Merge remote-tracking branch 'origin/master' into fix/multiline-display-math

2026-09-22 04:24:54 +08:00
commit ba46f347cf
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-07-23-client-plugin-loading-model.md
-2026-07-23-client-plugin-loading-model.md: a8d016a70792ad4ac6a71083677ce5d82a30af0a
-2026-07-23-client-plugin-loading-model.zh.md: 1b94909c9611f01e5a6d7fcb50ec3f91ee88fab1
+2026-07-23-client-plugin-loading-model.md: b8c23108a7a1cf3a04ded373d8705bae626c70c2
+2026-07-23-client-plugin-loading-model.zh.md: efaea843120e5b023bbc8f59663ea47468944c71
@@ -46,7 +46,7 @@ A `require.async("./client.<name>.js")` call requests the exact revisioned `/plu

 The shared tsdown preset emits a map for every plugin entry and chunk and rewrites first-party source paths into the browser-resolvable repository form `/packages/<group>/<package>/src/...`. The production Client pass consumes `lib/types`; the preset supplies each tsc map to Rolldown and fills `sourcesContent` from the original files, so the final map reaches TypeScript/TSX instead of stopping at emitted JavaScript. Other workspace sources inlined into a bundle likewise resolve to their `packages/` owner, while dependency paths remain unchanged. Combo generation strips each local debug directive, records its generated-line offset, resolves every authored source against the original per-plugin map URL, and emits an Indexed Source Map v3. An authored map supplies its section; otherwise an identity section embeds the generated bundle and uses the packer's `sourceURL` as its source name when present. The absolute combo map URL mirrors the script resource list by changing every `client.js` suffix to `client.js.map`, so `/plugins/??<package-a>/client.js,<package-b>/client.js&rev=<rev>` points to `/plugins/??<package-a>/client.js.map,<package-b>/client.js.map&rev=<rev>`. A chunk script likewise points to its own map URL. Source-map files are read and combined only when those map URLs receive `GET`; `HEAD` materializes neither script nor map bodies. The Vite shell also emits source maps, letting shell code and externally loaded plugins map stacks and performance profiles back to TypeScript/TSX.

-The graph retains each row's revisioned one-resource combo URL for HMR and adds a revisioned descriptor for every startup combo request; several descriptors may carry the same scheduling phase. Initial row revisions are opaque process nonces rather than content hashes; they keep the snapshotted one-resource response immutable without hashing every plugin at startup. The shared preset stamps the entry after every package output is written. After the watcher observes that completed-build stamp, `rebuilt(id)` hashes the entry bytes together with its timestamp and publishes the resulting revision; a chunk-only build therefore advances the owner revision without a Host-side sibling scan. Startup combo revisions derive from the ordered row revisions. Script bodies are assembled on their first `GET`; source-map files are read and combined separately on their first map `GET`. `HEAD` materializes neither body. Versioned scripts and maps use immutable caching, and unrelated graph recomposition retains already-materialized chunk responses at the same revision. The Host serves only exact generated URLs; stale revisions and unadvertised resource lists return 404 instead of aliasing different bytes. An external script's `error` event exposes neither response status nor body, so failure diagnostics name only the URL; the same-origin Host and build-stamped registration id form the identity boundary, while the post-`load` factory-presence check rejects an artifact that did not register the expected id.
+The graph retains each row's revisioned one-resource combo URL for HMR and adds a revisioned descriptor for every startup combo request; several descriptors may carry the same scheduling phase. Initial publication and `rebuilt(id)` use the same hash of entry mtime, ctime, and size; artifact contents never enter the hash. Ctime distinguishes rewrites that preserve mtime and size. A Host restart over unchanged artifacts therefore retains every row revision, so the reconnecting SSE snapshot does not trigger browser plugin replacement. The shared preset stamps the entry after every package output is written; a chunk-only build therefore advances the owner revision without a Host-side sibling scan. Startup combo revisions derive from the ordered row revisions. Script bodies are assembled on their first `GET`; source-map files are read and combined separately on their first map `GET`. `HEAD` materializes neither body. Versioned scripts and maps use immutable caching, and unrelated graph recomposition retains already-materialized chunk responses at the same revision. The Host serves only exact generated URLs; stale revisions and unadvertised resource lists return 404 instead of aliasing different bytes. An external script's `error` event exposes neither response status nor body, so failure diagnostics name only the URL; the same-origin Host and build-stamped registration id form the identity boundary, while the post-`load` factory-presence check rejects an artifact that did not register the expected id.

 ### The loading flow, end to end

@@ -56,7 +56,7 @@ What happens between `dsh web` starting and the UI appearing? Three stages: the

 1. The composing app (`apps/cli`) ships the roster as ordinary rows in its `cordis.yml` config tree — client plugin packages are entry rows like every host plugin, including the always-mounted `client-hmr` row. `auditStartupEntries` reports failed imports, activation errors with their original stacks, and pending dependencies; optional entries warn and required entries reject startup ([startup policy](2026-09-09-consumer-owned-startup-strictness.md)).
 2. The `dsh-client-modules` node half (the package is dual-face: its browser half is the module table) resolves each live Loader entry through the same `name` and owning-tree `baseUrl` inputs that imported its Host face, then reads the nearest owning package.json `dsh.client` declaration and composes `window.__DSH_BOOT__`: `{ rev, entries: [{ id, url, rev, inject?, immediately?, external? }], batches: [{ phase, url, rev, entries }] }`. The manifest package name is the browser module identity even when an overlay names a relative source or built entry file. Distinct active Loader sources resolving to one package name fail composition; after one source unloads, the surviving source supplies the row without a fiber restart. The row's three optional fields come from manifests, never hand-copied. Composition orders requested dynamic rows before their consumers, rejects synchronous request cycles, and assigns every row to exactly one initial batch. It refuses declared plugins without built `./client` bundles and groups their package/path rows under one required source-build instruction; malformed declaration fields also fail activation, and the Host audit reports either error from the FAILED fiber.
-3. Scanning is incremental per package — there is no full-rescan code path. Each cordis `internal/plugin` emission marks the fiber's entry name dirty (entry-less fibers drop O(1)); a microtask flush reconciles each dirty name against live loader entries, with package metadata (including the negative "not a client package" verdict) cached per entry name and owning-tree base URL for the process lifetime and bundle re-hashing reachable only through `rebuilt(id)`. The activation pass seeds the same dirty set from current entries and flushes synchronously, so first scan and steady state share one implementation. Initial rows receive an opaque process nonce plus sequence without hashing their artifacts; startup combo revisions hash the combined script inputs plus indexed map, and the rows plus batch descriptors hash into `graph.rev`. The graph types are single-sourced in the modules package's `./client` export — the webserver knows nothing about the graph, while modules registers the combo route and contributes structured index-injection rows.
+3. Scanning is incremental per package — there is no full-rescan code path. Each cordis `internal/plugin` emission marks the fiber's entry name dirty (entry-less fibers drop O(1)); a microtask flush reconciles each dirty name against live loader entries, with package metadata (including the negative "not a client package" verdict) cached per entry name and owning-tree base URL for the process lifetime and changed bundle publication reachable only through `rebuilt(id)`. The activation pass seeds the same dirty set from current entries and flushes synchronously, so first scan and steady state share one implementation. Initial rows hash their pre-read filesystem metadata; startup combo revisions hash the ordered row identities and revisions, and the rows plus batch descriptors hash into `graph.rev`. The graph types are single-sourced in the modules package's `./client` export — the webserver knows nothing about the graph, while modules registers the combo route and contributes structured index-injection rows.

 Why is the roster yml rows and not a scan? Because which plugins compose into a deployment is a composition decision, not a package property — a package declaring `dsh.client` in the repo does not mean this deployment mounts it, so discovery-by-scan cannot make that call; the node half scans only what the tree actually mounted.

@@ -80,7 +80,7 @@ The Host SSE adapter forwards existing graph-change notifications and sends the

 Hot reload is a composition decision: the web bundle mounts the `client-hmr` row (a normal plugin package) unconditionally; its node half brings the bundle watch and the SSE channel, and the chain stays idle until a rebuild watcher rewrites client bundles. A composition that must not expose it disables the row.

-How does a rebuilt bundle become a reload signal? The hmr node half observes it itself — no builder tells it. Before reading each startup snapshot, the module host captures the entry stat baseline and exposes it through `ctx.clientModules.artifactBaseline(id)`. One HMR-owned interval compares every current graph row with that baseline. An unchanged row starts watching without a content read or hash; a write after baseline capture is already a stat delta and only that row enters `rebuilt(id)`. This avoids both an initial all-row re-hash and `fs.watchFile`, whose asynchronous first baseline can silently absorb a construction-time rebuild. Watch membership follows `onGraphChanged`; vanished rows drop out, and an entry missing at poll time keeps its row dirty so reappearance forces a new revision even with identical metadata. The shared tsdown preset stamps `client.js` after every sibling output has been written; on an entry mtime or size delta, or a dirty row, `rebuilt(id)` derives the revision from the entry bytes and completed-build timestamp. A chunk-only edit therefore changes the revision, and a partial write followed by the completion stamp supplies a later stat change that self-heals. When the `rev` changes, the node half broadcasts a `rebuilt` frame on `GET /plugins/events` — a system SSE channel that sends the full graph on connect and `rebuilt` frames on change, presentation-only wire that never enters the session log. Polling is deliberate because inotify does not fire on the weka network mount, the same reason the build-side watcher needs `--poll`; one entry stat per row and interval is sufficient, the interval is a validated config field (default 500ms), and disposal clears the one timer. Rebuilding artifacts is any process using the shared Client tsdown preset — `scripts/dev-web.ts` remains the watch-build entry point, discovering its package list through `dsh.client` while scanning `packages/*/*/package.json` at startup — and builder and host share no notification protocol.
+How does a rebuilt bundle become a reload signal? The hmr node half observes it itself — no builder tells it. Before reading each startup snapshot, the module host captures the entry stat baseline and exposes it through `ctx.clientModules.artifactBaseline(id)`. One HMR-owned interval compares every current graph row with that baseline. An unchanged row starts watching without a content read or hash; a write after baseline capture is already a stat delta and only that row enters `rebuilt(id)`. This avoids redundant reads when installing the watcher and avoids `fs.watchFile`, whose asynchronous first baseline can silently absorb a construction-time rebuild. Watch membership follows `onGraphChanged`; vanished rows drop out, and an entry missing at poll time keeps its row dirty so reappearance retries publication even when mtime and size match the baseline. The shared tsdown preset stamps `client.js` after every sibling output has been written; on an entry mtime, ctime, or size delta, or a dirty row, `rebuilt(id)` derives the revision from those three metadata values. It reads the new bundle snapshot only if the revision changes. A chunk-only edit therefore changes the revision, and a partial write followed by the completion stamp supplies a later stat change that self-heals. When the `rev` changes, the node half broadcasts a `rebuilt` frame on `GET /plugins/events` — a system SSE channel that sends the full graph on connect and `rebuilt` frames on change, presentation-only wire that never enters the session log. Polling is deliberate because inotify does not fire on the weka network mount, the same reason the build-side watcher needs `--poll`; one entry stat per row and interval is sufficient, the interval is a validated config field (default 500ms), and disposal clears the one timer. Rebuilding artifacts is any process using the shared Client tsdown preset — `scripts/dev-web.ts` remains the watch-build entry point, discovering its package list through `dsh.client` while scanning `packages/*/*/package.json` at startup — and builder and host share no notification protocol.

 On the browser side, the transport delegates code replacement to the same modules controller that owns graph reconciliation:

@@ -120,4 +120,4 @@ Roster: it lives in the web bundle's config tree (`packages/bundle/web-app/cordi
 | Full ctx-ification now (React and libraries via services, no module table) | Static UI libraries still expose synchronous values, so removing the table would leave those imports without a shared identity |
 | Eager instantiation with a frozen table | Runs bundle side effects at script arrival; lazy registration keeps execution at Cordis import while recursive `require` materializes registered requests |
 | Fetch response text, then inject an inline `<script>` | Makes the module system buffer the complete source and maintain separate fetch/execute paths; dynamic source execution also breaks the browser-native association among the network resource, source map, and profile |
-| Builder-push rebuild channel (`POST /plugins/rebuilt` from the orchestrator's `onSuccess`) | Couples reload to one blessed builder process and a second wire protocol; the webserver already holds every bundle path, and stat polling covers the torn-write race (re-hash on every stat change) that once justified pushing |
+| Builder-push rebuild channel (`POST /plugins/rebuilt` from the orchestrator's `onSuccess`) | Couples reload to one blessed builder process and a second wire protocol; the webserver already holds every bundle path, and stat polling covers the torn-write race (publication on every stat change) that once justified pushing |
@@ -46,7 +46,7 @@ Host 会快照每个已构建插件入口 bundle，并把每个调度阶段的

 共享 tsdown 预设为每个插件入口与 chunk 产出 map，并把第一方源码路径重写成浏览器可识别的仓库形式 `/packages/<group>/<package>/src/...`。生产 Client 构建会消费 `lib/types`；预设把每份 tsc map 交给 Rolldown，并从原文件补齐 `sourcesContent`，使最终 map 回到 TypeScript/TSX，而不是停在编译后的 JavaScript。内联进 bundle 的其他 workspace 源码同样回到其 `packages/` 归属，依赖包路径保持原样。Combo 生成会移除每个局部调试指令、记录其生成行偏移、以原插件 map URL 解析每个自带 source，再产出 Indexed Source Map v3。插件有自带 map 时直接用于对应 section；没有时则生成 identity section，内嵌构建后 bundle，并在存在时把 packer 写入的 `sourceURL` 用作 source 名。绝对 combo map URL 会平行改写脚本资源列表中的每个 `client.js` 后缀，因此 `/plugins/??<package-a>/client.js,<package-b>/client.js&rev=<rev>` 指向 `/plugins/??<package-a>/client.js.map,<package-b>/client.js.map&rev=<rev>`。chunk 脚本同样指向自己的 map URL。只有在这些 map URL 收到 `GET` 后，source map 文件才会被读取和组合；`HEAD` 不会物化脚本或 map body。Vite 壳同样产出 sourcemap，使壳代码与经外部加载的插件都能从 stack 和性能 profile 回到 TypeScript/TSX。

-图为 HMR 保留每个 row 带 revision 的单资源 combo URL，并为每个启动 combo 请求增加带 revision 的描述；多条描述可以使用同一调度阶段。初始 row revision 是进程级不透明 nonce，而不是内容哈希；它无需在启动时哈希每个插件，也能保证已快照的单资源响应不可变。共享预设会在每个包输出写完后标记入口。watcher 观察到该构建完成标记后，`rebuilt(id)` 会把入口字节与其时间戳一起哈希并发布所得 revision；因此只重建 chunk 也会推进 owner revision，无需 Host 扫描 sibling。启动 combo revision 从有序 row revision 派生。脚本 body 在首次 `GET` 时组合；source map 文件在首次 map `GET` 时单独读取并组合。`HEAD` 不会物化任一 body。版本化脚本与 map 使用 immutable 缓存，无关图重组会保留相同 revision 下已经物化的 chunk 响应。Host 只提供精确生成的 URL；陈旧 revision 与未发布资源列表返回 404，不会别名到其他字节。外部脚本的 `error` 事件不给响应状态与正文，因此失败诊断只报告 URL；同源 Host 与构建期写入的 registration id 是身份边界，`load` 后的 factory 存在性检查负责拒绝未登记预期 id 的产物。
+图为 HMR 保留每个 row 带 revision 的单资源 combo URL，并为每个启动 combo 请求增加带 revision 的描述；多条描述可以使用同一调度阶段。首次发布与 `rebuilt(id)` 使用相同的入口 mtime、ctime 和大小哈希；产物内容不参与求哈希。ctime 用于区分保留 mtime 和大小的重写。Host 重启时若产物未变，每个 row 的 revision 都保持不变，因此重连后的 SSE 快照不会触发浏览器插件替换。共享预设会在每个包输出写完后标记入口；因此只重建 chunk 也会推进 owner revision，无需 Host 扫描 sibling。启动 combo revision 从有序 row revision 派生。脚本 body 在首次 `GET` 时组合；source map 文件在首次 map `GET` 时单独读取并组合。`HEAD` 不会物化任一 body。版本化脚本与 map 使用 immutable 缓存，无关图重组会保留相同 revision 下已经物化的 chunk 响应。Host 只提供精确生成的 URL；陈旧 revision 与未发布资源列表返回 404，不会别名到其他字节。外部脚本的 `error` 事件不给响应状态与正文，因此失败诊断只报告 URL；同源 Host 与构建期写入的 registration id 是身份边界，`load` 后的 factory 存在性检查负责拒绝未登记预期 id 的产物。

 ### 装载流程，端到端

@@ -56,7 +56,7 @@ Host 会快照每个已构建插件入口 bundle，并把每个调度阶段的

 1. 负责组合的 app（`apps/cli`）把名册作为普通行放进它的 `cordis.yml` 配置树——client 插件包与每个 host 插件一样是 entry 行，包括无条件挂载的 `client-hmr` 行。`auditStartupEntries` 报告 import 失败、带原始 stack 的激活错误，以及待满足的依赖；optional entry 输出 warning，required entry 则使启动失败（[启动策略](2026-09-09-consumer-owned-startup-strictness.zh.md)）。
 2. `dsh-client-modules` 的 node 半（该包是双面的：浏览器半就是模块表）使用 Host face import 时相同的 `name` 与所属 tree `baseUrl` 解析每个 live Loader entry，再读取最近归属 package.json 的 `dsh.client` 声明并组合出 `window.__DSH_BOOT__`：`{ rev, entries: [{ id, url, rev, inject?, immediately?, external? }], batches: [{ phase, url, rev, entries }] }`。即使 overlay 指向相对的 source 或 built entry 文件，manifest 包名仍是浏览器模块身份。若不同的 active Loader source 解析到同一包名，组合会失败；一个来源卸载后，仍存活的来源无需重启 fiber 即可提供该 row。Row 的三个可选字段都来自 manifest，永不人肉抄写。组合会把被请求的动态图 row 排到消费者之前、拒绝同步请求环，并把每个 row 恰好分配给一个初始批次。它会拒绝没有已构建 `./client` bundle 的已声明插件，并把它们的 package/path 行归到一条源码构建要求下；畸形声明字段同样会让激活失败，Host 检查会从 FAILED fiber 报告这两类错误。
-3. 扫描是单包增量——不存在全量重扫代码路径。每次 cordis `internal/plugin` 发射把该 fiber 的 entry 名标脏（无 entry 的 fiber O(1) 丢弃）；微任务 flush 把每个脏名对账 live loader entries，包元数据（含「非 client 包」的否定结论）按 entry 名与所属 tree base URL 缓存至进程结束，bundle 重哈希只经 `rebuilt(id)` 可达。激活趟从当前 entries 灌同一脏集合并同步 flush，初扫与稳态共享一条实现。初始 row 使用不透明的进程 nonce 加序号，不对其产物求哈希；启动 combo revision 对合并脚本输入及 indexed map 求哈希，row 与批次描述再共同哈希进 `graph.rev`。图类型单源在 modules 包的 `./client` 出口——webserver 对图一无所知；modules 会注册 combo 路由并贡献结构化 index 注入行。
+3. 扫描是单包增量——不存在全量重扫代码路径。每次 cordis `internal/plugin` 发射把该 fiber 的 entry 名标脏（无 entry 的 fiber O(1) 丢弃）；微任务 flush 把每个脏名对账 live loader entries，包元数据（含「非 client 包」的否定结论）按 entry 名与所属 tree base URL 缓存至进程结束，变化后 bundle 的发布只经 `rebuilt(id)` 可达。激活趟从当前 entries 灌同一脏集合并同步 flush，初扫与稳态共享一条实现。初始 row 对读取前的文件系统元数据求哈希；启动 combo revision 对有序 row 的身份与 revision 求哈希，row 与批次描述再共同哈希进 `graph.rev`。图类型单源在 modules 包的 `./client` 出口——webserver 对图一无所知；modules 会注册 combo 路由并贡献结构化 index 注入行。

 为什么名册是 yml 行而不是扫描？因为哪些插件组合进一次部署是组合决策，不是包属性——一个在仓库中声明了 dsh.client 的包，不代表这次部署要挂载它，扫描发现无从替人做这个决定；node 半只扫描配置树实际挂载了的东西。

@@ -80,7 +80,7 @@ Host SSE 适配器转发现有图变化通知，并在连接时发送当前完

 热重载是一项组合决策：web 组合包无条件挂载 `client-hmr` 行（一个常规的插件包），其 node 半带来 bundle 监视与 SSE（Server-Sent Events）通道；没有重建 watcher 改写客户端 bundle 时链路保持空闲。不应暴露它的组合可以禁用该行。

-重建好的 bundle 怎么变成重载信号？hmr 的 node 半自己观察——没有构建器来通知它。模块 host 在读取每份启动快照前捕获入口 stat 基线，并通过 `ctx.clientModules.artifactBaseline(id)` 暴露它。HMR 自持的单个定时器把当前图的每个 row 与这份基线比较：未变化的 row 直接开始监视，不读取内容也不求哈希；基线捕获后的写入已经形成 stat 差异，只有该 row 会进入 `rebuilt(id)`。这同时消除了启动期的全量重哈希，并避开 `fs.watchFile` 以异步首次 stat 建立基线、可能静默吸收构造期重建的问题。监视集合的成员随 `onGraphChanged` 更新；消失的 row 撤下监视，轮询时缺失的入口则让对应 row 保持标脏状态，文件重现时即使元数据相同也强制生成新 revision。共享 tsdown 预设会在每个 sibling 输出写完后标记 `client.js`；入口 mtime 或 size 变化、或 row 处于标脏状态时，`rebuilt(id)` 从入口字节与构建完成时间戳派生 revision。只修改 chunk 因此也会更换 revision；部分写入之后的完成标记还会提供一次更晚的 stat 变化以完成自愈。`rev` 变化时，node 半在 `GET /plugins/events` 上广播 `rebuilt` 帧——这是一条系统级 SSE 通道，连接即发全量图，变更时发 `rebuilt` 帧，仅供呈现的 wire，永不进会话日志。轮询是刻意选择：inotify 在 weka 网络挂载上不触发，构建侧监视器需要 `--poll` 也是同一原因；每个 row 每个间隔只需一次入口 stat，轮询间隔是一个经校验的配置字段（默认 500ms），dispose（资源释放）会清掉那一个定时器。重建产物的进程必须使用共享 Client tsdown 预设；`scripts/dev-web.ts` 仍作为 watch 构建入口保留，其包清单在启动时扫描 `packages/*/*/package.json` 按 dsh.client 发现，构建器与 host 之间没有通知协议。
+重建好的 bundle 怎么变成重载信号？hmr 的 node 半自己观察——没有构建器来通知它。模块 host 在读取每份启动快照前捕获入口 stat 基线，并通过 `ctx.clientModules.artifactBaseline(id)` 暴露它。HMR 自持的单个定时器把当前图的每个 row 与这份基线比较：未变化的 row 直接开始监视，不读取内容也不求哈希；基线捕获后的写入已经形成 stat 差异，只有该 row 会进入 `rebuilt(id)`。这既避免安装 watcher 时重复读取，也避开 `fs.watchFile` 以异步首次 stat 建立基线、可能静默吸收构造期重建的问题。监视集合的成员随 `onGraphChanged` 更新；消失的 row 撤下监视，轮询时缺失的入口则让对应 row 保持标脏状态，文件重现时即使 mtime 和大小与基线相同也重试发布。共享 tsdown 预设会在每个 sibling 输出写完后标记 `client.js`；入口 mtime、ctime 或大小变化、或 row 处于标脏状态时，`rebuilt(id)` 从这三个元数据值派生 revision。只有 revision 变化时，它才读取新的 bundle 快照。只修改 chunk 因此也会更换 revision；部分写入之后的完成标记还会提供一次更晚的 stat 变化以完成自愈。`rev` 变化时，node 半在 `GET /plugins/events` 上广播 `rebuilt` 帧——这是一条系统级 SSE 通道，连接即发全量图，变更时发 `rebuilt` 帧，仅供呈现的 wire，永不进会话日志。轮询是刻意选择：inotify 在 weka 网络挂载上不触发，构建侧监视器需要 `--poll` 也是同一原因；每个 row 每个间隔只需一次入口 stat，轮询间隔是一个经校验的配置字段（默认 500ms），dispose（资源释放）会清掉那一个定时器。重建产物的进程必须使用共享 Client tsdown 预设；`scripts/dev-web.ts` 仍作为 watch 构建入口保留，其包清单在启动时扫描 `packages/*/*/package.json` 按 dsh.client 发现，构建器与 host 之间没有通知协议。

 浏览器侧的传输把代码替换交给负责图对账的同一个 modules 控制器：

@@ -120,4 +120,4 @@ Wire 两侧运行同一份治理实现；浏览器特有层只包含一套模块
 | 现在就彻底 ctx 化（React 与库全走服务，不设模块表） | 静态 UI 库仍暴露同步实体，因此删除模块表会让这些 import 失去共享身份 |
 | 冻结表 + 到达即实例化 | 会在 script 到达时执行 bundle 副作用；惰性登记把执行推迟到 Cordis import，并由递归 `require` 物化已登记请求 |
 | fetch 响应文本后注入内联 `<script>` | 模块系统必须缓冲整份源码并维护 fetch/execute 两条路径；动态源码执行也切断浏览器网络资源、sourcemap 与 profile 的原生关联 |
-| 构建器推送重建通道（编排器在 `onSuccess` 里 POST `/plugins/rebuilt`） | 把重载耦合到一个钦定的构建器进程和第二套 wire 协议；webserver 本就握有每个 bundle 路径，stat 轮询（每次 stat 变化即重哈希）已兜住当年为推送辩护的撕裂写竞态 |
+| 构建器推送重建通道（编排器在 `onSuccess` 里 POST `/plugins/rebuilt`） | 把重载耦合到一个钦定的构建器进程和第二套 wire 协议；webserver 本就握有每个 bundle 路径，stat 轮询（每次 stat 变化即发布）已兜住当年为推送辩护的撕裂写竞态 |
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-20-device-local-shortcut-preferences.md
+2026-09-20-device-local-shortcut-preferences.md: 3da3d3a29c5fd068f3498de78c2de84d3f30fe45
+2026-09-20-device-local-shortcut-preferences.zh.md: 3c5420e8708bf168a61d3d60e6a6a2add60a9455
@@ -0,0 +1,27 @@
+# Agent Note: Keep shortcut preferences device-local and commit before activation
+
+Status: implemented
+
+English | [中文](2026-09-20-device-local-shortcut-preferences.zh.md)
+
+## Problem
+
+Keyboard bindings depend on the receiving device's operating system and browser restrictions. A Host can serve several devices, while a local save can fail after a user records a new combination. Activating an unpersisted binding makes the interface disagree with the next application launch. Rewriting unreadable or future-version preferences can destroy choices an older client cannot interpret.
+
+## Decision
+
+[The shortcut service](../../../../packages/client/shortcuts/README.md) stores only versioned overrides per runtime/platform. Web owns origin-local browser storage; Electron main owns `userData/keybindings.json`, independently of Harness home. Both adapters share validation and transaction logic. Successful persistence publishes one accepted configuration from which command matching, keycaps, and native interception derive.
+
+Missing commands retain dormant overrides. Explicit overrides win over newly introduced defaults; conflicting explicit overrides are all disabled. Unreadable configuration blocks ordinary edits and preserves the last accepted values. Restore All clears only the accepted current profile and cannot overwrite unreadable or future-version data.
+
+## Alternatives considered
+
+**Host settings.** A server's operating system and settings scope do not identify the visitor's device or browser restrictions. Host storage would also couple remote visitors' preferences.
+
+**Optimistic activation.** Updating bindings before persistence makes a failed save appear successful and leaves restart behavior inconsistent with the visible controls.
+
+**Cross-tab atomic merging.** localStorage has no compare-and-swap transaction. Web rereads before each operation and rejects known stale drafts, but accepts last-writer-wins for simultaneous writes. Electron main serializes edits and rejects stale revisions.
+
+## Consequences
+
+Devices and Web/Desktop do not synchronize bindings automatically. Repairing unreadable preferences requires correcting the stored document; application edits preserve those bytes. Browser concurrency does not promise lossless merging. Atomic Desktop replacement uses the shared writer's Windows retry behavior without promising fsync durability. Deterministic transaction, browser-storage, and Desktop-file tests cover failure retention, conflicts, stale drafts, and refusal to replace unreadable data; platform keyboard acceptance remains separate from persistence correctness.
@@ -0,0 +1,27 @@
+# Agent Note: 快捷键偏好按设备保存，提交后才激活
+
+Status: implemented
+
+[English](2026-09-20-device-local-shortcut-preferences.md) | 中文
+
+## 问题
+
+快捷键取决于接收输入设备的操作系统和浏览器限制。一个 Host 可服务多个设备，而用户录入新组合后，本地保存仍可能失败。激活未持久化的绑定会使界面与下一次启动不一致。重写不可读或未来版本的偏好可能破坏旧客户端无法解释的选择。
+
+## 决策
+
+[快捷键服务](../../../../packages/client/shortcuts/README.zh.md) 只保存按运行端／平台区分的版本化覆盖。Web 使用同 origin 的浏览器存储；Electron main 管理 `userData/keybindings.json`，与 Harness home 独立。两端适配器共享校验和事务逻辑。持久化成功后发布一个已接受配置，命令匹配、键帽和原生拦截都由此派生。
+
+未加载命令保留休眠覆盖。显式覆盖优先于新增默认值，相互冲突的显式覆盖全部禁用。不可读配置阻止普通编辑，并保留上次接受的值。全部恢复只清除已接受的当前平台覆盖，不会覆盖不可读或未来版本的数据。
+
+## 考虑过的替代方案
+
+**Host 设置。** 服务端操作系统和设置范围不能标识访问者设备或浏览器限制，Host 存储还会耦合远程访问者的偏好。
+
+**乐观激活。** 在持久化之前更新绑定会让保存失败看起来像成功，并使重启行为与可见控件不一致。
+
+**跨标签页原子合并。** localStorage 没有比较并交换事务。Web 每次操作前重新读取并拒绝已知过期草稿，但同时写入采用最后成功写入生效。Electron main 串行处理编辑并拒绝旧 revision。
+
+## 影响
+
+不同设备以及 Web／Desktop 不自动同步绑定。修复不可读偏好需要更正存储文档；应用内编辑保留这些原始内容。浏览器并发不承诺无损合并。Desktop 原子替换使用共享写入器的 Windows 重试行为，不承诺 fsync 持久性。确定性的事务、浏览器存储和桌面文件测试覆盖失败保留、冲突、过期草稿以及拒绝替换不可读数据；平台键盘验收与持久化正确性分别验证。
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-21-conversation-build-groups.md
-2026-09-21-conversation-build-groups.md: 6591ebea61d8edd06edbaf5f54f2bebd1bd00602
-2026-09-21-conversation-build-groups.zh.md: 70657ded8e04f0badb987ada965aef1184cfc7b0
+2026-09-21-conversation-build-groups.md: 7c02de8dd0aaf842690806ea67ddaf5d4561fc4e
+2026-09-21-conversation-build-groups.zh.md: 4f2b331596cacdd63d902c9db73931d65ac589ad
@@ -12,9 +12,11 @@ A Chat Builder aggregates one target's Nodes and indexes. Hardcoding a Chat proc

 Process groups are orthogonal to Steps: one Assistant Node can contribute reasoning inside a group and a reply outside it; tools after that reply enter a later group. Step-number ranges cannot describe membership. Existing event Definitions interpret one event at a time, whereas grouping needs the Nodes those Definitions have already interpreted.

+Broad benchmark budgets do not establish that grouping updates are local. Keyed notifications, component identity, browser layout, and retained memory are distinct properties; passing one check does not establish the others.
+
 ## Decision

-The grouping foundation provides a separate, Node-input `ConversationGroupDefinition`, its registry and Session-local context, generic Builder input/publication, keyed Group storage, and the two React branches. Production Chat segmentation and PR #4565 presentation are not registered by this foundation; the [business migration proposal](../../proposed/feature/2026-09-20-chat-work-details-migration.md) retains their requirements. The [subsystem reference](../../../../docs/subsystems/conversation.md#group-definitions) and [source types](../../../../packages/client/ui-conversation/src/client/contract/groups.ts) own the current API details.
+The grouping foundation provides a separate, Node-input `ConversationGroupDefinition`, its registry and Session-local context, generic Builder input/publication, keyed Group storage, and the two React branches. Chat owns its registered segmentation and presentation in the [business-rule reference](../../../../packages/client/ui-chat/src/client/conversation-nodes/README.md). The [subsystem reference](../../../../docs/subsystems/conversation.md#group-definitions) and [source types](../../../../packages/client/ui-conversation/src/client/contract/groups.ts) own the current API details.

 ### Responsibilities

@@ -22,21 +24,19 @@ The grouping foundation provides a separate, Node-input `ConversationGroupDefini
 |---|---|
 | Business grouping belongs to a registered Definition | Membership, segmentation, replies, steering, retries, summaries, and cache invalidation stay together. |
 | Builder and assembler do generic work | Supply inputs, dispatch Definitions, validate references, reuse identities, and publish; never construct a concrete grouping class. |
-| PR #4565 defines product behavior | Preserve its behavior without copying its invasive implementation. |
+| PR #4565 supplies the product reference | The Chat business-rule reference owns the current behavior and its agreed adjustments. |
 | React has two root kinds | The ordered root contains NodeReference and GroupReference, not another layout object model. |
 | All modes share grouping | Mode is absent from Definition input, keys, and parent selection. |
 | No buildLayout | ConversationViewDefinition keeps its existing responsibilities. |
-| Foundation precedes business | No production Chat grouping, summaries, notifications, or footer changes in the foundation PR. |
+| Business remains target-owned | Chat owns process grouping, summaries, notifications, and footer behavior; generic assembly does not interpret them. |

 ### Related decisions

 | Record | Relationship |
 |---|---|
 | [Business Node assembly](2026-08-09-client-conversation-node-assembly.md) | Retains event matching, Contexts, Locations, one business Node per Context, and target Builders; grouping adds another input category. |
-| [Presentation policy and grouping](../../proposed/architecture/2026-09-20-chat-presentation-policy-and-step-groups.md) | Retains Definition ownership, local subscriptions, and mode independence; replaces event folding and Step-range membership as the grouping mechanism. |
-| [Work-details migration](../../proposed/feature/2026-09-20-chat-work-details-migration.md) | Retains product scope and migration tracking; infrastructure alone does not complete those features. |

-These records retain independent rationale and remain active. Cross-View navigation and `toolCallFocus` are outside this change; no View handles, Label Slots, or resource-navigation architecture is introduced.
+Grouping preserves the independent Node-assembly decisions. Cross-View navigation and `toolCallFocus` remain separate responsibilities; Group references carry no View handles or resource-navigation policy.

 ## Definition input, state, and registration

@@ -116,7 +116,9 @@ The root selects `views.grouped('chat')?.entries` through the existing useConver

 React keys derive from reference kind, NodeKey/groupPart or GroupKey, using unambiguous tuples. No separate RenderKey type or renderer dispatch field is needed. Compact, Detailed, and Expanded keep the same group container and member parents; presentation changes do not rerun the Group Definition or select a different root branch.

-The stable Group parent is a `div` with `display: contents`, without its own layout box. CSS inheritance remains available; business styles adapt child/sibling selectors and own measurable body containers. Neither CSS variables nor geometry enter the Definition. Reading-position capture measures member Nodes and retains part-specific anchors; existing Turn navigation resolves the original NodeKey to its first visible part.
+The stable Group parent is a measurable `div`; its body owns capped inner scrolling and its content box reports growth. CSS inheritance remains available, and business styles adapt child/sibling selectors. Neither CSS variables nor geometry enter the Definition. Reading-position capture measures member Nodes and retains part-specific anchors; existing Turn navigation resolves the original NodeKey to its first visible part.
+
+The presentation channel maps each stored mode to a stable policy object. Seats and renderers select the fields they consume instead of receiving a mode prop through every renderer. Mode changes do not register Definitions or replay Contexts. Whole-Turn eligibility uses that Turn's loaded lifecycle facts rather than Session-wide pagination completion; the business-rule reference defines partial-history folding. Local group disclosure remains component state, while explicit whole-Turn closing resets participating disclosures through the injected Hook without replacing keys.

 ## Alternatives considered

@@ -138,6 +140,12 @@ The stable Group parent is a `div` with `display: contents`, without its own lay

 **Remove the group wrapper in Expanded.** Rejected: changing the parent remounts members even when their keys survive.

+**Attach a header to the first member or to a per-Step Context.** A first-member header couples group UI to an arbitrary business row. Per-Step identity cannot distinguish multiple groups in one Step; sharing aggregate Turn data also refreshes unrelated headers or leaves later Step reads stale.
+
+**Emit multiple Nodes from one event Context or derive child Contexts.** Most event Contexts own one Node; arrays add indirection without solving cross-Node grouping. Parent-derived Contexts require forwarding, replay, and removal lifecycles. A separate framework decision is warranted only if derived entities need those lifecycles independently of grouping.
+
+**Keep all Markdown mounted or reset renderers by remounting.** Retaining lightweight seats is not a reason to retain every full Markdown body. Full bodies remain disclosure-owned, and explicit resets avoid destroying unrelated renderer state. Importing all of #4565 at once would also mix independent visual changes with grouping costs and obscure which behavior caused a regression.
+
 ## Verification

 - [Group store tests](../../../../packages/client/ui-conversation/tests/conversation-group-store.client.spec.ts) cover atomic reference validation, root/member identity reuse, local publication, and removal without deleting source Nodes.
@@ -145,6 +153,15 @@ The stable Group parent is a `div` with `display: contents`, without its own lay
 - [Node source tests](../../../../packages/client/ui-chat/tests/chat-node-source.client.spec.ts) cover projected grouping inputs, indexed readers, and empty change batches.
 - [Chat rendering tests](../../../../packages/client/ui-chat/tests/chat-view.client.spec.tsx) retain component state across modes, rebind replacement Node stores, pass independent parts, and omit unreferenced Nodes. [Viewport tests](../../../../packages/client/ui-chat/tests/chat-viewport.client.spec.ts) cover grouped reading anchors, history prepend, and part-aware Turn navigation.

