', surface, INSTALL_ANCHOR, home, { userLayer: false })
bundlePatches = profile.layers.flatMap(layer => layer.patches)
}
// Deployment defaults live in a bundle beneath the profile patch, so Settings writes are not shadowed by overlays.
@@ -166,7 +172,7 @@ async function bootWeb(
const rootConfig = join(profileDir, 'cordis.yml')
await writeFile(rootConfig, '[]\n')
return await boot('dsh-test', rootConfig, [...bundlePatches, ...overrides], async (bootCtx) => {
- bootCtx.provide('profileContext', { name: 'spec', dir: profileDir, patchPath: profile.patchPath,
+ bootCtx.provide('profileContext', { name: surface, dir: profileDir, patchPath: profile.patchPath,
installAnchor: INSTALL_ANCHOR, home, cwd: home,
startedBundles: profileBundles ?? ['@deepseek-ai/dsh-base', '@deepseek-ai/dsh-web-app'],
overlays: [], telemetryDisabledEnv: '1' })
@@ -192,27 +198,15 @@ function toolParameterNames(ctx: Context, agent: Agent, toolName: string): strin
return Object.keys(properties).sort()
}
-function enablePresetTool(composition: string, id: string): string {
- const rows = load(composition, { schema: entryListSchema }) as import('@deepseek-ai/cordis-plugin-loader').EntryOptions[]
- const visit = (entries: typeof rows): boolean => entries.some((row) => {
- if (row.id === id) { row.disabled = false; return true }
- return row.group === true && visit(row.config as typeof rows)
- })
- if (!visit(rows)) throw new Error(`missing preset row ${id}`)
- return dump(rows, { schema: entryListSchema })
-}
-
let ctx: Context
beforeAll(async () => {
ctx = await bootWeb(await mkdtemp(join(tmpdir(), 'dsh-web-presets-')))
}, 120_000)
describe('the shipped Web composition', () => {
- it('leaves the global tool layer empty', () => {
- // Every model-facing tool belongs to a preset, `ask_user_question`
- // included: a tool in the global layer reaches EVERY agent regardless of
- // which preset composed it, expanding that preset's tool list.
- expect(toolNames(ctx)).toEqual([])
+ it('exposes only the directory tool in the global layer', () => {
+ // Directory selection is global; action tools belong to their Agent presets.
+ expect(toolNames(ctx)).toEqual(['working_directory'])
})
it('keeps the token meter and its context-meter projections on the host plane', async () => {
@@ -267,7 +261,7 @@ describe('the shipped Web composition', () => {
'schedule_create', 'schedule_delete', 'schedule_list', 'schedule_update',
'send_message', 'skill',
'subagent', 'subagent_fork', 'todo_write', 'update_goal', 'web_fetch', 'web_search',
- 'workflow', 'write',
+ 'workflow', 'working_directory', 'write',
])
expect(ctx.commands.find(handle.agent, 'goal')).toBeDefined()
} finally {
@@ -319,7 +313,7 @@ describe('the shipped Web composition', () => {
expect(assembly.sections).toEqual([
{ name: 'deployment:persona-prefix', text: MINIMAL_PROMPT },
])
- expect(assembly.tools.map(tool => tool.name)).toEqual(['bash'])
+ expect(assembly.tools.map(tool => tool.name)).toEqual(['bash', 'working_directory'])
expect(assembly.tools.find(tool => tool.name === 'bash')?.description).toBe(MINIMAL_BASH_DESCRIPTION)
expect(ctx.commands.find(handle.agent, 'goal')).toBeUndefined()
// serviceFor reports preset-owned providers; unisolated consumers inherit the host fs.
@@ -343,14 +337,14 @@ describe('the shipped Web composition', () => {
setup: agentCtx => ctx.agentPresets.mount(agentCtx, 'minimal').then(() => undefined),
})
try {
- expect(toolNames(ctx, minimal.agent)).toEqual(['bash'])
+ expect(toolNames(ctx, minimal.agent)).toEqual(['bash', 'working_directory'])
expect(toolNames(ctx, full.agent).length).toBeGreaterThan(10)
await minimal.dispose()
// Tearing the minimal session down leaves the full one whole.
expect(toolNames(ctx, full.agent).length).toBeGreaterThan(10)
- expect(toolNames(ctx)).toEqual([])
+ expect(toolNames(ctx)).toEqual(['working_directory'])
} finally {
await full.dispose()
}
@@ -509,7 +503,7 @@ describe('the shipped Web composition', () => {
// stays the preset's choice — minimal mounts no `tool-skill`, so its
// tool table has no loader even though the global layer is readable.
expect((await ctx.skills.list({ scope: handle.agent })).map(skill => skill.name)).toContain('dsh-badge')
- expect(toolNames(ctx, handle.agent)).toEqual(['bash'])
+ expect(toolNames(ctx, handle.agent)).toEqual(['bash', 'working_directory'])
} finally {
await handle.dispose()
}
@@ -549,14 +543,19 @@ describe('product Bundle and user-preset intersection', () => {
const standardConfig = composeEntries([webPatches('test')]).find(row => row.id === 'preset-standard')!.config as import('@deepseek-ai/dsh-agent-preset-registry').PresetDefinition
const standard = dump(standardConfig.plugins, { schema: entryListSchema })
for (const id of presetIds) {
- let composition = standard
+ const plugins = load(standard, { schema: entryListSchema }) as import('@deepseek-ai/cordis-plugin-loader').EntryOptions[]
+ // User presets declare their own delegation rows; provider bundles target only the three full shipped presets.
if (id === 'products-codex' || id === 'products-both') {
- composition = enablePresetTool(composition, 'tool-subagent-codex')
+ plugins.push({ id: 'custom-tool-subagent-codex', name: '@deepseek-ai/dsh-tool-subagent', config: {
+ provider: 'codex', toolName: 'subagent_codex', maxDepth: 'provider-managed',
+ } })
}
if (id === 'products-claude' || id === 'products-both') {
- composition = enablePresetTool(composition, 'tool-subagent-claude-code')
+ plugins.push({ id: 'custom-tool-subagent-claude-code', name: '@deepseek-ai/dsh-tool-subagent', config: {
+ provider: 'claude-code', toolName: 'subagent_claude_code', maxDepth: 'provider-managed',
+ } })
}
- definitions.push({ id: `preset-${id}`, name: '@deepseek-ai/dsh-agent-preset', config: { id, plugins: load(composition, { schema: entryListSchema }) } })
+ definitions.push({ id: `preset-${id}`, name: '@deepseek-ai/dsh-agent-preset', config: { id, plugins } })
}
const packageDir = (product: Product): string => (
product === 'codex' ? CODEX_PACKAGE_DIR : CLAUDE_CODE_PACKAGE_DIR
@@ -611,7 +610,7 @@ describe('product Bundle and user-preset intersection', () => {
expect(tools).toEqual(expect.arrayContaining(['job_kill', 'job_list', 'job_output']))
for (const productTool of productTools) {
expect(toolParameterNames(productCtx, handle.agent, productTool)).toEqual([
- 'description', 'prompt', 'run_in_background',
+ 'cwd', 'description', 'prompt',
])
}
} finally {
@@ -627,6 +626,75 @@ describe('product Bundle and user-preset intersection', () => {
}, 120_000)
})
+describe.each(['web', 'desktop'] as const)('%s native bundle adoption', (surface) => {
+ const products = ['codex', 'claude-code'] as const
+ const bundleNames = products.map(product => `@deepseek-ai/dsh-subagent-${product}`)
+
+ async function bootSelected(extra: ProfilePatch[]): Promise {
+ const root = await mkdtemp(join(tmpdir(), `dsh-${surface}-native-adoption-`))
+ onTestFinished(async () => { await rm(root, { recursive: true, force: true }) })
+ return await bootWeb(root, extra, [CODEX_PACKAGE_DIR, CLAUDE_CODE_PACKAGE_DIR], [
+ '@deepseek-ai/dsh-base', '@deepseek-ai/dsh-web-app', ...bundleNames,
+ ], surface)
+ }
+
+ it('keeps selected provider identities and later tool overrides without duplicating custom preset tools', async () => {
+ const definition = composeEntries([webPatches('adoption')]).find(row => row.id === 'preset-cordis')!