+Business behavior is verified through keyed-update regressions and recorded Web replay.
+
+| Evidence | Required observation |
+|---|---|
+| Keyed notifications and React updates | Content growth affects the owning Node and affected Group; unchanged historical rows and unrelated Turns receive no extra notifications. Mode changes preserve keys and member parents. |
+| Recorded Web replay | Current accessible titles, group disclosure, hidden ordinary Context, trigger notices, and footer placement match the committed expected output. |
+
+[Recorded Web scenarios](../../../../apps/web/tests/steering.e2e.ts) cover online steering, reconnect handoff, and grouped presentation through the shipped Web profile. These behavior checks do not establish a quantified latency or memory improvement.
+
 ## Consequences

 - This is an explicit framework extension: a new input protocol, registry, context, publication phase, and reader. It is not merely another callback.
@@ -152,4 +169,5 @@ The stable Group parent is a `div` with `display: contents`, without its own lay
 - Node order and visibility have one owner: the Builder. Grouping must not independently sort raw events or infer membership again in infrastructure.
 - Stable mounting does not eliminate layout, paint, or retained-memory costs. No measured latency or optimal-performance claim is made.
 - Real group splits, merges, first-member changes, and pagination repairs can change identity. The mode-switch guarantee does not prohibit those legitimate changes.
- Revealing hidden parts, selection/copy, interruption notices, group disclosure, and outer Turn interaction require business adaptation. Foundation tests exercise mixed references without enabling production groups.
+- Revealing hidden parts, selection/copy, interruption notices, group disclosure, and outer Turn interaction belong to Chat's business adaptation; generic reference tests alone do not establish those behaviors.
+- Turn status/duration replaces the old tool/message-count title, so status, accessible names, and empty-process Turns require explicit presentation coverage. Hiding ordinary Context retains non-human waking notices and original Session/Trajectory inspection; footer placement depends on the real Turn end rather than group membership.
@@ -12,9 +12,11 @@ Chat Builder 汇总整个目标的节点及索引。在其中固定创建 Chat

 过程组与 Step 正交：同一个 Assistant Node 可以把推理放在组内、回复放在组外，回复后的工具进入后面的组。Step 编号范围无法描述这种成员归属。现有事件 Definition 逐个解释事件，分组则需要这些 Definition 已经解释完成的节点。

+宽松的基准预算不能证明分组更新具有局部性。按键通知、组件身份、浏览器布局与常驻内存是不同的性质，通过其中一项检查不能证明其他性质。
+
 ## Decision

-分组基础机制提供独立的节点输入 `ConversationGroupDefinition`、注册表及 Session 内上下文、Builder 通用输入与发布、按键 Group 存储及两种 React 分支。基础机制不注册真实 Chat 分段及 PR #4565 展示，[业务迁移提案](../../proposed/feature/2026-09-20-chat-work-details-migration.zh.md)保留这些需求。[子系统参考](../../../../docs/subsystems/conversation.zh.md#group-definitions)与[源码类型](../../../../packages/client/ui-conversation/src/client/contract/groups.ts)拥有当前 API 细节。
+分组基础机制提供独立的节点输入 `ConversationGroupDefinition`、注册表及 Session 内上下文、Builder 通用输入与发布、按键 Group 存储及两种 React 分支。Chat 在[业务规则参考](../../../../packages/client/ui-chat/src/client/conversation-nodes/README.zh.md)中拥有其已注册的分段与展示规则。[子系统参考](../../../../docs/subsystems/conversation.zh.md#group-definitions)与[源码类型](../../../../packages/client/ui-conversation/src/client/contract/groups.ts)拥有当前 API 细节。

 ### 职责

@@ -22,21 +24,19 @@ Chat Builder 汇总整个目标的节点及索引。在其中固定创建 Chat
 |---|---|
 | 分组业务属于已注册 Definition | 成员、分段、回复、steering、重试、摘要和缓存失效放在一起。 |
 | Builder 与 assembler 做统一工作 | 提供输入、调度 Definition、校验引用、复用身份并发布，不创建具体分组类。 |
-| 产品行为以 PR #4565 为准 | 保留行为，不复制其侵入性实现。 |
+| PR #4565 提供产品参考 | Chat 业务规则参考拥有当前行为及已确认的调整。 |
 | React 根循环只有两种 kind | 根顺序包含 NodeReference 和 GroupReference，不引入另一套布局对象模型。 |
 | 所有模式共用分组 | 模式不进入 Definition 输入、key 或父级选择。 |
 | 不采用 buildLayout | ConversationViewDefinition 保留现有职责。 |
-| 先基础、后业务 | 基础 PR 不包含真实 Chat 分组、摘要、通知或页脚变化。 |
+| 业务属于目标包 | Chat 拥有过程分组、摘要、通知和页脚行为，通用组装不解释这些业务。 |

 ### 与已有记录的关系

 | 记录 | 关系 |
 |---|---|
 | [业务节点组装](2026-08-09-client-conversation-node-assembly.zh.md) | 保留事件匹配、Context、Location、每个 Context 一个业务 Node 及目标 Builder，分组增加另一种输入类别。 |
-| [展示策略与过程分组](../../proposed/architecture/2026-09-20-chat-presentation-policy-and-step-groups.zh.md) | 保留 Definition 归属、局部订阅和模式无关要求，以新分组机制替代事件 fold 及 Step 范围成员推断。 |
-| [工作过程展示迁移](../../proposed/feature/2026-09-20-chat-work-details-migration.zh.md) | 保留产品范围及迁移跟踪，基础机制本身不代表这些功能完成。 |

-这些记录仍有独立理由，保留有效状态。跨 View 导航与 `toolCallFocus` 不属于本次改动；不引入 View 句柄、Label Slot 或资源导航架构。
+分组保留独立的节点组装决策。跨 View 导航与 `toolCallFocus` 仍是独立职责，Group 引用不携带 View 句柄或资源导航策略。

 ## Definition 输入、状态与注册

@@ -116,7 +116,9 @@ GroupStore 按 GroupKey 索引记录和来源，不反复查找数组。等价

 React key 由引用 kind、NodeKey/groupPart 或 GroupKey 的无歧义元组派生，不另设 RenderKey 类型或 renderer 分发字段。Compact、Detailed、Expanded 保留同一组容器及成员父级，展示变化不重新运行 Group Definition，也不选择不同的根分支。

-稳定 Group 父级使用 `div` 与 `display: contents`，自身不产生布局盒子。CSS 继承仍然可用，业务样式适配子级／兄弟选择器并拥有可测量的正文容器。CSS 变量和几何信息都不进入 Definition。阅读位置采样测量成员 Node，保留部分专属锚点；既有轮次导航将原 NodeKey 解析到它的第一个可见部分。
+稳定 Group 父级使用可测量的 `div`，正文拥有组内限高滚动，内容盒子报告尺寸增长。CSS 继承仍然可用，业务样式适配子级／兄弟选择器。CSS 变量和几何信息都不进入 Definition。阅读位置采样测量成员 Node，保留部分专属锚点；既有轮次导航将原 NodeKey 解析到它的第一个可见部分。
+
+展示通道将每个存储模式映射为稳定策略对象。Seat 和 renderer 选择自己使用的字段，不通过所有 renderer 透传模式 prop。模式变化不注册 Definition，也不重放 Context。整轮折叠资格使用本轮已加载的生命周期事实，不依赖整个 Session 的分页完成状态；半截历史的折叠规则由业务参考定义。组开合保留在组件本地状态中，显式收起整轮通过注入 Hook 重置参与折叠的内部开合，不更换 key。

 ## Alternatives considered

@@ -138,6 +140,12 @@ React key 由引用 kind、NodeKey/groupPart 或 GroupKey 的无歧义元组派

 **Expanded 移除组容器。** 不采用，即使 key 不变，父级改变仍会重挂载成员。

+**让首成员或每 Step 的 Context 承载组头。** 首成员组头把组 UI 耦合到任意业务行。每 Step 的身份无法区分同一步内的多个组，共享整轮聚合数据还会刷新无关组头，或让后续 Step 的读取过期。
+
+**一个事件 Context 输出多个 Node，或派生子 Context。** 多数事件 Context 只拥有一个 Node，数组增加间接层却不能解决跨 Node 分组。父级派生 Context 需要转发、重放及移除生命周期，只有派生实体需要独立于分组的这些生命周期时，才值得另作框架决策。
+
+**常驻全部 Markdown，或靠重挂载重置 renderer。** 保留轻量 Seat 不意味着需要常驻所有完整 Markdown 正文。完整正文仍由开合状态控制，显式重置避免销毁无关 renderer 状态。一次性引入 #4565 的全部改动还会混合独立视觉变化与分组成本，难以判断导致回退的具体行为。
+
 ## Verification

 - [Group 存储测试](../../../../packages/client/ui-conversation/tests/conversation-group-store.client.spec.ts)覆盖原子引用校验、根与成员身份复用、局部发布，以及删除组但保留原 Node。
@@ -145,6 +153,15 @@ React key 由引用 kind、NodeKey/groupPart 或 GroupKey 的无歧义元组派
 - [Node 来源测试](../../../../packages/client/ui-chat/tests/chat-node-source.client.spec.ts)覆盖投影后的分组输入、索引读取器和空变化批次。
 - [Chat 渲染测试](../../../../packages/client/ui-chat/tests/chat-view.client.spec.tsx)保留模式切换时的组件状态，重绑定替换后的 Node 存储，传递独立部分，并省略未引用 Node。[视口测试](../../../../packages/client/ui-chat/tests/chat-viewport.client.spec.ts)覆盖组内阅读锚点、历史前插及部分感知的轮次导航。

+业务行为通过按键更新回归与已录制的 Web 回放验证。
+
+| 证据 | 必须观察到的结果 |
+|---|---|
+| 按键通知与 React 更新 | 正文增长影响所属 Node 和相关 Group；未变化历史行及其他 Turn 没有额外通知。模式变化保留 key 与成员父级。 |
+| 已录制的 Web 回放 | 当前可访问标题、组开合、普通 Context 隐藏、触发通知及页脚位置与提交的预期输出一致。 |
+
+[已录制的 Web 场景](../../../../apps/web/tests/steering.e2e.ts)通过正式 Web profile 覆盖在线 steering、重连接续与分组展示。这些行为检查不构成量化延迟或内存改善的证明。
+
 ## Consequences

 - 这是明确的框架扩展，包含新输入协议、注册表、上下文、发布阶段及读取器，不只是增加一个回调。
@@ -152,4 +169,5 @@ React key 由引用 kind、NodeKey/groupPart 或 GroupKey 的无歧义元组派
 - Node 顺序及可见性只有 Builder 一个所有者，分组不独立排序原始事件，也不在通用层再次推断成员。
 - 稳定挂载不消除布局、绘制或保留内存的成本，不宣称实测延迟或最优性能。
 - 真实组拆并、首成员变化及分页修正可以改变身份，模式切换保证不禁止这些正常变化。
- 隐藏部分的揭示、选择复制、中断提示、组开合与外层 Turn 联动需要业务适配。基础测试使用混合引用，不启用真实分组。
+- 隐藏部分的揭示、选择复制、中断提示、组开合与外层 Turn 联动属于 Chat 业务适配，仅凭通用引用测试不能确认这些行为。
+- 整轮状态与用时替代旧工具／消息计数标题，因此状态、可访问名称和空过程轮次需要明确的展示覆盖。隐藏普通 Context 时保留非人工唤醒通知及原始 Session／Trajectory 查看能力；页脚定位依赖真实 Turn 结束，不依赖分组成员。
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-21-desktop-page-close-shortcuts.md
+2026-09-21-desktop-page-close-shortcuts.md: dc976806445f9b78c3dbad83d4cd9f3b0b2f4799
+2026-09-21-desktop-page-close-shortcuts.zh.md: 6ef60c084fe15cdc0f608992a700084cbf81b4c1
@@ -0,0 +1,27 @@
+# Agent Note: Desktop close shortcuts follow page focus
+
+Status: implemented
+
+English | [中文](2026-09-21-desktop-page-close-shortcuts.zh.md)
+
+## Problem
+
+The [shortcut PRD](https://trtgsjkv6r.feishu.cn/wiki/APvtwgbztiBLzvk9DM4cQbccnhf) gives the close command two targets: the focused right-sidebar page, or the Desktop window when no page can close. Electron's native close role bypasses the page owner. On Windows, closing the last window also quits the Desktop instance and stops its Host tasks, so this fallback is a lifecycle choice rather than a menu-label change.
+
+## Decision
+
+The sidebar page owner resolves close against live focus and captures the target's Session, pane, tab occurrence, and navigation revision. It closes that page through its resource cleanup handler, or collapses the sole docked guide. Stale sidebar targets do not fall back to another page or the window. Without a closeable page, Desktop requests native window closure; Web has no window fallback.
+
+The macOS File menu routes Close Page or Window through the same owner and displays the accepted single-key binding. Native closure requires the current configuration revision, a focused and enabled product window, and inactive shortcut recording. The existing window lifecycle applies without a shortcut-specific confirmation: macOS keeps the application alive after its last window closes; Windows and Linux quit and stop the Host.
+
+This decision owns File-menu and close behavior in place of the close-role choice in [the standard macOS menu note](../bug-fix/2026-09-16-desktop-window-menus.md). That note retains the rationale for native Window and application hide commands. [Shortcut preference persistence](2026-09-20-device-local-shortcut-preferences.md) owns accepted bindings and revision publication.
+
+## Alternatives considered
+
+**Use Electron's native close role.** It closes the window without asking the focused page owner and cannot preserve page cleanup or the accepted custom binding's routing.
+
+**Disable the Windows window fallback.** This avoids a task-stopping close shortcut but omits the PRD's explicit Desktop fallback. The product keeps native window-close semantics; users who need the application to remain running can minimize it.
+
+## Consequences
+
+Close behaves consistently across the shortcut and macOS File menu. On Windows and Linux, pressing it outside a closeable sidebar page can stop active tasks by quitting the instance. The command does not add a background Host lifetime or a task-aware shutdown confirmation. Desktop keyboard tests cover revision and focus guards; sidebar focus tests cover captured page identity and stale targets; startup tests cover the platform menu declarations.
@@ -0,0 +1,27 @@
+# Agent Note: Desktop 关闭快捷键跟随页面焦点
+
+Status: implemented
+
+[English](2026-09-21-desktop-page-close-shortcuts.md) | 中文
+
+## 问题
+
+[快捷键 PRD](https://trtgsjkv6r.feishu.cn/wiki/APvtwgbztiBLzvk9DM4cQbccnhf) 为关闭命令规定了两类目标：获得焦点的右侧栏页面，或没有可关闭页面时的 Desktop 窗口。Electron 原生 close role 绕过页面 owner。Windows 关闭最后一个窗口还会退出 Desktop 实例并停止其 Host 任务，因此该回退属于生命周期选择，不只是菜单标签变更。
+
+## 决策
+
+侧栏页面 owner 根据实时焦点解析关闭操作，并捕获目标的 Session、窗格、tab occurrence 和导航 revision。它通过资源清理处理器关闭该页面，或收起唯一的停靠引导页。过期侧栏目标不会回退到其他页面或窗口。没有可关闭页面时，Desktop 请求原生窗口关闭；Web 没有窗口回退。
+
+macOS File 菜单通过同一个 owner 路由“关闭页面或窗口”，并显示已接受的单键绑定。原生关闭要求配置 revision 仍为当前值、产品窗口已聚焦且启用，并且没有在录制快捷键。现有窗口生命周期直接生效，不增加快捷键专用确认：macOS 最后一个窗口关闭后保留应用；Windows 和 Linux 退出并停止 Host。
+
+本决策接管[标准 macOS 菜单记录](../bug-fix/2026-09-16-desktop-window-menus.zh.md)中 close role 选择所涉及的 File 菜单和关闭行为。该记录保留原生 Window 与应用隐藏命令的理由。[快捷键偏好持久化](2026-09-20-device-local-shortcut-preferences.zh.md)负责已接受绑定及 revision 发布。
+
+## 考虑过的替代方案
+
+**使用 Electron 原生 close role。** 它不询问获得焦点的页面 owner 就关闭窗口，无法保留页面清理和已接受自定义绑定的路由。
+
+**禁用 Windows 窗口回退。** 这能避免关闭快捷键停止任务，但会遗漏 PRD 明确要求的 Desktop 回退。产品保留原生关窗语义；需要应用继续运行时，用户可以最小化窗口。
+
+## 影响
+
+快捷键与 macOS File 菜单的关闭行为一致。在 Windows 和 Linux 上，焦点不在可关闭侧栏页面时按下该快捷键，可能因退出实例而停止活动任务。该命令不增加后台 Host 生命周期或感知任务状态的退出确认。Desktop 键盘测试覆盖 revision 和焦点保护；侧栏焦点测试覆盖捕获的页面身份和过期目标；启动测试覆盖各平台菜单声明。
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-16-desktop-window-menus.md
-2026-09-16-desktop-window-menus.md: 8a5343404e0cb3d2e7c4e20248a8b29f3bfbec47
-2026-09-16-desktop-window-menus.zh.md: d6ee6412462aecf49557a7994a683d37bf8e7253
+2026-09-16-desktop-window-menus.md: 34eff83707440719182f4ebe61aa552919bd44ee
+2026-09-16-desktop-window-menus.zh.md: c3cb3e5d89497ae15210c034c0077fc8019e5688
@@ -10,9 +10,9 @@ The Desktop shell replaces Electron's default application menu with a custom tem

 ## Decision

-On macOS the template declares `{ role: 'fileMenu' }` before the Edit menu and `{ role: 'windowMenu' }` after it, and a separator-delimited run of `hide`, `hideOthers`, and `unhide` before Quit in the application submenu. Those roles contribute only the standard items; no Services submenu, window list, or other macOS default is declared. Windows and Linux keep the application and Edit menus.
+On macOS the template declares `{ role: 'windowMenu' }` after the Edit menu, and a separator-delimited run of `hide`, `hideOthers`, and `unhide` before Quit in the application submenu. Those roles contribute only the standard items; no Services submenu, window list, or other macOS default is declared. Windows and Linux keep the application and Edit menus. The [page-close decision](../architecture/2026-09-21-desktop-page-close-shortcuts.md) owns the custom File menu and close behavior.

-Electron supplies English defaults for the File, Window, and Edit roles. Explicit labels override role defaults while retaining native actions and shortcuts; the localized application commands are documented in the [Desktop README](../../../../apps/desktop/README.md). No custom close, minimize, or hide code is added: ⌘W destroys the window through Electron's own role.
+Electron supplies English defaults for the Window and Edit roles. Explicit labels override role defaults while retaining native actions and shortcuts; the localized application commands are documented in the [Desktop README](../../../../apps/desktop/README.md). Minimize and hide execute through Electron's roles without custom handlers.

 ## Alternatives considered

@@ -22,13 +22,13 @@ Electron supplies English defaults for the File, Window, and Edit roles. Explici

 **Add a bare `{ role: 'close' }` item to the application submenu.** It avoids a File menu containing a single command, but places a window command among the app-wide Plugins, Updates, Hide, and Quit items where no macOS application puts it.

-**Declare the File and Window menus on every platform.** The same template declares Ctrl+W there; with one window, closing it invokes `window-all-closed` and quits the application, turning a window shortcut into an unrequested quit path.
+**Declare the File and Window menus on every platform.** The same template declares Ctrl+W there; with one window, closing it invokes `window-all-closed` and quits the application. The menu-restoration task did not request this quit path; the page-close decision explicitly specifies the Desktop fallback.

 **Recreate the main window on Dock activation regardless of other windows.** The plugin window can outlive the main window, so gating `activate` on `mainWindow` instead of `BrowserWindow.getAllWindows()` would let a Dock click always restore the main window. That changes window lifecycle beyond restoring the suppressed platform commands, so the existing `activate` condition stays.

 ## Consequences

-macOS regains the window and application commands the custom menu suppressed. File, Window, and Edit retain Electron’s default English labels; application commands use the Desktop locale.
+macOS retains native Window and application hide commands through four menu roles. Window and Edit retain Electron’s default English labels; application commands use the Desktop locale.

 ## Testing

@@ -10,9 +10,9 @@ Desktop shell 用自定义模板替换了 Electron 的默认应用菜单，该

 ## 决策

-macOS 上的模板在 Edit 菜单之前声明 `{ role: 'fileMenu' }`，在其之后声明 `{ role: 'windowMenu' }`，并在应用子菜单的 Quit 之前声明由分隔符隔开的 `hide`、`hideOthers` 和 `unhide`。这些 role 只提供标准菜单项；不声明 Services 子菜单、窗口列表或其他 macOS 默认项。Windows 和 Linux 保留应用菜单和 Edit 菜单。
+macOS 上的模板在 Edit 菜单之后声明 `{ role: 'windowMenu' }`，并在应用子菜单的 Quit 之前声明由分隔符隔开的 `hide`、`hideOthers` 和 `unhide`。这些 role 只提供标准菜单项；不声明 Services 子菜单、窗口列表或其他 macOS 默认项。Windows 和 Linux 保留应用菜单和 Edit 菜单。[页面关闭决策](../architecture/2026-09-21-desktop-page-close-shortcuts.zh.md)负责自定义 File 菜单和关闭行为。

-Electron 为 File、Window 和 Edit role 提供英文默认标签。显式标签会覆盖 role 的默认标签，同时保留原生命令和快捷键；本地化的应用命令见 [Desktop README](../../../../apps/desktop/README.zh.md)。这里不新增任何自定义的关闭、最小化或隐藏代码：⌘W 通过 Electron 自身的 role 销毁窗口。
+Electron 为 Window 和 Edit role 提供英文默认标签。显式标签会覆盖 role 的默认标签，同时保留原生命令和快捷键；本地化的应用命令见 [Desktop README](../../../../apps/desktop/README.zh.md)。最小化和隐藏通过 Electron 的 role 执行，没有自定义处理器。

 ## 考虑过的替代方案

@@ -22,13 +22,13 @@ Electron 为 File、Window 和 Edit role 提供英文默认标签。显式标签

 **在应用子菜单里直接加一个 `{ role: 'close' }` 项。** 这样可以避免只有一个命令的 File 菜单，但会把窗口命令放到 Plugins、Updates、Hide、Quit 这些应用级命令中间，没有 macOS 应用这样排布。

-**在所有平台都声明 File 和 Window 菜单。** 同一份模板在那些平台会把 Ctrl+W 声明为关闭；应用只有一个窗口，关闭它会触发 `window-all-closed` 并退出应用，把窗口快捷键变成用户没有要求的退出路径。
+**在所有平台都声明 File 和 Window 菜单。** 同一份模板在那些平台会把 Ctrl+W 声明为关闭；应用只有一个窗口，关闭它会触发 `window-all-closed` 并退出应用。恢复菜单的任务没有要求这条退出路径；页面关闭决策明确规定了 Desktop 回退。

 **让 Dock 激活时无论其他窗口是否存在都重建主窗口。** 插件窗口可以比主窗口存活更久，因此把 `activate` 的判断从 `BrowserWindow.getAllWindows()` 改为 `mainWindow` 能让点击 Dock 总可以恢复主窗口。但这超出了恢复被压掉的平台命令，属于窗口生命周期的行为变更，因此保留现有的 `activate` 判断。

 ## 影响

-macOS 恢复了自定义菜单压掉的窗口和应用命令。File、Window 和 Edit 保留 Electron 的默认英文标签；应用命令使用 Desktop 的语言。
+macOS 通过四个菜单 role 保留原生 Window 和应用隐藏命令。Window 和 Edit 保留 Electron 的默认英文标签；应用命令使用 Desktop 的语言。

 ## 测试

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-16-browser-excel-preview.md
-2026-09-16-browser-excel-preview.md: 208bcdcd69d8ac30fcb5a7776271942424a92a05
-2026-09-16-browser-excel-preview.zh.md: c48d9156e44befaa265d5c1f4116d86efe099fda
+2026-09-16-browser-excel-preview.md: 15db888330b2a1a6d6d78dad46689962466d531d
+2026-09-16-browser-excel-preview.zh.md: 6b3a6a617a0cd18dcd3da1682a31f26bd7e70386
@@ -8,12 +8,16 @@ English | [中文](2026-09-16-browser-excel-preview.zh.md)

 PDF conversion loses spreadsheet navigation and the relationship between a formula and its saved value. Spreadsheet preview also needlessly depends on the Host Office engine when the browser can read the workbook.

+Unsupported drawing content can also prevent cell preview. ExcelJS 4.4.0 expects prefixed DrawingML element names and fails on valid default-namespace drawings emitted by Openpyxl. A chart that the viewer cannot display must not make otherwise readable worksheets unavailable.
+
 ## Decision

 The [document preview](../../../../packages/client/ui-sidebar-documentpreview/README.md#excel-preview) opens XLSX, XLS, CSV, and TSV with FortuneSheet and package-local adapters for ExcelJS, SheetJS CE, and PapaParse. The adapter accepts bytes, format, and limits and returns worksheet data; it has no React state setters, timers, or component references. Dependencies own file parsing, while the adapters share display formatting and initial selection without introducing another workbook model. CSV/TSV retain literal strings and a plain-text option; implicit type inference could otherwise discard leading zeros or interpret source text as formulas. The shared document reader calls `remote.workspaceFiles.readBytes(sessionId, path, {}, signal)` and receives native bytes through the binary Remote, retaining Session authorization, file versions, reload, and transient bytes without base64 decoding. Workspace Files owns bounded file reads; format parsing stays in the Client. The registration marks only XLSX/XLS as `binaryExtensions`, so the shared document container offers Plain text for CSV/TSV. Each renderer registers its body under its own id.

 Preview is read-only and retains formula text alongside saved results. It does not recalculate, so unsupported functions cannot replace a valid saved result with an error. A formula without a saved result remains blank. Workbooks containing formulas show a compact warning beside the formula icon instead of consuming worksheet height with a notice row. The spreadsheet is neither an authoring tool nor a full Excel rendering engine.

+The package-local `XlsxPreviewArchive` inspects XLSX content inside the parser Worker and removes DrawingML parts and their relationship parts from a temporary ZIP. ExcelJS also ignores worksheet drawing references; ignoring those references alone still leaves its archive-level drawing parser exposed to the failure. The source bytes and retained worksheet XML remain unchanged. A separate notice lists detected charts, images, shapes, and conditional formatting that the preview does not display and recommends a system application. Formula warnings remain independent, and files without detected unsupported content have no notice. Other formats return no unsupported-content categories.
+
 A disposable browser Worker contains parser CPU work. A source-byte limit precedes parsing, a combined rectangular-area limit precedes FortuneSheet matrix allocation, and a timeout terminates stalled parsing. These limits do not claim a hard memory sandbox. Styles are scoped to the renderer; external hyperlinks are text only.

 The pinned FortuneSheet React dependency carries a [patch](../../../../patches/@[email protected]) that skips the input box's read-only layout state update unless formula-reference highlighting is enabled. The unconditional update otherwise causes a maximum-update-depth failure when switching worksheets under the shipped React 18.3.1 runtime. Sheet activation also retains the adapter's complete initial selection instead of clearing it and leaving an empty or invalid address. The browser scenario covers these failures through the bundled ESM entry.
@@ -28,8 +32,14 @@ The ESM and CommonJS entries receive the same patches. Recheck worksheet switchi

 **Write an OOXML parser or create a new public package.** ExcelJS already owns the container and file semantics. One preview consumer does not justify another public API, Cordis service, or generic workbook abstraction; a second independent consumer can motivate extraction.

+**Patch ExcelJS's drawing namespace handling.** Correct parsing would still leave drawings undisplayed. Filtering the unsupported parts prevents them from blocking the supported cell preview without maintaining drawing behavior that the viewer cannot use.
+
+**Replace ExcelJS or require users to rewrite their files.** A parser replacement puts retained fonts, borders, merges, and frozen panes at risk. Rewriting a source file makes a viewer defect the user's responsibility. A temporary preview copy preserves both the existing adapter and the user's file.
+
 **Keep PDF as an Excel fallback or calculate every formula on import.** PDF retains neither spreadsheet interaction nor formula inspection, while recalculation can change saved results. The [Office engine decision](../architecture/2026-09-11-node-office-kit.md) remains applicable to Word/PowerPoint previews and independent conversion consumers; its conversion capability still supports spreadsheets.

 ## Consequences

 The renderer trades complete Excel fidelity for browser-local navigation and reusable conversion code. The package README owns supported formats, resource defaults, and unsupported features. Real XLSX/XLS fixtures and delimited-text cases cover conversion, Worker tests cover cancellation and cleanup, and the shipped-profile browser scenario opens a workbook with Office conversion disabled and copies a saved XLOOKUP result under read-only settings. It also exercises XLS sheet switching and CSV/TSV literal copying, text-view switching, and reload. SheetJS CE is pinned to its official release tarball because the public npm registry is stale; its Apache-2.0 license follows the existing permissive-license and bundled-notice policy.
+
+Drawing filtering adds ZIP inspection and, when parts are omitted, temporary uncompressed ZIP allocation. Existing Worker lifetime and source/matrix limits still apply; they do not bound decompressed memory. Drawing fixtures cover default and alternate prefixes, exact retained XML and input bytes, images, shapes, and comment VML. The browser scenario checks the notice, saved-value copying, and notice removal on file replacement. Adding drawing rendering requires revisiting both filtering and notice classification; a namespace fix alone does not restore that capability.
@@ -1,4 +1,4 @@
-# Agent Note：显示已保存公式结果的浏览器 Excel 预览
+# Agent Note: 显示已保存公式结果的浏览器 Excel 预览

 Status: implemented

@@ -8,12 +8,16 @@ Status: implemented

 PDF 转换会丢失工作表导航以及公式与已保存值之间的关系。浏览器能够读取工作簿时，表格预览也没有必要依赖 Host Office 引擎。

+不支持的绘图内容也可能阻断单元格预览。ExcelJS 4.4.0 要求 DrawingML 元素名带前缀，遇到 Openpyxl 生成的合法默认命名空间绘图时会失败。查看器无法展示的图表不应使原本可读的工作表无法打开。
+
 ## 决策

 [文档预览](../../../../packages/client/ui-sidebar-documentpreview/README.zh.md#excel-preview)使用 FortuneSheet 与包内 ExcelJS、SheetJS CE 和 PapaParse 适配层打开 XLSX、XLS、CSV 和 TSV。适配层接收字节、格式和限制并返回工作表数据，不包含 React 状态设置器、计时器或组件引用。依赖库负责文件解析，适配层复用显示格式化和初始选区，不引入另一种工作簿模型。CSV/TSV 保留字面字符串和纯文本选项；隐式类型推断可能丢失前导零或把源文本解释为公式。共享文档读取器调用 `remote.workspaceFiles.readBytes(sessionId, path, {}, signal)`，并通过二进制 Remote 直接接收原生字节，保留 Session 授权、文件版本、重新载入和临时字节，无需 base64 解码。Workspace Files 负责有界文件读取，格式解析留在 Client。注册仅将 XLSX/XLS 标为 `binaryExtensions`，共享文档容器因此为 CSV/TSV 提供纯文本选项。每个渲染器以自己的 id 注册正文。

 预览为只读，同时保留公式文本与已保存结果。它不重新计算，因此不受支持的函数不会用错误覆盖有效的已保存结果。没有已保存结果的公式保持为空。包含公式的工作簿会在公式图标旁显示紧凑提示，不再用整行提示占用工作表高度。该表格既不是编写工具，也不是完整的 Excel 渲染引擎。

+包内 `XlsxPreviewArchive` 在解析 Worker 中检查 XLSX 内容，从临时 ZIP 中移除 DrawingML 部件及其关系部件。ExcelJS 同时忽略工作表绘图引用；仅忽略这些引用仍会让其归档级绘图解析器触发该故障。源字节和保留的工作表 XML 均不改变。独立提示列出实际检测到但预览未展示的图表、图片、形状和条件格式，并建议使用系统应用。公式提示保持独立，未检测到不支持内容的文件不显示此提示。其他格式不返回不支持内容分类。
+
 独立可释放的浏览器 Worker 承担解析 CPU 工作。解析前检查源文件字节限制，FortuneSheet 分配矩阵前检查矩形区域合计限制，并通过超时终止停滞的解析。这些限制不代表严格的内存沙箱。样式限定在渲染器区域内，外部超链接仅显示为文本。

 固定版本的 FortuneSheet React 依赖带有一个[补丁](../../../../patches/@[email protected])：只读输入框仅在启用公式引用高亮时才提交布局状态更新。无条件更新会在仓库交付的 React 18.3.1 运行时下切换工作表时触发最大更新深度错误。激活工作表时还会保留适配层提供的完整初始选区，避免清空后留下空白或无效地址。浏览器场景通过打包后的 ESM 入口覆盖这些故障。
@@ -28,8 +32,14 @@ ESM 和 CommonJS 入口应用相同补丁。升级 FortuneSheet 时需要重新

 **自行编写 OOXML 解析器或创建新的公共包。** ExcelJS 已经负责容器和文件语义。单个预览使用方不足以支持另一套公共 API、Cordis 服务或通用工作簿抽象；出现第二个独立使用方时再考虑提取。

+**修补 ExcelJS 的绘图命名空间处理。** 正确解析仍不能使查看器展示绘图。过滤不支持的部件可防止其阻断已支持的单元格预览，无需维护查看器无法使用的绘图行为。
+
+**替换 ExcelJS 或要求用户重写文件。** 更换解析器会使现有字体、边框、合并及冻结窗格的保留面临风险。重写源文件则把查看器缺陷交给用户处理。临时预览副本同时保留现有适配器和用户文件。
+
 **保留 PDF 作为 Excel 兜底，或在导入时计算所有公式。** PDF 无法保留表格交互与公式查看，而重新计算可能改变已保存结果。[Office 引擎决策](../architecture/2026-09-11-node-office-kit.zh.md)仍适用于 Word/PowerPoint 预览与独立转换使用方；转换能力仍支持表格。

 ## 影响

 渲染器用部分 Excel 保真度换取浏览器内导航和可复用的转换代码。包 README 负责说明支持的格式、资源默认值和不支持的功能。真实 XLSX/XLS fixture 和分隔文本用例覆盖转换，Worker 测试覆盖取消和清理，发布 profile 的浏览器场景在禁用 Office 转换后打开工作簿，并在只读设置下复制已保存的 XLOOKUP 结果。该场景还验证 XLS 工作表切换，以及 CSV/TSV 字面值复制、纯文本切换和重新载入。由于公共 npm 仓库版本过旧，SheetJS CE 固定使用官方发布的 tarball；其 Apache-2.0 许可证沿用现有宽松许可证及打包声明规则。
+
+绘图过滤增加 ZIP 检查，并在移除部件时分配临时未压缩 ZIP。现有 Worker 生命周期和源文件／矩阵限制仍然适用，但不约束解压后的内存。绘图 fixture 覆盖默认及替代前缀、保留 XML 和输入字节的逐字节一致性、图片、形状及批注 VML。浏览器场景检查提示、已保存值的复制，以及文件替换后的提示移除。增加绘图渲染时，必须同时重新审视过滤和提示分类；仅修复命名空间不能恢复该能力。
@@ -1,6 +0,0 @@
-# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
-# side as of the last confirmed-consistent state. Both languages carry equal authority;
-# after editing either side, bring the other along and re-record with:
-#   pnpm run verify-translation-pairing --write .agents/notes/proposed/architecture/2026-09-20-chat-presentation-policy-and-step-groups.md
-2026-09-20-chat-presentation-policy-and-step-groups.md: 65fbb313d57a34a792ed2ec08d0adfb2fdd5f03d
-2026-09-20-chat-presentation-policy-and-step-groups.zh.md: 7ac3442476ea34d5127376cfc40d42892403ce47
@@ -1,288 +0,0 @@
-# Agent Note: Chat presentation policy channel and process-group architecture
-
-Status: proposed
-
-English | [中文](2026-09-20-chat-presentation-policy-and-step-groups.zh.md)
-
-## Problem
-
-At the start of this proposal, Chat's display setting had two modes: `normal` did not fold content, while `compact` folded process rows behind a whole-Turn control after completion. `TranscriptViewPolicy.mode` was injected into ChatView as an observable. ChatView read it through `useTranscriptView`, converted it to the boolean `compactTranscript`, and passed that prop through `ChatNodeList` to every `ChatNodeSeat`. The global `hasMore` boolean followed the same path as `historyIncomplete`. Either change re-rendered every seat, even when only a few foldable rows changed their output.
-
-The product requires three modes—Compact, Detailed, and Expanded—with consecutive process rows between replies collected into collapsible groups in Compact and Detailed. PR #4565 implemented the full feature, but was reverted eight minutes after merging because of performance regressions. The recorded local before/after comparison found long-session pagination +27%, DOM nodes +23%, heap +14%, and Trajectory switching +10%, all within CI budgets. None of the six existing repository benchmarks covered the new hot path: reasoning or tool chunks entering an active group during streaming, group reprojection, and seat re-rendering.
-
-The review identified implementation choices, not the product requirements, as the problem:
-
- The mode became an input to list structure. `ChatNodeList` subscribed to the entire `layout` and generated wrapper components from ranges; Expanded removed those wrappers. Switching modes remounted the list, and regrouping rebuilt wrapper keys.
- The mode entered `ChatNodeOwnerProps`. Every seat's owner object changed with the mode, re-rendering all business renderers, including unrelated user messages, tool rows, and compaction markers.
- A seat split one Assistant node into derived reasoning and response objects solely to wrap the former in the DOM. Master's `AssistantMarkdown` already had `reasoningHidden` and `revealProcess`, which could hide reasoning independently.
- Consumers repeated infrastructure-row filtering in four places, although nodes already had a Definition-owned `visibility` field.
-
-The deeper difficulty is information ownership: a group header must exist before its members as soon as the group opens, but its content requires a view of the entire Turn. Each event-driven Context receives only its own events. Only a turn-level Context can observe the whole Turn, and it can produce only one node.
-
-This proposal supplies an architecture for three modes and grouping that satisfies the constraints below and confines later product changes to a small set of nodes.
-
-The three settings, presentation policy channel, and per-Turn folding eligibility are implemented; step-group remains proposed. The [migration progress table](../feature/2026-09-20-chat-work-details-migration.md) owns current implementation, committed scope, and incomplete items. The grouping state machine and change inventory below do not describe delivered work.
-
-## Goals and constraints
-
-The [implemented Definition-owned Build Group foundation](../../implemented/architecture/2026-09-21-conversation-build-groups.md) supersedes this note's event fold, Builder-materialized group headers, Step-range membership, and changedLocationData proposal. This note retains the presentation-policy and per-Turn eligibility rationale; the grouping implementation below records the superseded route, not the current implementation plan.
-
-The following decisions were confirmed during design review and are inputs to this proposal.
-
-| Number | Decision | Meaning |
-|---|---|---|
-| 1 | Definitions own group structure | A Definition matching multiple events in the Turn folds group opening, closing, member ranges, and summaries; renderers do not derive them by scanning nodes |
-| 2 | Limit seat re-rendering | Mode changes re-render only seats whose presentation changes; streaming chunks re-render only their seat and group header; user messages, replies, and turn-tail do not re-render for either change |
-| 3 | One node per Context | Do not introduce multiple nodes per Context; most Contexts have one element, and arrays would fragment memory further |
-| 4 | Modes do not toggle Definitions | Registry changes rebuild and replay all Contexts, refreshing every seat; Definitions must be mode-independent |
-| 5 | Decide folding per Turn | A Turn can fold when its own `turn/start` is loaded; the oldest partial Turn stays open and is not optimized here |
-| 6 | ui-conversation may change | Engine changes are allowed only where needed for this design to work correctly |
-| 7 | Initial implementation scope | Initially change only code and this note; add tests and other documentation during CI repair |
-
-Accepting a full-page browser layout on mode changes does not mean accepting every seat re-rendering. Layout is a geometric result; a seat re-render executes a React component function. This proposal constrains the latter.
-
-## Viable approaches
-
-There are five approaches to group-header identity and content ownership.
-
-**Approach A: the first member's seat renders the header.** Keep the list unchanged. The builder derives membership and tells the first member's seat to render a title above itself; other member seats use the existing `hidden` mechanism. This adds no new concept, but creates a third seat state—visible with only a title—and attaches the header to a business node's seat.
-
-**Approach α: one Context per step supplies a header.** Add a Definition identified by `turn:step`. During construction, read the preceding `assistant-step` data to decide whether this is a new group start and emit a header node if so. Another turn-level Definition publishes the group's content as Turn data for the renderer.
-
-**Approach β: one Context emits multiple nodes.** A turn-level Definition emits the whole-Turn control and N group headers.
-
-**Approach γ: a parent Context derives child Contexts.** When a group opens, the turn-level fold creates a `step-group` child Context and forwards later events to it. Each child owns one node. The engine needs forwarding and cascaded replay primitives.
-
-**Approach δ: Definitions own structure; the builder materializes rows.** A turn-level Definition folds the group list and publishes Turn data. The Chat builder materializes header nodes and assigns membership. Seats use combined selectors for visibility. `ViewBuilder.apply` receives the Location data whose references changed in the flush.
-
-## Alternatives considered
-
-**One Context per group cannot satisfy the matching rules.** The engine requires `match(event)` to derive an id from one event. A group number depends on whether a reply preceded the event; one event cannot determine it. This is incompatible with the matching contract, not merely difficult to implement.
-
-**Approach α conflicts with decision 2.** Header identity is derivable, but every header reads the same Turn data, so one group's change refreshes all headers in that Turn. Reading later steps through `turn.steps` instead leaves stale references because a header node is not rebuilt when later steps arrive.
-
-**Decision 3 rules out approach β.** See the table above.
-
-**Approach γ is not justified yet.** It has the clearest ownership, but forwarding and cascaded replay would add hundreds of lines to the assembler core. It remains an alternative under the conditions at the end of this note.
-
-**Approach A remains the fallback.** If builder-owned materialization is rejected in practice, use A. Both share the same structural source and differ only in what carries the header row.
-
-Choose approach δ.
-
-## Proposal
-
-### Data flow
-
-```
-事件流
-  ──▶ step-groups Definition（turn 级 fold，多重匹配本轮事件）
-        ──▶ Turn 数据 step-groups：组列表，每组一个对象
-              ──▶ Chat builder
-                    ├─ 物化组头节点：一组一个 key，data 即组对象
-                    └─ 成员归属：按 step 映射到 key，写进 per-key presentation
-                          ──▶ seat：hidden = f(策略字段, 角色, 展开状态)
-                          ──▶ 组头渲染器：读自己节点的 data
-展示策略
-  ──▶ 渲染器：按 kind 注入的 hooks，选单个字段
-  ──▶ seat：组合 selector，选出的是自己的结论
-```
-
-The only engine change passes the Location data whose references changed during a flush to the builder through `apply`.
-
-### Responsibilities
-
-| Layer | Owns | Explicitly does not own |
-|---|---|---|
-| `step-groups` Definition | Opening and closing groups, `headStep`, `closeStep`, tool counts and names, running tools; publishes Turn data | View nodes or identification of member nodes |
-| Chat builder | Header-node identity and lifecycle, membership, `turnStarted`, identity comparison and publication of per-key presentation | Reading events or deriving business structure |
-| Presentation policy object | Mapping the enum to capability fields | Node or seat state |
-| Seat | Combining policy fields, role, and store state into hidden state; supplying group open/close actions to the header renderer | Determining group boundaries |
-| Header renderer | Title, chevron, click-to-toggle interaction | The source of group content |
-| assistant-step renderer | Settled reasoning first-line preview; hiding reasoning when closing a group | Group boundaries |
-
-### Header-node identity and lifecycle
-
-A header node's key is `step-group:${turn}:${headStep}`. `headStep` is fixed when a group opens, and later events cannot change its first member. The header exists and is reused from that point onward; its key does not change during streaming. Closing the group only changes `closed` in its data from false to true.
-
-The header anchor is the first member's anchor minus a synthetic offset, placing it immediately before that member. A streaming Assistant is anchored at its first visible chunk, then at its message event after persistence. Its anchor moves once; the header follows in the same structural update without adding another update.
-
-A header is part of the whole-Turn process and hides with its members when the Turn folds. It is not in `TURN_PROCESS_INDEPENDENT_KINDS`.
-
-Header data is the group object published by the fold. Closed group objects never change references, so their header sources never notify. Each event that changes a running group replaces only that group's object and re-renders only its header.
-
-### Fold state machine
-
-The `step-groups` Definition uses the Turn number as its id, starts on `turn/start`, and matches the same event set as `turn-process`. Its State is `{ turn, groups, open }`: `groups` is an array of group objects, and `open` is the active group's index or empty.
-
-| Event | Transition |
-|---|---|
-| `tool/call` | If no group is open, open one at the event's step; increment the count, record distinct tool names, and add callId to the running set |
-| Appended `tool/result` | Remove callId from the running set |
-| `assistant/live-chunk` reasoning delta with visible characters | Open a group at the chunk's step if none is open |
-| `assistant/live-chunk` text delta or text-block end with visible characters | Close an open group at the chunk's step |
-| Appended `assistant/message` | Apply the reasoning rule for visible reasoning and the text rule for a visible reply, in reasoning-then-text order |
-| `turn/end` | Mark an open group as closed by the Turn end |
-| `step/start`, `step/end`, `llm/retry` | No state change; retry rows belong to no group |
-
-Three invariants apply:
-
- Idempotence: opening an already-open group and closing an already-closed group do nothing. Live chunks and persisted messages describing the same content do not open or close twice; replay with only persisted messages derives the same group list.
- Stable references: `update` returns the original object when State is unchanged; the `groups` array changes reference only when the group list changes; closed group objects are never replaced.
- Forward-only folding: do not read neighboring Contexts, nodes, or later history.
-
-Turn-data publication: `buildLocationData` returns a value only for the turn phase and reuses its previous value when the `groups` reference is unchanged, preventing republication. A history window without `turn/start` uses the same fallback as `turn-process`: fold State from the available matches.
-
-Publication timing: batch live chunks at animation frames; publish other changes immediately.
-
-### Membership rules
-
-The builder assigns membership by step, not by seq ranges, because live-chunk seqs and persisted-event seqs use different scales.
-
-| Node | Rule |
-|---|---|
-| `tool-call` at step s | Belongs to the last group with `headStep ≤ s`. If text closes the preceding group in the same step, later tool calls open a new group at that step, so the last group is the applicable one |
-| `assistant-step` at step s where a group has `closeStep === s` | Closer role: the node remains visible; folding the group hides only its reasoning through the existing `reasoningHidden` mechanism |
-| Other `assistant-step` at step s | Member role: belongs to the group with `headStep ≤ s` whose `closeStep` has not been passed |
-| `model-retry`, `turn-error`, `turn-max-tokens`, `turn-tail`, `user`, `steering` | Belong to no group |
-
-Recompute membership only when the group list changes, with cost proportional to that Turn's node count. Streaming chunks that leave the group list unchanged do not publish member presentation.
-
-The header anchors before the earliest member. If a group contains only its closer's reasoning and no members, such as reasoning followed by a reply in one step, anchor the header before the closer so the hidden reasoning still has a control that reveals it.
-
-### Delivering group changes to the builder
-
-The fold publishes Turn data, not view nodes. When Location data changes, the engine's `flush` sets `timelineDirty` and calls `apply` on all active targets, but the builder cannot identify the changed Turn and key. Inferring them from an unrelated node update in the same Turn and flush is not a reliable guarantee.
-
-Add optional `changedLocationData` to `ConversationViewBuilder.apply`: the Location values whose references changed in this flush, each carrying `kind`, `turn`, optional `step`, and `key`. The assembler already compares references in `applyDirtyLocationData`; it collects those results for the builder. Chat reprojects only Turns with `key === 'step-groups'`. When the optional input is absent, the builder falls back to Turns affected by the current upserts.
-
-### Combining hidden state in a seat
-
-Seats stop receiving `compactTranscript` and `historyIncomplete`. A seat reads policy through `usePresentation`, selecting its own result rather than the mode:
-
-```ts
-declare function usePresentation<T>(select: (policy: {
-  stepGrouping: 'collapsed' | 'none'
-  foldCompletedTurns: boolean
-}) => T): T
-declare const group: { readonly headStep: number } | undefined
-
-const grouping = usePresentation(p => group === undefined ? 'none' : p.stepGrouping)
-const foldCompleted = usePresentation(p => p.foldCompletedTurns)
-```
-
-For a seat outside every group, `grouping` is `'none'` in all modes, so it does not re-render. `foldCompletedTurns` likewise stays true in all modes. The selector hook uses `useSyncExternalStoreWithSelector` and re-renders only when the selected value changes.
-
-Three sources combine into `hidden`:
-
-| Source | Condition | Reveal action |
-|---|---|---|
-| Whole-Turn folding | Existing rule: `turnClosed && turnStarted && has reply`, without manual expansion | Open the Turn |
-| Group folding | `grouping === 'collapsed'`, member role, group not manually expanded | Open the group |
-| Group header in Expanded | Header role and `grouping === 'none'` | None |
-
-The closer's reasoning is hidden independently: the seat passes `stepGroup.reasoningHidden` through owner props to the assistant-step renderer.
-
-The chat store keeps group expansion under a key combining `turn` and `headStep`, alongside whole-Turn manual expansion.
-
-### Re-render scope
-
-The following guarantees also define the next round of render-count assertions. Each row names an exact set, not an upper bound.
-
-| External change | May re-render |
-|---|---|
-| A running group receives a reasoning chunk | That assistant seat |
-| A running group receives `tool/call` | That tool seat and the group's header |
-| A reply appears and closes a group | That assistant seat and group header; membership recomputation occurs only when opening or closing groups |
-| A new group opens | Insert the new header into `order` with one structural layout; no other seat refreshes |
-| Switch Compact ↔ Detailed | Only assistant-step renderers with settled reasoning |
-| Switch to or from Expanded | Only member and header seats |
-| Change `performanceUsage` | Only turn-tail |
-| Load an earlier page | New seats and historical seats whose presentation changes |
-| Change locale | All seats, as a control case |
-
-### Presentation policy object
-
-Separate the persisted enum from runtime capabilities. `TranscriptViewMode` contains `compact`, `detailed`, and `expanded`; reading the legacy saved value `normal` maps it to `detailed` without writing it back. Runtime capabilities are the derived `ChatPresentationPolicy`:
-
-| Field | compact | detailed | expanded |
-|---|---|---|---|
-| `foldCompletedTurns` | true | true | true |
-| `stepGrouping` | collapsed | collapsed | none |
-| `settledReasoningPreview` | false | true | true |
-
-The mapping has one owner. Each mode maps to a constant object with a stable reference, so the derived observable needs no subscription bookkeeping: `getSnapshot` performs a lookup and `subscribe` forwards to the mode observable.
-
-Renderers select needed fields instead of comparing enum values. Policy is injected by kind: the assistant-step registration receives it through `inject.hooks.presentation`, just as turn-tail receives `performanceUsage`. Adding a fourth mode changes the table, not the renderers.
-
-### Per-Turn folding
-
-Add `turnStarted` to per-key presentation, derived from whether the Turn's `turn/start` is in the loaded window. Folding eligibility uses it instead of global `!historyIncomplete`. Completing pagination changes no global seat prop; only new nodes and presentation in their Turns change.
-
-### Complexity requirements
-
-| Scenario | Fold | Builder | Publication |
-|---|---|---|---|
-| Content chunk without a group-boundary change | O(1) transition, original object returned | No reprojection | None |
-| Event that changes a group boundary | O(1) | Reproject only the owning Turn, proportional to its node count | Keys whose facts changed in that Turn |
-| Structural changes and pagination | Proportional to matched events | One full pass | Keys whose facts changed |
-| Mode change | None | None | None; seat and renderer selectors determine re-renders |
-
-## Change inventory
-
-| Package | File | Change |
-|---|---|---|
-| ui-conversation | `contract/conversation.ts` | Add `ConversationLocationDataUpdate` and optional `changedLocationData` to `ConversationViewBuilder.apply` |
-| ui-conversation | `conversation/assembler.ts` | Collect changed Location references in `applyDirtyLocationData` and pass them through `apply` |
-| ui-conversation | `index.ts` | Export the new type |
-| ui-chat | `chat-settings.ts` | Three-mode enum; schema accepts legacy `normal` |
-| ui-chat | `transcript-view.ts` | Map `normal` to `detailed` on read |
-| ui-chat | New `presentation-policy.ts` | Policy objects, mapping table, derived observable |
-| ui-chat | `settings/TranscriptViewRow.tsx` | Three options |
-| ui-chat | `locale.ts` | Mode labels and group-header copy |
-| ui-chat | `contract/slots.ts` | `ChatViewInjected.hooks.presentation`, `PresentationInjected`, `ChatNodeOwnerProps.stepGroup`, `StepGroupOwnerProps` |
-| ui-chat | `contract/snapshot.ts` | `ChatTurnProcessPresentation.turnStarted`, `ChatNodeGroupPresentation`; combine `processSource` values per key |
-| ui-chat | `contract/chat-nodes.ts` | `StepGroupChatData` |
-| ui-chat | `contract/store.ts`, `stores.ts` | Manual group-expansion state and actions |
-| ui-chat | `conversation-nodes/common.ts` | Header anchor offset |
-| ui-chat | New `conversation-nodes/step-groups.ts` | Fold Definition and Turn-data declaration merging |
-| ui-chat | New `conversation-nodes/step-group-nodes.ts` | Materialize headers and project membership |
-| ui-chat | `conversation-nodes/turn-process-presentation.ts` | `turnStarted` and combined per-key presentation |
-| ui-chat | `conversation-nodes/chat-snapshot-builder.ts` | Integrate materialization, consume `changedLocationData`, support key deletion in the store |
-| ui-chat | `conversation-nodes/register.ts` | Register the fold Definition |
-| ui-chat | `chat/ChatView.tsx` | Stop passing `compactTranscript` and `historyIncomplete`; pass `usePresentation` |
-| ui-chat | `chat/ChatNodeSeat.tsx` | Combined selector, three hiding sources, `stepGroup` owner props |
-| ui-chat | `chat/AssistantNodeView.tsx`, `chat/AssistantMarkdown.tsx`, `chat/ReasoningRow.tsx` | Inject policy, toggle settled reasoning previews, hide closer reasoning |
-| ui-chat | New `chat/StepGroupNodeView.tsx` | Header renderer |
-| ui-chat | `chat/register-node-renderers.ts` | Register header renderer and inject policy into assistant-step |
-| ui-chat | `apply.ts`, `index.ts` | Create and inject policy observable; export types |
-
-This inventory retains the complete grouping proposal. Independent features have updated READMEs, i18n pairing files, and the slot catalog. The migration record tracks tests and snapshots; those updates do not complete the outstanding grouping work.
-
-## Acceptance criteria
-
-Grouping validation remains unimplemented; the migration record tracks independent presentation-feature evidence.
-
-**Render-count isolation.** Add counters to the existing `chat-view.client.spec` mounting approach: React Profiler `onRender` counts per seat, and test renderers registered in `conversation.chat.node` count by kind. Assert the exact sets in the re-render-scope table for each stimulus.
-
-**Publication counts.** Count notifications from each key's source under the same stimuli and assert the exact set.
-
-**Fold state-machine tests.** Feed event sequences and assert opening, closing, a new group after text then tools in one step, Turn-end closure, idempotence, unchanged closed-group references, and equivalent replay using only persisted messages.
-
-**Membership tests.** Given the group list and Turn nodes, assert each key's role.
-
-**Benchmark coverage.** Add incremental apply with reasoning and tools to `conversation-fold`, and a streaming fixture with tools and reasoning to `long-session-browser`. These provide wall-clock evidence, not a gate.
-
-## Risks
-
- **Builder-owned node creation.** This is the first proposed node creation by a view builder. A builder may only materialize rows from Turn or Step data; it must not read events or derive business structure. Synthetic keys use `step-group:`, while Context keys begin with digits, preventing collisions. Fall back to approach A if this ownership is rejected in practice.
- **Header anchor moves once with its first member.** Persisting a streaming Assistant moves its anchor from the first visible chunk to the message event. The header follows in the Assistant's structural update.
- **Actual mode differences in this phase.** Compact and Detailed currently differ only in settled reasoning first-line previews. Running detail titles and category summaries are outside this phase; the policy table leaves room for them.
- **Pagination and partial Turns.** The oldest partial Turn neither folds nor groups. Membership uses steps and is independent of pagination.
- **Header copy.** This phase proposes only processing/completed labels and tool-call counts; category summaries remain product work.
- **Streaming chunk step.** `assistant/live-chunk` carries `step`, as used by `turn-process`; a chunk without a step does not open a group.
-
-## Retained alternative: parent-derived child Contexts
-
-If builder materialization exposes more ownership problems than expected, add an engine primitive: a Context's `update` may derive a child Context with an explicit kind and id, then forward later matches. Each child owns its node, publication timing, and Location. Parent replay aligns children by id; children no longer derived become hidden under the existing withdrawal rules.
-
-This returns row identity and content to Definitions with one Context per group and no array fragmentation. It requires assembler forwarding and cascaded replay, and introduces a Context creation path outside `match`. Reconsider it if more than two business features exceed the builder's materialization limits, or if membership requires cases that steps cannot express.
@@ -1,288 +0,0 @@
-# Agent Note: Chat 展示策略通道与过程分组的基础架构
-
-Status: proposed
-
-[English](2026-09-20-chat-presentation-policy-and-step-groups.md) | 中文
-
-## 问题
-
-Chat 的「对话显示」设置在本提案开始时只有两档：`normal` 不折叠、`compact` 在轮次结束后把过程行折进一个整轮控件。设置值的流向是：`TranscriptViewPolicy.mode` 观察量注入 ChatView，ChatView 用 `useTranscriptView` 读成一个布尔值 `compactTranscript`，再作为 prop 传给 `ChatNodeList`，再传给每一个 `ChatNodeSeat`。另一个全局布尔值 `hasMore` 走同一条路，以 `historyIncomplete` 的名字进每个 seat。两个值一变，全部 seat 重渲染一遍，哪怕只有可折叠的那几个输出真的变了。
-
-产品要把这个设置改成三档：简洁、详细、完全展开；并在简洁和详细两档里把回复之间的连续过程行归成可折叠的组。PR #4565 做过一次完整实现，合并八分钟后因性能回退被整体撤回。合并前后在本机的对照实测：长会话分页耗时 +27%，DOM 节点 +23%，堆内存 +14%，Trajectory 切换 +10%，全部仍在 CI 预算内；仓库现有六个基准没有任何一个覆盖「流式期间 reasoning 或工具 chunk 进入活动分组、分组重投影、seat 重渲染」这条它新增的热路径。
-
-审阅那次实现，问题不在业务需求，在选型：
-
- 模式被当成列表结构的输入。`ChatNodeList` 订阅整表 `layout`，按 range 生成 wrapper 组件；完全展开模式下 wrapper 消失。模式切换等于整棵列表重挂载，任何一次重新分组都重建 wrapper 的 key。
- 模式进了 `ChatNodeOwnerProps`。每个 seat 的 owner 对象随模式变，所有业务渲染器跟着重渲染，包括与模式无关的用户消息、工具行、压缩标记。
- 同一个 Assistant 节点在 seat 里被拆成 reasoning 与 response 两份派生对象，只为了让 wrapper 在 DOM 上包住前者不包住后者。master 的 `AssistantMarkdown` 早有 `reasoningHidden` 与 `revealProcess`，靠隐藏状态就能只藏 reasoning。
- 基础设施行的 Chat 可见性由消费方过滤函数在四处各判一遍，而节点本身有 `visibility` 字段由 Definition 决定。
-
-再往下一层，是一个信息流上的两难：分组的行要出现在成员之前，从组打开那一刻就该存在；但它要显示的内容，只有看到整轮所有事件的人才知道。事件驱动的 Context 模型里每个 Context 只收自己的事件，能看到整轮的只有 turn 级 Context，而它只能产出一个节点。
-
-本记录给出一套基础架构，让三档模式与分组落地时满足下面的约束，并让后续产品变化只落在少数节点上。
-
-三档设置、展示策略通道与按轮折叠资格已实现；step-group 仍是提案。当前实现、已提交范围和未完成项以[迁移进度表](../feature/2026-09-20-chat-work-details-migration.zh.md)为准，下面的分组状态机与改动清单不表示已经交付。
-
-## 目标与约束
-
-[已实现的 Definition 分组基础机制](../../implemented/architecture/2026-09-21-conversation-build-groups.zh.md)取代本记录中的事件 fold、Builder 物化组头、Step 范围成员推断及 changedLocationData 提案。本记录保留展示策略与按轮折叠资格的理由；下文分组实现记录已被取代的路线，不是当前实施方案。
-
-下表是评审阶段已经确认的裁决，本方案不再重新讨论它们。
-
-| 编号 | 裁决 | 含义 |
-|---|---|---|
-| 1 | 分组结构在 Definition 层定义 | 组的开合、成员范围、摘要由一个多重匹配本轮事件的 Definition 折叠出来，不由渲染层扫描节点得到 |
-| 2 | 有限刷 seat | 切模式只重渲染 presentation 真正变化的 seat；流式 chunk 只重渲染所属 seat 和它所在组的组头；用户消息、回复、turn-tail 在这两种变化下零重渲染 |
-| 3 | 一个 Context 一个节点 | 不引入「一个 Context 产出多个节点」，理由是绝大多数 Context 只会有一个元素，数组化让内存更零散 |
-| 4 | 模式不开关 Definition | 注册变化会触发 registry 重建与全量重放，所有 seat 必刷；Definition 必须与模式无关 |
-| 5 | 折叠按轮判定 | 一轮只要自己的 `turn/start` 已加载就可以折叠；被分页切开的最老一轮保持展开，本轮不优化 |
-| 6 | 允许改 ui-conversation | 引擎可以改，但只做让方案正确成立所必需的小改动 |
-| 7 | 初始实现范围 | 初始阶段只写代码与本记录；测试与其他文档在 CI 修复阶段补齐 |
-
-有一条前置澄清：接受「切模式全屏重排版」不等于接受「所有 seat 重渲染」。浏览器重排是几何结果，seat 重渲染是 React 组件函数重跑，后者才是这里要限制的量。
-
-## 可行的路线
-
-围绕「组头这一行的身份从哪来、内容从哪来」，可行的路线有五条。
-
-**路线 A，头成员的 seat 画组头。** 列表不变，builder 算出分组后告诉第一个成员的 seat「你是组头」，该 seat 在自己上方画标题，其余成员 seat 用现有 `hidden` 机制藏起来。零新概念。缺点是 seat 里出现「自身可见但只显示标题」的第三种状态，且标题寄生在一个业务节点的 seat 里。
-
-**路线 α，每步一个 Context 当组头。** 增加一个 id 为 `turn:step` 的 Definition，在构建时读上一步的 `assistant-step` 数据判断自己是否新组开头，是则产出组头节点。组的内容由另一个 turn 级 Definition 发布成 Turn 数据供渲染器读取。
-
-**路线 β，一个 Context 产出多个节点。** turn 级 Definition 一个人产出整轮控件加 N 个组头。
-
-**路线 γ，父 Context 派生子 Context。** turn 级 fold 在开组时生成一个 `step-group` 子 Context 并把后续事件转发给它，子 Context 有自己的单个节点。引擎需要新增转发原语与重放级联。
-
-**路线 δ，Definition 拥有结构，builder 物化行。** turn 级 Definition 折叠出组列表并发布为 Turn 数据；Chat builder 据此物化组头节点并给成员写归属；seat 用组合 selector 决定隐藏；引擎给 `ViewBuilder.apply` 的入参加一份「本次 flush 哪些 Location 数据换了引用」。
-
-## 备选方案与取舍
-
-**每组一个 Context 无法成立。** 引擎要求 `match(event)` 只看单个事件算出 id，「第几组」取决于前面有没有回复，单个事件算不出。这不是实现难度，是契约上的不可能。
-
-**路线 α 与裁决 2 冲突。** 组头身份能算出，但内容要读整轮一份 Turn 数据，任何一组变化全轮组头都重渲染。改成去读 `turn.steps` 里后面几步的数据，又碰上组头节点不会因为后面的步到来而重建，读到的是陈旧引用。
-
-**路线 β 被裁决 3 否决。** 见上表。
-
-**路线 γ 现在不值。** 它在所有权上最纯，但要给 assembler 加转发与重放级联，是几百行的引擎核心改动。本记录把它保留为备选，条件写在末尾。
-
-**路线 A 作为退路保留。** 如果 builder 物化节点在实践中被否决，退到 A；两者的结构来源相同，只差组头这一行的承载。
-
-选择路线 δ。
-
-## 方案
-
-### 数据流
-
-```
-事件流
-  ──▶ step-groups Definition（turn 级 fold，多重匹配本轮事件）
-        ──▶ Turn 数据 step-groups：组列表，每组一个对象
-              ──▶ Chat builder
-                    ├─ 物化组头节点：一组一个 key，data 即组对象
-                    └─ 成员归属：按 step 映射到 key，写进 per-key presentation
-                          ──▶ seat：hidden = f(策略字段, 角色, 展开状态)
-                          ──▶ 组头渲染器：读自己节点的 data
-展示策略
-  ──▶ 渲染器：按 kind 注入的 hooks，选单个字段
-  ──▶ seat：组合 selector，选出的是自己的结论
-```
-
-引擎改动只有一处：assembler 在 flush 时把「哪些 Location 数据换了引用」随 `apply` 入参交给 builder。
-
-### 各层职责
-
-| 层 | 拥有 | 明确不拥有 |
-|---|---|---|
-| `step-groups` Definition | 组的开合、`headStep`、`closeStep`、工具计数与名称、运行中的工具；作为 Turn 数据发布 | 任何视图节点；成员是哪些节点 |
-| Chat builder | 组头节点的身份与生命周期；成员归属；`turnStarted`；per-key presentation 的身份比较发布 | 读事件；自己算业务结构 |
-| 展示策略对象 | 枚举到能力字段的映射 | 任何节点或 seat 状态 |
-| seat | 用策略字段、角色、store 状态合成 hidden；把组的开合能力交给组头渲染器 | 判断组的边界 |
-| 组头渲染器 | 标题、箭头、点击开合 | 组的内容来源 |
-| assistant-step 渲染器 | 是否显示已完成推理的首行预览；作为组的关闭者时隐藏推理部分 | 组的边界 |
-
-### 组头节点的身份与生命周期
-
-组头节点的 key 是 `step-group:${turn}:${headStep}`。`headStep` 在组打开那一刻就确定，之后任何事件都改不了「谁是第一个」，所以组头节点从打开起就存在并被复用，运行中不会换 key。组关闭只是它 data 里的 `closed` 从 false 变 true。
-
-组头节点的锚点是该组头成员节点锚点减去一个合成偏移，位置紧贴在第一个成员之前。头成员的 Assistant 节点在流式期间锚在第一个可见 chunk，落盘后锚在消息事件，锚点会移动一次；组头随之移动一次，这是一次结构性更新，与 Assistant 节点自己的结构性更新同时发生，不额外增加次数。
-
-组头节点属于整轮过程的一部分：整轮折叠时它随成员一起隐藏。它不在 `TURN_PROCESS_INDEPENDENT_KINDS` 里。
-
-组头节点的 data 就是 fold 发布的组对象。已关闭的组对象引用永不改变，因此已关闭组头的 source 永不通知；正在运行的组每来一个改变它的事件换一个对象，只有这一组的组头重渲染。
-
-### fold 状态机
-
-`step-groups` Definition 的 id 是 turn 号，在 `turn/start` 上启动，匹配与 `turn-process` 同一批事件。State 是 `{ turn, groups, open }`，`groups` 是组对象数组，`open` 是当前打开组的下标或空。
-
-| 事件 | 转移 |
-|---|---|
-| `tool/call` | 没有打开的组则以该事件的 step 开新组；计数加一；记录 distinct 工具名；把 callId 加入运行集合 |
-| `tool/result` 追加 | 从运行集合移除 callId |
-| `assistant/live-chunk` 推理 delta 含可见字符 | 没有打开的组则以该 chunk 的 step 开新组 |
-| `assistant/live-chunk` 文本 delta 或文本块结束含可见字符 | 有打开的组则以该 chunk 的 step 关闭它 |
-| `assistant/message` 追加 | 消息含可见推理则按推理规则处理，含可见回复则按文本规则处理；顺序是先推理后文本 |
-| `turn/end` | 有打开的组则标记为被轮次结束关闭 |
-| `step/start`、`step/end`、`llm/retry` | 不改变状态；重试行不属于任何组 |
-
-三条不变量：
-
- 幂等。开组时已有打开的组则无操作；关组时组已关闭则无操作。live chunk 与落盘消息重复描述同一内容不会开两次或关两次，历史重放只有落盘消息也能得到同样的组列表。
- 引用稳定。State 没变时 `update` 返回原对象；`groups` 数组只在组列表变化时换引用；已关闭的组对象永不替换。
- 只向前折叠。不读邻居 Context，不读节点，不向后看。
-
-Turn 数据发布：`buildLocationData` 只在 turn 阶段返回值，`groups` 引用不变时返回上一次发布的值，引擎据此不重新发布。没有 `turn/start` 的历史窗口用与 `turn-process` 相同的兜底：从已有匹配折叠出 State。
-
-发布节奏：live chunk 走动画帧合并，其余立即。
-
-### 成员归属规则
-
-归属由 builder 按 step 判定，不用 seq 区间，因为 live chunk 的 seq 与落盘事件的 seq 不在一个尺度上。
-
-| 节点 | 规则 |
-|---|---|
-| `tool-call`，step 为 s | 属于 `headStep ≤ s` 的最后一组。文本在同一 step 关闭了上一组之后的工具调用，会由 fold 以该 step 开出新组，所以「最后一组」总是正确的那一组 |
-| `assistant-step`，step 为 s，且某组 `closeStep === s` | 角色为关闭者。节点保持可见；组折叠时只隐藏它的推理部分，用现有 `reasoningHidden` 机制 |
-| `assistant-step`，step 为 s，其余情况 | 属于 `headStep ≤ s` 且 `s` 未越过 `closeStep` 的组，角色为成员 |
-| `model-retry`、`turn-error`、`turn-max-tokens`、`turn-tail`、`user`、`steering` | 不属于任何组 |
-
-归属只在组列表变化时重算，成本是该轮节点数。流式 chunk 不改变组列表时，成员的 presentation 不发布。
-
-组头行锚在最早的成员之前。一个组如果只有关闭者的推理而没有任何成员，比如一步里先推理后回复，组头行就锚在关闭者之前，这样被隐藏的推理仍然有一行可以点开。
-
-### 分组变化怎样到达 builder
-
-fold 只发布 Turn 数据，没有视图节点。engine 的 `flush` 在 Location 数据有变化时会把 `timelineDirty` 置真并对所有活跃目标调用 `apply`，但 builder 不知道是哪一轮的哪个 key 变了。依赖「同一轮总有别的节点也在这次 flush 里变了」去推断，是巧合不是契约。
-
-所以给 `ConversationViewBuilder.apply` 的入参增加可选的 `changedLocationData`：本次 flush 里换了引用的 Location 数据清单，每项含 `kind`、`turn`、可选 `step`、`key`。assembler 在 `applyDirtyLocationData` 里本来就逐条比较了前后引用，只是把比较结果收集起来交给 builder。Chat builder 只取 `key === 'step-groups'` 的轮次做重投影。入参可选，不传时 builder 退化为按本次 upsert 涉及的轮次重投影。
-
-### seat 的 hidden 合成
-
-seat 不再接收 `compactTranscript` 与 `historyIncomplete` 两个 prop。它通过 `usePresentation` 读策略，但选出的不是模式，而是自己的结论：
-
-```ts
-declare function usePresentation<T>(select: (policy: {
-  stepGrouping: 'collapsed' | 'none'
-  foldCompletedTurns: boolean
-}) => T): T
-declare const group: { readonly headStep: number } | undefined
-
-const grouping = usePresentation(p => group === undefined ? 'none' : p.stepGrouping)
-const foldCompleted = usePresentation(p => p.foldCompletedTurns)
-```
-
-不在任何组里的 seat，`grouping` 在三档下都是 `'none'`，值没变就不重渲染。`foldCompletedTurns` 在三档下都是 true，同理。selector hook 的底层是 `useSyncExternalStoreWithSelector`，只有选出的值变化才重渲染。
-
-三个隐藏来源合成一个 `hidden`：
-
-| 来源 | 条件 | 揭示动作 |
-|---|---|---|
-| 整轮折叠 | 现有规则，`turnClosed && turnStarted && 有回复` 且未手动展开 | 打开整轮 |
-| 组折叠 | `grouping === 'collapsed'`、角色为成员、组未手动展开 | 打开该组 |
-| 组头在完全展开档 | 角色为组头且 `grouping === 'none'` | 无 |
-
-关闭者节点的推理部分单独隐藏：seat 通过 owner props 里的 `stepGroup.reasoningHidden` 告诉 assistant-step 渲染器。
-
-组的展开状态进 chat store，key 是 `turn` 加 `headStep`，与整轮的手动展开状态并列。
-
-### 刷新范围
-
-下表是这套结构给出的保证，也是下一轮渲染次数测试的断言表。每一行断言的是精确集合，不是上限。
-
-| 外部变化 | 允许重渲染的 |
-|---|---|
-| 运行中的组来一个推理 chunk | 该 assistant seat |
-| 运行中的组来一个 `tool/call` | 该 tool seat，加这一组的组头 |
-| 回复出现，组关闭 | 该 assistant seat，加这一组的组头；成员归属重算只发生在开关组时 |
-| 新组打开 | 新组头进 `order`，一次结构重排；其他 seat 不刷 |
-| 模式在简洁与详细之间切换 | 仅有已完成推理的 assistant-step 渲染器 |
-| 模式切到完全展开或切回 | 仅成员与组头 seat |
-| `performanceUsage` 切换 | 仅 turn-tail |
-| 加载更早一页 | 新增 seat，加 presentation 变了的历史 seat |
-| 语言切换 | 全部，作为对照 |
-
-### 展示策略对象
-
-持久化的枚举与运行时词汇分开。枚举 `TranscriptViewMode` 是 `compact`、`detailed`、`expanded`，存档里的旧值 `normal` 读取时映射为 `detailed`，不回写。运行时词汇是派生的 `ChatPresentationPolicy`：
-
-| 字段 | compact | detailed | expanded |
-|---|---|---|---|
-| `foldCompletedTurns` | true | true | true |
-| `stepGrouping` | collapsed | collapsed | none |
-| `settledReasoningPreview` | false | true | true |
-
-映射只存在于一处。每档对应一个常量对象，同一档永远同一引用，所以派生观察量不需要自己的订阅簿记：`getSnapshot` 是查表，`subscribe` 直接转给模式观察量。
-
-渲染器不比较枚举，只 select 自己需要的字段。策略观察量按 kind 注入：assistant-step 的注册通过 `inject.hooks.presentation` 拿到它，与 turn-tail 注入 `performanceUsage` 是同一写法。以后加第四档只改这张表，渲染器一个不动。
-
-### 按轮折叠
-
-per-key presentation 增加 `turnStarted`，来源是该轮 `turn/start` 是否在加载窗口内。seat 的折叠资格由 `turnStarted` 替代原来的全局 `!historyIncomplete`。分页加载完成时不再有任何全局 prop 变化，只有新增节点与它们所在轮的 presentation 变化。
-
-### 复杂度契约
-
-| 场景 | fold | builder | 发布 |
-|---|---|---|---|
-| 内容型 chunk，不改变组边界 | O(1) 状态转移，返回原对象 | 无重投影 | 零 |
-| 改变组边界的事件 | O(1) | 只重投影所属轮，成本为该轮节点数 | 该轮内事实变化的 key |
-| 结构变化与分页 | 按匹配的事件数 | 全量一次 | 事实变化的 key |
-| 模式切换 | 无 | 无 | 无；重渲染由 seat 与渲染器的 selector 决定 |
-
-## 改动清单
-
-| 包 | 文件 | 改动 |
-|---|---|---|