+ .config as import('@deepseek-ai/dsh-agent-preset-registry').PresetDefinition
+ const config = { ...definition, plugins: [...definition.plugins, ...products.map(product => ({
+ id: `tool-subagent-${product}`, name: '@deepseek-ai/dsh-tool-subagent', disabled: product === 'codex',
+ config: { provider: product, toolName: `custom_${product.replaceAll('-', '_')}`, maxDepth: 'provider-managed' },
+ }))] }
+ const providerConfig = { model: 'adoption-model', env: { DSH_NATIVE_ADOPTION: 'preserved' } }
+ const productCtx = await bootSelected([
+ ...products.map(product => ({ id: `subagent-${product}`, config: providerConfig })),
+ { preset: 'preset-standard', id: 'tool-subagent-codex', disabled: true },
+ { preset: 'preset-standard', id: 'tool-subagent-claude-code', config: {
+ provider: 'claude-code', toolName: 'custom_claude_code', maxDepth: 'provider-managed',
+ } },
+ { id: 'preset-cordis', config },
+ ])
+ const spawn = vi.spyOn(productCtx.subprocess, 'spawn')
+ try {
+ expect(productCtx.subagents.list()).toEqual(expect.arrayContaining([...products]))
+ for (const product of products) {
+ expect([...productCtx.loader.entries()].find(entry => entry.options.id === `subagent-${product}`)?.options.config)
+ .toMatchObject(providerConfig)
+ }
+ for (const [preset, expected] of [
+ ['standard', ['custom_claude_code']], ['cordis', ['custom_claude_code']],
+ ['ptc', ['subagent_claude_code', 'subagent_codex']], ['minimal', []],
+ ] as const) {
+ const handle = await productCtx.agents.create({
+ sessionId: SessionId(`adoption-${surface}-${preset}-${randomUUID()}`),
+ setup: owner => productCtx.agentPresets.mount(owner, preset).then(() => undefined),
+ })
+ try {
+ expect(toolNames(productCtx, handle.agent).filter(name => /(?:subagent|custom)_(?:codex|claude_code)/.test(name)))
+ .toEqual(expected)
+ } finally { await handle.dispose() }
+ }
+ expect(spawn).not.toHaveBeenCalled()
+ } finally {
+ spawn.mockRestore()
+ await productCtx.fiber.dispose()
+ }
+ }, 120_000)
+
+ it('reports a redundant manual tool instead of silently replacing the bundle contribution', async () => {
+ const productCtx = await bootSelected([{ preset: 'preset-standard', insert: [{
+ id: 'manual-codex', name: '@deepseek-ai/dsh-tool-subagent', config: {
+ provider: 'codex', toolName: 'subagent_codex', maxDepth: 'provider-managed',
+ },
+ }] }])
+ try {
+ expect((await productCtx.agentPresets.list()).find(preset => preset.id === 'standard')?.broken)
+ .toContain('already registered')
+ expect(productCtx.profileContext.startedBundles).toEqual(expect.arrayContaining(bundleNames))
+ } finally { await productCtx.fiber.dispose() }
+ }, 120_000)
+})
+
describe('a user preset declared from the shipped cordis rows', () => {
/** The JSON text a `cordis_inspect_*` result renders. */
function resultText(result: { content: ReadonlyArray<{ type: string; text?: string }> }): string {
@@ -862,9 +930,8 @@ describe('the default preset as a user setting', () => {
setup: agentCtx => ctx.agentPresets.mount(agentCtx).then(() => undefined),
})
try {
- // `mount()` with no id resolves the effective default. One tool, not
- // `standard`'s catalog: the setting decided the composition.
- expect(toolNames(ctx, handle.agent)).toEqual(['bash'])
+ // An omitted preset id resolves the stored default instead of the composed default.
+ expect(toolNames(ctx, handle.agent)).toEqual(['bash', 'working_directory'])
} finally {
await handle.dispose()
}
@@ -910,7 +977,7 @@ describe('a profile patch stored before Developer tools owned preset selection',
setup: agentCtx => legacy.agentPresets.mount(agentCtx).then(() => undefined),
})
try {
- expect(toolNames(legacy, handle.agent)).toEqual(['bash'])
+ expect(toolNames(legacy, handle.agent)).toEqual(['bash', 'working_directory'])
} finally {
await handle.dispose()
}
@@ -927,7 +994,7 @@ describe('a session keeps the preset it was created with', () => {
try {
// The api-proxy guard reads exactly this: the header records what the
// session runs, so naming anything else is a caller error rather than a
- // switch. Its history was produced under `minimal`'s single tool.
+ // switch.
expect(handle.agent.session.header.agentPreset).toBe('minimal')
} finally {
await handle.dispose()
diff --git a/apps/desktop-host/package.json b/apps/desktop-host/package.json
index fe870e6308..f2a75bfa51 100644
--- a/apps/desktop-host/package.json
+++ b/apps/desktop-host/package.json
@@ -1,7 +1,7 @@
{
"name": "@deepseek-ai/dsh-desktop-host",
"description": "Private Node-mode host process for the Electron desktop application",
- "version": "0.2.0-rc.2",
+ "version": "0.2.1-alpha.1",
"private": true,
"license": "MIT",
"type": "module",
@@ -12,7 +12,7 @@
],
"dependencies": {
"koffi": "^3.1.0",
- "@deepseek-ai/libreoffice-kit": "^0.1.1",
+ "@deepseek-ai/libreoffice-kit": "^0.1.5",
"@deepseek-ai/cordis": "workspace:~",
"@deepseek-ai/dsh": "workspace:*",
"@deepseek-ai/dsh-agent": "workspace:*",
diff --git a/apps/desktop-host/src/index.ts b/apps/desktop-host/src/index.ts
index 4a47a92ce8..dd8f57c54c 100644
--- a/apps/desktop-host/src/index.ts
+++ b/apps/desktop-host/src/index.ts
@@ -27,7 +27,7 @@ async function main(): Promise {
profile: 'desktop',
resolvedProfile: { profile, installAnchor },
patchFiles: [],
- args: ['--no-open', '--port', '19387'],
+ args: ['--no-open', '--port', '0'],
...(process.argv[5] === undefined ? {} : {
packageManager: {
command: process.execPath,
diff --git a/apps/desktop-host/src/office-engine.ts b/apps/desktop-host/src/office-engine.ts
index d8f0bd1d5f..f58019d116 100644
--- a/apps/desktop-host/src/office-engine.ts
+++ b/apps/desktop-host/src/office-engine.ts
@@ -29,7 +29,11 @@ export function installOfficeEngineResolution(runtimeDir: string): ModuleHooks |
return registerHooks({
resolve(specifier, context, nextResolve) {
const resolved = nextResolve(specifier, context)
- if (!/^@deepseek-ai\/libreoffice-kit-(?:darwin|win32|linux)-/u.test(specifier)) return resolved
+ if (!resolved.url.startsWith('file:')) return resolved
+ const engineRequest = /^@deepseek-ai\/libreoffice-kit-(?:darwin|win32|linux)-/u.test(specifier)
+ const engineTarget = /\/node_modules\/@deepseek-ai\/libreoffice-kit-(?:darwin|win32|linux)-[^/]+\//u
+ .test(new URL(resolved.url).pathname)
+ if (!engineRequest && !engineTarget) return resolved
const canonical = pathToFileURL(realpathSync(fileURLToPath(resolved.url))).href
if (!canonical.startsWith(source)) {
if (canonical.startsWith(pathToFileURL(archive + '/').href)) {
diff --git a/apps/desktop-host/tests/office-engine.spec.ts b/apps/desktop-host/tests/office-engine.spec.ts
index 716aef756d..83c544dc01 100644
--- a/apps/desktop-host/tests/office-engine.spec.ts
+++ b/apps/desktop-host/tests/office-engine.spec.ts
@@ -1,19 +1,26 @@
import { mkdirSync, mkdtempSync, realpathSync, rmSync, symlinkSync, writeFileSync } from 'node:fs'
import { createRequire, type ModuleHooks } from 'node:module'
import { tmpdir } from 'node:os'
-import { dirname, join } from 'node:path'
+import { dirname, join, sep } from 'node:path'
import { afterEach, expect, it } from 'vitest'
import { installOfficeEngineResolution } from '../src/office-engine.ts'
+import { PackageManifests } from '../../../packages/boot/hmr/src/package-manifest.ts'
const roots: string[] = []
const hooks: ModuleHooks[] = []
+const disposers: Array<() => void> = []
afterEach(() => {
+ for (const dispose of disposers.splice(0).reverse()) dispose()
for (const hook of hooks.splice(0)) hook.deregister()
+ const cache = createRequire(import.meta.url).cache
+ for (const path of Object.keys(cache)) {
+ if (roots.some(root => path.startsWith(root + sep))) Reflect.deleteProperty(cache, path)
+ }
for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true })
})
function fixture(runtimeName = 'dsh') {
- const root = mkdtempSync(join(tmpdir(), 'desktop-office-resolution-'))
+ const root = realpathSync(mkdtempSync(join(tmpdir(), 'desktop-office-resolution-')))
roots.push(root)
const runtime = join(root, 'app.asar', runtimeName)
const manifest = 'node_modules/@deepseek-ai/libreoffice-kit-darwin-arm64/package.json'
@@ -40,6 +47,45 @@ it('resolves engine manifests to physical directories and leaves unrelated modul
expect(f.require('@deepseek-ai/libreoffice-kit/package.json')).toEqual({ name: '@deepseek-ai/libreoffice-kit' })
})
+it('resolves an absolute engine manifest to its unpacked copy', () => {
+ const f = fixture()
+ expect(f.require(join(f.runtime, f.manifest)))
+ .toMatchObject({ path: realpathSync(dirname(join(f.root, 'app.asar.unpacked', 'dsh', f.manifest))) })
+})
+
+it.each(['exports', 'main'] as const)('refreshes a cached plugin %s while Office resolution stays active', (field) => {
+ const f = fixture()
+ const packageRoot = join(f.root, 'plugin')
+ mkdirSync(packageRoot)
+ const manifest = join(packageRoot, 'package.json')
+ const a = join(packageRoot, 'a.cjs')
+ const b = join(packageRoot, 'b.cjs')
+ writeFileSync(manifest, JSON.stringify({ name: 'plugin', [field]: './a.cjs' }))
+ writeFileSync(a, 'module.exports = { marker: "a" }')
+ writeFileSync(b, 'module.exports = { marker: "b" }')
+ symlinkSync(packageRoot, join(f.runtime, 'node_modules', 'plugin'), process.platform === 'win32' ? 'junction' : 'dir')
+ const require = createRequire(join(f.runtime, 'package.json'))
+ const original: unknown = require('plugin')
+ const next: unknown = require(b)
+ const originalModule = require.cache[a]
+ const nextModule = require.cache[b]
+ const engine = f.require('@deepseek-ai/libreoffice-kit-darwin-arm64/package.json')
+ expect(original).toEqual({ marker: 'a' })
+ expect(next).toEqual({ marker: 'b' })
+ expect(require('plugin')).toBe(original)
+ const manifests = new PackageManifests()
+ disposers.push(() => { manifests.dispose() })
+ writeFileSync(manifest, JSON.stringify({ name: 'plugin', [field]: './b.cjs' }))
+ manifests.invalidate(manifest)
+ expect(require('plugin')).toBe(next)
+ expect(require.resolve('plugin')).toBe(b)
+ expect(require.cache[a]).toBe(originalModule)
+ expect(require.cache[b]).toBe(nextModule)
+ expect(require(a)).toBe(original)
+ expect(f.require('@deepseek-ai/libreoffice-kit-darwin-arm64/package.json')).toBe(engine)
+ expect(f.require(join(f.runtime, f.manifest))).toBe(engine)
+})
+
it('rejects an engine missing from the unpacked tree instead of using its archived copy', () => {
const f = fixture()
rmSync(join(f.root, 'app.asar.unpacked'), { recursive: true })
diff --git a/apps/desktop/.env.macos.example b/apps/desktop/.env.macos.example
index d21463ef9d..da5502ce5d 100644
--- a/apps/desktop/.env.macos.example
+++ b/apps/desktop/.env.macos.example
@@ -1,3 +1,4 @@
+# Release configuration only; local --unsigned builds ignore this file.