-| ui-conversation | `contract/conversation.ts` | 新增 `ConversationLocationDataUpdate`；`ConversationViewBuilder.apply` 入参增加可选 `changedLocationData` |
-| ui-conversation | `conversation/assembler.ts` | `applyDirtyLocationData` 收集换了引用的 Location 数据并随 `apply` 传出 |
-| ui-conversation | `index.ts` | 导出新类型 |
-| ui-chat | `chat-settings.ts` | 三档枚举；schema 接受旧值 `normal` |
-| ui-chat | `transcript-view.ts` | 读取时 `normal` 映射为 `detailed` |
-| ui-chat | `presentation-policy.ts` 新增 | 策略对象、映射表、派生观察量 |
-| ui-chat | `settings/TranscriptViewRow.tsx` | 三个选项 |
-| ui-chat | `locale.ts` | 三档文案；组头文案 |
-| ui-chat | `contract/slots.ts` | `ChatViewInjected.hooks.presentation`；`PresentationInjected`；`ChatNodeOwnerProps.stepGroup`；`StepGroupOwnerProps` |
-| ui-chat | `contract/snapshot.ts` | `ChatTurnProcessPresentation.turnStarted`；`ChatNodeGroupPresentation`；`processSource` 的值改为 per-key 组合对象 |
-| ui-chat | `contract/chat-nodes.ts` | `StepGroupChatData` |
-| ui-chat | `contract/store.ts`、`stores.ts` | 组的手动展开状态与动作 |
-| ui-chat | `conversation-nodes/common.ts` | 组头锚点偏移 |
-| ui-chat | `conversation-nodes/step-groups.ts` 新增 | fold Definition 与 Turn 数据声明合并 |
-| ui-chat | `conversation-nodes/step-group-nodes.ts` 新增 | 组头节点物化与成员归属投影 |
-| ui-chat | `conversation-nodes/turn-process-presentation.ts` | `turnStarted`；组合 per-key presentation |
-| ui-chat | `conversation-nodes/chat-snapshot-builder.ts` | 接入物化投影；消费 `changedLocationData`；store 支持删除 key |
-| ui-chat | `conversation-nodes/register.ts` | 注册 fold Definition |
-| ui-chat | `chat/ChatView.tsx` | 删除 `compactTranscript` 与 `historyIncomplete` 的传递；传 `usePresentation` |
-| ui-chat | `chat/ChatNodeSeat.tsx` | 组合 selector；三个隐藏来源；`stepGroup` owner props |
-| ui-chat | `chat/AssistantNodeView.tsx`、`chat/AssistantMarkdown.tsx`、`chat/ReasoningRow.tsx` | 注入策略；已完成推理的预览开关；关闭者的推理隐藏 |
-| ui-chat | `chat/StepGroupNodeView.tsx` 新增 | 组头渲染器 |
-| ui-chat | `chat/register-node-renderers.ts` | 注册组头渲染器；给 assistant-step 注入策略 |
-| ui-chat | `apply.ts`、`index.ts` | 创建策略观察量并注入；导出类型 |
-
-上述清单保留完整分组方案；独立功能已经更新 README、i18n 配对文件及 slot catalog。测试与快照进度见迁移记录，未完成的分组改动不随这些更新自动完成。
-
-## 验收标准
-
-分组相关验收仍待实现；独立展示功能的验证进度见迁移记录。
-
-**渲染次数隔离测试。** 在现有 `chat-view.client.spec` 的挂载方式上加计数：React Profiler 的 `onRender` 按 seat 计数，测试专用的计数渲染器注册进 `conversation.chat.node` 按 kind 计数。刺激与期望按「刷新范围」一节的表逐行断言精确集合。
-
-**发布次数测试。** 同样的刺激下统计每个 key 的 source 通知次数，断言精确集合。
-
-**fold 状态机单测。** 喂事件序列，断言组列表：开组、关组、同 step 先文本后工具开新组、轮次结束关组、幂等性、已关闭组对象引用不变、只有落盘消息的历史重放得到相同组列表。
-
-**成员归属单测。** 给定组列表与该轮节点，断言每个 key 的角色。
-
-**基准补位。** `conversation-fold` 增加带推理与工具的增量 apply 场景；`long-session-browser` 增加带工具与推理的流式 fixture。这是墙钟兜底，不是门禁。
-
-## 风险
-
- **builder 产出节点的边界。** 这是这套架构里第一次由视图 builder 产出节点。边界写死为：builder 只能从 Turn 或 Step 数据物化行，不能读事件，不能自己算业务结构。合成 key 用 `step-group:` 前缀，Context key 以数字开头，不会冲突。如果实践中被否决，退到路线 A。
- **组头锚点随头成员移动一次。** 头成员是流式 Assistant 时，落盘让锚点从首个可见 chunk 移到消息事件，组头跟着移动一次。与 Assistant 自己的结构性更新同时发生。
- **三档在本轮的实际差异。** 简洁与详细目前只差已完成推理的首行预览；运行中的详情标题、类别摘要等产品特性不在本轮。策略表已为它们留了位置。
- **分页与半截轮。** 被分页切开的最老一轮不折叠、不分组；归属只按 step 计算，不受分页影响。
- **组头文案。** 本轮只有「正在处理」与「已完成处理」加工具调用次数，类别摘要留给产品层。
- **流式 chunk 的 step 字段。** `assistant/live-chunk` 事件携带 `step`，与 `turn-process` 的用法相同；若 chunk 缺少 step 则不开组。
-
-## 备选保留：父 Context 派生子 Context
-
-如果 builder 物化节点在使用中暴露出比预期更多的边界问题，替代方案是给引擎加一个原语：Context 在 `update` 中可以派生一个指定 kind 与 id 的子 Context，并把后续匹配转发给它；子 Context 有自己的单个节点、自己的发布节奏与 Location。父 Context 重放时子 Context 按 id 对齐，未再派生的子 Context 按现有撤回规则转为隐藏。
-
-它的收益是行的身份与内容都回到 Definition 层，一组一个 Context，没有数组碎片。代价是 assembler 要新增转发与重放级联，且 `match` 之外多出一条 Context 创建路径。切换条件：builder 物化节点的边界在两个以上业务里被突破，或成员归属的按 step 规则出现无法用 step 表达的用例。
@@ -1,6 +0,0 @@
-# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
-# side as of the last confirmed-consistent state. Both languages carry equal authority;
-# after editing either side, bring the other along and re-record with:
-#   pnpm run verify-translation-pairing --write .agents/notes/proposed/feature/2026-09-20-chat-work-details-migration.md
-2026-09-20-chat-work-details-migration.md: 126b61d32d4a4dbf27cb5997149abc9820d7f881
-2026-09-20-chat-work-details-migration.zh.md: 20727c299307881b67d0662092d269afa9af176c
@@ -1,176 +0,0 @@
-# Agent Note: Chat work-details migration progress
-
-Status: proposed
-
-English | [中文](2026-09-20-chat-work-details-migration.zh.md)
-
-## Problem
-
-PR #4565 combines three display modes, process grouping, whole-Turn status, trigger notifications, tool-row visuals, and infrastructure-row hiding. Migrating it as one batch mixes independent features with list restructuring and makes individual performance changes difficult to assess. A feature-based progress table allows independent visuals to be reviewed first and Turn-related behavior to be considered with step-group later, without losing product requirements.
-
-## Proposal
-
-Completed independent features stay in `feat/chat-presentation-channel`. The remaining unfinished code continues in `.artifacts/worktrees/pr-4565-turnstep` under the repository root, based on the current channel and this progress record, with drafts kept unstaged for combined turn/step and grouping review. The `pr-4565` worktree remains the original PR's behavior and implementation reference; existing `feat/chat-step-groups` experiments are outside this transfer.
-
-This record tracks feature scope, current implementation, and acceptance progress. The [presentation policy channel and process-group architecture](../architecture/2026-09-20-chat-presentation-policy-and-step-groups.md) retains the architecture and alternatives. This record neither replaces it nor treats its proposals as implemented. Because it does not fully supersede that decision, retain the architecture note without archival or deletion.
-
-This record maintains an English/Chinese pair. Completion, implementation, staging or commit state, and acceptance are separate dimensions. Incomplete items remain marked incomplete even when drafts exist, and stay in the inventory. Tests and documentation are added during CI repair; browser snapshots and performance acceptance are tracked separately. Written code, staging, commits, and successful builds do not establish complete functional or performance acceptance.
-
-### Status definitions
-
-| Dimension | State | Meaning |
-|---|---|---|
-| Completion | Complete | Migration code has been reviewed feature by feature and committed to this channel; behavior and performance evidence are separate |
-| Completion | Incomplete | Outside the channel's completed migration scope; may have an unstaged draft or no implementation |
-| Implementation | Existing capability | Already present in this channel |
-| Implementation | Code written | Implementation exists in the relevant worktree; does not imply completion, staging, commit, or acceptance |
-| Implementation | Awaiting migration | Included in non-grouping scope but not yet implemented |
-| Implementation | Grouping phase | Requirement retained; depends on grouping structure or interactions and is not connected to this channel yet |
-| Staging or commit | Unstaged | Changes remain in the worktree, including untracked files |
-| Staging or commit | Partially staged | Only some feature changes are staged; the exact scope must be stated |
-| Staging or commit | Staged | All pending code changes for the feature are staged but not committed |
-| Staging or commit | Committed | Feature code is included in current HEAD |
-| Acceptance | Pending | Requires behavior, node identity, update-scope, or browser performance evidence; Git state and compilation cannot substitute |
-
-Verify staging against the feature's diff hunks, not whole files. Inspect the worktree, index, and HEAD when updating status. Staging some fields in a shared file does not stage every feature depending on that file.
-
-### Capabilities already in this channel
-
-| Capability | compact | detailed | expanded | Completion | Implementation | Staging or commit | Acceptance |
-|---|---|---|---|---|---|---|---|
-| Three settings and legacy-value reading | Compact | Detailed; legacy `normal` reads as this mode without write-back | Expanded | Complete | Existing capability | Committed | Pending |
-| Per-Turn folding eligibility | A closed Turn with its start loaded and a final reply can fold process content; cancellation/failure extensions are item 6 | Same | Same | Complete | Existing capability | Committed | Pending |
-| Collapsed settled-reasoning summary | Think title only | First line | First line | Complete | Existing capability | Committed | Pending |
-| Retain summary DOM across mode changes | CSS hides summary and separator | Show existing summary and separator | Same | Complete | Existing capability | Committed | Pending |
-| Local reasoning-preview subscription | `ReasoningRow` selects its own visibility | Same | Same | Complete | Existing capability | Committed | Pending |
-| Stable disclosure-row references | Callbacks, icons, and unchanged summaries retain references; full Markdown mounts only on expansion | Same | Same | Complete | Existing capability | Committed | Pending |
-
-All three modes retain whole-Turn folding. `expanded` removes group-level folding, headers, and height limits while retaining group identity and member parents; it does not disable whole-Turn folding or automatically expand reasoning and tool-card bodies. Until grouping is connected, Chat presents `detailed` and `expanded` identically.
-
-### Migration inventory without grouping dependencies
-
-“All three modes” means the behavior applies in every mode, not that switching modes changes it. “Without grouping dependencies” means the draft introduces no step-group, not that every item must be accepted before grouping. Numbers follow the feature review inventory; item 0's compilation wiring is complete and committed, so it is not listed as a product feature. Incomplete drafts remain in `pr-4565-turnstep`, outside this channel's completed features. Behavior and performance acceptance remain pending for the features below.
-
-| Number | Feature | compact | detailed | expanded | Completion | Implementation | Staging or commit | Destination and considerations |
-|---|---|---|---|---|---|---|---|---|
-| 1 | Chinese tool titles | All three modes | All three modes | All three modes | Complete | Code written | Committed | Bash/Pwsh: “运行命令”; Grep: “搜索文件内容”; Glob: “查找文件”; Skill: “加载技能”. Only UI dictionaries change; model tool names do not |
-| 2 | Tool-row interaction visuals | All three modes | All three modes | All three modes | Complete | Code written | Committed | Hover darkens titles and summaries in tool, Bash, and command rows; shared `DisclosureRow` and independent Bash rows point the expanded chevron upward |
-| 3 | Bash stopped-state screen-reader text | All three modes | All three modes | All three modes | Complete | Code written | Committed | Complete the stopped-state accessible name without changing execution or cancellation semantics |
-| 4 | Running tool/command text shimmer | All three modes | All three modes | All three modes | Complete | Code written | Both 4A shimmer and 4B accompanying optimizations committed | 4A includes a fixed `TextShimmer` span, CSS activation, tool/command integration, replacement of old sweep styles, and reduced-motion support, excluding step/turn. 4B adds business-row computation caches, stable callbacks, and JSX references |
-| 5 | Streaming reasoning summary | Update after a paragraph's first line completes | Same | Same | Complete | Code written | Committed | `ReasoningRow` retains the original PR's `latestCompletedParagraphFirstLine(text)` and computes from full text. Retain summary DOM, stable props, and right-edge fading; add no Definition parsing state or cross-layer summary fields |
-| 6 | Keep process expanded after cancellation/failure | All three modes | All three modes | All three modes | Incomplete | Draft code written | Unstaged | Draft uses `keepOpen` in Turn process projection; folding eligibility and stopped/failed behavior await Turn/grouping review |
-| 7 | Whole-Turn status and duration control | All three modes | All three modes | All three modes | Incomplete | Draft code written | Unstaged | Draft anchors the control to loaded `turn/start` after opening inputs, isolates timing in `LiveTurnProcessLabel`, and replaces the bottom activity bar; positioning and status await review |
-| 8 | Non-human trigger notifications | All three modes | All three modes | All three modes | Incomplete | Draft code written | Unstaged | Draft identifies waking inputs from next-turn and first-step next-step claims and projects `turn-trigger`; Turn starts, notification ownership, and expanded content await review |
-| 9 (permission/system) | Hide permission-command and system-prompt rows | All three modes | All three modes | All three modes | Complete | Code written | Committed | `isVisibleChatNode` centralizes filtering for the existing Chat list, navigation, and process presentation. Command and request-prompt Definitions do not own these filters; persistence and Trajectory are unchanged |
-| 9 (context) | Hide ordinary Context rows | All three modes | All three modes | All three modes | Incomplete | Draft code written | Unstaged | Paired with item 8's waking notifications to retain source explanations; final filter ownership awaits Turn/grouping review |
-| 10 | Turn action-bar positioning | All three modes | All three modes | All three modes | Incomplete | Draft code written | Unstaged | Draft anchors `turn-tail` after `turn/end`; reply ownership for feedback/copy and the real Turn-end seq for branching await combined review |
-| 11 | Action-bar persistent visibility | All three modes | All three modes | All three modes | Incomplete | Draft code written | Unstaged | Draft projects `footer` per Turn in the Chat builder: persistently visible when the latest Turn ends in a reply, otherwise on hover/focus; tail detection will be considered with grouping |
-
-The current base already enables developer tools by default; do not migrate that again. Retain the protection that waits for Host acceptance of settings instead of applying the original PR's missing-value fallback. Its `Switch` change only affects a comment and is not a migrated feature.
-
-### Subsequent review batches
-
-Review batches are independent of implementation and staging status. Review remaining drafts in `pr-4565-turnstep`, kept unstaged; a draft does not complete a migration. Transfer only this channel's remaining code, without automatically incorporating `feat/chat-step-groups` experiments or installing dependencies and compiling in the destination worktree.
-
-| Batch | Features | Review scope |
-|---|---|---|
-| Independent feature, committed | 4A: text shimmer | `TextShimmer`, row integration, and browser painting cost; performance acceptance pending |
-| Independent optimization, committed | 4B: accompanying memoization and reference stability | `ToolRow`, `BashRow`, and `GenericCommandCard` computation caches, callbacks, and JSX references; not required for shimmer itself; performance acceptance pending |
-| Independent feature, committed | Permission-command and system-prompt hiding from item 9 | Retain the original PR's centralized visibility decision; without step-group, the main list connects it in `orderedVisibleChatNodes`, independent of waking-message classification |
-| Incomplete, transferred to turnstep worktree | 6, 7, 10, 11 | Whole-Turn folding eligibility, status/clock, action-bar position, and tail detection, considered with Turn/group relationships |
-| Incomplete, transferred to turnstep worktree | 8 and ordinary Context hiding from item 9 | Trigger notifications depend on Turn starts and Inbox claims; Context hiding accompanies notifications so waking reasons remain visible |
-
-### Requirements retained for the grouping phase
-
-All items below remain incomplete and retain their full requirements for the turn/step and grouping phase. The [Definition-owned grouping foundation](../../implemented/architecture/2026-09-21-conversation-build-groups.md) is implemented; that does not establish completion of these product behaviors or performance requirements.
-
-| Feature | compact | detailed | expanded | Current state |
-|---|---|---|---|---|
-| Consecutive process groups between replies | Group tools and reasoning, initially collapsed | Same | Show process rows without group-level folding; retain member parents | Incomplete (grouping phase) |
-| Independent reasoning/reply visibility within one Assistant | Reasoning may join the preceding group; reply stays visible | Same | No secondary group hiding | Incomplete; do not directly copy the original split into two render nodes |
-| Header category summary | Current category while running; aggregate main categories after completion | Same | No header | Incomplete (grouping phase) |
-| Running header details | Hidden | Show command, path, query, etc.; reasoning summary when no tool is running | No header | Incomplete (grouping phase) |
-| Header update cadence | Preserve category title's minimum display duration | Also handle detail updates | Not applicable | Incomplete (grouping phase) |
-| Height-limited scrolling within a group | Limit expanded height, scroll independently, fade edges | Same | Not applicable | Incomplete (grouping phase) |
-| Group and whole-Turn folding interaction | Hide groups when the Turn folds | Same | Whole-Turn folding only | Incomplete; retain node identity and separately decide whether internal expansion resets |
-| Pagination, streaming settlement, and group identity | Stable existing headers and members; handle partial Turns separately | Same | Show the same business nodes directly | Incomplete (grouping phase) |
-
-Grouping details to verify: completed summaries aggregate at most three categories and use “etc.” beyond three; call counts determine category ordering rather than appearing as header numbers. Detailed-mode live details collapse whitespace and are capped at 160 characters. Titles remain for at least 150ms; retain only the latest update without replaying queued updates. Expanded height is at most the smaller of 400px and half the viewport. Scrollable edges use a 24px fade and preserve interaction with outer scrolling. Retry rows are outside secondary groups. These values describe the original PR's reference behavior, not completed grouping experiments.
-
-### Definition-owned segmentation and presentation
-
-Business State accepts each input, clears pending changes, and returns repeatable output. Replace builds the loaded window; apply separates structural changes from content updates and maintains affected segments or Turn-local indexes. It owns group opening/closing, stable keys, summaries, and invalidation; generic infrastructure never corrects those decisions by Node kind or Step number.
-
-| Ordered visible input | Business action |
-|---|---|
-| Owning Turn changes | Close the pending group. |
-| No Turn ownership | Close the group and emit an independent Node; never merge across it. |
-| turn-process control | Emit independently without closing the pending process. |
-| User, steering, trigger, retry, error, max-tokens, or tail | Close the group and emit independently. |
-| Assistant reasoning | Append the reasoning part to the pending group. |
-| Assistant visible reply | Close the group and emit the response part independently. Later tools enter a later group. |
-| Other process Nodes | Append the Node to the pending group; an ordinary Step boundary does not close it. |
-| Turn end | Close that Turn's pending groups even without Node upserts. |
-
-Content growth with unchanged classification does not resegment history; it may update only the current summary. A first reply, new tool, steering, or retry can change structure. Visibility/location repair handles both old and new ownership. Real structural changes may linearly merge root references; the interface does not promise all operations are constant-time.
-
-Group headers select data independently from member arrays. All modes retain the same Group container and member parents:
-
-| Mode | Group header | Body |
-|---|---|---|
-| Compact | Short activity summary | Group open/closed state controls visibility. |
-| Detailed | Summary plus live command/path/query details | Same group open/closed state. |
-| Expanded | Hidden | Visible without group-level collapse or height cap; wrapper remains. |
-
-This assumes the outer Turn process is open. Expanded retains whole-Turn folding and individual tool/reasoning disclosure; it must not eagerly mount all full Markdown. Turn-close resets of internal state are explicit business actions, not key changes. Group headers, scrolling/fades, and Turn interaction belong to this business integration.
-
-| Business implementation | Responsibility |
-|---|---|
-| process-groups.ts and register.ts | Definition-owned segmentation, membership, caches, summaries, and registration. |
-| AssistantNodeView, Group seat, stores, navigation | Interpret parts; group header/body presentation; local open state; Turn/group reveal, selection/copy and interruption ownership. |
-
-## Performance constraints
-
-| Scenario | Property to preserve | Required evidence |
-|---|---|---|
-| Switching among modes | Business-node keys do not change; modes do not re-register Definitions; only relevant visibility/presentation fields update | Node identity and update-scope checks |
-| Incremental reasoning/tool content | Update only the owning node without scanning full history; compute reasoning summary from current full text during rendering | Update scope and long-text cost; the current summary algorithm does not reduce `ReasoningRow` render count |
-| Whole-Turn running clock | Only live clock content updates each second, without refreshing members, historical rows, or list | Update scope and timer disposal |
-| Summary visibility | Keep lightweight summaries mounted; do not mount every full Markdown body for mode switching | DOM identity, initial loading, memory observations |
-| Pagination | Update new nodes and nodes with changed facts; completed Turns do not refresh together because of global pagination state | Multi-page interaction and update-scope checks |
-| State transitions | Stable text/icon/callback references when content is unchanged; do not clear internal state through remounting | Interaction state and component lifecycle checks |
-
-Retaining DOM reduces mounting and unmounting cost, not style calculation, layout, or painting, and can increase retained memory. Changing display properties alone is not a guarantee against jank. The aim is lower switching peaks with acceptable initial-load, pagination, and streaming costs.
-
-## Alternatives considered
-
-**Replay the original PR as one batch.** Rejected: grouping, node splitting, whole-Turn status, and independent visuals would mix, obscuring each feature's performance effects and overwriting local subscriptions and node reuse already completed in this channel.
-
-**Unmount and recreate summaries or process nodes on mode changes.** Rejected for summary mode changes. Stable mounts allow repeated switching to change only display state; initial costs for new nodes still require separate validation.
-
-**Keep every Markdown body mounted for smooth switching.** Rejected: lightweight summaries and full bodies differ in memory, DOM, and rendering cost. Bodies remain mounted according to manual expansion.
-
-**Remount renderers when folding a Turn to reset tool cards.** Do not migrate directly. It conflicts with stable nodes and preserved interaction state. If reset behavior remains necessary, define its state owner and trigger explicitly.
-
-## Acceptance criteria
-
-Update implementation, staging, and commit status separately as work progresses. Completion follows feature review and commits; acceptance follows actual validation. Retain incomplete items across branch splits and worktree transfers. Before grouping work starts, check every product requirement and mode mapping above.
-
-| Acceptance item | Current state |
-|---|---|
-| Complete behavior validation of existing channel capabilities | Relevant unit and browser regressions pass; this excludes unmigrated grouping features and does not establish performance acceptance |
-| Non-grouping feature migration | Completed scope is in the inventory; incomplete drafts await review in `pr-4565-turnstep`; functional and performance validation remain incomplete |
-| DOM identity and update scope during mode changes | Unit tests verify summary/expanded-body DOM identity and policy-field subscriptions; browsers verify persistence of all modes and whole-Turn folding; whole-page update scope and performance remain pending |
-| Long-session initial loading, pagination, streaming, and memory | Pending; the original PR's historical measurements do not validate this implementation |
-| Unit, browser, and recorded-snapshot coverage | 785 relevant unit tests pass; read-only replay of 35 browser files yields 178 passing tests and 4 conditional skips; UI expectations are updated and Session JSONL is unchanged |
-| Grouping and the Detailed/Expanded distinction | Incomplete (grouping phase) |
-
-Validation evidence: after rebasing onto master, this channel passed full `pnpm run build`, lint, duplication checks, and all 41 documentation checks. New presentation policy, shimmer, and visibility filtering, plus the settings and Skill rows reported by CI, pass 100% coverage checks over their selected source scope. Test repairs, UI snapshots, and bilingual pairing are committed together as CI fixes. No install, build, or tests ran in `pr-4565-turnstep`; this channel's results do not establish acceptance for that worktree. A real-model GUI demo and performance measurements remain outstanding.
-
-## Risks
-
- `expanded` and `detailed` currently present identically; the original PR's distinction exists only after grouping is implemented.
- Whole-Turn duration replaces the existing tool/message-count title, changing product information. Migration must preserve status, accessible names, and Turns with no process content, not merely restyle the control.
- Hiding ordinary Context before adding trigger notifications removes background waking reasons; connect both items in the inventory's order.
- The original footer decision depends on grouping indexes. Rework ownership per feature rather than introducing the whole grouping infrastructure for a footer.
- Group identity, membership, and builder materialization in the experiments still require evaluation; this record does not treat the experiment as final architecture.
@@ -1,176 +0,0 @@
-# Agent Note: Chat 工作过程展示迁移进度
-
-Status: proposed
-
-[English](2026-09-20-chat-work-details-migration.md) | 中文
-
-## 问题
-
-PR #4565 同时包含三档展示设置、过程分组、整轮状态、触发通知、工具行视觉和基础设施行隐藏。整批迁移会把独立功能与列表重组混在一起，也难以逐项判断性能变化。需要一份按功能维护的进度表，先评审独立视觉功能，再结合 step-group 统一考虑轮次相关行为，避免遗漏原有产品需求。
-
-## 方案
-
-已完成的独立功能保留在 `feat/chat-presentation-channel`。剩余未完成代码的后续工作区是仓库根目录下的 `.artifacts/worktrees/pr-4565-turnstep`，以当前通道及本进度记录为基线，草稿保持未暂存；后续结合 turn/step 与分组整体评审。`pr-4565` worktree 继续作为原 PR 的行为和实现参考；`feat/chat-step-groups` 的既有分组实验不在本次搬迁范围内。
-
-本记录管理功能范围、当前实现和验收进度。[展示策略通道与过程分组的基础架构](../architecture/2026-09-20-chat-presentation-policy-and-step-groups.zh.md)保留架构路线及备选方案；本记录不替代它，也不把其中的方案视为已经实现。新记录没有完整取代既有架构决策，因此保留原记录，不做归档或删除。
-
-本记录维护中英文配对。完成状态、实现状态、暂存或提交状态、验收状态分别记录。未完成项即使已有代码草稿，也继续标为未完成，不从清单移除。测试和文档随 CI 修复补齐，浏览器快照与性能验收单独记录；代码写好、进入暂存区、提交或构建通过，都不等同于完整功能或性能验收。
-
-### 状态定义
-
-| 维度 | 状态 | 含义 |
-|---|---|---|
-| 完成 | 已完成 | 功能迁移代码已逐项审阅并提交到当前通道；行为与性能证据另行记录 |
-| 完成 | 未完成 | 尚未纳入当前通道的已完成迁移范围；可以已有未暂存草稿，也可以尚未编写 |
-| 实现 | 当前代码已有 | 当前通道的既有基础能力 |
-| 实现 | 代码已写好 | 对应工作区中已有实现；不代表已完成、已暂存、已提交或通过验收 |
-| 实现 | 待迁移 | 已纳入非分组迁移范围，当前尚未实现 |
-| 实现 | 分组阶段 | 产品需求保留，依赖分组结构或分组交互，暂不接入当前通道 |
-| 暂存或提交 | 未暂存 | 该功能的改动仍在工作区，包括尚未跟踪的新文件 |
-| 暂存或提交 | 部分暂存 | 该功能只有部分改动进入暂存区，必须注明具体范围 |
-| 暂存或提交 | 已暂存 | 该功能当前待提交的代码改动均已进入暂存区，尚未提交 |
-| 暂存或提交 | 已提交 | 该功能代码已包含在当前 HEAD 中 |
-| 验收 | 待验收 | 需要行为、节点身份、刷新范围或浏览器性能证据；不能用 Git 状态或编译结果代替 |
-
-暂存状态按产品功能对应的差异片段核对，不按整个文件推断。更新状态时同时查看工作区、暂存区和 HEAD；共享文件只暂存部分字段，不能将依赖该文件的所有功能都标为已暂存。
-
-### 当前通道已有的能力
-
-| 能力 | compact | detailed | expanded | 完成状态 | 实现状态 | 暂存或提交状态 | 验收状态 |
-|---|---|---|---|---|---|---|---|
-| 三档设置与旧值读取 | 简洁 | 详细；旧值 `normal` 读作本档，不回写 | 完全展开 | 已完成 | 当前代码已有 | 已提交 | 待验收 |
-| 按轮判断整轮折叠资格 | 已加载起点且存在最终回复的结束轮次，可收起过程内容；停止和失败的扩展行为见迁移项 6 | 相同 | 相同 | 已完成 | 当前代码已有 | 已提交 | 待验收 |
-| 已完成推理的收起摘要 | 只显示「思考」 | 显示首行 | 显示首行 | 已完成 | 当前代码已有 | 已提交 | 待验收 |
-| 模式切换时保留摘要 DOM | 用 CSS 隐藏摘要及分隔点 | 显示原有摘要及分隔点 | 相同 | 已完成 | 当前代码已有 | 已提交 | 待验收 |
-| 推理预览的局部订阅 | `ReasoningRow` 选择自己的可见性 | 相同 | 相同 | 已完成 | 当前代码已有 | 已提交 | 待验收 |
-| 折叠行引用稳定 | 回调、图标及未变化的摘要保持引用；完整 Markdown 仅在展开时挂载 | 相同 | 相同 | 已完成 | 当前代码已有 | 已提交 | 待验收 |
-
-三档都保留整轮折叠。`expanded` 取消组级折叠、组头和限高，保留组身份与成员父级；并非禁止整轮折叠，也不是自动展开每个思考或工具卡的正文。分组尚未接入时，`detailed` 与 `expanded` 的 Chat 展示相同。
-
-### 不依赖分组的迁移清单
-
-下表的“三档共用”表示三档都应用该行为，不表示切换档位时会改变它。“不依赖分组”指实现草稿未引入 step-group，不代表都要先于分组接受。编号沿用逐项评审清单；编号 0 的编译接线修正已完成并提交，不作为产品功能另列。未完成项的草稿留在 `pr-4565-turnstep`，不是当前通道已完成的功能。下列功能的行为与性能均待验收。
-
-| 编号 | 功能 | compact | detailed | expanded | 完成状态 | 实现状态 | 暂存或提交状态 | 迁移落点与注意事项 |
-|---|---|---|---|---|---|---|---|---|
-| 1 | 工具标题中文化 | 三档共用 | 三档共用 | 三档共用 | 已完成 | 代码已写好 | 已提交 | Bash/Pwsh 为「运行命令」、Grep 为「搜索文件内容」、Glob 为「查找文件」、Skill 为「加载技能」；只改 UI 字典，不改模型工具名 |
-| 2 | 工具行交互视觉 | 三档共用 | 三档共用 | 三档共用 | 已完成 | 代码已写好 | 已提交 | 工具行、Bash 行和命令行悬停时标题及摘要加深；共享 `DisclosureRow` 和独立 Bash 行展开箭头朝上 |
-| 3 | Bash 停止状态的读屏提示 | 三档共用 | 三档共用 | 三档共用 | 已完成 | 代码已写好 | 已提交 | 补齐停止状态的可访问名称，不改变执行或取消语义 |
-| 4 | 工具及命令运行时文字扫光 | 三档共用 | 三档共用 | 三档共用 | 已完成 | 代码已写好 | 4A 扫光与 4B 附带优化均已提交 | 4A 包含 `TextShimmer` 固定 span 与 CSS 启停、工具及命令行接入、旧扫光样式替换和减少动态效果支持，不含 step/turn；4B 为业务行额外的计算缓存、稳定回调及 JSX 引用 |
-| 5 | 流式推理摘要 | 段落首行写完后才更新 | 相同 | 相同 | 已完成 | 代码已写好 | 已提交 | `ReasoningRow` 沿用原 PR 的 `latestCompletedParagraphFirstLine(text)`，直接从完整文本计算；摘要 DOM、稳定 props 和右侧渐隐保留，不增加 Definition 解析状态或跨层摘要字段 |
-| 6 | 取消、失败后保持过程展开 | 三档共用 | 三档共用 | 三档共用 | 未完成 | 代码草稿已写好 | 未暂存 | 草稿在 Turn 过程投影中使用 `keepOpen`；轮次与分组阶段再评审折叠资格和停止、失败行为 |
-| 7 | 整轮状态与用时控件 | 三档共用 | 三档共用 | 三档共用 | 未完成 | 代码草稿已写好 | 未暂存 | 草稿将控件锚定到已加载的 `turn/start`、排在开场输入之后，以 `LiveTurnProcessLabel` 单独计时，并替换底部运行条；整体定位与状态待评审 |
-| 8 | 非人工触发通知 | 三档共用 | 三档共用 | 三档共用 | 未完成 | 代码草稿已写好 | 未暂存 | 草稿使用 next-turn 及首步 next-step 领取事实识别唤醒输入，投影 `turn-trigger`；轮次起点、通知归属和展开内容待评审 |
-| 9（permission/系统） | 隐藏 permission 命令与系统提示词行 | 三档共用 | 三档共用 | 三档共用 | 已完成 | 代码已写好 | 已提交 | `isVisibleChatNode` 集中判断，现有 Chat 列表、导航和过程展示复用；命令与请求提示词 Definition 不承载这些过滤规则，持久化数据与 Trajectory 不变 |
-| 9（context） | 隐藏普通上下文行 | 三档共用 | 三档共用 | 三档共用 | 未完成 | 代码草稿已写好 | 未暂存 | 与 8 的唤醒通知配套，保留来源解释；过滤规则的最终归属留到轮次与分组阶段 |
-| 10 | 轮次操作栏位置 | 三档共用 | 三档共用 | 三档共用 | 未完成 | 代码草稿已写好 | 未暂存 | 草稿将 `turn-tail` 锚定到 `turn/end` 之后；反馈、复制的回复归属和分支的真实轮次结束序号待整体评审 |
-| 11 | 操作栏常显条件 | 三档共用 | 三档共用 | 三档共用 | 未完成 | 代码草稿已写好 | 未暂存 | 草稿由 Chat builder 按 Turn 投影 `footer`；最新轮以回复结尾时常显，其余悬停或聚焦显示，尾部判定与分组一起考虑 |
-
-开发者工具默认开启已由当前基线提供，不重复迁移。当前实现保留等待 Host 接受设置后才启用相关能力的保护，不以原 PR 的缺值回退覆盖它。原 PR 的 `Switch` 改动只有注释，不作为功能迁移项。
-
-### 后续评审批次
-
-评审批次独立于实现和暂存状态。未完成草稿的后续评审统一在 `pr-4565-turnstep`，保持未暂存；已有草稿不代表迁移已完成。仅搬迁当前通道的剩余代码，不自动合入 `feat/chat-step-groups` 的实验，也不在目标工作区安装依赖或编译。
-
-| 批次 | 功能 | 评审范围 |
-|---|---|---|
-| 独立功能，已提交 | 4A：文字扫光 | `TextShimmer` 本身、各行的调用方式和浏览器绘制成本；性能待验收 |
-| 独立优化，已提交 | 4B：附带的 memo 与引用稳定化 | `ToolRow`、`BashRow` 和 `GenericCommandCard` 的计算缓存、回调和 JSX 引用；不是扫光功能的必要条件，性能待验收 |
-| 独立功能，已提交 | 9 中的 permission 命令与系统提示词隐藏 | 沿用原 PR 的集中可见性判断；当前无 step-group，主列表改在 `orderedVisibleChatNodes` 接入，不依赖唤醒消息分类 |
-| 未完成，转入 turnstep 工作区 | 6、7、10、11 | 整轮折叠资格、状态与时钟、操作栏位置和尾部判定，统一考虑轮次与分组关系 |
-| 未完成，转入 turnstep 工作区 | 8、9 中的普通 context 隐藏 | 触发通知依赖轮次起点和 Inbox 领取判定；隐藏普通上下文与通知配套，避免先隐藏唤醒原因 |
-
-### 分组阶段保留的需求
-
-这些项目均未完成，继续保留全部需求，后续在 turn/step 与分组阶段处理。[Definition 拥有分组的基础机制](../../implemented/architecture/2026-09-21-conversation-build-groups.zh.md)已经实现，但不代表这些产品行为或性能要求已经完成。
-
-| 功能 | compact | detailed | expanded | 当前状态 |
-|---|---|---|---|---|
-| 回复之间的连续过程分组 | 工具与推理归组，默认收起 | 相同 | 过程行不做组级折叠，保留成员父级 | 未完成（分组阶段） |
-| 同一 Assistant 中推理与回复的分别显隐 | 推理可归入前组，回复外露 | 相同 | 不做二级分组隐藏 | 未完成；不直接复制原版拆成两个渲染节点的实现 |
-| 组头类别摘要 | 运行时显示当前类别，完成后聚合主要类别 | 相同 | 无组头 | 未完成（分组阶段） |
-| 运行中组头详情 | 不显示 | 显示命令、路径、查询等详情，无运行工具时显示推理摘要 | 无组头 | 未完成（分组阶段） |
-| 组头内容更新节奏 | 保留类别标题的最短展示时间 | 同时处理详情更新 | 不适用 | 未完成（分组阶段） |
-| 组内限高滚动 | 展开内容限高、独立滚动、边缘渐隐 | 相同 | 不适用 | 未完成（分组阶段） |
-| 分组与整轮折叠联动 | 整轮收起时隐藏分组 | 相同 | 仅整轮折叠 | 未完成；保留节点身份，内部开合状态是否重置单独确定 |
-| 分页、流式结算与组身份 | 既有组头和成员稳定，半截轮单独处理 | 相同 | 同一批业务节点直接展示 | 未完成（分组阶段） |
-
-分组产品细节的核对项：完成摘要最多聚合前三类，超过三类使用「等」；调用计数用于分类排序，不直接显示为组头数字。详细模式的实时详情合并空白并限制为 160 个字符；标题最短展示时间为 150ms，只保留最新更新，不补播积压项。展开区高度不超过 400px 与半屏中的较小值，可滚动方向显示 24px 渐隐，并保留与外层滚动的衔接。重试行不属于二级过程组。这些数值是原 PR 的行为参考，不代表当前分组实验已经实现。
-
-### Definition 拥有的分段与展示
-
-业务 State 接受输入、清空待输出变化并返回可重复读取的结果。replace 构建已加载窗口；apply 区分结构变化和正文更新，维护受影响段或轮次内索引。它拥有开组、关组、稳定 key、摘要和失效规则；通用层不按 Node kind 或 Step 编号再次修正业务结论。
-
-| 有序可见输入 | 业务动作 |
-|---|---|
-| 所属 Turn 改变 | 关闭待完成组。 |
-| 没有 Turn 归属 | 关闭组并输出独立 Node，不跨越它合并。 |
-| turn-process 控件 | 独立输出，不关闭待完成过程。 |
-| 用户、steering、触发、重试、错误、最大 token 或尾部 | 关闭组并独立输出。 |
-| Assistant 推理 | 把 reasoning 部分加入待完成组。 |
-| Assistant 可见回复 | 关闭组，独立输出 response 部分；后续工具进入后面的组。 |
-| 其他过程 Node | 加入待完成组，普通 Step 边界不关闭组。 |
-| Turn 结束 | 即使没有节点 upsert，也关闭该轮次待完成的组。 |
-
-分类未变的正文增长不重新分段历史，必要时只更新当前摘要。首次回复、新工具、steering 或重试可以改变结构。可见性或位置修正同时处理旧、新归属。真实结构变化允许线性合并根引用，接口不承诺全部操作常数时间。
-
-组头独立于成员数组选择 data，所有模式保留同一 Group 容器及成员父级：
-
-| 模式 | 组头 | 正文 |
-|---|---|---|
-| Compact | 简短活动摘要 | 按组开合状态显隐。 |
-| Detailed | 摘要及实时命令、路径、查询详情 | 使用同一组开合状态。 |
-| Expanded | 隐藏 | 显示，取消组级折叠及限高，容器保留。 |
-
-以上以外层 Turn 过程已展开为前提。Expanded 保留整轮折叠和单个工具、推理行开合，不能提前挂载全部完整 Markdown。Turn 收起时的内部状态重置是明确业务动作，不通过更换 key 实现。组头、滚动渐隐及整轮联动属于本业务接入。
-
-| 业务实现 | 职责 |
-|---|---|
-| process-groups.ts 与 register.ts | Definition 拥有分段、成员、缓存、摘要及注册。 |
-| AssistantNodeView、Group 容器、stores、navigation | 解释部分内容，组头和正文展示，本地开合状态，Turn/Group 揭示、选择复制及中断提示归属。 |
-
-## 性能约束
-
-| 场景 | 要保留的性质 | 所需证据 |
-|---|---|---|
-| 切换三档模式 | 不改变业务节点 key，不因模式切换重新注册 Definition；仅相关可见性或展示字段更新 | 节点身份和刷新范围检查 |
-| 推理或工具内容增量更新 | 只更新所属节点，不扫描完整历史；推理摘要在渲染时从当前完整文本计算 | 更新范围与长内容计算开销；当前摘要算法不减少 `ReasoningRow` 的渲染次数 |
-| 整轮运行时钟 | 只有运行中的时钟内容按秒更新，不带动整轮成员、历史行和列表 | 更新范围及计时器释放检查 |
-| 摘要显隐 | 轻量摘要常驻；完整 Markdown 正文不为模式切换而全部常驻 | DOM 身份、首次加载和内存观察 |
-| 分页 | 新增节点与事实变化的节点更新，已完成轮次不因全局分页状态一起刷新 | 多页历史交互与刷新范围检查 |
-| 状态切换 | 文字、图标、回调引用在内容未变时稳定；不通过重挂载清空内部状态 | 交互状态与组件生命周期检查 |
-
-保留 DOM 只减少挂载和卸载成本，不消除样式计算、布局与绘制，也会增加常驻内存。不能将“只改显示属性”写成“不会卡顿”的保证。性能目标是降低切换峰值，并保持首次加载、分页和流式更新的成本可接受。
-
-## 备选方案与取舍
-
-**整批重放原 PR。** 不采用。分组、节点拆分、整轮状态和独立视觉功能混在一起，难以把性能变化对应到具体功能，也会覆盖当前通道已完成的局部订阅与节点复用。
-
-**切换模式时卸载、重新创建摘要或过程节点。** 摘要模式切换不采用该方式。稳定挂载让来回切换只改变显示状态；新增节点的初始成本仍须单独检查。
-
-**为了切换平滑，把所有 Markdown 正文常驻。** 不采用。轻量摘要与完整正文的内存、DOM 和渲染成本不同；正文继续按手动展开状态挂载。
-
-**收起整轮时重挂载 renderer，以重置工具卡。** 不直接迁移。该实现与稳定节点及保留交互状态的方向冲突；若后续仍需要重置行为，应明确状态所有者和触发规则。
-
-## 验收标准
-
-每项代码写好、暂存或提交后，分别更新对应状态；完成状态按逐项评审和提交记录更新，验收只按实际验证记录更新。未完成项保留，不因拆分分支或搬迁工作区而删除。分组阶段开始前，逐行复核上面的产品需求和模式对应关系。
-
-| 验收项 | 当前状态 |
-|---|---|
-| 当前通道已有能力的完整行为验证 | 已通过本次相关单元和浏览器回归；不包含未迁移的分组功能，也不代表性能验收 |
-| 非分组功能迁移 | 完成范围见迁移清单；未完成草稿留到 `pr-4565-turnstep` 继续评审，功能与性能验证仍未完成 |
-| 模式切换时的 DOM 身份和刷新范围 | 单元测试已验证摘要、手动展开正文的 DOM 身份和策略字段订阅；浏览器已验证三档持久化及整轮折叠，整页刷新范围与性能仍待验收 |
-| 长会话首次打开、分页、流式输入与内存 | 待验收；原 PR 的历史测量不代表本实现 |
-| 新行为的单元、浏览器与录制快照覆盖 | 相关单元测试 785 项通过；35 个浏览器文件只读回放，178 项通过、4 项按条件跳过；UI 预期输出已更新，Session JSONL 未改动 |
-| 分组功能与两档差异 | 未完成（分组阶段） |
-
-验证记录：当前通道在 rebase master 后通过完整 `pnpm run build`、lint、重复代码检查和完整文档检查（41 项）。新增展示策略与扫光、可见性过滤，以及 CI 报告的设置行和 Skill 行覆盖率已通过对应源码范围的 100% 检查。测试修复、UI 快照和中英配对随 CI 修复一并提交；`pr-4565-turnstep` 未执行安装、构建或测试，当前通道的结果不代表该工作区已验收。真实模型 GUI 演示和性能测量仍待补。
-
-## 风险
-
- 当前 `expanded` 与 `detailed` 的展示相同；只有分组阶段完成后，两档才具备原 PR 设计的区别。
- 整轮用时控件替换现有工具和消息计数标题，属于产品信息变化；迁移时不能只换样式而遗漏状态、可访问名称或空过程轮次。
- 普通上下文隐藏若先于触发通知，会让后台唤醒原因消失；两项需按清单顺序衔接。
- 原 PR 的页脚判定与分组索引耦合，需要按功能重写归属，不能为页脚单独引入整套分组基础设施。
- 分组实验中的组身份、成员归属和 builder 物化路线仍需继续评估；本记录不将实验实现列为最终架构。
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write apps/desktop/README.md
-README.md: 711e65fb5feaea601800218801d138a0df9b3f97
-README.zh.md: 183d195a9af485c9ffe5a3e5bf65e3a459582b93
+README.md: 813813cf2292a6cfece78a273dcf6843093a95cf
+README.zh.md: e63557e98c0a19ecd9bf9e6c9497ce074ce8b57b
@@ -22,6 +22,10 @@ Press F12 (Fn+F12 on media-key keyboards), Command+Option+I on macOS, or Ctrl+Sh

 The original artwork lives in `resources/icon.png` and `resources/icon.svg`; platform adaptations retain the whale and gradients in `resources/icon-windows.*` and `resources/icon-macos.*`. Export each platform SVG as a transparent 1024×1024 PNG. Electron-builder generates the multi-size ICO for the Windows application, installer, and uninstaller ([Windows icon requirements](https://learn.microsoft.com/en-us/windows/apps/design/iconography/app-icon-construction)). The installation pages use matching artwork in both themes; the uninstaller's welcome and finish pages share `installer/assets/uninstaller-sidebar.png`, converted to a 164×314 BMP during preparation.

+Shortcut overrides are stored in `app.getPath('userData')/keybindings.json`, separately from `DSH_HOME`. The main process validates and serializes changes before publishing accepted bindings. Failed reads retain the last accepted bindings and block edits, including Restore All; unreadable and future-version files remain unchanged. Development can isolate these preferences with `DSH_DESKTOP_USER_DATA_DIR`; the launcher prints its resolved path. See the [shortcut service](../../packages/client/shortcuts/README.md) for format and conflict semantics.
+
+The macOS File menu displays the accepted single-key binding, including arrow keys, and routes Close Page or Window through the client page owner. On Windows and macOS, all complete accepted bindings are intercepted before main-document, embedded-frame, and browser-guest input, including editing and terminal input. Recording and input-method composition remain protected. Two-key chords leave the first key’s initial press available to the page and do not intercept its release; complete chords and their repeats are consumed. The renderer leaves configurable binding dispatch to the native adapter. Chords have no native menu accelerator. Accepted commands are forwarded once through the trusted preload. Linux dispatches main-document shortcuts through the DOM and forwards accepted embedded-frame bindings to the client resolver. Closing the last window preserves macOS application lifetime; Windows exits the desktop instance and stops its tasks. The [close decision](../../.agents/notes/implemented/architecture/2026-09-21-desktop-page-close-shortcuts.md) records this lifecycle choice.
+
 The macOS PNG uses an inset rounded background for legacy ICNS packaging, with representations up to 1024 pixels. It is a flattened icon, not an Icon Composer document. Apple's [app icon guidance](https://developer.apple.com/design/human-interface-guidelines/app-icons) describes unmasked layers for Icon Composer; those inputs require a separate macOS export and must not reuse the rounded ICNS artwork. Verify Finder and Dock appearance on supported macOS versions before release.

 ### Bundled workspace dependencies
@@ -64,9 +68,9 @@ The product UI retains Web actions, including "Open In..." through the shared au

 Electron chooses typed English or Chinese shell copy from its application locale and falls back to English. The macOS application bundle declares English and Simplified Chinese in `CFBundleLocalizations`, allowing macOS to match the initial application language to the user’s preferred languages. Saved Client UI language preferences still take precedence for the main interface. On Windows, the main document's language updates desktop menus, recovery and update prompts. The repository Client UI i18n gate checks desktop sources.

-Windows uses a 40-DIP caption with native window controls and colors synchronized from the application palette. Localized Application and Edit entries beside the sidebar toggle open native popup menus. They mount only after the application frame publishes its shell overlay seat, and remain absent during startup loading. Application provides Check for Updates and Exit; Edit provides undo, redo, cut, copy, paste, delete, and select all by sending the corresponding keys to the focused editor. Plugin management uses the main application's Plugins page. No separate native menu row appears on Alt. Other platforms retain their native menus. Editable fields retain keyboard commands and a context menu without shortcut labels; Chromium supplies command availability, and selected read-only text offers Copy.
+Windows uses a 40-DIP caption with native window controls and colors synchronized from the application palette. Localized Application and Edit entries beside the sidebar toggle open native popup menus. They mount only after the application frame publishes its shell overlay seat, and remain absent during startup loading. Application provides Check for Updates and Exit; Edit provides undo, redo, cut, copy, paste, delete, and select all by sending the corresponding keys to the focused editor, independently of custom shortcut bindings. Plugin management uses the main application's Plugins page. No separate native menu row appears on Alt. Other platforms retain their native menus. Editable fields retain keyboard commands and a context menu without shortcut labels; Chromium supplies command availability, and selected read-only text offers Copy.

-On macOS the custom application menu also declares the standard File, Window, and application menus, because replacing Electron's default menu drops Close Window (⌘W), Minimize (⌘M), and Hide (⌘H). Linux keeps the application and Edit menus.
+On macOS the custom menu retains Electron's standard Window menu and application hide commands, including Minimize (⌘M) and Hide (⌘H). Linux keeps the application and Edit menus.

 ### Runtime and plugin activation

@@ -86,7 +90,6 @@ Native dialog details include at most 1,200 UTF-16 code units and eight diagnost

 Recovery waits for Host shutdown before changing plugin activation. The native recovery action calls the shared app-boot recovery function under the profile transaction lock. It disables third-party bundles and renames the profile’s `cordis.patch.yml` to `cordis.patch.yml.bak-<timestamp>` (with an ordinal on collisions) without parsing it; the next startup creates an empty patch. Installed packages and earlier backups remain. The home-level patch is unchanged. The Electron console records the backup path (or its absence) and the unchanged home-level patch. Invalid profile data, rename failures, or write failures are reported as recovery-operation errors; completed changes remain, and Desktop does not restart as though recovery succeeded. Desktop has no profile-reset action or emergency HTML document.

-
 ## Develop

 The development application menu offers Reload Page (Cmd+R on macOS, Ctrl+R elsewhere) and Restart App and Host. Restart waits for Host shutdown before relaunching Electron and starting a new Host; neither action rebuilds source files.
@@ -22,6 +22,10 @@ Desktop Host 的 Platform API 请求与更新策略请求使用相同的 `x-clie

 设计师原稿位于 `resources/icon.png` 和 `resources/icon.svg`；平台适配保留鲸鱼与渐变，分别位于 `resources/icon-windows.*` 和 `resources/icon-macos.*`。将各平台 SVG 导出为透明的 1024×1024 PNG。electron-builder 为 Windows 应用、安装程序和卸载程序生成多尺寸 ICO（[Windows 图标要求](https://learn.microsoft.com/en-us/windows/apps/design/iconography/app-icon-construction)）。安装页面在两种主题下使用匹配的图案；卸载程序的欢迎和完成页共用 `installer/assets/uninstaller-sidebar.png`，准备阶段将其转换为 164×314 BMP。

+快捷键覆盖保存在 `app.getPath('userData')/keybindings.json`，与 `DSH_HOME` 分离。主进程校验并串行保存修改后才发布已接受键位。读取失败保留上次接受的键位并阻止编辑，包括全部恢复；不可读和未来版本的文件保持不变。开发时可通过 `DSH_DESKTOP_USER_DATA_DIR` 隔离这些偏好，启动器会输出解析后的路径。格式和冲突语义见[快捷键服务](../../packages/client/shortcuts/README.zh.md)。
+
+macOS“文件”菜单显示已接受的单键绑定（包括方向键），并通过 Client 页面 owner 路由“关闭页面或窗口”。Windows 和 macOS 在主文档、内嵌 frame 和浏览器 guest 输入之前拦截所有已接受的完整绑定，包括编辑和终端输入。录制和输入法组合状态仍受保护。双键组合会将首键的初次按下事件交给页面，且不拦截其松开事件；完整组合及其重复事件会被消费。渲染进程将可配置绑定的分发交给原生适配器。双键组合不注册原生菜单快捷键。已接受的命令通过可信 preload 转发一次。Linux 通过 DOM 分发主文档快捷键，并将已接受的内嵌 frame 绑定转发给 Client 解析器。关闭最后一个窗口后 macOS 保留应用生命周期；Windows 退出桌面实例并停止其任务。[关窗决策](../../.agents/notes/implemented/architecture/2026-09-21-desktop-page-close-shortcuts.zh.md)记录了这一生命周期选择。
+
 macOS PNG 使用带留白的圆角底板，供传统 ICNS 打包使用，包含最高 1024 像素的表示。它是扁平图标，并非 Icon Composer 文档。Apple 的[应用图标指南](https://developer.apple.com/design/human-interface-guidelines/app-icons)要求向 Icon Composer 提供未遮罩的图层；这些输入需要在 macOS 上单独导出，不能复用已做圆角的 ICNS 图案。发布前须在支持的 macOS 版本中验收 Finder 和 Dock 的显示效果。

 ### 内置工作区依赖
@@ -64,9 +68,9 @@ Electron 拥有 `$DSH_HOME/profiles/desktop`。其 `dependencies` 包含 pnpm

 Electron 根据应用语言选择类型化的英文或中文 shell 文案，并回退到英文。macOS 应用包通过 `CFBundleLocalizations` 声明支持英语和简体中文，让 macOS 根据用户的首选语言匹配初始应用语言。主界面仍优先使用已保存的 Client UI 语言偏好。在 Windows 上，主文档的语言会更新桌面菜单、恢复与更新提示。仓库 Client UI i18n 检查覆盖桌面端源码。

-Windows 使用 40 DIP 顶栏，保留原生窗口按钮，颜色随应用调色板同步。侧栏开关旁的本地化“应用”和“编辑”入口打开原生弹出菜单。仅当应用框架发布 shell overlay 席位后才挂载菜单，启动加载期间不显示。“应用”提供检查更新和退出；“编辑”向当前编辑器发送对应按键，提供撤销、重做、剪切、复制、粘贴、删除和全选。插件管理使用主应用的“插件”页面。按 Alt 不会出现额外的原生菜单行。其他平台保留原生菜单。可编辑区域保留快捷键和不带快捷键标注的右键菜单；命令可用状态由 Chromium 提供，选中的只读文本提供“复制”命令。 顶栏菜单保留鼠标和键盘操作，顶栏中的 Web 控件仍可触达。共享 DOM 只约束展示，不构成安全边界：产品脚本可以隐藏蒙层，但不能借此清除主进程策略或授权安装。更新操作与状态通过隔离预加载和壳 frame 之间的私有 MessageChannel 传递。
+Windows 使用 40 DIP 顶栏，保留原生窗口按钮，颜色随应用调色板同步。侧栏开关旁的本地化“应用”和“编辑”入口打开原生弹出菜单。仅当应用框架发布 shell overlay 席位后才挂载菜单，启动加载期间不显示。“应用”提供检查更新和退出；“编辑”向当前编辑器发送对应按键，提供撤销、重做、剪切、复制、粘贴、删除和全选，不受自定义快捷键绑定影响。插件管理使用主应用的“插件”页面。按 Alt 不会出现额外的原生菜单行。其他平台保留原生菜单。可编辑区域保留快捷键和不带快捷键标注的右键菜单；命令可用状态由 Chromium 提供，选中的只读文本提供“复制”命令。

-macOS 上自定义应用菜单还会声明标准的 File、Window 和应用菜单，因为替换 Electron 的默认菜单会丢掉 Close Window（⌘W）、Minimize（⌘M）和 Hide（⌘H）。Linux 保留应用菜单和 Edit 菜单。
+macOS 上自定义菜单保留 Electron 的标准 Window 菜单及应用隐藏命令，包括 Minimize（⌘M）和 Hide（⌘H）。Linux 保留应用菜单和 Edit 菜单。

 ### 运行时与插件激活

@@ -86,7 +90,6 @@ macOS 上自定义应用菜单还会声明标准的 File、Window 和应用菜

 恢复操作等待 Host 关闭后才修改插件启用状态。原生恢复操作在 profile 事务锁内调用共享 app-boot 恢复函数。它禁用第三方 bundle，并将 profile 的 `cordis.patch.yml` 重命名为 `cordis.patch.yml.bak-<timestamp>`（重名时追加序号），无需解析；下次启动创建空 patch。已安装包和已有备份保留。home 级 patch 不变。Electron 控制台记录备份路径（或原文件不存在）以及 home 级 patch 未修改。profile 数据无效、重命名失败或写入失败会作为恢复操作错误报告；已完成的修改保留，Desktop 不会假装恢复成功后重启。Desktop 不提供 profile 重置操作或应急 HTML 文档。

-
 ## 开发

 开发环境应用菜单提供“刷新页面”（macOS 为 Cmd+R，其他平台为 Ctrl+R）和“重启应用与 Host”。重启会等待 Host 关闭，再重新启动 Electron 和新的 Host；这两项操作都不会重新构建源码。
@@ -373,7 +376,7 @@ macOS 打包在组装 App 时、代码签名前写入 `Contents/Resources/app-up

 登录和策略请求共用内存 Session，与产品窗口及 updater 隔离；应用重启后需要重新登录。关闭窗口取消登录，导航失败提供本地化重试提示。返回服务后重新查询策略；重定向、Cookie 或 HTTP 422 都不是有效策略决定。取消、登录过期及无效响应均保留已知强更阻塞。固定登录结果写入进程诊断及可选更新日志；登录控制器不记录 Cookie、OAuth 参数或远程错误原文。真实 Harness 网关/API 联调及 macOS 登录验收仍未完成。

-扁平化的 `40005` 打开壳拥有的模态窗口，并拒绝后续插件修改，不停止现有 Host 任务。服务端标题与详情是可选纯文本，缺失时使用客户端兜底文案；缺少下载地址或地址未获批准时隐藏外部页面操作，不解除阻塞。macOS 强更蒙层原位渐入渐出，在更新状态切换时保留蒙层，并将父窗口焦点和键盘输入重定向到蒙层。Windows 由隔离的应用 preload 在主窗口内挂载 shell 来源的 frame，以蒙层和弹窗覆盖 40 DIP 顶栏下方的内容区域。它阻止背景页面输入，不创建额外的原生窗口；移动和最大化只作用于主窗口。父窗口保持启用，原生移动、缩放、最小化、最大化和关闭控件仍可操作。退出应用会完成清理，不会解除更新要求；Esc 不会关闭覆盖层。批准安装后，安装器接管的退出流程会在 Electron 关闭窗口前释放模态窗口。下载、含准备步骤的文件校验、任务检查和安装确认共用同一弹窗。只有第二次用户批准才允许任务收尾和安装；稍后更新保留阻塞与安装包。仅存在受影响任务时，重启文案才提示正在停止任务。策略不跨应用重启持久化，策略响应也不作废或替换 updater 产物。
+扁平化的 `40005` 打开壳拥有的模态窗口，并拒绝后续插件修改，不停止现有 Host 任务。服务端标题与详情是可选纯文本，缺失时使用客户端兜底文案；缺少下载地址或地址未获批准时隐藏外部页面操作，不解除阻塞。macOS 强更蒙层原位渐入渐出，在更新状态切换时保留蒙层，并将父窗口焦点和键盘输入重定向到蒙层。Windows 由隔离的应用 preload 在主窗口内挂载 shell 来源的 frame，以蒙层和弹窗覆盖 40 DIP 顶栏下方的内容区域。它阻止背景页面输入，不创建额外的原生窗口；移动和最大化只作用于主窗口。顶栏菜单保留鼠标和键盘操作，顶栏中的 Web 控件仍可触达。共享 DOM 只约束展示，不构成安全边界：产品脚本可以隐藏蒙层，但不能借此清除主进程策略或授权安装。更新操作与状态通过隔离 preload 和壳 frame 之间的私有 MessageChannel 传递。父窗口保持启用，原生移动、缩放、最小化、最大化和关闭控件仍可操作。退出应用会完成清理，不会解除更新要求；Esc 不会关闭覆盖层。批准安装后，安装器接管的退出流程会在 Electron 关闭窗口前释放模态窗口。下载、含准备步骤的文件校验、任务检查和安装确认共用同一弹窗。只有第二次用户批准才允许任务收尾和安装；稍后更新保留阻塞与安装包。仅存在受影响任务时，重启文案才提示正在停止任务。策略不跨应用重启持久化，策略响应也不作废或替换 updater 产物。

 失败时在同一弹窗内保留阻塞、本地化重试提示和折叠诊断。白名单下载页面操作只在恢复状态出现，不与正常下载或安装并列。请求打开浏览器后立即提供复制替代入口，即使系统请求尚未返回；请求成功不证明网页已打开。复制失败时展示完整、只读的地址供手动复制。浏览器与剪贴板结果不覆盖 updater 错误。只有新的有效无需强更响应才解除阻塞；阻塞期间仍可使用顶部菜单检查。

@@ -69,6 +69,8 @@
    "@types/react": "~18.3.1",
    "@types/react-dom": "~18.3.0",
    "vite": "^6.0.0",
-    "@deepseek-ai/dsh-client-ui-theme": "workspace:^"
+    "@deepseek-ai/dsh-client-ui-theme": "workspace:^",
+    "@deepseek-ai/dsh-client-shortcuts": "workspace:^",
+    "@deepseek-ai/dsh-atomic-write": "workspace:^"
  }
 }
@@ -63,7 +63,7 @@ async function launchElectron(): Promise<void> {
  const rendererPort = debugPort('DSH_DESKTOP_RENDERER_DEBUG_PORT', 9222)
  const hostPort = debugPort('DSH_DESKTOP_HOST_INSPECT_PORT', 9230)
  const home = resolve(process.env.DSH_HOME ?? join(DEVELOPMENT_ROOT, 'home'))
-  const userData = join(DEVELOPMENT_ROOT, 'electron-user-data')
+  const userData = resolve(process.env.DSH_DESKTOP_USER_DATA_DIR ?? join(DEVELOPMENT_ROOT, 'electron-user-data'))
  const environment: NodeJS.ProcessEnv = {
    ...process.env,
    DSH_HOME: home,
@@ -72,6 +72,7 @@ async function launchElectron(): Promise<void> {
    ELECTRON_ENABLE_LOGGING: process.env.ELECTRON_ENABLE_LOGGING ?? '1',
  }
  console.log(`desktop development: DSH_HOME=${home}`)
+  console.log(`desktop development: userData=${userData}`)
  console.log(`desktop development: inspectors main=${String(mainPort)}, renderer=${String(rendererPort)}, host=${String(hostPort)}`)
  if (process.platform === 'darwin') {
    const executable = prepareDevelopmentApp({ electron, appRoot: APP_ROOT, directory: DEVELOPMENT_ROOT, home, userData,
@@ -9,6 +9,7 @@ interface GuestLease {
  readonly partition: string
  attached: boolean
  guest?: WebContents
+  releaseInput?: () => void
 }

 /** Owns workspace storage partitions independently from individual tab guests. */
@@ -51,6 +52,7 @@ export class DesktopBrowserGuests {
    const lease = this.leases.get(key)
    if (lease === undefined) return
    if (lease.owner !== owner) throw new Error('desktop browser: guest belongs to another window')
+    lease.releaseInput?.()
    this.leases.delete(key)
    const guest = lease.guest
    if (guest !== undefined && !guest.isDestroyed()) {
@@ -63,8 +65,9 @@ export class DesktopBrowserGuests {
  /**
   * Install attachment checks before the application document can create a webview.
   * @param window - primary application window.
+   * @param attachInput - attaches native input after guest ownership is verified and returns its disposer.
   */
-  bind(window: BrowserWindow): void {
+  bind(window: BrowserWindow, attachInput: (guest: WebContents, name: DesktopBrowserLeaseId) => () => void): void {
    const owner = window.webContents
    owner.on('will-attach-webview', (event, preferences, params) => {
      const id = typeof params.src === 'string' && params.src.startsWith('about:blank#')
@@ -102,7 +105,8 @@ export class DesktopBrowserGuests {
        }
        lease.guest = guest
        attachedLease = id
-        guest.once('destroyed', () => { this.leases.delete(id) })
+        lease.releaseInput = attachInput(guest, id)
+        guest.once('destroyed', () => { lease.releaseInput?.(); this.leases.delete(id) })
      })
      guest.setWindowOpenHandler(({ url, postBody }) => {
        const lease = attachedLease === undefined ? undefined : this.leases.get(attachedLease)
@@ -1,10 +1,17 @@
 /** Typed preload operations exposed only by the Electron shell. */

+import type { DesktopKeyboardApi, DesktopShortcutsApi } from '@deepseek-ai/dsh-client-shortcuts/protocol'
 import type { IpcMainInvokeEvent } from 'electron'
 import type { DesktopBrowserBridge } from '@deepseek-ai/dsh-client-ui-sidebar-browser/types'

 /** IPC channel names kept private to the desktop application bundle. */
 export const DESKTOP_IPC = {
+  shortcutsInput: 'dsh-desktop:shortcuts-input',
+  shortcutsCloseWindow: 'dsh-desktop:shortcuts-close-window',
+  shortcutsGet: 'dsh-desktop:shortcuts-get',
+  shortcutsEdit: 'dsh-desktop:shortcuts-edit',
+  shortcutsChanged: 'dsh-desktop:shortcuts-changed',
+  shortcutsRecording: 'dsh-desktop:shortcuts-recording',
  boot: 'dsh-desktop:boot',
  enterWorkspace: 'dsh-desktop:enter-workspace',
  bootFailed: 'dsh-desktop:boot-failed',
@@ -62,6 +69,8 @@ export interface DesktopUpdatePresentation {
 export interface DshDesktopProductApi {
  readonly protocolVersion: 1
  readonly browser: DesktopBrowserBridge
+  readonly keyboard: DesktopKeyboardApi
+  readonly shortcuts: DesktopShortcutsApi
  readonly updates: {
    status(): Promise<DesktopUpdatePresentation>
    open(): Promise<void>
@@ -0,0 +1,27 @@
+/** Device-local shortcut preferences in Electron userData; writes share one serialized coordinator. */
+import { readFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { writeFileAtomic } from '@deepseek-ai/dsh-atomic-write'
+import { ShortcutPersistence } from '@deepseek-ai/dsh-client-shortcuts/protocol'
+import type { ShortcutConfigSnapshot, ShortcutPlatform } from '@deepseek-ai/dsh-client-shortcuts/protocol'
+
+/**
+ * Open the device configuration with atomic replacement.
+ * @param userData - Electron-owned userData directory, never a Renderer-supplied path.
+ * @param platform - local input platform.
+ * @param publish - updates the native binding index and trusted product page after commit.
+ * @returns the single-writer transaction coordinator.
+ */
+export function desktopKeybindings(userData: string, platform: ShortcutPlatform,
+  publish: (snapshot: ShortcutConfigSnapshot) => void): ShortcutPersistence {
+  const path = join(userData, 'keybindings.json')
+  return new ShortcutPersistence({
+    read: async () => {
+      try { return await readFile(path, 'utf8') } catch (error) {
+        if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null
+        throw error
+      }
+    },
+    write: raw => writeFileAtomic(path, raw, { mode: 0o600, dirMode: 0o700 }),
+  }, 'desktop', platform, false, publish)
+}
@@ -0,0 +1,253 @@
+/** Product-window preference IPC and native menu interception during physical-key dispatch/recording. */
+import { ipcMain, type BrowserWindow, type IpcMainInvokeEvent, type Input, type MenuItemConstructorOptions, type WebContents } from 'electron'
+import { bindingKey, effectiveShortcuts, presentBinding, parseShortcutDefinitions, parseShortcutEdit } from '@deepseek-ai/dsh-client-shortcuts/protocol'
+import type { NormalizedBinding, ShortcutConfigSnapshot, ShortcutDefinition, ShortcutPlatform, ShortcutRevision } from '@deepseek-ai/dsh-client-shortcuts/protocol'
+import type { DesktopBrowserLeaseId } from '@deepseek-ai/dsh-client-ui-sidebar-browser/types'
+import { desktopKeybindings } from './keybindings.ts'
+import { DESKTOP_IPC, assertDesktopSender } from './ipc.ts'
+
+/**
+ * Install application-owned configuration handlers and attach each product window's input lifecycle.
+ * @param getWindow - current product window.
+ * @param userData - Electron-resolved device preference directory.
+ * @param platform - local device platform.
+ * @param updateMenu - rebuild the application menu when the close accelerator or availability changes.
+ * @returns menu construction, editor key delivery, window attachment, and teardown operations.
+ */
+export function installDesktopShortcuts(
+  getWindow: () => BrowserWindow | undefined, userData: string, platform: ShortcutPlatform, updateMenu: () => void,
+): {
+  fileMenu(labels: { fileMenu: string; closePage: string }): MenuItemConstructorOptions
+  /**
+   * Send a native Edit action to the editor without matching user shortcuts.
+   * @param keyCode - edit key.
+   * @param modifiers - edit modifiers.
+   */
+  sendEditingKey(keyCode: string, modifiers: Array<'control'>): void
+  attach(window: BrowserWindow): void
+  /**
+   * Intercept an approved browser guest's keys until its lease ends.
+   * @param window - owning product window.
+   * @param guest - approved browser contents.
+   * @param name - main-issued lease used as the webview element name.
+   * @returns idempotent listener disposer.
+   */
+  attachGuest(window: BrowserWindow, guest: WebContents, name: DesktopBrowserLeaseId): () => void
+  dispose(): void
+} {
+  let definitions: readonly ShortcutDefinition[] = []
+  let recording = false
+  let revision: ShortcutRevision | undefined
+  let closeBinding: NormalizedBinding | null = null
+  let editingInput: BrowserWindow['webContents'] | undefined
+  const scopedDesktop = platform === 'windows' || platform === 'macos'
+  const disposers = new Set<() => void>()
+  const guestInputs = new Map<WebContents, { window: BrowserWindow; reset(): void }>()
+  const closeAccelerator = (): string | undefined => presentBinding(closeBinding, platform).aria
+    ?.replace('Meta+', 'Command+').replace(/Arrow(Up|Down|Left|Right)$/u, '$1')
+  const sendMenuClose = (): void => {
+    const window = getWindow()
+    if (window === undefined || window.isDestroyed() || !window.isFocused() || !window.isEnabled()
+      || revision === undefined || recording) return
+    window.webContents.send(DESKTOP_IPC.shortcutsInput, { kind: 'menu', commandId: 'page.close', revision })
+  }
+  let keys = new Set<string>()
+  const publish = (snapshot: ShortcutConfigSnapshot): void => {
+    const wasEnabled = revision !== undefined
+    const previousAccelerator = closeAccelerator()
+    revision = definitions.length === 0 || snapshot.status === 'loading' ? undefined : snapshot.revision
+    const rows = snapshot.status === 'loading' ? [] : effectiveShortcuts(definitions, snapshot.document, 'desktop', platform)
+    keys = new Set(rows.flatMap(row => row.binding !== null && row.issue === null && row.conflicts.length === 0
+      ? [bindingKey(row.binding)] : []))
+    const close = rows.find(row => row.id === 'page.close')
+    closeBinding = close?.issue === null && close.conflicts.length === 0 ? close.binding : null
+    if (wasEnabled !== (revision !== undefined) || previousAccelerator !== closeAccelerator()) updateMenu()
+    const window = getWindow()
+    if (window !== undefined && !window.isDestroyed() && window.webContents.mainFrame.url.startsWith('dsh-app://app/')) {
+      window.webContents.send(DESKTOP_IPC.shortcutsChanged, snapshot)
+    }
+  }
+  const persistence = desktopKeybindings(userData, platform, publish)
+  const assertSender = (event: IpcMainInvokeEvent): BrowserWindow => {
+    const window = getWindow()
+    if (window === undefined || window.isDestroyed() || event.sender !== window.webContents
+      || event.senderFrame !== window.webContents.mainFrame) throw new Error('desktop shortcuts: rejected sender')
+    assertDesktopSender(event, ['app'])
+    return window
+  }
+  ipcMain.handle(DESKTOP_IPC.shortcutsGet, async (event, input: unknown) => {
+    assertSender(event)
+    definitions = parseShortcutDefinitions(input)
+    persistence.setDefinitions(definitions)
+    return persistence.readCurrent()
+  })
+  ipcMain.handle(DESKTOP_IPC.shortcutsEdit, async (event, input: unknown, revision: unknown) => {
+    assertSender(event)
+    if (typeof revision !== 'string') throw new Error('desktop shortcuts: invalid revision')
+    return persistence.edit(parseShortcutEdit(input), revision as ShortcutRevision)
+  })
+  ipcMain.handle(DESKTOP_IPC.shortcutsRecording, (event, active: unknown) => {
+    const window = assertSender(event)
+    if (typeof active !== 'boolean') throw new Error('desktop shortcuts: invalid recording state')
+    recording = active
+    window.webContents.setIgnoreMenuShortcuts(active)
+  })
+  ipcMain.handle(DESKTOP_IPC.shortcutsCloseWindow, (event, expected: unknown) => {
+    const window = assertSender(event)
+    if (expected !== revision || revision === undefined || recording || !window.isFocused() || !window.isEnabled()) return
+    window.close()
+  })
+  function attachInput(window: BrowserWindow, contents: WebContents, guestName?: DesktopBrowserLeaseId): () => void {
+    let deadKey = false
+    const held = new Set<string>()
+    const consumed = new Map<string, 'press' | 'repeat'>()
+    let inputFrame: typeof contents.focusedFrame = null
+    let inputRevision: ShortcutRevision | undefined
+    const resetInput = (): void => {
+      deadKey = false; held.clear(); consumed.clear(); inputFrame = null; inputRevision = undefined
+      if (!contents.isDestroyed()) contents.setIgnoreMenuShortcuts(false)
+    }
+    if (guestName !== undefined) guestInputs.set(contents, { window, reset: resetInput })
+    const resetWindow = (): void => {
+      resetInput()
+      for (const guest of guestInputs.values()) if (guest.window === window) guest.reset()
+    }
+    const clear = (): void => {
+      resetInput()
+      if (guestName !== undefined) return
+      definitions = []; keys.clear(); recording = false
+      persistence.setDefinitions(null)
+    }
+    const navigation = (event: Electron.Event<Electron.WebContentsDidStartNavigationEventParams>): void => {
+      if (event.isMainFrame && !event.isSameDocument) clear()
+    }
+    const beforeInput = (event: Electron.Event, input: Input): void => {
+      if (editingInput === contents) {
+        held.clear()
+        consumed.clear()
+        contents.setIgnoreMenuShortcuts(true)
+        return
+      }
+      if (window !== getWindow() || !window.isFocused() || !window.isEnabled() || revision === undefined
+        || (guestName !== undefined && !contents.isFocused())) {
+        contents.setIgnoreMenuShortcuts(false)
+        held.clear()
+        consumed.clear()
+        return
+      }
+      const modifiers = (['control', 'alt', 'shift', 'meta'] as const).filter(modifier => input[modifier])
+      const key = bindingKey({ code: input.code, modifiers })
+      const match = keys.has(key)
+      const menuMatch = closeBinding !== null && closeBinding.secondCode === undefined && modifiers.join('+') === closeBinding.modifiers.join('+')
+        && input.key.toUpperCase() === (closeBinding.code.startsWith('Key') ? closeBinding.code.slice(3) : input.code === closeBinding.code ? input.key.toUpperCase() : '')
+      contents.setIgnoreMenuShortcuts(recording || match || menuMatch)
+      const frame = contents.focusedFrame
+      const composing = input.isComposing || input.key === 'Dead' || deadKey || input.modifiers.includes('altgr')
+      if (input.type === 'keyDown') deadKey = input.key === 'Dead'
+      if (recording || composing || frame === null) { held.clear(); consumed.clear(); return }
+      let binding: NormalizedBinding = { code: input.code, modifiers }
+      let priority = false
+      if (scopedDesktop) {
+        if (frame !== inputFrame || inputRevision !== revision) { held.clear(); inputFrame = frame; inputRevision = revision }
+        const modifierKey = /^(Control|Alt|Shift|Meta)(Left|Right)$/u.test(input.code)
+        if (input.type === 'keyUp') {
+          // A chord's first key reached the renderer, so its release must reach the same input handlers.
+          if (consumed.get(input.code) === 'press') event.preventDefault()
+          consumed.delete(input.code)
+          held.delete(input.code)
+          if (modifierKey) held.clear()
+          return
+        }
+        if (!input.isAutoRepeat) consumed.delete(input.code)
+        if (modifierKey) { held.clear(); return }
+        if (input.isAutoRepeat && consumed.has(input.code) && !match) { event.preventDefault(); return }
+        if (input.isAutoRepeat && !held.has(input.code) && !match) return
+        held.add(input.code)
+        const codes: [string, ...string[]] = [input.code, ...[...held].filter(value => value !== input.code)]
+        codes.sort()
+        const pair = { code: codes[0], ...(codes[1] === undefined ? {} : { secondCode: codes[1] }), modifiers }
+        priority = keys.has(key)
+        if (codes.length === 2 && keys.has(bindingKey(pair))) { binding = pair; priority = true }
+      }
+      const main = guestName === undefined && frame === contents.mainFrame
+      if (!priority && (main || !match)) return
+      event.preventDefault()
+      if (input.type !== 'keyDown') return
+      if (scopedDesktop) {
+        if (!input.isAutoRepeat) {
+          if (binding.secondCode !== undefined) {
+            consumed.set(binding.code, 'repeat')
+            consumed.set(binding.secondCode, 'repeat')
+          }
+          consumed.set(input.code, 'press')
+        }
+        // Electron can omit both keyups after interception; completed presses cannot seed another chord.
+        held.clear()
+      }
+      let embedding = frame
+      while (guestName === undefined && !main && embedding.parent !== null && embedding.parent !== contents.mainFrame) {
+        embedding = embedding.parent
+      }
+      window.webContents.send(DESKTOP_IPC.shortcutsInput, { kind: guestName === undefined ? main ? 'keyboard' : 'iframe' : 'webview',
+        revision, frameName: guestName ?? (main ? '' : embedding.name),
+        code: binding.code, ...(binding.secondCode === undefined ? {} : { secondCode: binding.secondCode }),
+        repeat: input.isAutoRepeat, control: input.control, alt: input.alt, shift: input.shift, meta: input.meta })
+    }
+    const dispose = (): void => {
+      contents.off('did-start-navigation', navigation)
+      contents.off('before-input-event', beforeInput)
+      contents.off('blur', resetInput)
+      contents.off('destroyed', dispose)
+      if (guestName === undefined) { window.off('blur', resetWindow); window.off('closed', closed) }
+      disposers.delete(dispose)
+      guestInputs.delete(contents)
+      if (!contents.isDestroyed()) contents.setIgnoreMenuShortcuts(false)
+    }
+    const closed = (): void => { clear(); dispose() }
+    contents.on('did-start-navigation', navigation)
+    contents.on('before-input-event', beforeInput)
+    contents.on('blur', resetInput)
+    contents.once('destroyed', dispose)
+    if (guestName === undefined) { window.on('closed', closed); window.on('blur', resetWindow) }
+    disposers.add(dispose)
+    return dispose
+  }
+
+  return {
+    sendEditingKey(keyCode, modifiers) {
+      const window = getWindow()
+      if (window === undefined || window.isDestroyed()) return
+      const contents = [...guestInputs].find(([guest, owner]) => owner.window === window && !guest.isDestroyed() && guest.isFocused())?.[0]
+        ?? window.webContents
+      contents.focus()
+      const previous = editingInput
+      editingInput = contents
+      try {
+        // Electron emits before-input-event synchronously for these editor-owned keys.
+        contents.sendInputEvent({ type: 'keyDown', keyCode, modifiers })
+        contents.sendInputEvent({ type: 'keyUp', keyCode, modifiers })
+      } finally {
+        editingInput = previous
+        if (!contents.isDestroyed()) contents.setIgnoreMenuShortcuts(recording)
+      }
+    },
+    fileMenu: (labels) => {
+      const accelerator = closeAccelerator()
+      return { label: labels.fileMenu, submenu: [{
+        id: 'dsh-page-close', label: labels.closePage, enabled: revision !== undefined,
+        ...accelerator === undefined ? {} : { accelerator },
+        click: sendMenuClose,
+      }] }
+    },
+    attach(window) { attachInput(window, window.webContents) },
+    attachGuest: attachInput,
+    dispose() {
+      for (const dispose of disposers) dispose()
+      persistence.dispose()
+      for (const channel of [DESKTOP_IPC.shortcutsGet,
+        DESKTOP_IPC.shortcutsEdit, DESKTOP_IPC.shortcutsRecording, DESKTOP_IPC.shortcutsCloseWindow]) {
+        ipcMain.removeHandler(channel)
+      }
+    },
+  }
+}
@@ -2,6 +2,8 @@