# Copy to .env.macos (Git ignored). Use UTF-8 and quote secrets containing # or spaces.
# Paths may be absolute or relative to apps/desktop. Values are not shell-expanded.
DSH_DESKTOP_APP_ID=com.deepseek.harness
@@ -20,7 +21,7 @@ DSH_DESKTOP_MACOS_DOWNLOAD_PROXY=
# Requires permission to change system proxies; affects other applications during notarization.
DSH_DESKTOP_MACOS_NOTARIZATION_PROXY=
-# The selected mandatory-update origin is required, including unsigned and preparation builds.
+# The selected mandatory-update origin is required for release and preparation builds.
DSH_DESKTOP_MANDATORY_UPDATE_TEST_ORIGIN=
DSH_DESKTOP_MANDATORY_UPDATE_PROD_ORIGIN=
# Set approved login origins for test builds; omit allowedAuthOrigins for production.
diff --git a/apps/desktop/README.i18n.yaml b/apps/desktop/README.i18n.yaml
index f412464ae6..9c95cd3111 100644
--- a/apps/desktop/README.i18n.yaml
+++ b/apps/desktop/README.i18n.yaml
@@ -3,8 +3,8 @@
# After editing either side, bring the other along and re-record with:
# pnpm run verify-translation-pairing --write apps/desktop/README.md
/deepseek-harness-desktop:
- en: eccac345d51428fa
- zh: 4a448b3d63cb8117
+ en: 0f0f6ea914eff51e
+ zh: 4934245b04e9f1c0
/deepseek-harness-desktop/terminal-command:
en: bef92953c237363f
zh: d21d6effd21b8c00
@@ -15,23 +15,23 @@
en: 069fdfd72d2ea26a
zh: 76ae549d43c99bb4
/deepseek-harness-desktop/key-technical-decisions/bundled-workspace-dependencies:
- en: 320733f93ede61a4
- zh: 33206c3c4753c802
+ en: 0f9b6c1d6761d108
+ zh: 77127063f244c361
/deepseek-harness-desktop/bundled-command-runtime:
- en: beecf076aa2f0796
- zh: c9001ce0f22d2379
+ en: 09f0b75af9f0ed14
+ zh: 60bbc2e67d5e87a8
/deepseek-harness-desktop/installation-ownership:
en: 22153a298a6662e1
zh: 3600803c8c9d0274
/deepseek-harness-desktop/installation-ownership/runtime-and-plugin-activation:
- en: 0d11af8639977a6d
- zh: 86b086b12d2210d3
+ en: a1a47b09f4a72ba4
+ zh: 7b1cf27f0b72cf31
/deepseek-harness-desktop/installation-ownership/host-environment:
en: 84a9cc7ca9455aa8
zh: 4091b8aa8231b74a
/deepseek-harness-desktop/develop:
- en: 40d2ad4014bf445b
- zh: 6a08de06df9ed042
+ en: fe6d23e6a3d3bc66
+ zh: d60c8d3a55747916
/deepseek-harness-desktop/develop/startup-onboarding:
en: a51346b8d880ddba
zh: 7913214c1c66063c
@@ -42,29 +42,35 @@
en: 4cd8a8da6977928d
zh: 9f624855a2edac37
/deepseek-harness-desktop/package/release-versions:
- en: f461b255133384cc
- zh: 2b9db718f22fdd04
+ en: 99607dc36badb7f1
+ zh: 5df47873fe8cdea8
+/deepseek-harness-desktop/package/local-macos-dmg-without-release-signing:
+ en: 57869a5e3885f843
+ zh: 7cfc01b2dcbebd78
+/deepseek-harness-desktop/package/local-official-bundles-from-a-loopback-registry:
+ en: 5f05072ec82cc62d
+ zh: a3d63b58d1ef2db7
/deepseek-harness-desktop/package/runtime-file-selection:
- en: f0e345fd89868803
- zh: fd2c775ad23fa2f0
+ en: e7c1eb8e78fe46e3
+ zh: b7ea497dd75be524
/deepseek-harness-desktop/package/upload-updates:
- en: 72073b2e72590067
- zh: 63b1f9790395c37d
+ en: f48baa680e841b0d
+ zh: 25ded1aeaac6dad1
/deepseek-harness-desktop/package/unsigned-windows-test-installer:
en: cfd5780dd26a8e46
zh: f7a16b1ede793b7b
/deepseek-harness-desktop/package/windows-installer-interface:
- en: f176a8b1c7de3064
- zh: 6ea2dbe6bb808c34
+ en: 1fc1db8f54475c8f
+ zh: dd834ed206070396
/deepseek-harness-desktop/package/windows-ev-signing:
- en: 8efe3498dbe8686d
- zh: a88c16f20a9430f3
+ en: be1379e4b4703e14
+ zh: 244ccd2874bb155a
/deepseek-harness-desktop/updates:
- en: d0df867b69cbffa4
- zh: eeb47b79b86fe5ee
+ en: 10d58aa5bbffbd67
+ zh: d9c2476e744a6537
/deepseek-harness-desktop/updates/mandatory-update-policy:
- en: 2f789a4949fafb12
- zh: d8b28c01cfee11b7
+ en: 1527dceec540649e
+ zh: 543782c36f91f893
/deepseek-harness-desktop/updates/local-updater-qualification:
en: bc50fd8a4d96c227
zh: fb0a6ce80c31cda6
diff --git a/apps/desktop/README.md b/apps/desktop/README.md
index fa00c27e08..57eb2cb333 100644
--- a/apps/desktop/README.md
+++ b/apps/desktop/README.md
@@ -4,7 +4,7 @@ English | [中文](README.zh.md)
Desktop analytics follows the [product collection policy](../../packages/client/product-analytics/README.md), including its live application setting. Web usage is excluded. Update installation waits for its local analytics intake before locking API admission and stopping the Host. Intake has a one-second deadline; failure does not prevent installation, and collector delivery is not awaited.
-The desktop application is an Electron shell around the complete dsh Web application. An Electron RunAsNode child starts the shared profile runner, and Electron immediately loads the packaged Web entry at `dsh-app://app/`. Its shared loading page waits for Host boot injections, then starts the client without navigating to another document. Electron forwards application HTTP requests to the authenticated Web Host, dropping connection-level response headers (`transfer-encoding`, `connection`, `keep-alive`) that describe the Node fetch rather than the resource, and marking plugin bundle responses `no-store` because their per-launch revisions would only accumulate in Chromium's disk cache; WebSocket streams connect to that Host with credentials attached only for the owned application window. Node IPC carries boot injections, readiness, and shutdown. Desktop defaults to port `19387`, separate from Web’s `3080`; a `webserver.config.port` patch can override it.
+The desktop application is an Electron shell around the complete dsh Web application. An Electron RunAsNode child starts the shared profile runner, and Electron immediately loads the packaged Web entry at `dsh-app://app/`. Its shared loading page waits for Host boot injections, then starts the client without navigating to another document. Electron forwards application HTTP requests to the authenticated Web Host, dropping connection-level response headers (`transfer-encoding`, `connection`, `keep-alive`) that describe the Node fetch rather than the resource, and marking plugin bundle responses `no-store` because their per-launch revisions would only accumulate in Chromium's disk cache; WebSocket streams connect to that Host with credentials attached only for the owned application window. Node IPC carries boot injections, readiness, and shutdown. Desktop listens on an OS-assigned port by default, so it cannot collide with Web’s `3080` or a reserved port; a `webserver.config.port` patch can override it.
The first application-menu command, **About DeepSeek Harness**, opens Electron's native About panel with the application icon, product name, and installed release version. The menu follows the Desktop shell locale. On macOS, Hide, Hide Others, Show All, and Quit use localized labels; Hide and Quit include the DeepSeek Harness product name. These commands retain their native actions and shortcuts. macOS reads the icon from its application bundle, so an unpackaged development launch displays Electron's icon; Windows receives the packaged PNG.