 export const en = {
  application: 'Application',
+  fileMenu: 'File',
+  closePage: 'Close Page or Window',
  aboutMenu: 'About DeepSeek Harness',
  hideApplication: 'Hide DeepSeek Harness',
  hideOtherApplications: 'Hide Others',
@@ -129,6 +131,8 @@ export type DesktopMessages = { readonly [Key in keyof typeof en]: string }

 export const zh = {
  application: '应用',
+  fileMenu: '文件',
+  closePage: '关闭页面或窗口',
  aboutMenu: '关于 DeepSeek Harness',
  hideApplication: '隐藏 DeepSeek Harness',
  hideOtherApplications: '隐藏其他',
@@ -47,6 +47,7 @@ import { DesktopPolicyTestAuth } from './policy-test-auth.ts'
 import { DesktopUpdateDialog, type UpdateDialogOptions } from './update-dialog.ts'
 import { readDesktopRuntime } from './runtime-tree.ts'
 import { DesktopBrowserGuests } from './browser-guests.ts'
+import { installDesktopShortcuts } from './keyboard.ts'

 let focusPrimaryWindow = (): void => {}
 let stopForRecovery = async (): Promise<void> => {}
@@ -511,6 +512,9 @@ async function main(): Promise<void> {

  installDesktopDirectoryPicker(() => mainWindow)
  installMicrophonePermissions(session.defaultSession, () => mainWindow?.webContents)
+  const shortcuts = installDesktopShortcuts(() => mainWindow, app.getPath('userData'),
+    process.platform === 'darwin' ? 'macos' : process.platform === 'win32' ? 'windows' : 'linux', () => { refreshApplicationMenu() })
+  app.on('will-quit', () => { shortcuts.dispose() })

  ipcMain.handle(DESKTOP_IPC.boot, async (event) => {
    assertDesktopSender(event, ['app'])
@@ -592,7 +596,7 @@ async function main(): Promise<void> {
    locale = current
    platformView.notifyLocaleChanged()
    windowsLanguage = locale.id
-    installMenu()
+    refreshApplicationMenu()
  })
  ipcMain.handle(DESKTOP_IPC.updatesStatus, (event) => {
    assertProductSender(event)
@@ -744,8 +748,8 @@ async function main(): Promise<void> {
  // its standard menus and application hide commands declared explicitly.
  // Keep app.name stable: Electron derives its default userData directory from it.
  const darwin = process.platform === 'darwin'
-  const platformMenus: MenuItemConstructorOptions[] = darwin
-    ? [{ role: 'fileMenu' }, { role: 'editMenu' }, { role: 'windowMenu' }]
+  const platformMenus = (): MenuItemConstructorOptions[] => darwin
+    ? [shortcuts.fileMenu(currentDesktopLocale().messages), { role: 'editMenu' }, { role: 'windowMenu' }]
    : [{ role: 'editMenu' }]
  const hideCommands: MenuItemConstructorOptions[] = darwin
    ? [{ role: 'hide', label: currentDesktopLocale().messages.hideApplication },
@@ -774,13 +778,13 @@ async function main(): Promise<void> {
    { role: 'toggleDevTools', visible: false },
    { role: 'toggleDevTools', visible: false, accelerator: 'F12' },
  ]
-  const installMenu = (): void => {
+  const refreshApplicationMenu = (): void => {
    Menu.setApplicationMenu(Menu.buildFromTemplate(process.platform === 'win32' ? devToolsItems : [{
      label: darwin ? app.name : currentDesktopLocale().messages.application,
      submenu: [...applicationItems(), ...devToolsItems],
-    }, ...platformMenus]))
+    }, ...platformMenus()]))
  }
-  installMenu()
+  refreshApplicationMenu()

  if (process.platform === 'win32') {
    ipcMain.handle(DESKTOP_IPC.windowsMenu, (event, name: unknown, x: unknown, y: unknown) => {
@@ -796,9 +800,7 @@ async function main(): Promise<void> {
        label,
        ...(accelerator === undefined ? {} : { accelerator }),
        click: () => {
-          window.webContents.focus()
-          window.webContents.sendInputEvent({ type: 'keyDown', keyCode, modifiers })
-          window.webContents.sendInputEvent({ type: 'keyUp', keyCode, modifiers })
+          shortcuts.sendEditingKey(keyCode, modifiers)
        },
      })
      const items: MenuItemConstructorOptions[] = name === 'application' ? applicationItems() : [
@@ -834,7 +836,8 @@ async function main(): Promise<void> {
  const createMainWindow = (): BrowserWindow => {
    const window = createWindow(appPreload, false, true)
    mainWindow = window
-    browserGuests.bind(window)
+    browserGuests.bind(window, (guest, name) => shortcuts.attachGuest(window, guest, name))
+    shortcuts.attach(window)
    window.on('focus', automaticCheck)
    window.on('closed', () => { if (mainWindow === window) mainWindow = undefined })
    window.webContents.on('did-fail-load', (_event, code, description, url, isMainFrame) => {
@@ -925,7 +928,7 @@ async function main(): Promise<void> {
    if (isQuitting() || backend.state.phase !== 'ready') return
    locale = resolveDesktopStartupLocale(state.localePreference, systemLanguages)
    windowsLanguage = locale.id
-    installMenu()
+    refreshApplicationMenu()
    if (!enteredWorkspace && needsWelcome({ loggedIn: state.loggedIn, hasApiKey: state.hasApiKey })) {
      await showWelcome()
    } else {
@@ -1,5 +1,6 @@
 /** Origin-scoped boot, native directory selection, host paths of picked files, and update presentation with native confirmation actions. */

+import type { DesktopShortcutInput, ShortcutConfigSnapshot, ShortcutSaveResult } from '@deepseek-ai/dsh-client-shortcuts/protocol'
 import { contextBridge, ipcRenderer, webUtils } from 'electron'
 import { DESKTOP_IPC, SCHEME, type DshDesktopProductApi, type DesktopUpdatePresentation } from './ipc.ts'
 import { PLATFORM_IPC } from './platform-ipc.ts'
@@ -13,6 +14,37 @@ function createProductApi(): DshDesktopProductApi {
  return {
    protocolVersion: 1,
    browser: createDesktopBrowserBridge(),
+    keyboard: {
+      closeWindow: revision => ipcRenderer.invoke(DESKTOP_IPC.shortcutsCloseWindow, revision) as Promise<void>,
+      subscribe: (listener) => {
+        const handle = (_event: Electron.IpcRendererEvent, input: DesktopShortcutInput): void => {
+          if (input.kind === 'iframe') {
+            const element = document.activeElement
+            if (!(element instanceof HTMLIFrameElement) || !element.isConnected
+              || !element.matches('iframe[data-sidebar-browser-frame], iframe[data-html-preview]')) return
+            if (input.frameName === '' || element.name !== input.frameName) return
+          }
+          if (input.kind === 'webview') {
+            const element = document.activeElement
+            if (element?.matches('webview[data-sidebar-browser-frame]') !== true || !element.isConnected
+              || input.frameName === '' || element.getAttribute('name') !== input.frameName) return
+          }
+          listener(input)
+        }
+        ipcRenderer.on(DESKTOP_IPC.shortcutsInput, handle)
+        return () => { ipcRenderer.off(DESKTOP_IPC.shortcutsInput, handle) }
+      },
+    },
+    shortcuts: {
+      get: definitions => ipcRenderer.invoke(DESKTOP_IPC.shortcutsGet, definitions) as Promise<ShortcutConfigSnapshot>,
+      edit: (edit, revision) => ipcRenderer.invoke(DESKTOP_IPC.shortcutsEdit, edit, revision) as Promise<ShortcutSaveResult>,
+      recording: active => ipcRenderer.invoke(DESKTOP_IPC.shortcutsRecording, active) as Promise<void>,
+      subscribe(listener) {
+        const handle = (_event: Electron.IpcRendererEvent, snapshot: ShortcutConfigSnapshot): void => { listener(snapshot) }
+        ipcRenderer.on(DESKTOP_IPC.shortcutsChanged, handle)
+        return () => { ipcRenderer.off(DESKTOP_IPC.shortcutsChanged, handle) }
+      },
+    },
    updates: {
      status: () => ipcRenderer.invoke(DESKTOP_IPC.updatesStatus) as Promise<DesktopUpdatePresentation>,
      open: () => ipcRenderer.invoke(DESKTOP_IPC.updatesOpen) as Promise<void>,
@@ -60,7 +92,7 @@ markDocumentPlatform()
 syncWindowFullscreen()
 syncNativeTheme()
 // Main-process IPC also verifies the owning window and top frame.
-contextBridge.exposeInMainWorld('dshDesktop', location.protocol === `${SCHEME}:` && location.hostname === 'app' ? createProductApi() : { protocolVersion: 1 })
+contextBridge.exposeInMainWorld('dshDesktop', location.protocol === `${SCHEME}:` && location.hostname === 'app' && process.isMainFrame ? createProductApi() : { protocolVersion: 1 })