@@ -14,7 +14,7 @@ Creator and the Web Plugin Manager use Desktop’s bundled pnpm under Electron N
Embedded Platform documents use a persistent WebContentsView partition keyed by a hash of the Platform origin and stable account ID. localStorage preferences, including dismissed notices, survive view closure and application restart; different accounts and origins use separate storage. The Host supplies the account ID from its latest successful profile read; while no ID is known, the document opens in a disposable partition that keeps no preference across opens. Opening a persistent partition clears cookies, filesystem, IndexedDB, Cache Storage, the HTTP and shader caches, service workers, and HTTP authentication before the document loads; a disposable partition clears all of its storage. Closing a view destroys the document, removes its request interceptors, and schedules the same cleanup, so authentication left by an unclean exit is cleared before the next document loads. The next open and application shutdown await that cleanup, and an update install waits for it before the installer takes over the exit. A failed cleanup rejects that open and blocks the same account until a later cleanup succeeds; other accounts keep opening. Sign-out destroys the document but retains account-scoped preferences for the next sign-in. A document already open in a disposable partition stays mounted when the account ID arrives for the same credential; the next open uses the account-scoped partition. The [storage decision](../../.agents/notes/implemented/architecture/2026-09-22-platform-browser-storage.md) describes the retention policy. Host sends account credentials through private Node IPC; account RPC and the Harness renderer receive no token. Before page scripts execute, the Platform preload performs one synchronous IPC to read the prepared main-process credential. It exposes displayMode, synchronous getAuthToken() and getLocale() getters, and onLocaleChange(listener), which returns an unsubscribe function. Both getters read preload memory without further IPC. The bootstrap includes the resolved Desktop language (`zh_CN` or `en_US`); Settings language changes update the preload cache and notify the open Platform document without reloading. Platform applies this language before its first render and does not persist it as a browser preference. The main-process handler performs only sender validation and an in-memory read; it never waits for Host, disk, or network. Trusted-page initialization failures retain embedded mode and make the getter throw, preventing browser-credential fallback. Only the owned Platform main frame on the configured issuer origin can initialize. Sign-out, credential replacement, Host shutdown, and view closure destroy the document. Cross-origin document navigation is blocked. HTTPS links requesting a new window open in the system browser without the embedded session or token; other schemes and URL credentials are rejected. Native views occupy the viewport below the Account feature’s return bar.
-Desktop Host Platform API requests and update-policy requests identify the installed client with the same Platform client headers: platform, client version, locale, timezone offset in seconds, and a bundle id that is intentionally empty. Account operations take the calling UI's identity per call; the account provider owns [API-only header configuration](../../packages/credentials/deepseek-account-platform/README.md#use-this-package). Update policy additionally reports architecture, update channel, and bundled runtime version.
+Desktop Host Platform API requests and update-policy requests identify the installed client with the same Platform client headers: platform, client version, locale, timezone offset in seconds, and a bundle id that is intentionally empty. Account operations take the calling UI's identity per call; the account provider owns [API-only header configuration](../../packages/credentials/deepseek-account-platform/README.md#use-this-package). Update policy additionally reports architecture, update channel, and bundled runtime version. The native account-state decoder accepts `no-response` sign-in failures and preserves the error code in the UI-safe projection.
A server-expired account credential returns to Welcome when no official API key is configured; an available API key keeps the workspace open. Explicit sign-out follows the same rule. Both Welcome and the workspace display the localized expiry notice.
@@ -56,7 +56,7 @@ The macOS PNG uses an inset rounded background for legacy ICNS packaging, with r
### Bundled workspace dependencies
-electron-builder copies only the manifest's `dependencies` into `app.asar/node_modules`, so the Electron main bundle `lib/main.js` inlines its workspace devDependencies and leaves `electron`, Node builtins, and those `dependencies` as its only bare imports; a sandboxed preload may leave only `electron`, `events`, `timers`, and `url`, the modules its `require` polyfill resolves. The main bundle resolves the inlined packages from their `lib/` output, so the root `build:lib:host` bundles `apps/desktop` after the concurrent workspace tsdown pass, and [`desktop-bundle-imports`](scripts/desktop-bundle-imports.mjs) fails any Desktop bundle whose static, dynamic, or `require()` import the packaged application cannot resolve. Without that check an import rolldown could not resolve ships as an external specifier and fails at launch with `ERR_MODULE_NOT_FOUND`. The [bundle-order decision](../../.agents/notes/implemented/process/2026-09-22-desktop-main-bundle-after-workspace-tsdown.md) records the alternatives.
+electron-builder copies only the manifest's `dependencies` into `app.asar/node_modules`, so the Electron main bundle `lib/main.js` inlines its workspace devDependencies and leaves `electron`, Node builtins, and those `dependencies` as its only bare imports; a sandboxed preload may leave only `electron`, `events`, `timers`, and `url`, the modules its `require` polyfill resolves. The main bundle resolves the inlined packages from their `lib/` output, so the root `build:lib:host` bundles `apps/desktop` after the concurrent workspace tsdown pass, and [`desktop-bundle-imports`](scripts/desktop-bundle-imports.mjs) fails any Desktop bundle whose static, dynamic, or `require()` import the packaged application cannot resolve. Without that check an import rolldown could not resolve ships as an external specifier and fails at launch with `ERR_MODULE_NOT_FOUND`. The [archived bundle-order decision](../../.agents/notes/archived/process/2026-09-22-desktop-main-bundle-after-workspace-tsdown.md) records the alternatives.
Signed Windows packaging scans the primary runtime and application production dependencies for PE content, including files without a conventional extension. The final scan covers the entire unpacked application. Directory links, malformed `MZ` files and non-PE `.exe`, `.dll` or `.pyd` files stop packaging; data files beginning with `MZ` are also rejected unless they contain a valid PE header. It preserves valid vendor signatures and signs unsigned code before sealing runtime hashes or executing smoke checks. Public-key inspection uses batches of 32 files with at most four processes; hardware-token signing remains serial, and each new signature must match the configured certificate and carry a timestamp. Hardware signing and verification failures stop the run; isolated timestamp requests follow the bounded policy below. Electron-builder preserves copied runtime executables only after signature and exact-byte verification. A final PE-signature audit and a fresh-cache ASAR payload and Host smoke must pass before the release completion record is written. Development, preparation-only and unsigned builds do not use the hardware token and can be blocked by Windows code-integrity policy; no build mode disables that policy. Passing smoke checks does not establish compatibility with every enterprise policy.
@@ -84,9 +84,11 @@ The [thin-wrapper decision](../../.agents/notes/implemented/architecture/2026-09
Welcome loads the shared Toast palette and shadow tokens, with system typography for body-mounted notifications.
+
+
## Bundled command runtime
-The installed `resources/runtime/cli/bin/dsh` shell script (`dsh.cmd` on Windows) runs the ordinary CLI dispatcher using Desktop's Electron executable and bundled pnpm. It works while Desktop is closed and retains the [Electron runtime limitations](../../.agents/notes/implemented/architecture/2026-09-11-desktop-electron-node-runtime.md). Ordinary profile, configuration, and plugin commands use the same implementation as npm dsh; the command does not open Desktop.
+The installed `resources/runtime/cli/bin/dsh` shell script (`dsh.cmd` on Windows) runs the ordinary CLI dispatcher using Desktop's Electron executable and bundled pnpm. It works while Desktop is closed and retains the Electron runtime limitations. Ordinary profile, configuration, and plugin commands use the same implementation as npm dsh; the command does not open Desktop.
To manage Desktop's plugins, launch Desktop once to initialize its profile, fully quit the application, then run `dsh plugin --profile desktop add `, `list`, or `remove `. Reopen Desktop to use the changes. Package operations retain the shared profile write lock and compatibility checks. The installed command refuses an uninitialized Desktop profile instead of creating an ordinary CLI profile in its place.
@@ -116,7 +118,7 @@ On macOS the custom menu retains Electron's standard Window menu and application
### Runtime and plugin activation
-The signed `resources/app.asar/dsh/desktop-runtime.json` binds the shell version, Electron's Node version, platform, architecture, shared package versions, and final file inventory. Startup reads the metadata and checks shared package records. Release schema, shell version, target compatibility, and file integrity are verified during packaging. Core packages are never copied into profile storage or installed by pnpm at first launch.
+The signed `resources/app.asar/dsh/desktop-runtime.json` binds the shell version, Electron's Node version, platform, architecture, shared package versions, and final file inventory. Startup reads the metadata and checks shared package records. Release schema, shell version, target compatibility, and file integrity are verified during packaging. Reintroducing startup release comparisons requires a concrete installation failure that packaging validation and actual Host diagnostics cannot adequately explain. Core packages are never copied into profile storage or installed by pnpm at first launch.
1. The main window loads the shared Web loading page offscreen from packaged static assets before profile preparation or backend startup. Shared profile initialization creates missing manifest, empty user patch, and pnpm workspace files without overwriting existing files.
2. Before Host startup, Desktop validates the runtime descriptor and prepares the profile without modifying installed packages, declarations, or the lockfile; it removes only the `.dsh-module-fallback` projections earlier link-backend launches wrote, and startup never runs pnpm. Packages inside the profile keep native precedence, and installation package names resolve through the runtime resolution ([lookup order](../../.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.md); [cleanup removal](../../.agents/notes/implemented/simplification/2026-09-19-remove-desktop-profile-core-cleanup.md)).
@@ -160,6 +162,8 @@ The Web counterparts are `pnpm run dev:web` and `pnpm run start:web`, documented
The [native/renderer keyboard tests](tests/keyboard.spec.ts) compile as part of the repository Client typecheck. Their Desktop imports are limited to Cordis-free input, persistence, IPC, browser-guest, and overlay modules.
+Dependency installation does not run the locked Electron package's separate binary installer. Before running the [Windows console-signal tests](tests/windows-cli-signals.spec.ts) directly, prepare the locked Electron binary with `pnpm --filter @deepseek-ai/dsh-desktop exec install-electron` from the repository root. For downloads through a proxy, enable `ELECTRON_GET_USE_PROXY=1` for that installer process. Windows coverage aggregates require successful provisioning before the instrumented unit inventory starts.
+
### Startup onboarding
The API-key input starts empty and uses `autocomplete="new-password"` to ask Chromium not to autofill saved login passwords.
@@ -205,11 +209,11 @@ pnpm --dir apps/desktop run package:win:x64 --build-version 0.1.6-alpha.1.202609
A production release publishes the product version and takes no `--build-version`. Uploading one tags the packaged commit as `desktop-v` once the artifacts are public; a build from a modified checkout is not tagged, and a tagging failure prints the command to run by hand rather than failing a completed upload. Test and local builds are deliberately left untagged, and every artifact records `dshBuildCommit` and `dshBuildDirty` in its manifest so a build handed over directly remains traceable.
-Version derivation does not change the fixed update channel or `nightly.yml` / `nightly-mac.yml` filenames. SemVer orders `0.1.6-alpha.1 < 0.1.6-alpha.1.20260916.1 < 0.1.6-alpha.2`, and a stable base's test version precedes that stable release. Clients only accept a greater version: replacing a feed cannot move an installed higher version to a lower corrected version. Such clients need manual installation; keep automatic downgrade disabled. The [version decision](../../.agents/notes/implemented/process/2026-09-16-desktop-release-version-derivation.md) explains why the channel does not supply the prerelease identifier.
+Version derivation does not change the fixed update channel or `nightly.yml` / `nightly-mac.yml` filenames. SemVer orders `0.1.6-alpha.1 < 0.1.6-alpha.1.20260916.1 < 0.1.6-alpha.2`, and a stable base's test version precedes that stable release. Clients only accept a greater version: replacing a feed cannot move an installed higher version to a lower corrected version. Such clients need manual installation; keep automatic downgrade disabled. The [archived version decision](../../.agents/notes/archived/process/2026-09-16-desktop-release-version-derivation.md) explains why the channel does not supply the prerelease identifier.
-Packaging, upload, and manual macOS signature verification read `apps/desktop/.env.windows` or `.env.macos`, selected by target platform. Copy the [Windows template](.env.windows.example) or [macOS template](.env.macos.example) and fill in the local settings; Git ignores both local files, and packaged artifacts exclude them. Release fields come only from the target file, without fallback to system or shell variables; `PATH`, proxies, and build-tool settings remain inherited. The published version is an argument rather than a release field, and upload reads it from the completion record the packaging run wrote. Files use UTF-8 with optional BOM; relative certificate, SignTool, Apple API key, and keychain paths resolve from `apps/desktop`, values are not shell-expanded, and passwords containing `#` or spaces need quotes. CI also creates the target file before invoking packaging.
+Except for local unsigned macOS builds, packaging, upload, and manual macOS signature verification read `apps/desktop/.env.windows` or `.env.macos`, selected by target platform. Copy the [Windows template](.env.windows.example) or [macOS template](.env.macos.example) and fill in the local settings; Git ignores both local files, and packaged artifacts exclude them. Release fields come only from the target file, without fallback to system or shell variables; `PATH`, proxies, and build-tool settings remain inherited. The published version is an argument rather than a release field, and upload reads it from the completion record the packaging run wrote. Files use UTF-8 with optional BOM; relative certificate, SignTool, Apple API key, and keychain paths resolve from `apps/desktop`, values are not shell-expanded, and passwords containing `#` or spaces need quotes. CI also creates the target file before invoking packaging.
-Every package command checks the application ID, update origin, and mode-specific signing configuration before building or downloading, then probes the external tools the run will use: the archive reader, and on a Windows target the installer compiler. macOS checks the identity, Team ID, one complete notarization strategy, readable local `CSC_LINK` p12 file, explicit `CSC_KEY_PASSWORD`, and referenced API key and keychain files; Windows checks the public code-signing certificate, SignTool file, container name, and PIN format. Windows preparation-only and explicit unsigned builds do not require signing credentials. Configuration checks do not authenticate the PIN, log in to the token, unlock a keychain, or contact Apple; actual signing and notarization perform those checks. `--build-version auto` does contact the destination bucket, including under `--check`. Run the same checks separately:
+Every package command checks the application ID and its mode-specific update and signing configuration before building or downloading, then probes the external tools the run will use: the archive reader, and on a Windows target the installer compiler. macOS checks the identity, Team ID, one complete notarization strategy, readable local `CSC_LINK` p12 file, explicit `CSC_KEY_PASSWORD`, and referenced API key and keychain files; Windows checks the public code-signing certificate, SignTool file, container name, and PIN format. Windows preparation-only builds and explicit unsigned builds on either platform do not require signing credentials. Configuration checks do not authenticate the PIN, log in to the token, unlock a keychain, or contact Apple; actual signing and notarization perform those checks. `--build-version auto` does contact the destination bucket, including under `--check`. Run the same checks separately:
```sh
pnpm --dir apps/desktop run check:package
@@ -233,13 +237,42 @@ The macOS arm64 command requires Apple Silicon. The macOS x64 command runs on In
Each target owns its packed package inputs, prepared runtime, package set, dsh tree, pnpm preparation state, unpacked application, update metadata, and final artifacts under `apps/desktop/.desktop-build/targets//`. The Electron archive cache remains shared under `.desktop-build/downloads` because every archive name includes its version, platform, and architecture and is verified before extraction. A target build never consumes another target's mutable preparation state.
+### Local macOS DMG without release signing
+
+After `pnpm install`, run one command from the repository root. No `.env.macos`, Apple account, certificate, or update service configuration is required:
+
+```sh
+pnpm run package:desktop:mac:arm64:unsigned
+pnpm run package:desktop:mac:x64:unsigned
+```
+
+Add `--check` to validate local configuration and tools without building, or `--dir` to stop at the unpacked application. The DMG is `apps/desktop/.desktop-build/targets//unsigned-artifacts/deepseek-harness--mac--unsigned.dmg`. After all checks pass, the command prints `DMG:` followed by its absolute path. Open it and copy the application to a local test directory.
+
+These commands ignore `.env.macos` and inherited release settings, use `com.deepseek.harness` as the app ID, and omit automatic-update and mandatory-update configuration. Build tools, standard network proxies, and `DSH_DESKTOP_NPM_REGISTRY` remain available from the shell. They skip Developer ID signing, Apple notarization, temporary signing keychains, and notarization proxy changes. Electron receives a local ad-hoc signature without certificates so the modified executable can run; the DMG is unsigned. Both preparation and the assembled application still run runtime integrity and smoke checks. Local builds omit update feeds, ZIPs, and release completion records, and the upload commands cannot publish them. macOS may require approval in System Settings → Privacy & Security to open an unnotarized application.
+
+### Local Official bundles from a loopback registry
+
+The test DMG excludes the provider runtimes the Official on-demand catalog advertises, and a release publishes matching bundle versions to npm. To install locally built bundles before that release, start a loopback registry that packs and serves the catalog's complete local dependency closure:
+
+```sh
+pnpm run dev:bundle-registry
+```
+
+The command validates the catalog and the workspace inventory, runs `pnpm run build:official`, packs the closure into a new `dist/test-bundles//` directory, writes `bundle-registry.json` last as the completion marker, and only then prints the artifact path, the registry URL, and the exact `name@version` specs. It serves `127.0.0.1` on an allocated port under a fresh namespace until Ctrl+C or SIGTERM, and stopping it leaves both the artifacts and the installed packages on disk. It needs no `.env.macos`, Apple credentials, or npm credentials, and it does not change `pnpm run package:desktop:unsigned`.
+
+In the packaged application, open Plugins → Add plugin, paste one printed spec, choose **Custom address**, paste the printed registry URL, and install. A custom registry is asked alone, so this process must answer every dependency: repository-owned packages come from the run's own archives, and third-party packages keep npm's real metadata and bytes through a fixed redirect to `registry.npmjs.org`, which still requires network access. The installed entry stays Official because its package name is in the catalog. The registry choice is remembered in this browser; choose an offered registry again to switch back.
+
+A run's artifacts are immutable, so a rebuild serves a new namespace and a new URL, and the Official **Update** control does not appear while the installed and running versions match. The profile records the previous run's tarball URL in `pnpm-lock.yaml`, and pnpm verifies recorded entries, so installing or reinstalling that bundle against a new URL is refused with `ERR_PNPM_TARBALL_URL_MISMATCH` and can leave the earlier files in place. To test changed code at the same version, clear the stale resolution first — `pnpm clean --lockfile` in `$DSH_HOME/profiles/`, or install into a fresh profile — then install again from the new URL. `bundle-registry.json` records each archive's version, filename, size, and SHA-512 integrity together with the packing checkout's commit and dirty flag.
+
+The served `time` is the real packing time, so pnpm 11's default 24-hour `minimumReleaseAge` records the exemption it granted in the profile's `pnpm-workspace.yaml` (`minimumReleaseAgeExclude`); an explicitly stricter policy there fails the installation with pnpm's own message instead of being overridden. A `@scope:registry` route in `~/.npmrc` or the profile's `.npmrc` overrides `--registry` for that scope, so it must not route the served scope.
+
### Runtime file selection
Desktop packs workspace packages locally and installs external dependencies through the target's bundled Node and pnpm. [Desktop's file policy](scripts/runtime-file-policy.ts) then filters the immutable `resources/app.asar/dsh/node_modules` copy before signing and integrity sealing. It omits TypeScript declarations, recognized JavaScript/CSS/TypeScript source maps, TypeScript build caches, Domino's test directory, selected native compiler outputs, and node-pty prebuilds for other platforms. It preserves runtime JavaScript, native modules and their DLL/EXE helpers, WASM, unknown assets, licenses, and notices. Dependency manifests pass through electron-builder's metadata cleanup before integrity sealing, so archiving preserves their recorded bytes. The policy does not alter npm tarballs, the bundled package manager, or user-installed plugin files.
The [Office conversion provider](../../packages/document/office-to-pdf/README.md) carries the target’s declared native engine, or WASM when the kit declares no matching native target. Preparation rejects a missing target engine before packaging. The complete Office dependencies, including CLI, JavaScript libraries, and the selected engine’s executables, data, licenses, and notices, are unpacked under `resources/app.asar.unpacked/dsh/node_modules/`. The Desktop Host resolves engine manifests to these physical directories and supplies loaded skills with absolute standalone Node and unpacked CLI paths. Node lives in `resources/runtime/primary-runtime/dependencies/node/bin/`; the CLI is the unpacked `@deepseek-ai/libreoffice-kit/lib/cli.js`. On macOS, the native helper receives the JIT entitlement required by [LibreOffice’s UNO bridge](https://github.com/LibreOffice/core/blob/master/sysui/desktop/macosx/hardened_runtime.xcent.in).