 if (location.protocol === `${SCHEME}:` && location.hostname === 'app') {
  contextBridge.exposeInMainWorld('__DSH_LOCALE__', {
@@ -0,0 +1,35 @@
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { expect, it, onTestFinished } from 'vitest'
+import { desktopKeybindings } from '../src/keybindings.ts'
+import type { ShortcutCommandId, ShortcutConfigSnapshot } from '@deepseek-ai/dsh-client-shortcuts/protocol'
+
+it('persists into the supplied userData, reloads null bindings, and retains original future-version bytes', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'dsh-keybindings-'))
+  onTestFinished(async () => { await rm(root, { recursive: true, force: true }) })
+  let state!: ShortcutConfigSnapshot
+  const first = desktopKeybindings(root, 'windows', (value) => { state = value })
+  onTestFinished(() => { first.dispose() })
+  const id = 'test.toggle' as ShortcutCommandId
+  const definitions = [{ id, defaults: {
+    'desktop:macos': { code: 'KeyB', modifiers: ['primary'] as const },
+    'desktop:windows': { code: 'KeyB', modifiers: ['primary'] as const },
+    'desktop:linux': { code: 'KeyB', modifiers: ['primary'] as const },
+  } }]
+  first.setDefinitions(definitions)
+  await first.readCurrent()
+  expect((await first.edit({ type: 'set', id, binding: null }, state.revision)).status).toBe('saved')
+  const path = join(root, 'keybindings.json')
+  const saved: unknown = JSON.parse(await readFile(path, 'utf8'))
+  expect(saved).toMatchObject({ profiles: { 'desktop:windows': { [id]: null } } })
+  const second = desktopKeybindings(root, 'windows', (value) => { state = value })
+  onTestFinished(() => { second.dispose() })
+  second.setDefinitions(definitions)
+  expect((await second.readCurrent()).document.profiles['desktop:windows']?.[id]).toBeNull()
+  const original = '{"schemaVersion":7,"custom":"retain exactly"}\n'
+  await writeFile(path, original)
+  expect((await second.readCurrent()).error).toBe('future')
+  expect((await second.edit({ type: 'reset-all' }, state.revision)).status).toBe('unreadable')
+  expect(await readFile(path, 'utf8')).toBe(original)
+})
@@ -0,0 +1,679 @@
+// @vitest-environment jsdom
+import { EventEmitter } from 'node:events'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, expect, it, onTestFinished, vi } from 'vitest'
+import type { BrowserWindow, WebContents, WebFrameMain } from 'electron'
+import type { DesktopShortcutInput, ShortcutBinding, ShortcutCommandId, ShortcutConfigSnapshot,
+  ShortcutDefinition, ShortcutSaveResult } from '@deepseek-ai/dsh-client-shortcuts/protocol'
+import { ShortcutRegistry } from '../../../packages/client/shortcuts/src/client/registry.ts'
+import { installKeyboard } from '../../../packages/client/shortcuts/src/client/dom.ts'
+import { installNativeKeyboard } from '../../../packages/client/shortcuts/src/client/native.ts'
+import type { DesktopBrowserLeaseId, DesktopBrowserReservation } from '@deepseek-ai/dsh-client-ui-sidebar-browser/types'
+import { DESKTOP_IPC } from '../src/ipc.ts'
+
+const ipc = vi.hoisted(() => ({ handle: vi.fn(), removeHandler: vi.fn() }))
+vi.mock('electron', () => ({ ipcMain: ipc, app: { isPackaged: true }, session: { fromPartition: () => ({
+  setPermissionRequestHandler: vi.fn(), setPermissionCheckHandler: vi.fn(), setDevicePermissionHandler: vi.fn(),
+  setDisplayMediaRequestHandler: vi.fn(), on: vi.fn(), webRequest: { onBeforeRequest: vi.fn() },
+}) } }))
+const { installDesktopShortcuts } = await import('../src/keyboard.ts')
+const { DesktopBrowserGuests } = await import('../src/browser-guests.ts')
+afterEach(() => { vi.clearAllMocks() })
+
+type FrameFixture = { url: WebFrameMain['url']; name: WebFrameMain['name']; parent: FrameFixture | null }
+type ContentsFixture = EventEmitter & Pick<WebContents,
+  'isDestroyed' | 'isFocused' | 'send' | 'setIgnoreMenuShortcuts' | 'focus' | 'sendInputEvent'> & {
+    mainFrame: FrameFixture
+    focusedFrame: FrameFixture | null
+  }
+type WindowFixture = EventEmitter & Pick<BrowserWindow, 'isDestroyed' | 'isFocused' | 'isEnabled' | 'close'> & {
+  webContents: ContentsFixture
+}
+type InvokeFixture = { sender: object; senderFrame: object | null }
+type KeyboardFixture = Omit<ReturnType<typeof installDesktopShortcuts>, 'attach' | 'attachGuest'> & {
+  attach(window: WindowFixture): void
+  attachGuest(window: WindowFixture, guest: ContentsFixture, name: DesktopBrowserLeaseId): () => void
+}
+// Electron is substituted at module load; fixtures implement the native members exercised by this installer.
+const installFixture = installDesktopShortcuts as (
+  getWindow: () => WindowFixture | undefined, userData: string,
+  platform: Parameters<typeof installDesktopShortcuts>[2], updateMenu: () => void,
+) => KeyboardFixture
+type GuestsFixture = {
+  acquire(owner: ContentsFixture, workspace: unknown): DesktopBrowserReservation
+  release(owner: ContentsFixture, id: unknown): Promise<void>
+  bind(window: WindowFixture, attachInput: (guest: ContentsFixture, name: DesktopBrowserLeaseId) => () => void): void
+}
+
+function desktopDefaults(binding: ShortcutBinding): ShortcutDefinition['defaults'] {
+  return { 'desktop:macos': binding, 'desktop:windows': binding, 'desktop:linux': binding }
+}
+
+async function fixture(platform: 'macos' | 'windows' | 'linux' = 'macos') {
+  const root = await mkdtemp(join(tmpdir(), 'dsh-keyboard-'))
+  onTestFinished(async () => { await rm(root, { recursive: true, force: true }) })
+  const frame: FrameFixture = { url: 'dsh-app://app/', name: '', parent: null }
+  const contents = Object.assign(new EventEmitter(), { mainFrame: frame, focusedFrame: frame,
+    isDestroyed: () => false, isFocused: () => true, send: vi.fn(),
+    setIgnoreMenuShortcuts: vi.fn(), focus: vi.fn(), sendInputEvent: vi.fn() })
+  const window = Object.assign(new EventEmitter(), { webContents: contents, isDestroyed: vi.fn(() => false),
+    isFocused: vi.fn(() => true), isEnabled: vi.fn(() => true), close: vi.fn() })
+  let current: WindowFixture | undefined = window
+  const updateMenu = vi.fn()
+  const keyboard = installFixture(() => current, root, platform, updateMenu)
+  keyboard.attach(current)
+  onTestFinished(() => { keyboard.dispose() })
+  const handlers = new Map<string, (event: InvokeFixture, ...args: unknown[]) => unknown>(
+    ipc.handle.mock.calls.map(([channel, handler]) => [channel, handler]))
+  const event: InvokeFixture = { sender: contents, senderFrame: frame }
+  const call = async <T>(channel: string, ...args: unknown[]): Promise<T> => await handlers.get(channel)!(event, ...args) as T
+  const definitions: readonly ShortcutDefinition[] = [
+    { id: 'sidebar.left.toggle' as ShortcutCommandId, defaults: desktopDefaults({ code: 'KeyB', modifiers: ['primary'] }) },
+  ]
+  return { keyboard, window, contents, frame, event, handlers, call, definitions, updateMenu, detach: () => { current = undefined } }
+}
+
+it('mirrors only successful bindings, suppresses recording menus, and invalidates pre-navigation drafts', async () => {
+  const f = await fixture()
+  const initial = await f.call<ShortcutConfigSnapshot>(DESKTOP_IPC.shortcutsGet, f.definitions)
+  const press = (code: string) => f.contents.emit('before-input-event', { preventDefault: vi.fn() },
+    { type: 'keyDown', modifiers: [], code, key: code.replace('Key', ''), meta: true, control: false, alt: false, shift: false })
+  press('KeyB'); expect(f.contents.setIgnoreMenuShortcuts).toHaveBeenLastCalledWith(true)
+  press('KeyJ'); expect(f.contents.setIgnoreMenuShortcuts).toHaveBeenLastCalledWith(false)
+  const saved = await f.call<ShortcutSaveResult>(DESKTOP_IPC.shortcutsEdit, { type: 'set', id: 'sidebar.left.toggle', binding: { code: 'KeyJ', modifiers: ['primary'] } }, initial.revision)
+  expect(saved.status).toBe('saved')
+  press('KeyB'); expect(f.contents.setIgnoreMenuShortcuts).toHaveBeenLastCalledWith(false)
+  press('KeyJ'); expect(f.contents.setIgnoreMenuShortcuts).toHaveBeenLastCalledWith(true)
+  expect((await f.call<ShortcutSaveResult>(DESKTOP_IPC.shortcutsEdit, { type: 'reset-all' }, initial.revision)).status).toBe('stale')
+  await f.call(DESKTOP_IPC.shortcutsRecording, true)
+  press('KeyW'); expect(f.contents.setIgnoreMenuShortcuts).toHaveBeenLastCalledWith(true)
+  f.window.isFocused.mockReturnValue(false)
+  press('KeyW'); expect(f.contents.setIgnoreMenuShortcuts).toHaveBeenLastCalledWith(false)
+  f.contents.emit('did-start-navigation', { isMainFrame: true, isSameDocument: false }, 'dsh-app://app/', false, true)
+  expect((await f.call<ShortcutSaveResult>(DESKTOP_IPC.shortcutsEdit, { type: 'reset-all' }, saved.snapshot.revision)).status).toBe('not-ready')
+  await f.call(DESKTOP_IPC.shortcutsGet, f.definitions)
+  expect((await f.call<ShortcutSaveResult>(DESKTOP_IPC.shortcutsEdit, { type: 'reset-all' }, saved.snapshot.revision)).status).toBe('stale')
+})
+
+it('rejects other windows, subframes, remote/shell pages, and malformed edits', async () => {
+  const f = await fixture()
+  const get = f.handlers.get(DESKTOP_IPC.shortcutsGet)!
+  for (const event of [{ ...f.event, sender: {} }, { ...f.event, senderFrame: null }, { ...f.event, senderFrame: {} }]) {
+    await expect(get(event, f.definitions)).rejects.toThrow('rejected sender')
+  }
+  for (const url of ['dsh-app://shell/', 'https://example.com/', 'http://localhost/']) {
+    f.frame.url = url
+    await expect(get(f.event, f.definitions)).rejects.toThrow('unowned renderer')
+  }
+  f.frame.url = 'dsh-app://app/'
+  const ready = await f.call<ShortcutConfigSnapshot>(DESKTOP_IPC.shortcutsGet, f.definitions)
+  await expect(f.call(DESKTOP_IPC.shortcutsEdit, { type: 'reset-all', path: '/tmp' }, ready.revision)).rejects.toThrow('Invalid')
+  await expect(f.call(DESKTOP_IPC.shortcutsEdit, { type: 'reset-all' }, 1)).rejects.toThrow('revision')
+  await expect(f.call(DESKTOP_IPC.shortcutsRecording, 'true')).rejects.toThrow('recording')
+  f.window.isDestroyed.mockReturnValue(true)
+  await expect(get(f.event, f.definitions)).rejects.toThrow('rejected sender')
+  f.detach(); await expect(get(f.event, f.definitions)).rejects.toThrow('rejected sender')
+})
+
+it('routes embedded input once, follows rebindings, and guards native window closure by revision and focus', async () => {
+  const f = await fixture()
+  const closeItem = () => (f.keyboard.fileMenu({ fileMenu: 'File', closePage: 'Close' }).submenu as Electron.MenuItemConstructorOptions[])[0]!
+  const initial = await f.call<ShortcutConfigSnapshot>(DESKTOP_IPC.shortcutsGet, [
+    { id: 'page.close', defaults: desktopDefaults({ code: 'KeyW', modifiers: ['primary'] }) },
+    { id: 'page.refresh', defaults: desktopDefaults({ code: 'KeyR', modifiers: ['primary'] }) },
+  ])
+  expect(closeItem().accelerator).toBe('Command+W')
+  const preventDefault = vi.fn()
+  const input = { modifiers: [], type: 'keyDown', code: 'KeyW', key: 'w', meta: true, control: false, alt: false, shift: false, isAutoRepeat: false, isComposing: false }
+  f.contents.send.mockClear()
+  f.contents.emit('before-input-event', { preventDefault }, input)
+  expect(preventDefault).toHaveBeenCalledOnce()
+  expect(f.contents.send).toHaveBeenLastCalledWith(DESKTOP_IPC.shortcutsInput,
+    expect.objectContaining({ kind: 'keyboard', code: 'KeyW' }))
+  preventDefault.mockClear(); f.contents.send.mockClear()
+  Object.assign(f.contents, { focusedFrame: { name: 'embedded', parent: f.frame } })
+  f.contents.emit('before-input-event', { preventDefault }, input)
+  expect(preventDefault).toHaveBeenCalledTimes(1)
+  expect(f.contents.send).toHaveBeenLastCalledWith(DESKTOP_IPC.shortcutsInput, expect.objectContaining({ kind: 'iframe', revision: initial.revision, frameName: 'embedded', code: 'KeyW' }))
+  f.contents.emit('before-input-event', { preventDefault }, { ...input, type: 'keyUp' })
+  expect(f.contents.send).toHaveBeenCalledTimes(1)
+  const saved = await f.call<ShortcutSaveResult>(DESKTOP_IPC.shortcutsEdit,
+    { type: 'set', id: 'page.close', binding: { code: 'KeyJ', modifiers: ['primary'] } }, initial.revision)
+  expect(closeItem().accelerator).toBe('Command+J')
+  f.contents.send.mockClear()
+  f.contents.emit('before-input-event', { preventDefault }, input)
+  expect(f.contents.send).not.toHaveBeenCalled()
+  f.contents.emit('before-input-event', { preventDefault }, { ...input, code: 'KeyZ', key: 'j' })
+  expect(f.contents.setIgnoreMenuShortcuts).toHaveBeenLastCalledWith(true)
+  expect(f.contents.send).not.toHaveBeenCalled()
+  await f.call(DESKTOP_IPC.shortcutsCloseWindow, initial.revision)
+  expect(f.window.close).not.toHaveBeenCalled()
+  f.window.isEnabled.mockReturnValue(false)
+  await f.call(DESKTOP_IPC.shortcutsCloseWindow, saved.snapshot.revision)
+  expect(f.window.close).not.toHaveBeenCalled()
+  f.window.isEnabled.mockReturnValue(true)
+  await f.call(DESKTOP_IPC.shortcutsCloseWindow, saved.snapshot.revision)
+  expect(f.window.close).toHaveBeenCalledTimes(1)
+  await f.call(DESKTOP_IPC.shortcutsEdit, { type: 'set', id: 'page.close', binding: null }, saved.snapshot.revision)
+  expect(closeItem().accelerator).toBeUndefined()
+  f.keyboard.dispose()
+  expect(f.contents.listenerCount('before-input-event')).toBe(0)
+})
+
+it.each([
+  ['browser.new', 'KeyT'], ['session.new', 'KeyN'],
+])('forwards Linux %s from embedded frames while leaving main-document input to the DOM', async (id, code) => {
+  const f = await fixture('linux')
+  const initial = await f.call<ShortcutConfigSnapshot>(DESKTOP_IPC.shortcutsGet,
+    [{ id, defaults: desktopDefaults({ code, modifiers: ['primary'] }) }])
+  const input = { modifiers: ['control'], type: 'keyDown', code, key: code.slice(3).toLowerCase(),
+    control: true, meta: false, alt: false, shift: false, isAutoRepeat: false, isComposing: false }
+  const preventDefault = vi.fn()
+  f.contents.send.mockClear()
+  f.contents.emit('before-input-event', { preventDefault }, input)
+  expect(preventDefault).not.toHaveBeenCalled()
+  expect(f.contents.send).not.toHaveBeenCalled()
+
+  Object.assign(f.contents, { focusedFrame: { name: 'browser', parent: f.frame } })
+  f.contents.emit('before-input-event', { preventDefault }, input)
+  expect(preventDefault).toHaveBeenCalledOnce()
+  expect(f.contents.send).toHaveBeenCalledExactlyOnceWith(DESKTOP_IPC.shortcutsInput,
+    expect.objectContaining({ kind: 'iframe', frameName: 'browser', code, revision: initial.revision }))
+  f.contents.emit('before-input-event', { preventDefault }, { ...input, type: 'keyUp' })
+  expect(f.contents.send).toHaveBeenCalledOnce()
+
+  const cleared = await f.call<ShortcutSaveResult>(DESKTOP_IPC.shortcutsEdit,
+    { type: 'set', id, binding: null }, initial.revision)
+  expect(cleared.status).toBe('saved')
+  preventDefault.mockClear(); f.contents.send.mockClear()
+  f.contents.emit('before-input-event', { preventDefault }, input)
+  expect(preventDefault).not.toHaveBeenCalled()
+  expect(f.contents.send).not.toHaveBeenCalled()
+})
+
+it.each([
+  ['ArrowUp', 'Command+Up'], ['ArrowDown', 'Command+Down'],
+  ['ArrowLeft', 'Command+Left'], ['ArrowRight', 'Command+Right'],
+])('uses the Electron accelerator for a saved %s binding', async (code, accelerator) => {
+  const f = await fixture()
+  const initial = await f.call<ShortcutConfigSnapshot>(DESKTOP_IPC.shortcutsGet,
+    [{ id: 'page.close', defaults: desktopDefaults({ code: 'KeyW', modifiers: ['primary'] }) }])
+  const saved = await f.call<ShortcutSaveResult>(DESKTOP_IPC.shortcutsEdit,
+    { type: 'set', id: 'page.close', binding: { code, modifiers: ['primary'] } }, initial.revision)
+  expect(saved.status).toBe('saved')
+  const menu = f.keyboard.fileMenu({ fileMenu: 'File', closePage: 'Close' }).submenu as Electron.MenuItemConstructorOptions[]
+  expect(menu[0]?.accelerator).toBe(accelerator)
+})
+
+it('refreshes the native menu only when its accelerator or availability changes', async () => {
+  const f = await fixture()
+  const close = { id: 'page.close', defaults: desktopDefaults({ code: 'KeyW', modifiers: ['primary'] }) }
+  expect(f.updateMenu).not.toHaveBeenCalled()
+  await f.call(DESKTOP_IPC.shortcutsGet, [close])
+  expect(f.updateMenu).toHaveBeenCalledOnce()
+  const menu = f.keyboard.fileMenu({ fileMenu: 'File', closePage: 'Close' }).submenu as Electron.MenuItemConstructorOptions[]
+  const registered = await f.call<ShortcutConfigSnapshot>(DESKTOP_IPC.shortcutsGet, [close, ...f.definitions])
+  const edited = await f.call<ShortcutSaveResult>(DESKTOP_IPC.shortcutsEdit,
+    { type: 'set', id: 'sidebar.left.toggle', binding: { code: 'KeyJ', modifiers: ['primary'] } }, registered.revision)
+  expect(edited.status).toBe('saved')
+  expect(f.updateMenu).toHaveBeenCalledOnce()
+  f.contents.send.mockClear()
+  const click = menu[0]!.click as () => void
+  click()
+  expect(f.contents.send).toHaveBeenCalledExactlyOnceWith(DESKTOP_IPC.shortcutsInput,
+    { kind: 'menu', commandId: 'page.close', revision: edited.snapshot.revision })
+  await f.call(DESKTOP_IPC.shortcutsEdit,
+    { type: 'set', id: 'page.close', binding: { code: 'KeyQ', modifiers: ['primary'] } }, edited.snapshot.revision)
+  expect(f.updateMenu).toHaveBeenCalledTimes(2)
+  f.contents.emit('did-start-navigation', { isMainFrame: true, isSameDocument: false })
+  expect(f.updateMenu).toHaveBeenCalledTimes(3)
+  f.contents.emit('did-start-navigation', { isMainFrame: true, isSameDocument: false })
+  expect(f.updateMenu).toHaveBeenCalledTimes(3)
+})
+
+it.each(['macos', 'windows'] as const)('prioritizes %s custom editing bindings before both main and embedded frame handlers', async (platform) => {
+  const f = await fixture(platform)
+  const initial = await f.call<ShortcutConfigSnapshot>(DESKTOP_IPC.shortcutsGet,
+    [{ id: 'session.new', defaults: desktopDefaults({ code: 'KeyN', modifiers: ['primary'] }) }])
+  const saved = await f.call<ShortcutSaveResult>(DESKTOP_IPC.shortcutsEdit,
+    { type: 'set', id: 'session.new', binding: { code: 'KeyC', modifiers: ['primary'] } }, initial.revision)
+  expect(saved.status).toBe('saved')
+  const input = { modifiers: [], type: 'keyDown', code: 'KeyC', key: 'c', meta: platform === 'macos',
+    control: platform === 'windows', alt: false, shift: false, isAutoRepeat: false, isComposing: false }
+  const preventDefault = vi.fn()
+  const press = (changes = {}) => f.contents.emit('before-input-event', { preventDefault }, { ...input, ...changes })
+  f.contents.send.mockClear()
+  press()
+  expect(preventDefault).toHaveBeenCalledOnce()
+  expect(f.contents.send).toHaveBeenLastCalledWith(DESKTOP_IPC.shortcutsInput, expect.objectContaining({ kind: 'keyboard', code: 'KeyC' }))
+  press({ type: 'keyUp' })
+  expect(preventDefault).toHaveBeenCalledTimes(2)
+  expect(f.contents.send).toHaveBeenCalledOnce()
+  Object.assign(f.contents, { focusedFrame: { name: 'embedded', parent: f.frame } })
+  press()
+  expect(f.contents.send).toHaveBeenLastCalledWith(DESKTOP_IPC.shortcutsInput, expect.objectContaining({ kind: 'iframe', frameName: 'embedded' }))
+  await f.call(DESKTOP_IPC.shortcutsRecording, true)
+  preventDefault.mockClear(); f.contents.send.mockClear()
+  press()
+  expect(preventDefault).not.toHaveBeenCalled()
+  expect(f.contents.send).not.toHaveBeenCalled()
+  await f.call(DESKTOP_IPC.shortcutsRecording, false)
+  press({ isComposing: true })
+  press({ modifiers: ['altgr'] })
+  press({ key: 'Dead' })
+  press()
+  expect(preventDefault).not.toHaveBeenCalled()
+  await f.call(DESKTOP_IPC.shortcutsEdit, { type: 'set', id: 'session.new', binding: null }, saved.snapshot.revision)
+  f.contents.send.mockClear()
+  press()
+  expect(preventDefault).not.toHaveBeenCalled()
+  expect(f.contents.send).not.toHaveBeenCalled()
+  expect(f.contents.setIgnoreMenuShortcuts).toHaveBeenLastCalledWith(false)
+})
+
+it.each(['macos', 'windows'] as const)('intercepts complete %s chords once and leaves their first key untouched', async (platform) => {
+  const f = await fixture(platform)
+  const initial = await f.call<ShortcutConfigSnapshot>(DESKTOP_IPC.shortcutsGet,
+    [{ id: 'page.close', defaults: desktopDefaults({ code: 'KeyW', modifiers: ['primary'] }) }])
+  const saved = await f.call<ShortcutSaveResult>(DESKTOP_IPC.shortcutsEdit,
+    { type: 'set', id: 'page.close', binding: { code: 'KeyA', secondCode: 'KeyB', modifiers: [] } }, initial.revision)
+  expect(saved.status).toBe('saved')
+  const menu = f.keyboard.fileMenu({ fileMenu: 'File', closePage: 'Close' }).submenu as Electron.MenuItemConstructorOptions[]
+  expect(menu[0]?.accelerator).toBeUndefined()
+  const preventDefault = vi.fn()
+  const press = (code: string, type = 'keyDown', isAutoRepeat = false) => {
+    f.contents.emit('before-input-event', { preventDefault }, { code, key: code.slice(3), type, modifiers: [],
+      control: false, alt: false, shift: false, meta: false, isAutoRepeat, isComposing: false })
+  }
+  for (const embedded of [false, true]) {
+    Object.assign(f.contents, { focusedFrame: embedded ? { name: 'browser', parent: f.frame } : f.frame })
+    f.contents.send.mockClear(); preventDefault.mockClear()
+    press('KeyA'); press('KeyA', 'keyUp'); press('KeyB'); press('KeyB', 'keyUp')
+    expect(preventDefault).not.toHaveBeenCalled()
+    expect(f.contents.send).not.toHaveBeenCalled()
+    press('KeyB')
+    expect(preventDefault).not.toHaveBeenCalled()
+    press('KeyA')
+    expect(preventDefault).toHaveBeenCalledOnce()
+    expect(f.contents.send).toHaveBeenLastCalledWith(DESKTOP_IPC.shortcutsInput,
+      expect.objectContaining({ kind: embedded ? 'iframe' : 'keyboard', code: 'KeyA', secondCode: 'KeyB', repeat: false }))
+    press('KeyA', 'keyUp'); press('KeyB', 'keyUp')
+  }
+  for (const reset of [() => { f.window.emit('blur') },
+    () => { press('MetaLeft', 'keyUp') },
+    () => { Object.assign(f.contents, { focusedFrame: f.frame }) }]) {
+    press('KeyA'); reset(); f.contents.send.mockClear(); press('KeyB')
+    expect(f.contents.send).not.toHaveBeenCalled()
+    press('KeyA', 'keyUp'); press('KeyB', 'keyUp')
+  }
+  f.contents.send.mockClear()
+  press('KeyC'); press('KeyA'); press('KeyB')
+  expect(f.contents.send).not.toHaveBeenCalled()
+})
+
+it.each(['C', 'V', 'Z'])('delivers Windows Edit %s to the editor and physical input to its shortcut', async (keyCode) => {
+  const f = await fixture('windows')
+  const initial = await f.call<ShortcutConfigSnapshot>(DESKTOP_IPC.shortcutsGet, f.definitions)
+  const saved = await f.call<ShortcutSaveResult>(DESKTOP_IPC.shortcutsEdit,
+    { type: 'set', id: 'sidebar.left.toggle', binding: { code: `Key${keyCode}`, modifiers: ['control'] } }, initial.revision)
+  const registry = new ShortcutRegistry('desktop', 'windows', saved.snapshot)
+  const run = vi.fn()
+  registry.register({ ...f.definitions[0]!, label: () => 'Toggle sidebar', aliases: [], regions: ['page', 'editable'], modals: [],
+    resolve: () => ({ status: 'handled', run }) })
+  let nativeInput: (input: DesktopShortcutInput) => void = () => {}
+  onTestFinished(installNativeKeyboard(window, {
+    closeWindow: vi.fn(), subscribe: (listener) => { nativeInput = listener; return () => {} },
+  }, registry, () => registry.config.getSnapshot()))
+  onTestFinished(installKeyboard(window, registry, undefined, true))
+  f.contents.send.mockImplementation((channel: string, input: DesktopShortcutInput) => {
+    if (channel === DESKTOP_IPC.shortcutsInput) nativeInput(input)
+  })
+  const editorInput: string[] = []
+  const deliver = (type: 'keyDown' | 'keyUp'): void => {
+    const preventDefault = vi.fn()
+    f.contents.emit('before-input-event', { preventDefault }, { type, code: `Key${keyCode}`, key: keyCode.toLowerCase(),
+      modifiers: ['control'], control: true, meta: false, alt: false, shift: false, isAutoRepeat: false, isComposing: false })
+    if (!preventDefault.mock.calls.length) {
+      editorInput.push(type)
+      document.body.dispatchEvent(new KeyboardEvent(type === 'keyDown' ? 'keydown' : 'keyup',
+        { code: `Key${keyCode}`, key: keyCode.toLowerCase(), ctrlKey: true, bubbles: true, cancelable: true }))
+    }
+  }
+  f.contents.sendInputEvent.mockImplementation((input: { type: 'keyDown' | 'keyUp' }) => { deliver(input.type) })
+  f.contents.send.mockClear()
+
+  f.keyboard.sendEditingKey(keyCode, ['control'])
+
+  expect(f.contents.focus).toHaveBeenCalledOnce()
+  expect(editorInput).toEqual(['keyDown', 'keyUp'])
+  expect(f.contents.send).not.toHaveBeenCalled()
+  expect(run).not.toHaveBeenCalled()
+  expect(f.contents.sendInputEvent.mock.calls).toEqual([
+    [{ type: 'keyDown', keyCode, modifiers: ['control'] }],
+    [{ type: 'keyUp', keyCode, modifiers: ['control'] }],
+  ])
+  editorInput.length = 0
+  deliver('keyDown')
+  deliver('keyUp')
+  expect(editorInput).toEqual([])
+  expect(f.contents.send).toHaveBeenCalledExactlyOnceWith(DESKTOP_IPC.shortcutsInput,
+    expect.objectContaining({ kind: 'keyboard', code: `Key${keyCode}` }))
+  expect(run).toHaveBeenCalledOnce()
+})
+
+it('restores shortcut interception after native Edit delivery fails', async () => {
+  const f = await fixture('windows')
+  await f.call<ShortcutConfigSnapshot>(DESKTOP_IPC.shortcutsGet, f.definitions)
+  f.contents.sendInputEvent.mockImplementationOnce(() => { throw new Error('editor unavailable') })
+  expect(() => { f.keyboard.sendEditingKey('C', ['control']) }).toThrow('editor unavailable')
+  const preventDefault = vi.fn()
+  f.contents.emit('before-input-event', { preventDefault }, { type: 'keyDown', code: 'KeyB', key: 'b', modifiers: ['control'],
+    control: true, meta: false, alt: false, shift: false, isAutoRepeat: false, isComposing: false })
+  expect(preventDefault).toHaveBeenCalledOnce()
+  f.window.isDestroyed.mockReturnValue(true)
+  expect(() => { f.keyboard.sendEditingKey('C', ['control']) }).not.toThrow()
+  f.detach()
+  expect(() => { f.keyboard.sendEditingKey('C', ['control']) }).not.toThrow()
+  expect(f.contents.sendInputEvent).toHaveBeenCalledOnce()
+})
+
+it.each(['macos', 'windows'] as const)('intercepts %s standalone custom keys and clears held state when preferences change', async (platform) => {
+  const f = await fixture(platform)
+  let snapshot = await f.call<ShortcutConfigSnapshot>(DESKTOP_IPC.shortcutsGet, f.definitions)
+  for (const code of ['KeyA', 'F1', 'ArrowLeft', 'Escape', 'Tab', 'Enter']) {
+    const saved = await f.call<ShortcutSaveResult>(DESKTOP_IPC.shortcutsEdit,
+      { type: 'set', id: 'sidebar.left.toggle', binding: { code, modifiers: [] } }, snapshot.revision)
+    expect(saved.status).toBe('saved'); snapshot = saved.snapshot
+    const preventDefault = vi.fn()
+    f.contents.send.mockClear()
+    f.contents.emit('before-input-event', { preventDefault }, { type: 'keyDown', code, key: code, modifiers: [],
+      control: false, alt: false, shift: false, meta: false, isAutoRepeat: false, isComposing: false })
+    expect(preventDefault).toHaveBeenCalledOnce()
+    expect(f.contents.send).toHaveBeenLastCalledWith(DESKTOP_IPC.shortcutsInput,
+      expect.objectContaining({ code, revision: snapshot.revision }))
+  }
+})
+
+it.each(['macos', 'windows'] as const)('keeps %s native interception identical for inherited, saved and reset bindings', async (platform) => {
+  const f = await fixture(platform)
+  let snapshot = await f.call<ShortcutConfigSnapshot>(DESKTOP_IPC.shortcutsGet, f.definitions)
+  for (const operation of [null,
+    { type: 'set', id: 'sidebar.left.toggle', binding: { code: 'KeyB', modifiers: ['primary'] } },
+    { type: 'reset', id: 'sidebar.left.toggle' }]) {
+    if (operation !== null) {
+      const result = await f.call<ShortcutSaveResult>(DESKTOP_IPC.shortcutsEdit, operation, snapshot.revision)
+      expect(result.status).toBe('saved'); snapshot = result.snapshot
+    }
+    for (const embedded of [false, true]) {
+      Object.assign(f.contents, { focusedFrame: embedded ? { name: 'browser', parent: f.frame } : f.frame })
+      const preventDefault = vi.fn()
+      f.contents.send.mockClear()
+      f.contents.emit('before-input-event', { preventDefault }, { type: 'keyDown', code: 'KeyB', key: 'b', modifiers: [],
+        control: platform === 'windows', meta: platform === 'macos', alt: false, shift: false, isAutoRepeat: false, isComposing: false })
+      expect(preventDefault).toHaveBeenCalledOnce()
+      expect(f.contents.send).toHaveBeenLastCalledWith(DESKTOP_IPC.shortcutsInput,
+        expect.objectContaining({ kind: embedded ? 'iframe' : 'keyboard', code: 'KeyB', revision: snapshot.revision }))
+    }
+  }
+})
+
+it('consumes a held single-key repeat after focus reset without treating it as a fresh press', async () => {
+  const f = await fixture('macos')
+  await f.call<ShortcutConfigSnapshot>(DESKTOP_IPC.shortcutsGet, f.definitions)
+  const preventDefault = vi.fn()
+  const input = { type: 'keyDown', code: 'KeyB', key: 'b', modifiers: [],
+    control: false, meta: true, alt: false, shift: false, isAutoRepeat: false, isComposing: false }
+  f.contents.emit('before-input-event', { preventDefault }, input)
+  f.window.emit('blur')
+  f.contents.send.mockClear(); preventDefault.mockClear()
+  f.contents.emit('before-input-event', { preventDefault }, { ...input, isAutoRepeat: true })
+  expect(preventDefault).toHaveBeenCalledOnce()
+  expect(f.contents.send).toHaveBeenLastCalledWith(DESKTOP_IPC.shortcutsInput, expect.objectContaining({ code: 'KeyB', repeat: true }))
+})
+
+it('delivers a fresh unbound key release after macOS omitted the previous Command character release', async () => {
+  const f = await fixture('macos')
+  await f.call<ShortcutConfigSnapshot>(DESKTOP_IPC.shortcutsGet, f.definitions)
+  const preventDefault = vi.fn()
+  const press = (code: string, type: string, meta: boolean): void => {
+    f.contents.emit('before-input-event', { preventDefault }, { type, code, key: code, modifiers: [],
+      control: false, meta, alt: false, shift: false, isAutoRepeat: false, isComposing: false })
+  }
+  press('KeyB', 'keyDown', true)
+  expect(preventDefault).toHaveBeenCalledOnce()
+  press('MetaLeft', 'keyUp', false)
+  preventDefault.mockClear()
+  press('KeyB', 'keyDown', false); press('KeyB', 'keyUp', false)
+  expect(preventDefault).not.toHaveBeenCalled()
+})
+
+it.each(['macos', 'windows'] as const)('releases %s native input when a saved binding overlaps a mounted fixed action', async (platform) => {
+  const f = await fixture(platform)
+  const initial = await f.call<ShortcutConfigSnapshot>(DESKTOP_IPC.shortcutsGet, f.definitions)
+  const saved = await f.call<ShortcutSaveResult>(DESKTOP_IPC.shortcutsEdit,
+    { type: 'set', id: 'sidebar.left.toggle', binding: { code: 'Escape', modifiers: [] } }, initial.revision)
+  expect(saved.status).toBe('saved')
+  await f.call(DESKTOP_IPC.shortcutsGet, [...f.definitions,
+    { id: 'menu.dismiss', defaults: {}, fixed: [{ code: 'Escape', modifiers: [] }] }])
+  const preventDefault = vi.fn()
+  f.contents.send.mockClear()
+  f.contents.emit('before-input-event', { preventDefault }, { type: 'keyDown', code: 'Escape', key: 'Escape', modifiers: [],
+    control: false, meta: false, alt: false, shift: false, isAutoRepeat: false, isComposing: false })
+  expect(preventDefault).not.toHaveBeenCalled()
+  expect(f.contents.send).not.toHaveBeenCalled()
+})
+
+it.each(['macos', 'windows'] as const)('keeps %s chord presses singular across native interception and renderer key delivery', async (platform) => {
+  const f = await fixture(platform)
+  const initial = await f.call<ShortcutConfigSnapshot>(DESKTOP_IPC.shortcutsGet, f.definitions)
+  const saved = await f.call<ShortcutSaveResult>(DESKTOP_IPC.shortcutsEdit,
+    { type: 'set', id: 'sidebar.left.toggle', binding: { code: 'KeyF', secondCode: 'KeyG', modifiers: [] } }, initial.revision)
+  const registry = new ShortcutRegistry('desktop', platform, saved.snapshot)
+  const run = vi.fn()
+  registry.register({ ...f.definitions[0]!, label: () => 'Toggle sidebar', aliases: [], regions: ['page'], modals: [],
+    resolve: () => ({ status: 'handled', run }) })
+  let deliver: (input: DesktopShortcutInput) => void = () => {}
+  onTestFinished(installNativeKeyboard(window, { closeWindow: vi.fn(), subscribe: (listener) => { deliver = listener; return () => {} } },
+    registry, () => registry.config.getSnapshot()))
+  onTestFinished(installKeyboard(window, registry, undefined, true))
+  f.contents.send.mockImplementation((channel: string, input: DesktopShortcutInput) => {
+    if (channel === DESKTOP_IPC.shortcutsInput) deliver(input)
+  })
+  const rendererReleases: string[] = []
+  const press = (code: string, type: 'keyDown' | 'keyUp', repeat = false): void => {
+    const preventDefault = vi.fn()
+    f.contents.emit('before-input-event', { preventDefault }, { code, key: code.slice(3).toLowerCase(), type, modifiers: [],
+      control: false, meta: false, alt: false, shift: false, isAutoRepeat: repeat, isComposing: false })
+    // Electron only delivers input to the document when the main process did not intercept it.
+    if (!preventDefault.mock.calls.length) {
+      if (type === 'keyUp') rendererReleases.push(code)
+      document.body.dispatchEvent(new KeyboardEvent(type === 'keyDown' ? 'keydown' : 'keyup',
+        { code, key: code.slice(3).toLowerCase(), repeat, bubbles: true, cancelable: true }))
+    }
+  }
+  for (const [index, [first, second]] of ([['KeyF', 'KeyG'], ['KeyG', 'KeyF']] as const).entries()) {
+    press(first, 'keyDown'); press(first, 'keyUp'); press(second, 'keyDown'); press(second, 'keyUp')
+    expect(run).toHaveBeenCalledTimes(index)
+    press(first, 'keyDown'); press(second, 'keyDown'); press(second, 'keyDown', true); press(first, 'keyDown', true)
+    expect(run).toHaveBeenCalledTimes(index + 1)
+    if (index === 0) { press(first, 'keyUp'); press(second, 'keyUp') }
+    else { press(second, 'keyUp'); press(first, 'keyUp') }
+    press(second, 'keyDown'); press(second, 'keyUp'); press(first, 'keyDown'); press(first, 'keyUp')
+    expect(run).toHaveBeenCalledTimes(index + 1)
+  }
+  expect(rendererReleases.filter(code => code === 'KeyF')).toHaveLength(5)
+  expect(rendererReleases.filter(code => code === 'KeyG')).toHaveLength(5)
+})
+
+it.each(['macos', 'windows'] as const)('requires fresh %s chord presses when Electron omits intercepted key releases', async (platform) => {
+  const f = await fixture(platform)
+  const bindings = [
+    { id: 'sidebar.left.toggle', binding: { code: 'KeyJ', secondCode: 'KeyK', modifiers: [] } },
+    { id: 'sidebar.right.toggle', binding: { code: 'KeyF', secondCode: 'KeyG', modifiers: [] } },
+    { id: 'shortcuts.open', binding: { code: 'KeyV', modifiers: [] } },
+  ]
+  let snapshot = await f.call<ShortcutConfigSnapshot>(DESKTOP_IPC.shortcutsGet,
+    bindings.map(({ id }) => ({ id, defaults: {} })))
+  for (const binding of bindings) {
+    const saved = await f.call<ShortcutSaveResult>(DESKTOP_IPC.shortcutsEdit, { type: 'set', ...binding }, snapshot.revision)
+    expect(saved.status).toBe('saved')
+    snapshot = saved.snapshot
+  }
+  const press = (code: string, type = 'keyDown', repeat = false): boolean => {
+    const preventDefault = vi.fn()
+    f.contents.emit('before-input-event', { preventDefault }, { code, key: code.slice(3).toLowerCase(), type, modifiers: [],
+      control: false, meta: false, alt: false, shift: false, isAutoRepeat: repeat, isComposing: false })
+    return preventDefault.mock.calls.length > 0
+  }
+  for (const embedded of [false, true]) {
+    Object.assign(f.contents, { focusedFrame: embedded ? { name: 'browser', parent: f.frame } : f.frame })
+    f.contents.send.mockClear()
+    expect(press('KeyJ')).toBe(false)
+    expect(press('KeyK')).toBe(true)
+    expect(f.contents.send).toHaveBeenCalledOnce()
+    // Electron on macOS can omit both releases after intercepting the second keydown.
+    for (const code of ['KeyJ', 'KeyK']) {
+      expect(press(code)).toBe(false)
+      expect(press(code, 'keyUp')).toBe(false)
+    }
+    expect(f.contents.send).toHaveBeenCalledOnce()
+    expect(press('KeyK')).toBe(false)
+    expect(press('KeyJ')).toBe(true)
+    expect(f.contents.send).toHaveBeenCalledTimes(2)
+    expect(press('KeyJ', 'keyDown', true)).toBe(true)
+    expect(press('KeyK', 'keyDown', true)).toBe(true)
+    expect(f.contents.send).toHaveBeenCalledTimes(2)
+    expect(press('KeyF')).toBe(false)
+    expect(press('KeyG')).toBe(true)
+    expect(f.contents.send).toHaveBeenCalledTimes(3)
+    expect(press('KeyV')).toBe(true)
+    expect(press('KeyJ')).toBe(false)
+    expect(press('KeyK')).toBe(true)
+    expect(f.contents.send).toHaveBeenCalledTimes(5)
+  }
+})
+
+it.each(['macos', 'windows', 'linux'] as const)('routes approved %s browser guest input to its owner and stops delivery before guest destruction', async (platform) => {
+  const f = await fixture(platform)
+  const snapshot = await f.call<ShortcutConfigSnapshot>(DESKTOP_IPC.shortcutsGet,
+    [{ id: 'browser.new', defaults: desktopDefaults({ code: 'KeyT', modifiers: ['primary'] }) }])
+  const guests = new DesktopBrowserGuests(() => undefined) as GuestsFixture
+  const attach = vi.fn((guest: ContentsFixture, name: DesktopBrowserLeaseId) => f.keyboard.attachGuest(f.window, guest, name))
+  guests.bind(f.window, attach)
+  const reservation = guests.acquire(f.contents, 'session:test')
+  const frame: FrameFixture = { url: `about:blank#${reservation.lease}`, name: '', parent: null }
+  const guest = Object.assign(new EventEmitter(), { mainFrame: frame, focusedFrame: frame,
+    getURL: () => frame.url, isDestroyed: () => false, isFocused: vi.fn(() => true),
+    setWindowOpenHandler: vi.fn(), setIgnoreMenuShortcuts: vi.fn(), send: vi.fn(), close: vi.fn(),
+    focus: vi.fn(), sendInputEvent: vi.fn() })
+  onTestFinished(() => { guest.emit('destroyed') })
+  const rejected = { preventDefault: vi.fn() }
+  f.contents.emit('will-attach-webview', rejected, {}, { src: 'about:blank#unknown', partition: reservation.partition })
+  expect(rejected.preventDefault).toHaveBeenCalledOnce()
+  const invalid = Object.assign(new EventEmitter(), { getURL: () => 'about:blank#unknown', setWindowOpenHandler: vi.fn(), close: vi.fn() })
+  f.contents.emit('did-attach-webview', {}, invalid)
+  invalid.emit('dom-ready')
+  expect(invalid.close).toHaveBeenCalledExactlyOnceWith({ waitForBeforeUnload: false })
+  expect(attach).not.toHaveBeenCalled()
+
+  const approved = { preventDefault: vi.fn() }
+  f.contents.emit('will-attach-webview', approved, {}, { src: frame.url, partition: reservation.partition })
+  expect(approved.preventDefault).not.toHaveBeenCalled()
+  f.contents.emit('did-attach-webview', {}, guest)
+  guest.emit('dom-ready')
+  expect(attach).toHaveBeenCalledExactlyOnceWith(guest, reservation.lease)
+  const input = { modifiers: [], type: 'keyDown', code: 'KeyT', key: 't', meta: platform === 'macos',
+    control: platform !== 'macos', alt: false, shift: false, isAutoRepeat: false, isComposing: false }
+  const preventDefault = vi.fn()
+  f.contents.send.mockClear()
+  guest.emit('before-input-event', { preventDefault }, input)
+  expect(preventDefault).toHaveBeenCalledOnce()
+  expect(guest.send).not.toHaveBeenCalled()
+  expect(f.contents.send).toHaveBeenCalledExactlyOnceWith(DESKTOP_IPC.shortcutsInput, {
+    kind: 'webview', frameName: reservation.lease, revision: snapshot.revision, code: 'KeyT',
+    meta: platform === 'macos', control: platform !== 'macos', alt: false, shift: false, repeat: false,
+  })
+  guest.isFocused.mockReturnValue(false)
+  guest.emit('before-input-event', { preventDefault }, input)
+  expect(f.contents.send).toHaveBeenCalledOnce()
+  guest.isFocused.mockReturnValue(true)
+  const release = guests.release(f.contents, reservation.lease)
+  expect(guest.close).toHaveBeenCalledExactlyOnceWith({ waitForBeforeUnload: false })
+  expect(guest.listenerCount('before-input-event')).toBe(0)
+  guest.emit('before-input-event', { preventDefault }, input)
+  expect(f.contents.send).toHaveBeenCalledOnce()
+  guest.emit('destroyed')
+  await release
+})
+
+it('keeps browser guest chord state local and leaves accepted bindings active through guest navigation', async () => {
+  const f = await fixture('macos')
+  const initial = await f.call<ShortcutConfigSnapshot>(DESKTOP_IPC.shortcutsGet, f.definitions)
+  await f.call(DESKTOP_IPC.shortcutsEdit, { type: 'set', id: 'sidebar.left.toggle',
+    binding: { code: 'KeyF', secondCode: 'KeyG', modifiers: [] } }, initial.revision)
+  const frame: FrameFixture = { url: 'https://example.test/', name: '', parent: null }
+  const guest = Object.assign(new EventEmitter(), { mainFrame: frame, focusedFrame: frame,
+    isDestroyed: () => false, isFocused: () => true, setIgnoreMenuShortcuts: vi.fn(),
+    send: vi.fn(), focus: vi.fn(), sendInputEvent: vi.fn() })
+  const blurListeners = f.window.listenerCount('blur')
+  const closedListeners = f.window.listenerCount('closed')
+  const dispose = f.keyboard.attachGuest(f.window, guest, 'guest' as DesktopBrowserLeaseId)
+  onTestFinished(dispose)
+  expect(f.window.listenerCount('blur')).toBe(blurListeners)
+  expect(f.window.listenerCount('closed')).toBe(closedListeners)
+  const press = (contents: EventEmitter, code: string): void => {
+    contents.emit('before-input-event', { preventDefault: vi.fn() }, { modifiers: [], type: 'keyDown', code, key: code,
+      meta: false, control: false, alt: false, shift: false, isAutoRepeat: false, isComposing: false })
+  }
+  f.contents.send.mockClear()
+  press(guest, 'KeyF')
+  guest.emit('blur')
+  press(guest, 'KeyG')
+  expect(f.contents.send).not.toHaveBeenCalled()
+  f.window.emit('blur')
+  press(guest, 'KeyF')
+  expect(f.contents.send).not.toHaveBeenCalled()
+  guest.emit('did-start-navigation', { isMainFrame: true, isSameDocument: false })
+  press(guest, 'KeyF')
+  press(f.contents, 'KeyG')
+  expect(f.contents.send).not.toHaveBeenCalled()
+  press(guest, 'KeyG')
+  expect(f.contents.send).toHaveBeenCalledExactlyOnceWith(DESKTOP_IPC.shortcutsInput,
+    expect.objectContaining({ kind: 'webview', frameName: 'guest', code: 'KeyF', secondCode: 'KeyG' }))
+  guest.emit('destroyed')
+  press(f.contents, 'KeyF')
+  expect(f.contents.send).toHaveBeenCalledTimes(2)
+  expect(f.contents.send).toHaveBeenLastCalledWith(DESKTOP_IPC.shortcutsInput,
+    expect.objectContaining({ kind: 'keyboard', code: 'KeyF', secondCode: 'KeyG' }))
+})
+
+it('delivers Windows Edit actions to the focused browser guest without invoking its custom shortcut', async () => {
+  const f = await fixture('windows')
+  const initial = await f.call<ShortcutConfigSnapshot>(DESKTOP_IPC.shortcutsGet, f.definitions)
+  await f.call(DESKTOP_IPC.shortcutsEdit, { type: 'set', id: 'sidebar.left.toggle',
+    binding: { code: 'KeyC', modifiers: ['control'] } }, initial.revision)
+  const frame: FrameFixture = { url: 'https://example.test/', name: '', parent: null }
+  const guest = Object.assign(new EventEmitter(), { mainFrame: frame, focusedFrame: frame,
+    isDestroyed: () => false, isFocused: () => true, setIgnoreMenuShortcuts: vi.fn(),
+    send: vi.fn(), focus: vi.fn(), sendInputEvent: vi.fn() })
+  const dispose = f.keyboard.attachGuest(f.window, guest, 'guest' as DesktopBrowserLeaseId)
+  onTestFinished(dispose)
+  const events: string[] = []
+  guest.sendInputEvent.mockImplementation((input: { type: 'keyDown' | 'keyUp' }) => {
+    const preventDefault = vi.fn()
+    guest.emit('before-input-event', { preventDefault }, { ...input, code: 'KeyC', key: 'c', modifiers: ['control'],
+      control: true, meta: false, alt: false, shift: false, isAutoRepeat: false, isComposing: false })
+    if (!preventDefault.mock.calls.length) events.push(input.type)
+  })
+  f.contents.send.mockClear()
+  f.keyboard.sendEditingKey('C', ['control'])
+  expect(guest.focus).toHaveBeenCalledOnce()
+  expect(events).toEqual(['keyDown', 'keyUp'])
+  expect(f.contents.send).not.toHaveBeenCalled()
+  expect(f.contents.sendInputEvent).not.toHaveBeenCalled()
+  dispose()
+  f.keyboard.sendEditingKey('C', ['control'])
+  expect(f.contents.sendInputEvent).toHaveBeenCalledTimes(2)
+})
@@ -1,6 +1,6 @@
 import type { AccountView } from '@deepseek-ai/dsh-deepseek-account/types'
 import { WINDOWS_TITLEBAR_HEIGHT } from '../src/windows-layout.ts'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, onTestFinished, vi } from 'vitest'
 import type { IpcMainInvokeEvent } from 'electron'
 import { join } from 'node:path'
 import { mkdtempSync, readFileSync, readdirSync, rmSync } from 'node:fs'
@@ -61,6 +61,8 @@ const harness = await vi.hoisted(async () => {
      getURL: () => this.urls.at(-1) ?? '',
      mainFrame: { url: '' },
      getZoomFactor: () => 1,
+      isDestroyed: () => this.destroyed,
+      setIgnoreMenuShortcuts: vi.fn(),
      focus: vi.fn(),
      sendInputEvent: vi.fn(),
      send: vi.fn((channel: string, state: { policy?: { blocking: boolean } }) => {
@@ -131,6 +133,7 @@ const harness = await vi.hoisted(async () => {
    getPreferredSystemLanguages: () => ['en-US'],
    getVersion: () => '1.0.0',
    getAppPath: (): string => 'desktop-test-app',
+    getPath: vi.fn<(name: 'userData') => string>(),
    setAboutPanelOptions: vi.fn<(options: Electron.AboutPanelOptionsOptions) => void>(),
    requestSingleInstanceLock: () => true,
    setAsDefaultProtocolClient: vi.fn(),
@@ -314,6 +317,9 @@ beforeEach(() => {
  testAuth.login.mockResolvedValue('cancelled')
  vi.useFakeTimers()
  harness.reset()
+  const userData = mkdtempSync(join(tmpdir(), 'dsh-main-user-data-'))
+  onTestFinished(() => { rmSync(userData, { recursive: true, force: true }) })
+  harness.app.getPath.mockReturnValue(userData)
  harness.dialog.showMessageBox.mockImplementation((options: { title?: string }) => {
    if (options.title !== en.startupFailed) return Promise.resolve({ response: 1 })
    harness.dialogShown.resolve()
@@ -754,7 +760,7 @@ describe('desktop main startup', () => {
    await edit
  })

-  it.each(['darwin', 'linux'] as const)('adds the standard macOS window commands only on macOS (%s)', async (platform) => {
+  it.each(['darwin', 'linux'] as const)('adds the product File menu and standard window commands only on macOS (%s)', async (platform) => {
    vi.spyOn(process, 'platform', 'get').mockReturnValue(platform)
    await import('../src/main.ts')
    await harness.preparing.promise
@@ -765,7 +771,7 @@ describe('desktop main startup', () => {
      .find(items => items.some(item => item.role === 'editMenu'))
    if (template === undefined) throw new Error('application menu missing')
    expect(template.map(describeItem)).toEqual(platform === 'darwin'
-      ? ['Desktop test', 'fileMenu', 'editMenu', 'windowMenu']
+      ? ['Desktop test', en.fileMenu, 'editMenu', 'windowMenu']
      : ['Application', 'editMenu'])
    const application = template[0]!.submenu as MenuItemConstructorOptions[]
    expect(application.filter(item => item.visible !== false).map(describeItem)).toEqual(platform === 'darwin'
@@ -1,5 +1,6 @@
+// @vitest-environment jsdom
 import { JSDOM } from 'jsdom'
-import { afterEach, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
 import { installMandatoryUpdateOverlay } from '../src/preload-mandatory-overlay.ts'
 import { syncWindowsAppearance } from '../src/preload-windows.ts'
 import { DESKTOP_IPC, type DshDesktopProductApi } from '../src/ipc.ts'
@@ -15,7 +16,8 @@ vi.mock('../src/preload-theme.ts', () => ({ syncNativeTheme: vi.fn() }))
 vi.mock('../src/preload-windows.ts', () => ({ syncWindowsAppearance: vi.fn() }))
 vi.mock('../src/preload-mandatory-overlay.ts', () => ({ installMandatoryUpdateOverlay: vi.fn() }))

-afterEach(() => { vi.unstubAllGlobals(); vi.restoreAllMocks(); vi.clearAllMocks(); vi.resetModules() })
+beforeEach(() => { vi.stubGlobal('process', { ...process, isMainFrame: true }) })
+afterEach(() => { document.body.replaceChildren(); vi.unstubAllGlobals(); vi.restoreAllMocks(); vi.clearAllMocks(); vi.resetModules() })

 it('limits product documents to update status and a native confirmation action', async () => {
  vi.stubGlobal('location', new URL('dsh-app://app/index.html'))
@@ -121,7 +123,7 @@ it('moves welcome-entry focus to the document without changing keyboard tab orde
 })

 it.each(['win32', 'darwin'] as const)('installs the embedded mandatory UI only in the Windows app document (%s)', async (platform) => {
-  vi.spyOn(process, 'platform', 'get').mockReturnValue(platform)
+  vi.stubGlobal('process', { ...process, platform })
  for (const url of ['dsh-app://app/', 'dsh-app://shell/mandatory-update.html', 'https://example.com/']) {
    vi.resetModules()
    vi.mocked(installMandatoryUpdateOverlay).mockClear()
@@ -130,3 +132,92 @@ it.each(['win32', 'darwin'] as const)('installs the embedded mandatory UI only i
    expect(installMandatoryUpdateOverlay).toHaveBeenCalledTimes(platform === 'win32' && url === 'dsh-app://app/' ? 1 : 0)
  }
 })
+
+it('exposes constrained shortcut operations and releases configuration subscriptions', async () => {
+  vi.stubGlobal('location', new URL('dsh-app://app/'))
+  await import('../src/preload-app.ts')
+  const api = electron.contextBridge.exposeInMainWorld.mock.calls.find(([name]) => name === 'dshDesktop')?.[1] as DshDesktopProductApi
+  await api.shortcuts.get([])
+  expect(api.shortcuts).not.toHaveProperty('reload')
+  await api.shortcuts.recording(true)
+  expect(electron.ipcRenderer.invoke).toHaveBeenCalledWith(DESKTOP_IPC.shortcutsGet, [])
+  expect(electron.ipcRenderer.invoke).toHaveBeenCalledWith(DESKTOP_IPC.shortcutsRecording, true)
+  const listener = vi.fn()
+  const off = api.shortcuts.subscribe(listener)
+  const handler = electron.ipcRenderer.on.mock.calls.find(([name]) => name === DESKTOP_IPC.shortcutsChanged)![1] as
+    (event: unknown, state: unknown) => void
+  handler({}, { status: 'ready' })
+  expect(listener).toHaveBeenCalledWith({ status: 'ready' })
+  off(); expect(electron.ipcRenderer.off).toHaveBeenCalledWith(DESKTOP_IPC.shortcutsChanged, handler)
+})
+
+it('withholds the product API from same-origin child frames', async () => {
+  vi.stubGlobal('location', new URL('dsh-app://app/'))
+  vi.stubGlobal('process', { ...process, isMainFrame: false })
+  await import('../src/preload-app.ts')
+  expect(electron.contextBridge.exposeInMainWorld).toHaveBeenCalledWith('dshDesktop', { protocolVersion: 1 })
+})
+
+it('forwards only the focused product iframe and releases native input subscriptions', async () => {
+  vi.stubGlobal('location', new URL('dsh-app://app/'))
+  await import('../src/preload-app.ts')
+  const api = electron.contextBridge.exposeInMainWorld.mock.calls.find(([name]) => name === 'dshDesktop')?.[1] as DshDesktopProductApi
+  const listener = vi.fn()
+  const off = api.keyboard.subscribe(listener)
+  const handler = electron.ipcRenderer.on.mock.calls.find(([name]) => name === DESKTOP_IPC.shortcutsInput)![1] as
+    (event: unknown, state: unknown) => void
+  const input = { kind: 'iframe', frameName: 'preview', revision: 'current' }
+  handler({}, input)
+  const frame = document.createElement('iframe')
+  document.body.append(frame)
+  frame.name = 'preview'
+  frame.focus()
+  handler({}, input)
+  expect(listener).not.toHaveBeenCalled()
+  frame.setAttribute('data-html-preview', '')
+  handler({}, { ...input, frameName: 'stale' })
+  handler({}, { ...input, frameName: '' })
+  expect(listener).not.toHaveBeenCalled()
+  handler({}, input)
+  expect(listener).toHaveBeenCalledExactlyOnceWith(input)
+  frame.remove()
+  handler({}, input)
+  expect(listener).toHaveBeenCalledTimes(1)
+  const menu = { kind: 'menu', commandId: 'page.close', revision: 'current' }
+  handler({}, menu)
+  expect(listener).toHaveBeenLastCalledWith(menu)
+  off()
+  expect(electron.ipcRenderer.off).toHaveBeenCalledWith(DESKTOP_IPC.shortcutsInput, handler)
+})
+
+it('forwards browser guest input only for the focused live webview lease', async () => {
+  vi.stubGlobal('location', new URL('dsh-app://app/'))
+  await import('../src/preload-app.ts')
+  const api = electron.contextBridge.exposeInMainWorld.mock.calls.find(([name]) => name === 'dshDesktop')?.[1] as DshDesktopProductApi
+  const listener = vi.fn()
+  const off = api.keyboard.subscribe(listener)
+  const handler = electron.ipcRenderer.on.mock.calls.find(([name]) => name === DESKTOP_IPC.shortcutsInput)![1] as
+    (event: unknown, state: unknown) => void
+  const input = { kind: 'webview', frameName: 'guest', revision: 'current' }
+  const frame = document.createElement('webview')
+  frame.tabIndex = 0
+  frame.setAttribute('name', 'guest')
+  document.body.append(frame)
+  frame.focus()
+  handler({}, input)
+  expect(listener).not.toHaveBeenCalled()
+  frame.setAttribute('data-sidebar-browser-frame', 'webview')
+  handler({}, { ...input, frameName: '' })
+  handler({}, { ...input, frameName: 'old' })
+  expect(listener).not.toHaveBeenCalled()
+  handler({}, input)
+  expect(listener).toHaveBeenCalledExactlyOnceWith(input)
+  const other = document.createElement('input')
+  document.body.append(other)
+  other.focus()
+  handler({}, input)
+  frame.remove()
+  handler({}, input)
+  expect(listener).toHaveBeenCalledOnce()
+  off()
+})
@@ -45,6 +45,7 @@ vi.mock('electron', () => ({
    getVersion: () => '1.0.0',
    setAboutPanelOptions: vi.fn(),
    getAppPath: () => '/development-app',
+    getPath: vi.fn<(name: 'userData') => string>().mockReturnValue('/desktop-user-data'),
    getPreferredSystemLanguages: () => ['en-US'],
    on: (name: string, callback: (...args: unknown[]) => void) => { state.appListeners.set(name, callback) },
    quit: state.quit,
@@ -22,6 +22,12 @@
    },
    {
      "path": "../../packages/client/ui-sidebar-browser/tsconfig.host.json"
+    },
+    {
+      "path": "../../packages/client/shortcuts/tsconfig.host.json"
+    },
+    {
+      "path": "../../packages/util/atomic-write"
    }
  ],
  "exclude": [
@@ -30,7 +30,7 @@ const PROMPT = `Write a file named notes.txt in the workspace containing exactly
 /** Draft used to measure the composer's own text cap: enough lines to pass it. */
 const CAP_PROBE = Array.from({ length: 40 }, (_, index) => `line ${index}`).join('\n')