-The packaged application runs compiled JavaScript and pre-generated Typert metadata; it does not compile TypeScript plugins. Source-level debugger navigation and editor declarations remain available in development packages. [Copy-policy tests](tests/runtime-file-policy.spec.ts) cover exclusions and retained assets; The [payload smoke](tests/fixtures/runtime-payload-smoke.mjs) runs under Electron RunAsNode before the Host smoke and final inventory verification. The payload smoke resolves the search tool’s ripgrep executable and verifies text search and file enumeration. Signed Windows builds run these checks after dependency signing; other builds run them during `prepare:dsh`. The [Host smoke](scripts/smoke-runtime.ts) creates DOCX, XLSX, and PPTX inputs with bundled Python, converts each through the real Office provider, and checks PDF output. Every assembled application, including directory and unsigned Windows builds, repeats the payload and Host checks against ASAR. Archive integrity checks compare the complete archived descriptor with preparation, file bytes and membership in both archive and unpacked trees, recorded executable flags for archived files, and physical permissions for unpacked files. The Host smoke also obtains CLI paths from the loaded skill and runs capabilities and DOCX conversion with an empty PATH. Conversion failures stop packaging before a release record is written; macOS DMG/ZIP builds run these checks before notarization.
+The packaged application runs compiled JavaScript and pre-generated Typert metadata; it does not compile TypeScript plugins. Source-level debugger navigation and editor declarations remain available in development packages. [Copy-policy tests](tests/runtime-file-policy.spec.ts) cover exclusions and retained assets; The [payload smoke](tests/fixtures/runtime-payload-smoke.mjs) runs under Electron RunAsNode before the Host smoke and final inventory verification. The payload smoke resolves the search tool’s ripgrep executable and verifies text search and file enumeration. Signed Windows builds run these checks after dependency signing; other builds run them during `prepare:dsh`. The [Host smoke](scripts/smoke-runtime.ts) creates DOCX, XLSX, and PPTX inputs with bundled Python, converts each through the real Office provider, and checks PDF output. Every assembled application, including directory and unsigned builds, repeats the payload and Host checks against ASAR. Archive integrity checks compare the complete archived descriptor with preparation, file bytes and membership in both archive and unpacked trees, recorded executable flags for archived files, and physical permissions for unpacked files. The Host smoke also obtains CLI paths from the loaded skill and runs capabilities and DOCX conversion with an empty PATH. Conversion failures stop packaging before a release record is written; macOS DMG/ZIP builds run these checks before notarization.
Windows release qualification also runs [directory and replacement checks](scripts/smoke-windows.ps1) manually after the Desktop build. Set `$Makensis`, `$SevenZip`, and `$PluginDir` to the pinned builder’s NSIS compiler, 7-Zip executable, and x86-unicode NSIS plugin directory; pass the prepared `window-frame.dll` as `-FrameLibrary` to exercise the native extraction path and its failure report as well. From the repository root, run the command below. It verifies directory replacement and rollback, and both locked-file replacement modes; it is not part of the unit-test lane.
@@ -289,7 +322,7 @@ The target dotenv file for internal-test packaging explicitly sets `DSH_DESKTOP_
Early internal-test packages use the `test` deployment. Select `production` explicitly only for a production release; changing upload credentials does not retarget an existing package. Packaging requires no COS credentials, disables electron-builder publishing, strips COS credentials from child processes, and records completion only after signing and notarization succeed. Upload validates this record, deployment, target, shared version, filenames, sizes, and SHA-512 before reading credentials. Packages and blockmaps upload before YAML; historical objects are retained. Every release publishes `nightly.yml` or `nightly-mac.yml`; stable releases also publish `latest.yml` or `latest-mac.yml` pointing at the same artifacts. Published YAML uses absolute binary URLs. The uploader leaves Cache-Control unset, including the empty header the COS SDK would otherwise add: deployment infrastructure owns cache policy, with uncached feeds and separately configurable binary caching. Serialize publication per target and verify public artifacts and feed contents before release qualification.
-The macOS configuration uses the required release environment instead of accepting whichever certificate appears first in a keychain. It rejects empty values, a malformed Team ID, a signing identity that includes electron-builder's unsupported `Developer ID Application:` prefix, and incomplete notarization credentials. macOS packaging requires the configured identity and its private key. Runtime preparation applies that identity, a secure timestamp, and hardened runtime to every embedded Mach-O file; after signing the application, a deep strict check rejects any other leaf authority or Team ID before artifact creation. The fixed-target macOS installer commands create separate copies of the signed application and run two artifact lanes concurrently. One lane notarizes and staples the App before generating the ZIP and its update metadata. The other encloses its signed App copy in a signed DMG, then notarizes, staples, and verifies the DMG; its inner App has no individually stapled ticket. Both lanes must finish successfully before their artifacts reach the final directory and the release completion record is written. Directory-only commands also require notarization credentials and wait for Apple notarization and App stapling. The [parallel notarization decision](../../.agents/notes/implemented/process/2026-09-09-parallel-macos-notarization.md) owns copy isolation and container ticket semantics. `CSC_LINK` must name a local p12 containing the Developer ID Application certificate and private key; URLs and Base64 inputs are not supported. `CSC_KEY_PASSWORD` is its export password, not an Apple account or login password; an explicitly empty value supports an unencrypted p12. Before building, packaging creates and unlocks a private temporary keychain, imports the p12, authorizes signing, and signs a small probe. Runtime and App signing use this keychain explicitly; existing login keychains require no setup or manual unlocking. Child processes receive its path without the p12 password. The keychain is deleted after success or ordinary failure; CI must clean temporary credentials after forced termination. CI writes the certificate and `.env.macos` from its secret store, restricts file access, and deletes both after the job. Ambient `CSC_NAME` and certificate discovery order do not select the release owner. Notary credentials may instead use electron-builder's complete Apple ID or keychain-profile strategy. The two macOS identity variables are also required when repeating the application check manually with `pnpm --dir apps/desktop run verify:mac-signature -- `.
+The signed macOS configuration uses the required release environment instead of accepting whichever certificate appears first in a keychain. It rejects empty values, a malformed Team ID, a signing identity that includes electron-builder's unsupported `Developer ID Application:` prefix, and incomplete notarization credentials. Signed macOS packaging requires the configured identity and its private key. Runtime preparation applies that identity, a secure timestamp, and hardened runtime to every embedded Mach-O file; after signing the application, a deep strict check rejects any other leaf authority or Team ID before artifact creation. The signed fixed-target macOS installer commands create separate copies of the signed application and run two artifact lanes concurrently. One lane notarizes and staples the App before generating the ZIP and its update metadata. The other encloses its signed App copy in a signed DMG, then notarizes, staples, and verifies the DMG; its inner App has no individually stapled ticket. Both lanes must finish successfully before their artifacts reach the final directory and the release completion record is written. Signed directory-only commands also require notarization credentials and wait for Apple notarization and App stapling. The [parallel notarization decision](../../.agents/notes/implemented/process/2026-09-09-parallel-macos-notarization.md) owns copy isolation and container ticket semantics. `CSC_LINK` must name a local p12 containing the Developer ID Application certificate and private key; URLs and Base64 inputs are not supported. `CSC_KEY_PASSWORD` is its export password, not an Apple account or login password; an explicitly empty value supports an unencrypted p12. Before building, packaging creates and unlocks a private temporary keychain, imports the p12, authorizes signing, and signs a small probe. Runtime and App signing use this keychain explicitly; existing login keychains require no setup or manual unlocking. Child processes receive its path without the p12 password. The keychain is deleted after success or ordinary failure; CI must clean temporary credentials after forced termination. CI writes the certificate and `.env.macos` from its secret store, restricts file access, and deletes both after the job. Ambient `CSC_NAME` and certificate discovery order do not select the release owner. Notary credentials may instead use electron-builder's complete Apple ID or keychain-profile strategy. The two macOS identity variables are also required when repeating the application check manually with `pnpm --dir apps/desktop run verify:mac-signature -- `.
macOS signing visits real files without following Framework symlink aliases. PAK resources retain all shipped languages and are sealed by the enclosing Framework or application signature instead of receiving individual signatures. The [release policy](../../.agents/notes/implemented/architecture/2026-08-25-electron-desktop-packaging-and-updates.md) owns the dependency patch and verification requirements.
@@ -323,11 +356,11 @@ The command requires `DSH_DESKTOP_APP_ID` and the normal build dependencies, inc
### Windows installer interface
-The Windows installer uses native NSIS pages with light and dark palettes, system shadows, an editable installation directory, and a finish page whose launch checkbox is selected by default. Installation is restricted to the current user. Clicking Install or pressing Enter validates the current path; new destinations must be empty, and nonempty destinations must be registered installations. Running executables at the affected installation path produce a native prompt and remain running; same-named applications in other directories do not block installation. Silent updates wait up to ten seconds for the affected application to exit, then stop with exit code 2 if it is still running.
+The Windows installer uses native NSIS pages with light and dark palettes, system shadows, an editable installation directory, and a finish page whose launch checkbox is selected by default. Installation is restricted to the current user. Clicking Install or pressing Enter validates the current path; drive roots remain invalid after normalization, including repeated trailing separators. New destinations must be empty, and nonempty destinations must be registered installations. Running executables at the affected installation path produce a native prompt and remain running; same-named applications in other directories do not block installation. Silent updates wait up to ten seconds for the affected application to exit, then stop with exit code 2 if it is still running.
The theme follows Windows at startup; `/THEME=light`, `/THEME=dark`, and `/THEME=auto` select a palette explicitly. The window appears after its branded controls are ready. When the welcome page first appears, the installer moves above ordinary windows once and flashes its taskbar button if another window has focus; it does not remain always on top. Progress reads the pinned 7-Zip extractor’s percentage; directory promotion, registration, and cleanup retain bounded estimates. The weighted percentage does not predict remaining time. After NSIS reports success, the bar fills over 600 ms and displays 100% briefly before the finish page appears; the transition targets 750 ms. The finish page preserves the window position. Finish dismisses the installer before launching the installed executable; a launch failure restores the page for retry. Directory replacement and failure recovery follow the installation flow described above. First-launch profile preparation remains a separate Desktop operation.
-Windows packaging compiles an x86 Win32/GDI+ helper with Visual C++ Build Tools and a Windows SDK; signed builds sign this helper through the configured Windows signer. The preparation hook leaves production dependency collection to electron-builder on every platform. The [installer decision](../../.agents/notes/implemented/architecture/2026-09-10-windows-native-installer-pages.md) records the NSIS integration and release checks.
+Windows packaging compiles an x86 Win32/GDI+ helper with Visual C++ Build Tools and a Windows SDK; signed builds sign this helper through the configured Windows signer. The preparation hook leaves production dependency collection to electron-builder on every platform.
Run `pnpm --dir apps/desktop run test:installer` from the repository root on an interactive Windows x64 desktop to build and exercise a small native test payload through the production installer configuration. Each run uses a unique product identity and sequentially exercises English-only and Chinese-only installer variants, selecting test labels from the displayed welcome button. Both variants install into private directories and uninstall after testing; screenshots and results remain under `.desktop-build/installer-tests/`. The checks include upgrades to registered paths with trailing separators and rejection of drive roots. The optional `--signed` flag uses the Windows EV configuration below to sign test executables and the helper before embedding them; it does not enable an update feed.
@@ -390,9 +423,9 @@ pnpm run prepare:desktop
This diagnostic command is an alternative stopping point, not the first half of a two-command build. A later `package:desktop*` command repeats the official build and preparation so it cannot consume stale dsh packages, runtime files, or dsh content.
-Every package command builds the repository, packs the first-party production closures rooted at dsh and the private Desktop Host, and prepares the target Electron distribution and pnpm CLI. `prepare:dsh` installs the production graph once at build time, prepares materialized packages for electron-builder to archive under `app.asar/dsh`, removes package-manager metadata, and writes `desktop-runtime.json` with shared package versions and final file hashes. On macOS it signs and verifies native files before inventory generation; electron-builder excludes this already-signed tree from nested re-signing. Resource mappings explicitly include `dsh/node_modules`, which the default root-directory filter omits; the prepared runtime inventory is checked after native signing. Native executables and libraries are unpacked beside ASAR; Python, standalone Node and pnpm remain in external runtime resources. Windows packaging checks every prepared PE against its ASAR unpacked entry and byte-identical disk copy, including unsigned builds. Builder glob rules match braces in PE filenames as single-character wildcards, so a matching neighboring file may also be unpacked. Prepared runtime smoke uses the verified target descriptor rather than the build host architecture. Signed installer, notarization, installed upgrade, and target-specific native-module qualification require the release environment.
+Every package command builds the repository, packs the first-party production closures rooted at dsh and the private Desktop Host, and prepares the target Electron distribution and pnpm CLI. `prepare:dsh` installs the production graph once at build time, prepares materialized packages for electron-builder to archive under `app.asar/dsh`, removes package-manager metadata, and writes `desktop-runtime.json` with shared package versions and final file hashes. Signed macOS builds sign and verify native files before inventory generation; electron-builder excludes this already-signed tree from nested re-signing. Resource mappings explicitly include `dsh/node_modules`, which the default root-directory filter omits; the prepared runtime inventory is checked after native signing. Native executables and libraries are unpacked beside ASAR; Python, standalone Node and pnpm remain in external runtime resources. Windows packaging checks every prepared PE against its ASAR unpacked entry and byte-identical disk copy, including unsigned builds. Builder glob rules match braces in PE filenames as single-character wildcards, so a matching neighboring file may also be unpacked. Prepared runtime smoke uses the verified target descriptor rather than the build host architecture. Signed installer, notarization, installed upgrade, and target-specific native-module qualification require the release environment.
-macOS packaging writes `Contents/Resources/app-update.yml` while assembling the App and before code signing, including the directory build that feeds the parallel ZIP and DMG lanes. The signing hook verifies the exact feed and updater cache directory. Both lane copies and the promoted App are checked again before the release completion record is written; a missing or mismatched configuration prevents artifact promotion and therefore prevents upload.
+Signed macOS packaging writes `Contents/Resources/app-update.yml` while assembling the App and before code signing, including the directory build that feeds the parallel ZIP and DMG lanes. The signing hook verifies the exact feed and updater cache directory. Both lane copies and the promoted App are checked again before the release completion record is written; a missing or mismatched configuration prevents artifact promotion and therefore prevents upload.
An unpacked artifact contains Electron, the materialized dsh production tree, pnpm, and the shell application. Installer size and filesystem size differ; release qualification measures both, plus the profile’s plugin storage and first-launch latency. The runtime trades more application files for eliminating core package installation on the user’s machine.
@@ -412,9 +445,11 @@ If task teardown fails after confirmed Host exit, installation is refused and th
Confirmed Host exit without successful task teardown displays localized recovery guidance in both ordinary and mandatory update dialogs. A typed preparation cause selects that guidance in each locale; changing translated wording cannot reclassify the failure. “View technical details” is collapsed by default and exposes only exit status, signal, shutdown acknowledgement, and deadline facts, not plugin stderr. Expanding it neither retries nor authorizes installation.
+
+
### Mandatory update policy
-The [mandatory client decision](../../.agents/notes/implemented/feature/2026-09-11-desktop-mandatory-update-client.md) owns policy polling and the blocking window. Packaging reads `.env.windows` or `.env.macos`: `DSH_DESKTOP_AUTO_UPDATE_ENV=test` (the default) selects `DSH_DESKTOP_MANDATORY_UPDATE_TEST_ORIGIN`; `production` selects `DSH_DESKTOP_MANDATORY_UPDATE_PROD_ORIGIN`. The templates leave both origins blank; fill in the selected deployment origin in the ignored local dotenv file. The selected origin is required before preparation or signing, including unsigned and preparation-only builds; the unselected origin is optional. These settings never fall back to the parent environment or the other deployment. Packaging embeds the selected policy with the application ID; packaged applications ignore runtime overrides.
+Packaging reads `.env.windows` or `.env.macos`: `DSH_DESKTOP_AUTO_UPDATE_ENV=test` (the default) selects `DSH_DESKTOP_MANDATORY_UPDATE_TEST_ORIGIN`; `production` selects `DSH_DESKTOP_MANDATORY_UPDATE_PROD_ORIGIN`. The templates leave both origins blank; fill in the selected deployment origin in the ignored local dotenv file. Local unsigned macOS builds omit this policy and do not read either file. Other modes require the selected origin before preparation or signing, including unsigned Windows and preparation-only builds; the unselected origin is optional. These settings never fall back to the parent environment or the other deployment. Packaging embeds the selected policy with the application ID; packaged applications ignore runtime overrides.
`DSH_DESKTOP_MANDATORY_UPDATE_CONFIG` JSON supplies test login origins and optional polling and download-page options; packaging rejects `origin` and `authentication` inside it. The page allowlist defaults to the selected service origin; explicitly allow other approved download-page origins when needed. Test builds select `feishu-test` and require `allowedAuthOrigins` in `DSH_DESKTOP_MANDATORY_UPDATE_CONFIG`; production selects `anonymous` and rejects that field. Each login origin must be an HTTPS origin without credentials, path, query, or fragment. The login window permits document navigation only to the selected policy origin and these configured origins. Policy requests reject redirects; only test authentication carries gateway cookies. Unpackaged development instead reads a complete policy JSON from this variable and requires `DSH_DESKTOP_APP_ID`; absent JSON disables development policy queries, and only anonymous development permits HTTP `127.0.0.1`. A user-initiated ordinary check triggers policy work concurrently but never waits for or reports a policy failure. Only a confirmed blocking decision cancels ordinary dialogs. Test authentication waits until the active ordinary dialog finishes, and cancellation or failure does not discard the updater result.
diff --git a/apps/desktop/README.zh.md b/apps/desktop/README.zh.md
index 61caaf038d..d8256885dc 100644
--- a/apps/desktop/README.zh.md
+++ b/apps/desktop/README.zh.md
@@ -4,7 +4,7 @@
桌面埋点遵循[产品采集策略](../../packages/client/product-analytics/README.zh.md)及其动态应用配置，不包含 Web 使用情况。安装更新会等待该操作的本地埋点接收请求结束，再锁定 API 准入并停止 Host。接收请求的时限为一秒，失败不会阻止安装，也不等待收集端完成发送。
-桌面应用是完整 dsh Web 应用外的一层 Electron 壳。Electron RunAsNode 子进程启动共享 profile runner，Electron 立即从 `dsh-app://app/` 加载打包内的 Web 入口。共享加载页等待 Host 启动注入，然后在同一文档中启动客户端。Electron 将应用 HTTP 请求转发给已认证的 Web Host，转发时丢弃描述 Node fetch 连接而非资源本身的响应头（`transfer-encoding`、`connection`、`keep-alive`），并把插件 bundle 响应标记为 `no-store`，因为其每次启动都变化的 revision 只会在 Chromium 磁盘缓存中累积；WebSocket 流连接到该 Host，仅为归属的应用窗口附加凭据。Node IPC 承载启动注入、就绪与关闭。Desktop 默认使用端口 `19387`，与 Web 的 `3080` 分开；可通过 `webserver.config.port` patch 覆盖。
+桌面应用是完整 dsh Web 应用外的一层 Electron 壳。Electron RunAsNode 子进程启动共享 profile runner，Electron 立即从 `dsh-app://app/` 加载打包内的 Web 入口。共享加载页等待 Host 启动注入，然后在同一文档中启动客户端。Electron 将应用 HTTP 请求转发给已认证的 Web Host，转发时丢弃描述 Node fetch 连接而非资源本身的响应头（`transfer-encoding`、`connection`、`keep-alive`），并把插件 bundle 响应标记为 `no-store`，因为其每次启动都变化的 revision 只会在 Chromium 磁盘缓存中累积；WebSocket 流连接到该 Host，仅为归属的应用窗口附加凭据。Node IPC 承载启动注入、就绪与关闭。Desktop 默认监听系统分配的端口，因此不会与 Web 的 `3080` 或系统保留端口冲突；可通过 `webserver.config.port` patch 覆盖。
应用菜单第一项“**关于 DeepSeek Harness**”打开 Electron 原生关于面板，展示应用图标、产品名称和当前安装的发布版本。菜单文案跟随桌面壳的语言。macOS 的隐藏、隐藏其他、显示全部和退出条目使用本地化文案，隐藏和退出条目包含 DeepSeek Harness 产品名称。这些条目保留原生动作和快捷键。macOS 从应用包读取图标，因此未打包的开发启动会显示 Electron 图标；Windows 使用随包分发的 PNG。
@@ -14,7 +14,7 @@ Creator 和 Web Plugin Manager 在 Electron Node 模式下使用 Desktop 内置
Platform 内嵌文档使用持久化 WebContentsView 分区，分区名由 Platform 来源和稳定账号 ID 的哈希决定。localStorage 中的页面偏好（包括已关闭的通知）在关闭视图和重启应用后保留；不同账号和来源使用独立存储。账号 ID 来自 Host 最近一次成功的资料读取；尚无该 ID 时，文档在一次性分区中打开，该分区不跨次保留偏好。打开持久分区会先清理 Cookie、文件系统、IndexedDB、Cache Storage、HTTP 与着色器缓存、Service Worker 及 HTTP 认证状态；一次性分区则清理其全部存储。关闭视图会销毁文档、移除请求拦截器并安排相同的清理，因此异常退出遗留的认证会在下一个文档加载前被清除。下次打开和应用退出都会等待该清理完成，更新安装也会在安装器接管退出前等待。清理失败会使该次打开失败，并在后续清理成功前阻止同一账号打开；其他账号不受影响。退出登录会销毁文档，但保留账号偏好供下次登录使用。同一凭证下账号 ID 迟到时，已以一次性分区打开的文档保持挂载；下次打开使用账号分区。[存储决策](../../.agents/notes/implemented/architecture/2026-09-22-platform-browser-storage.zh.md)说明保留策略。Host 通过私有 Node IPC 发送账号凭证；账号 RPC 和 Harness 渲染进程不接收 token。Platform preload 在页面脚本执行前通过一次同步 IPC 读取主进程中已准备的凭证。它暴露 displayMode、同步的 getAuthToken() 和 getLocale() getter，以及返回取消订阅函数的 onLocaleChange(listener)。两个 getter 都只读取 preload 内存，不再调用 IPC。bootstrap 包含 Desktop 已解析的语言（`zh_CN` 或 `en_US`）；Settings 语言变更会更新 preload 缓存并通知已打开的 Platform 文档，无需重载。Platform 在首屏渲染前应用该语言，且不将其持久化为浏览器偏好。主进程处理器仅校验调用来源并读取内存，不等待 Host、磁盘或网络。可信页面初始化失败时保留内嵌模式，由 getter 抛错，避免回退到浏览器凭证。只有受控 Platform 页面中、位于所配置签发来源的主 frame 能完成初始化。退登、凭证替换、Host 关闭及视图关闭都会销毁文档。跨来源文档导航被阻止。请求新窗口的 HTTPS 链接在系统浏览器中打开，不携带内嵌会话或 token；其他协议及带 URL 凭证的链接被拒绝。原生视图占据 Account 功能返回栏下方的视口。
-Desktop Host 的 Platform API 请求与更新策略请求用相同的 Platform 客户端请求头标识已安装客户端：平台、客户端版本、语言、以秒为单位的时区偏移，以及有意保持为空的 bundle id。账号操作按调用逐次传入调用界面的身份；账号 provider 管理[仅 API 使用的请求头配置](../../packages/credentials/deepseek-account-platform/README.zh.md#use-this-package)。更新策略额外上报架构、更新通道和内置运行时版本。
+Desktop Host 的 Platform API 请求与更新策略请求用相同的 Platform 客户端请求头标识已安装客户端：平台、客户端版本、语言、以秒为单位的时区偏移，以及有意保持为空的 bundle id。账号操作按调用逐次传入调用界面的身份；账号 provider 管理[仅 API 使用的请求头配置](../../packages/credentials/deepseek-account-platform/README.zh.md#use-this-package)。更新策略额外上报架构、更新通道和内置运行时版本。 原生账号状态解析器接受 `no-response` 登录失败，并在供 UI 使用的安全投影中保留该错误码。
账号凭据被服务端判定失效后，未配置官方 API key 时返回 Welcome；有可用 API key 时保持工作区打开。主动退出登录遵循相同规则。Welcome 和工作区均显示本地化的登录失效提示。
@@ -58,7 +58,7 @@ macOS PNG 使用带留白的圆角底板，供传统 ICNS 打包使用，包含
### 内置工作区依赖
-electron-builder 只把清单中的 `dependencies` 复制进 `app.asar/node_modules`，因此 Electron 主进程 bundle `lib/main.js` 内联其工作区 devDependencies，裸导入只剩 `electron`、Node 内置模块与这些 `dependencies`；沙箱 preload 只能留下 `electron`、`events`、`timers` 与 `url`，即其 `require` polyfill 能解析的模块。主进程 bundle 从被内联包的 `lib/` 产物解析它们，所以根 `build:lib:host` 在并发的工作区 tsdown 阶段之后才为 `apps/desktop` 打 bundle，并由 [`desktop-bundle-imports`](scripts/desktop-bundle-imports.mjs) 让任何静态、动态或 `require()` 导入无法在打包应用内解析的 Desktop bundle 直接失败。没有这项检查时，rolldown 无法解析的导入会作为外部说明符进入产物，并在启动时以 `ERR_MODULE_NOT_FOUND` 失败。[bundle 顺序决策](../../.agents/notes/implemented/process/2026-09-22-desktop-main-bundle-after-workspace-tsdown.zh.md)记录了备选方案。
+electron-builder 只把清单中的 `dependencies` 复制进 `app.asar/node_modules`，因此 Electron 主进程 bundle `lib/main.js` 内联其工作区 devDependencies，裸导入只剩 `electron`、Node 内置模块与这些 `dependencies`；沙箱 preload 只能留下 `electron`、`events`、`timers` 与 `url`，即其 `require` polyfill 能解析的模块。主进程 bundle 从被内联包的 `lib/` 产物解析它们，所以根 `build:lib:host` 在并发的工作区 tsdown 阶段之后才为 `apps/desktop` 打 bundle，并由 [`desktop-bundle-imports`](scripts/desktop-bundle-imports.mjs) 让任何静态、动态或 `require()` 导入无法在打包应用内解析的 Desktop bundle 直接失败。没有这项检查时，rolldown 无法解析的导入会作为外部说明符进入产物，并在启动时以 `ERR_MODULE_NOT_FOUND` 失败。[已归档的bundle 顺序决策](../../.agents/notes/archived/process/2026-09-22-desktop-main-bundle-after-workspace-tsdown.md)记录了备选方案。
Windows 签名打包按 PE 文件内容扫描第一方运行时和应用生产依赖，包括没有常规扩展名的文件。最终扫描覆盖整个解包应用。目录链接、格式错误的 `MZ` 文件以及非 PE 的 `.exe`、`.dll` 或 `.pyd` 文件会使打包停止；以 `MZ` 开头的数据文件也会被拒绝，除非包含有效 PE 头。它保留有效的上游签名，并在记录运行时哈希或执行冒烟检查前为未签名代码补签。公钥验签每个进程处理最多 32 个文件，同时最多运行四个进程；硬件令牌签名仍串行执行，每个新签名必须匹配配置的证书且带时间戳。硬件签名或验签失败会停止本轮执行；独立的时间戳请求遵循下文的有界重试规则。electron-builder 只有在验签和逐字节比对通过后，才保留复制后运行时可执行文件的签名。写入发布完成记录前，必须通过最终 PE 签名检查，以及使用全新缓存的 ASAR 载荷和 Host 冒烟检查。开发、仅准备和未签名构建不使用硬件令牌，可能被 Windows 代码完整性策略阻止；任何构建模式都不会关闭该策略。冒烟检查通过不代表兼容所有企业策略。
@@ -86,9 +86,11 @@ Node 准备内置解释器和 Python 库，无需系统 Python 或 pip。[下载
Welcome 加载共享 Toast 的配色和阴影变量，挂载在 body 下的通知使用系统字体。
+
+
## 内置命令运行时
-安装后的 `resources/runtime/cli/bin/dsh` shell 脚本（Windows 为 `dsh.cmd`）使用 Desktop 的 Electron 可执行文件和内置 pnpm 运行普通 CLI 分派入口。Desktop 关闭时也可使用，并保留 [Electron 运行时限制](../../.agents/notes/implemented/architecture/2026-09-11-desktop-electron-node-runtime.zh.md)。普通 profile、配置和插件命令与 npm dsh 使用相同实现；该命令不会打开 Desktop。
+安装后的 `resources/runtime/cli/bin/dsh` shell 脚本（Windows 为 `dsh.cmd`）使用 Desktop 的 Electron 可执行文件和内置 pnpm 运行普通 CLI 分派入口。Desktop 关闭时也可使用，并保留 Electron 运行时限制。普通 profile、配置和插件命令与 npm dsh 使用相同实现；该命令不会打开 Desktop。
管理 Desktop 插件前，先启动一次 Desktop 以初始化其 profile，完全退出应用，再运行 `dsh plugin --profile desktop add `、`list` 或 `remove