-describe('web e2e: approval takeover keeps its actions reachable', () => {
+describe.each(MODE === 'record' ? ['button'] as const : ['button', 'keyboard'] as const)('web e2e: approval takeover through %s', (method) => {
  let scaffold: WebScaffold
  let browser: Browser
  let page: Page
@@ -119,7 +119,11 @@ describe('web e2e: approval takeover keeps its actions reachable', () => {
      await page.setViewportSize(original)
    }

-    await panel.getByRole('button', { name: 'Allow once' }).click()
+    if (method === 'button') await panel.getByRole('button', { name: 'Allow once' }).click()
+    else {
+      await scroll.focus()
+      await page.keyboard.press('Enter')
+    }

    const sessionId = await settled
    if (MODE === 'record') {
@@ -11,7 +11,7 @@ import {
  assertFixtureInventory, captureStableAria, compareOrRefreshGolden,
  launchWebScaffold, seedSession, watchConsole, webSnapshotMode, type WebScaffold,
 } from './scaffold.ts'
-import { expandOwningTurnProcess, newEnglishPage, saveFailureShot } from './support.ts'
+import { expandOwningTurnProcess, newEnglishPage, saveFailureShot, WEB_FIXTURE_TIME } from './support.ts'

 import { AUTO_REVIEW_FIXTURE, captureAutoReviewState } from './auto-review-fixture.ts'

@@ -52,9 +52,10 @@ describe.skipIf(MODE === 'record')('web e2e: cold Auto-review denial', () => {
    expect(result?.data).not.toHaveProperty('callId')

    scaffold = await launchWebScaffold(AUTO_REVIEW_FIXTURE)
-    await seedSession(scaffold, fixture, SEED_ID)
+    await seedSession(scaffold, fixture, SEED_ID, undefined, { createdAt: WEB_FIXTURE_TIME })
    browser = await chromium.launch()
    page = await newEnglishPage(browser)
+    await page.clock.setFixedTime(WEB_FIXTURE_TIME)
    tripwire = watchConsole(page)
    await page.goto(scaffold.authenticatedUrl, { waitUntil: 'load' })
    await page.waitForSelector('[class*="frame"]', { timeout: 30_000 })
@@ -11,7 +11,7 @@ import {
  assertFixtureInventory, captureStableAria, compareOrRefreshGolden, fixtureUserPrompts,
  launchWebScaffold, seedSession, watchConsole, webSnapshotMode, type WebScaffold,
 } from './scaffold.ts'
-import { newEnglishPage, saveFailureShot } from './support.ts'
+import { expandTurnProcesses, newEnglishPage, saveFailureShot, WEB_FIXTURE_TIME } from './support.ts'

 const FIXTURE = fileURLToPath(new URL('../../../snapshots/acp/cancel-tool-calls/session.v3.jsonl', import.meta.url))
 const SNAPSHOT_DIR = fileURLToPath(new URL('../../../snapshots/web/bash-abort-row', import.meta.url))
@@ -30,9 +30,10 @@ describe.skipIf(MODE === 'record')('web e2e: cancelled Bash row disclosure', ()
    const fixture = await readFile(FIXTURE, 'utf8')
    expect(fixtureUserPrompts(fixture)).toEqual([PROMPT])
    scaffold = await launchWebScaffold({})
-    await seedSession(scaffold, fixture, SEED_ID)
+    await seedSession(scaffold, fixture, SEED_ID, undefined, { createdAt: WEB_FIXTURE_TIME })
    browser = await chromium.launch()
    page = await newEnglishPage(browser)
+    await page.clock.setFixedTime(WEB_FIXTURE_TIME)
    tripwire = watchConsole(page)
    await page.goto(scaffold.authenticatedUrl, { waitUntil: 'load' })
    await page.waitForSelector('[class*="frame"]', { timeout: 30_000 })
@@ -43,6 +44,7 @@ describe.skipIf(MODE === 'record')('web e2e: cancelled Bash row disclosure', ()
    const sessionRow = page.locator('[role="treeitem"]').nth(1)
    await sessionRow.waitFor({ timeout: 10_000 })
    await sessionRow.click()
+    await expandTurnProcesses(page)
    await page.locator('[data-sample="bash"]').nth(1).waitFor({ timeout: 15_000 })
  }, 120_000)

@@ -67,9 +69,6 @@ describe.skipIf(MODE === 'record')('web e2e: cancelled Bash row disclosure', ()
    await expect.poll(() => call.getByText('Error: tool call aborted', { exact: true }).count()).toBe(2)

    const snapshot = (await captureStableAria(page, '[class*="centerCol"]', scaffold.workspaceCwd))
-      // The borrowed fixture's UTC date is still the previous day in PDT;
-      // the disclosure golden must not depend on the runner timezone.
-      .replace(/\b\d{1,2}\/\d{1,2}(?= \{\{clock\}\})/g, '{{date}}')
      .split(SEED_ID).join('{{seededId}}')
    await compareOrRefreshGolden(UI_EXPECTED, snapshot, MODE)
    expect(tripwire.pageErrors).toEqual([])
@@ -712,6 +712,7 @@ describe('web e2e: long Chat scroll contract', () => {
        await world.page.getByRole('button', { name: 'Send message', exact: true }).click()
        await expect.poll(() => fileExists(readyPath), { timeout: 15_000 }).toBe(true)
        const liveRow = world.page.locator(`[data-chat-call-id="${LIVE_TOOL_CALL_ID}"] [data-sample="bash"]`)
+        await expandOwningTurnProcess(world.page, liveRow)
        await liveRow.waitFor({ timeout: 15_000 })
        expect(await liveRow.getAttribute('data-state')).toBe('running')
        await expectBottom(world.page)
@@ -35,7 +35,7 @@ import {
  webSnapshotMode,
  type WebScaffold,
 } from './scaffold.ts'
-import { openSettingsFromAccountMenu, newEnglishPage, saveFailureShot } from './support.ts'
+import { openSettingsFromAccountMenu, expandTurnProcesses, newEnglishPage, saveFailureShot } from './support.ts'

 const SNAPSHOT_DIR = fileURLToPath(new URL('./expected/clickable-links-gallery', import.meta.url))
 const UI_EXPECTED = fileURLToPath(new URL('./expected/clickable-links-gallery/ui.expected.md', import.meta.url))
@@ -373,11 +373,9 @@ describe('web e2e: clickable links gallery', () => {
    // no openable path even though its create still joins the produced chips.
    expect(await page.locator('button[class*="fileLink"]').count()).toBe(7)

-    // Expanded cards. The turn-process group collapses a multi-call turn, so
-    // it opens first. Rows expand via a right-edge click: the row center can
-    // land on the nested fileLink button, which would hand the path to the
-    // Host's opener.
-    await page.getByRole('button', { name: `${String(CALLS.length)} tool calls` }).click()
+    // A row-center click can hit the nested fileLink button and invoke the
+    // Host opener; right-edge clicks expand the card itself.
+    await expandTurnProcesses(page)
    for (const row of [
      /^Search clickable link styles/,
      /^Fetch /,
@@ -2,7 +2,7 @@
 import { fileURLToPath } from 'node:url'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
-import { cp, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { cp, mkdtemp, readFile, rm, stat, utimes, writeFile } from 'node:fs/promises'
 import { chromium, type Page } from 'playwright'
 import { expect, it, onTestFailed, onTestFinished } from 'vitest'
 import {
@@ -256,6 +256,10 @@ it('reports bootstrap rebuilds without remounting the settings page or navigatin
    const originalInput = await draft.elementHandle()
    let navigations = 0
    page.on('framenavigated', () => { navigations++ })
+    const clientPath = scaffold.ctx.clientModules.clientPath('@deepseek-ai/dsh-client-modules')!
+    const originalStat = await stat(clientPath)
+    onTestFinished(() => utimes(clientPath, originalStat.atime, originalStat.mtime))
+    await utimes(clientPath, originalStat.atime, new Date(originalStat.mtimeMs + 1_000))
    scaffold.ctx.clientModules.rebuilt('@deepseek-ai/dsh-client-modules')
    const failure = page.locator('[data-client-sync-failure]')
    await failure.getByText(/replacing bootstrap module .* requires a page reload/).waitFor()
@@ -0,0 +1,48 @@
+/** The shipped composer preserves drafts when an application Enter chord has extra modifiers. */
+import { chromium, type Page } from 'playwright'
+import { expect, it } from 'vitest'
+import type { SessionEvent } from '@deepseek-ai/dsh-session'
+import { launchWebScaffold, watchConsole } from './scaffold.ts'
+import { connectFreshWorkspace, newEnglishPage, saveFailureShot, writeComposerDraft } from './support.ts'
+
+it('preserves the composer draft and menu for application Enter combinations', async () => {
+  const scaffold = await launchWebScaffold({})
+  const events: SessionEvent[] = []
+  const off = scaffold.ctx.on('session/event', (_session, event) => { events.push(event) })
+  try {
+    const browser = await chromium.launch()
+    let failurePage: Page | undefined
+    try {
+      const page = await newEnglishPage(browser)
+      failurePage = page
+      const tripwire = watchConsole(page)
+      await page.goto(scaffold.authenticatedUrl)
+      await connectFreshWorkspace(page, scaffold.workspaceCwd, 'composer-shortcuts')
+      const input = page.locator('[data-composer-input][contenteditable="true"]').first()
+      for (const draft of ['unsent draft', '/']) {
+        await writeComposerDraft(page, input, draft)
+        const markup = await input.innerHTML()
+        for (const chord of ['Alt+Enter', 'Meta+Alt+Enter', 'Control+Alt+Enter', 'Control+Meta+Enter', 'Meta+Shift+Enter', 'Control+Shift+Enter']) {
+          await input.press(chord)
+          expect(await input.innerHTML(), `${draft}: ${chord}`).toBe(markup)
+        }
+        await input.press('Escape')
+      }
+      await writeComposerDraft(page, input, 'first line')
+      await input.press('Shift+Enter')
+      await page.keyboard.type('second line')
+      expect(await input.innerText()).toBe('first line\nsecond line')
+      expect(events.filter(event => event.type === 'user/message')).toHaveLength(0)
+      expect(tripwire.pageErrors).toEqual([])
+      expect(tripwire.warnings).toEqual([])
+    } catch (error) {
+      if (failurePage !== undefined) await saveFailureShot(failurePage, 'web-e2e-composer-shortcuts')
+      throw error
+    } finally {
+      await browser.close()
+    }
+  } finally {
+    off()
+    await scaffold.close()
+  }
+})
@@ -0,0 +1,89 @@
+/** Real WebSocket loss without replacing Client plugins or navigating the page. */
+import { fileURLToPath } from 'node:url'
+import { readFile } from 'node:fs/promises'
+import { chromium, type WebSocketRoute } from 'playwright'
+import { expect, it, onTestFailed, onTestFinished } from 'vitest'
+import { launchWebScaffold, seedSession, watchConsole } from './scaffold.ts'
+import { newEnglishPage, saveFailureShot, writeComposerDraft } from './support.ts'
+
+it.each([false, true])('retains the mounted application across WebSocket recovery with an active Session: %s', async (activeSession) => {
+  const scaffold = await launchWebScaffold({
+    extraOverlayPath: fileURLToPath(new URL('./pin-browse-picker.overlay.yml', import.meta.url)),
+  })
+  onTestFinished(() => scaffold.close())
+  const title = 'Connection recovery session'
+  const draft = 'Unsent draft retained across connection recovery'
+  if (activeSession) {
+    const workspace = await scaffold.ctx.workspaceRegistry.create(scaffold.workspaceCwd)
+    const seed = fileURLToPath(new URL('../../../snapshots/web/seeded-history/session.v3.jsonl', import.meta.url))
+    const sessionId = await seedSession(scaffold, await readFile(seed, 'utf8'), 'connection-recovery-session')
+    await workspace.attachSession(sessionId)
+    await scaffold.ctx.sessionController.rename({ sessionId, title })
+  }
+  const browser = await chromium.launch()
+  onTestFinished(() => browser.close())
+  const page = await newEnglishPage(browser)
+  const console = watchConsole(page)
+  onTestFailed(() => saveFailureShot(page, 'web-e2e-connection-recovery'))
+  const sockets: { client: WebSocketRoute; server: WebSocketRoute }[] = []
+  let readyFrames = 0
+  let sessionBaselines = 0
+  await page.routeWebSocket('**/api/remote.mux', (client) => {
+    const server = client.connectToServer()
+    sockets.push({ client, server })
+    const endpoints = new Map<string, string>()
+    client.onMessage((message) => {
+      if (typeof message === 'string') {
+        const frame = JSON.parse(message) as { type?: string; streamId: string; endpoint: string }
+        if (frame.type === 'open') endpoints.set(frame.streamId, frame.endpoint)
+      }
+      server.send(message)
+    })
+    server.onMessage((message) => {
+      if (typeof message === 'string') {
+        const frame = JSON.parse(message) as { type?: string; streamId: string; value?: { type?: string } }
+        if (frame.type === 'item' && frame.value?.type === 'ready') readyFrames++
+        if (frame.type === 'item' && endpoints.get(frame.streamId) === 'session/follow'
+          && frame.value?.type === 'snapshot') sessionBaselines++
+      }
+      client.send(message)
+    })
+  })
+  await page.goto(scaffold.authenticatedUrl, { waitUntil: 'load' })
+  const composer = page.locator('[data-composer-input][contenteditable="true"]')
+  if (activeSession) {
+    await page.getByRole('treeitem').filter({ has: page.getByText(title, { exact: true }) }).click({ timeout: 20_000 })
+    await writeComposerDraft(page, composer, draft)
+    await expect.poll(() => sessionBaselines).toBeGreaterThan(0)
+  } else {
+    await page.getByText('Into the Unknown', { exact: true }).waitFor({ timeout: 20_000 })
+  }
+  await expect.poll(() => readyFrames).toBeGreaterThan(0)
+  const root = await page.locator('[data-slot="root"]').elementHandle()
+  expect(root).not.toBeNull()
+  let navigations = 0
+  page.on('framenavigated', () => { navigations++ })
+
+  for (let attempt = 0; attempt < 3; attempt++) {
+    const previousReady = readyFrames
+    const previousBaseline = sessionBaselines
+    const active = sockets.at(-1)!
+    await Promise.all([
+      active.client.close({ code: 1012, reason: 'test connection loss' }),
+      active.server.close({ code: 1012, reason: 'test connection loss' }),
+    ])
+    await expect.poll(() => readyFrames, { timeout: 20_000 }).toBeGreaterThan(previousReady)
+    if (activeSession) {
+      await expect.poll(() => sessionBaselines, { timeout: 20_000 }).toBeGreaterThan(previousBaseline)
+    }
+    await page.evaluate(() => new Promise<void>((resolve) => {
+      requestAnimationFrame(() => { requestAnimationFrame(() => { resolve() }) })
+    }))
+    expect(await root!.evaluate(element => element.isConnected)).toBe(true)
+    expect(console.pageErrors).toEqual([])
+    if (activeSession) expect(await composer.textContent()).toBe(draft)
+  }
+
+  expect(navigations).toBe(0)
+  if (!activeSession) expect(await page.getByText('Into the Unknown', { exact: true }).isVisible()).toBe(true)
+})
@@ -10,6 +10,7 @@ import { afterAll, beforeAll, describe, expect, it, onTestFailed, vi } from 'vit
 import { createLaunchEnvironmentSnapshot } from '@deepseek-ai/dsh-launch-environment'
 import { realOfficeBytes } from './office-fixture.ts'
 import { excelFixture, excelHtmlFixture, excelHtmlText, meetingMinutesFixture } from '../../../packages/client/ui-sidebar-documentpreview/tests/excel-fixture.ts'
+import { excelDrawingFixture } from '../../../packages/client/ui-sidebar-documentpreview/tests/excel-drawing-fixture.ts'
 import { xlsFixture } from '../../../packages/client/ui-sidebar-documentpreview/tests/xls-fixture.ts'
 import { pdfFixture, selectionPdfFixture } from '../../../packages/client/ui-sidebar-documentpreview/tests/pdf-fixture.ts'
 import { assertFixtureInventory, compareOrRefreshGolden, launchWebScaffold, watchConsole, webSnapshotMode, type WebScaffold } from './scaffold.ts'
@@ -266,6 +267,7 @@ else process.exit(1);
      ...[90, 180, 270].map(rotation => writeFile(join(cwd, `rotated-${rotation}.pdf`), pdfFixture(4, rotation))),
      writeFile(join(cwd, 'selection.pdf'), selectionPdfFixture()),
      writeFile(join(cwd, 'budget.xlsx'), await excelFixture()),
+      writeFile(join(cwd, 'chart-budget.xlsx'), await excelDrawingFixture()),
      writeFile(join(cwd, 'meeting.xlsx'), await meetingMinutesFixture()),
      writeFile(join(cwd, 'literal-html.xlsx'), await excelHtmlFixture()),
      writeFile(join(cwd, 'budget.xls'), xlsFixture()),
@@ -856,8 +858,19 @@ else process.exit(1);
    await page.keyboard.press('ControlOrMeta+C')
    await expect.poll(() => page.evaluate(() => navigator.clipboard.readText())).toBe('42\n')
    await successShot(page, 'excel-cached-formula')
+    await openFile('chart-budget.xlsx')
+    await sheetTabs.getByText('季度预算', { exact: true }).waitFor({ state: 'visible' })
+    const unsupportedNotice = excel.locator('[data-excel-unsupported-notice]')
+    const chartNotice = await unsupportedNotice.innerText()
+    expect(chartNotice).toBe('This preview does not support charts, conditional formatting in this workbook. Open it in a system application for the full experience.')
+    await sheetOverlay.click({ position: { x: 500, y: 110 } })
+    await expect.poll(() => formulaInput.innerText()).toBe('=C3/B3')
+    await page.keyboard.press('ControlOrMeta+C')
+    await expect.poll(() => page.evaluate(() => navigator.clipboard.readText())).toBe('80.0%\n')
+    await successShot(page, 'excel-chart-notice')
    await openFile('meeting.xlsx')
    await sheetTabs.getByText('会议信息', { exact: true }).waitFor({ state: 'visible' })
+    expect(await unsupportedNotice.count()).toBe(0)
    expect(await excel.getByText('Read-only preview', { exact: false }).count()).toBe(0)
    expect(await excel.getByText('Some formulas have no saved result', { exact: false }).count()).toBe(0)
    const formulaWarning = excel.locator('[data-excel-formula-warning]')
@@ -903,6 +916,8 @@ else process.exit(1);
      '- Opens without the Office conversion service',
      '- Sheets: 季度预算 | 公式与格式; hidden worksheet omitted',
      '- Formula workbooks use a compact warning beside fx; notice rows absent',
+      `- Unsupported XLSX content: ${chartNotice}`,
+      '- Drawing parts omitted; styled cells and cached formulas retained; notice cleared on file replacement',
      '- Formatted percent copied: 80.0%; date copied: 2026-09-16',
      '- Cached XLOOKUP result copied: 42; typing leaves it unchanged',
      '- Formula bar is read-only; PDF body and editing toolbar absent',
@@ -7,7 +7,9 @@
    - tab "Trajectory"
 - text: "Assemble the link gallery: write the report and styles, inspect the sources, and summarize. {{clock}}"
 - button "Copy"
- button "16 tool calls" [expanded]
+- status: Worked
+- button "Took {{duration}}" [expanded]
+- button "Edited files, called tools, searched code, etc." [expanded]
 - button "Write site/report.html +1 -0":
  - text: Write
  - button "site/report.html"
@@ -11,8 +11,9 @@
  - button "Jump to turn 3"
 - text: "Use only Cordis tools. First call cordis_inspect_self with no arguments. Then call cordis_define with plugin kind \"new\", idPrefix \"snap\", name \"snapshot noop\", purpose \"does nothing, for the snapshot\", code.host exactly \"return { name: \\\"snapshot-noop\\\", apply(ctx) {} }\" and code.client exactly \"return { inject: [\\\"slots\\\"], apply(ctx) { ctx.slots.register({ name: \\\"shell.overlay\\\", id: \\\"snapshot-probe\\\" }, () => React.createElement(\\\"div\\\", { \\\"data-snapshot-probe\\\": \\\"loaded\\\" })) } }\". Read its returned pluginId and packageId, then call cordis_run with those exact IDs and mode \"run\". After the run request returns, reply exactly CORDIS_UI_READY and stop. 9/1 {{clock}}"
 - button "Copy"
- button "3 tool calls" [expanded]
- button "Context injection runtime-context"
+- status: Worked
+- button "Took {{duration}}" [expanded]
+- button "Called tools" [expanded]
 - button "Think"
 - button "Inspect plugins 0 dynamic plugins"
 - button "Think"
@@ -37,7 +38,11 @@
 - button "Bad response"
 - button "Branch into a new conversation"
 - text: 9/1 {{clock}}
- button "Thought for a while"
+- button "Plugin status updated 9/1 {{clock}}":
+  - text: Plugin status updated
+  - time: 9/1 {{clock}}
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: The Cordis Plugin is running.
 - button "Copy"
 - button "Good response"
@@ -45,7 +50,9 @@
 - button "Branch into a new conversation"
 - text: 9/1 {{clock}} Use only Cordis tools. Call cordis_stop with pluginId "snap-1". After it succeeds, reply exactly CORDIS_UI_DONE and stop. 9/1 {{clock}}
 - button "Copy"
- button "1 tool call" [expanded]
+- status: Worked
+- button "Took {{duration}}" [expanded]
+- button "Called tools" [expanded]
 - text: Stop Cordis Plugin snap-1
 - button "Inspect"
 - text: Dynamic Plugin snap-1 is stopped; its definition and versions remain.
@@ -24,6 +24,9 @@
  - button "详细"
  - text: 开发者工具 显示用于调试和排查问题的工具与信息
  - switch "开发者工具" [checked]
+  - text: 快捷键
+  - paragraph: 查看当前可用的快捷键和输入操作
+  - button "查看快捷键"
  - text: 繁忙时的发送行为 智能体运行时 Enter 键和发送按钮的行为；Cmd/Ctrl+Enter 使用另一行为
  - button "排队发送"
  - text: 当前版本：{{version}}
@@ -24,6 +24,9 @@
  - button "Detailed"
  - text: Developer tools Show tools and information for debugging and troubleshooting
  - switch "Developer tools" [checked]
+  - text: Keyboard shortcuts
+  - paragraph: Browse available shortcuts and input actions
+  - button "View shortcuts"
  - text: Send behavior while busy What Enter and the Send button do while the agent is running; Cmd/Ctrl+Enter uses the other behavior
  - button "Queue"
  - text: "Current version: {{version}}"
@@ -1,13 +1,11 @@
 - text: "Use the read tool twice in one assistant message: read a.txt and b.txt. Then reply with the single word DONE and stop. {{clock}}"
 - button "Copy"
- button "Think"
- text: Failed
- 'button "Read The history inherited by this branch records this tool call starting but does not include its result. The parent session may have completed it after the fork point. Decide whether to retry from the tool semantics: retry only if the operation is read-only or idempotent; if it may have side effects, first verify external state or ask the user. Do not retry blindly."'
- text: Failed
- 'button "Tool call The history inherited by this branch has no record of this tool call starting. The parent session may have executed it after the fork point. Decide whether to retry from the tool semantics: retry only if the operation is read-only or idempotent; if it may have side effects, first verify external state or ask the user. Do not retry blindly."'
+- status: Worked
+- button "Took {{duration}}"
 - text: FORK_BRANCH_USER Summarize what this branch knows about the reads. {{clock}}
 - button "Copy"
- button "Thought for a while"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: FORK_BRANCH_FIRST this branch has no read results, so I would check what the parent completed before retrying. FORK_BRANCH_DONE.
 - button "Copy"
 - button "Good response"
@@ -16,9 +16,11 @@
  - tablist:
    - tab "Chat" [selected]
    - tab "Trajectory"
- button "Thought for a while" [expanded]
- button "Context injection webhook github webhook handled by review-pr-when-ready"
- button "Context injection runtime-context"
+- button "GitHub event received {{clock}}":
+  - text: GitHub event received
+  - time: {{clock}}
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: "Review complete: no actionable findings."
 - button "Copy"
 - button "Good response"
@@ -16,7 +16,11 @@
  - tablist:
    - tab "Chat" [selected]
    - tab "Trajectory"
- button "Thought for a while"
+- button "GitHub event received {{clock}}":
+  - text: GitHub event received
+  - time: {{clock}}
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: "Review complete: no actionable findings."
 - button "Copy"
 - button "Good response"
@@ -7,6 +7,8 @@
    - tab "Trajectory"
 - text: Render adjacent CJK strong emphasis. {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - heading "CJK strong emphasis" [level=2]
 - paragraph:
  - strong: 注意：
@@ -7,6 +7,8 @@
    - tab "Trajectory"
 - text: Show the Markdown image policy. {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - heading "Markdown images" [level=2]
 - paragraph:
  - img "Remote test image"
@@ -6,6 +6,8 @@
    - tab "Trajectory"
 - text: Show the local preview URL. {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - heading "Inline code links" [level=2]
 - paragraph:
  - text: "Preview:"
@@ -7,6 +7,8 @@
    - tab "Trajectory"
 - text: Render this mathematical proof. {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - heading "Math rendering" [level=2]
 - paragraph:
  - text: Inline dollar
@@ -7,7 +7,8 @@
    - tab "Trajectory"
 - text: Research notes what changed? Referenced session · Research notes {{clock}}
 - button "Copy"
- button "Session recall Research notes"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - textbox "Message or run a task, / commands, @ files or sessions"
 - button "Add files or run commands"
 - 'button "Access mode, current: Workspace Write"': Workspace Write
@@ -24,6 +24,9 @@
  - button "Detailed"
  - text: Developer tools Show tools and information for debugging and troubleshooting
  - switch "Developer tools"
+  - text: Keyboard shortcuts
+  - paragraph: Browse available shortcuts and input actions
+  - button "View shortcuts"
  - text: Send behavior while busy What Enter and the Send button do while the agent is running; Cmd/Ctrl+Enter uses the other behavior
  - button "Queue"
  - text: "Current version: {{version}}"
@@ -24,6 +24,9 @@
  - button "Detailed"
  - text: Developer tools Show tools and information for debugging and troubleshooting
  - switch "Developer tools"
+  - text: Keyboard shortcuts
+  - paragraph: Browse available shortcuts and input actions
+  - button "View shortcuts"
  - text: Send behavior while busy What Enter and the Send button do while the agent is running; Cmd/Ctrl+Enter uses the other behavior
  - button "Queue"
  - text: "Current version: {{version}}"
@@ -24,6 +24,9 @@
  - button "详细"
  - text: 开发者工具 显示用于调试和排查问题的工具与信息
  - switch "开发者工具"
+  - text: 快捷键
+  - paragraph: 查看当前可用的快捷键和输入操作
+  - button "查看快捷键"
  - text: 繁忙时的发送行为 智能体运行时 Enter 键和发送按钮的行为；Cmd/Ctrl+Enter 使用另一行为
  - button "排队发送"
  - text: 当前版本：{{version}}
@@ -0,0 +1,5 @@
+- listitem:
+  - text: New Session
+  - button "Remove shortcut for New Session"
+  - button "Edit shortcut for New Session"
+  - button "New Session A B": A B
@@ -0,0 +1,5 @@
+- group "New Session":
+  - button "Restore default"
+  - button "Remove"
+  - button "Press a shortcut"
+  - text: Already used by “Open reference menu”
@@ -0,0 +1,5 @@
+- listitem:
+  - text: New Session
+  - button "Remove shortcut for New Session"
+  - button "Edit shortcut for New Session"
+  - button "New Session ⌘ C": ⌘ C
@@ -0,0 +1,12 @@
+# Modal layers
+
+{
+  "settingsOnTop": {
+    "focused": "Settings",
+    "foreground": "Settings"
+  },
+  "referenceOnTop": {
+    "focused": "Keyboard shortcuts",
+    "foreground": "Keyboard shortcuts"
+  }
+}
@@ -0,0 +1,4 @@
+- group "New Session":
+  - button "Restore default"
+  - button "Remove"
+  - button "Press a shortcut"
@@ -0,0 +1,5 @@
+- listitem:
+  - text: New Session
+  - button "Remove shortcut for New Session"
+  - button "Edit shortcut for New Session"
+  - button "New Session Ctrl + C": Ctrl + C
@@ -0,0 +1,18 @@
+- tablist:
+  - tab "Browser Close":
+    - text: Browser
+    - button "Close"
+  - tab "Browser Close" [selected]:
+    - text: Browser
+    - button "Close"
+  - button "New tab"
+  - button "Split"
+  - button "Fullscreen"
+  - button "Collapse right sidebar"
+- button "Back" [disabled]
+- button "Forward" [disabled]
+- button "Reload" [disabled]
+- textbox "Enter an HTTP(S) address"
+- button "Open in system browser" [disabled]
+- button "Disable sandbox restrictions"
+- text: Enter an HTTP(S) address to start browsing
@@ -0,0 +1,9 @@
+- tablist:
+  - tab "Start" [selected]
+  - button "Split"
+  - button "Exit fullscreen"
+  - button "Collapse right sidebar"
+- button "Workspace files Browse files in this session's workspace"
+- button "New terminal Run commands in the Session workspace"
+- button "Choose shell"
+- button "Browser Browse web pages"
@@ -0,0 +1,23 @@
+- tablist:
+  - tab "Files Close":
+    - text: Files
+    - button "Close"
+  - tab "bash Close" [selected]:
+    - text: bash
+    - button "Close"
+  - button "New tab"
+  - button "Split" [disabled]
+  - button "Fullscreen"
+  - button "Collapse right sidebar"
+- textbox "Terminal"
+- tablist:
+  - tab "Files Close" [selected]:
+    - text: Files
+    - button "Close"
+  - button "New tab"
+  - button "Split" [disabled]
+- text: {{cwd}}/workspace
+- button "Reload"
+- list:
+  - listitem:
+    - button "t6-refresh.txt"
@@ -0,0 +1,25 @@
+- tablist:
+  - tab "Files Close":
+    - text: Files
+    - button "Close"
+  - tab "bash Close":
+    - text: bash
+    - button "Close"
+  - tab "bash Close" [selected]:
+    - text: bash
+    - button "Close"
+  - button "New tab"
+  - button "Split" [disabled]
+  - button "Exit fullscreen"
+  - button "Collapse right sidebar"
+- textbox "Terminal"
+- tablist:
+  - tab "Files Close" [selected]:
+    - text: Files
+    - button "Close"
+  - button "New tab"
+  - button "Split" [disabled]
+- text: {{cwd}}/workspace
+- button "Reload"
+- list:
+  - listitem: Empty directory
@@ -0,0 +1,2 @@
+- menu:
+  - menuitem "Close"
@@ -0,0 +1 @@
+- alert: This session has no completed turn
@@ -0,0 +1,9 @@
+- text: Workspaces
+- button "Search sessions"
+- textbox "Search session names"
+- button "View options"
+- button "Add workspace"
+- tree "Sessions":
+  - treeitem "Ungrouped" [expanded]
+  - treeitem "T4 source (1) now"
+  - treeitem "T4 source 1min" [selected]
@@ -0,0 +1,132 @@
+- dialog "Keyboard shortcuts":
+  - banner:
+    - heading "Keyboard shortcuts" [level=2]
+    - button "Close keyboard shortcuts"
+  - search "Search shortcuts":
+    - searchbox "Search shortcuts"
+  - region "Application":
+    - list:
+      - listitem:
+        - text: Open keyboard shortcuts
+        - button "Remove shortcut for Open keyboard shortcuts"
+        - button "Edit shortcut for Open keyboard shortcuts"
+        - button "Open keyboard shortcuts ⌘ /": ⌘ /
+      - listitem:
+        - text: Toggle left sidebar
+        - button "Remove shortcut for Toggle left sidebar"
+        - button "Edit shortcut for Toggle left sidebar"
+        - button "Toggle left sidebar ⌥ ⌘ B": ⌥ ⌘ B
+      - listitem:
+        - text: Toggle right sidebar
+        - button "Remove shortcut for Toggle right sidebar"
+        - button "Edit shortcut for Toggle right sidebar"
+        - button "Toggle right sidebar ⇧ ⌘ B": ⇧ ⌘ B
+      - listitem:
+        - text: Split
+        - button "Remove shortcut for Split"
+        - button "Edit shortcut for Split"
+        - button "Split ⌘ \\": ⌘ \
+      - listitem:
+        - text: Toggle panel fullscreen
+        - button "Remove shortcut for Toggle panel fullscreen"
+        - button "Edit shortcut for Toggle panel fullscreen"
+        - button "Toggle panel fullscreen ⌥ ⌘ Enter": ⌥ ⌘ Enter
+      - listitem:
+        - text: Close current page or window
+        - button "Remove shortcut for Close current page or window"
+        - button "Edit shortcut for Close current page or window"
+        - button "Close current page or window ⌥ ⌘ W": ⌥ ⌘ W
+      - listitem:
+        - text: Refresh current page
+        - button "Edit shortcut for Refresh current page"
+        - button "Refresh current page No shortcut": No shortcut
+      - listitem:
+        - text: New Session
+        - button "Remove shortcut for New Session"
+        - button "Edit shortcut for New Session"
+        - button "New Session ⌥ ⌘ N": ⌥ ⌘ N
+      - listitem:
+        - text: Search sessions
+        - button "Remove shortcut for Search sessions"
+        - button "Edit shortcut for Search sessions"
+        - button "Search sessions ⌥ ⌘ K": ⌥ ⌘ K
+      - listitem:
+        - text: Add workspace
+        - button "Remove shortcut for Add workspace"
+        - button "Edit shortcut for Add workspace"
+        - button "Add workspace ⌥ ⌘ O": ⌥ ⌘ O
+      - listitem:
+        - text: Rename session
+        - button "Remove shortcut for Rename session"
+        - button "Edit shortcut for Rename session"
+        - button "Rename session ⇧ ⌘ R": ⇧ ⌘ R
+      - listitem:
+        - text: Fork session
+        - button "Remove shortcut for Fork session"
+        - button "Edit shortcut for Fork session"
+        - button "Fork session ⇧ ⌘ F": ⇧ ⌘ F
+      - listitem:
+        - text: Archive session
+        - button "Remove shortcut for Archive session"
+        - button "Edit shortcut for Archive session"
+        - button "Archive session ⌥ ⌘ A": ⌥ ⌘ A
+      - listitem:
+        - text: Open settings
+        - button "Remove shortcut for Open settings"
+        - button "Edit shortcut for Open settings"
+        - button "Open settings ⌘ ,": ⌘ ,
+      - listitem:
+        - text: Workspace files
+        - button "Remove shortcut for Workspace files"
+        - button "Edit shortcut for Workspace files"
+        - button "Workspace files ⌥ ⌘ P": ⌥ ⌘ P
+      - listitem:
+        - text: New terminal
+        - button "Remove shortcut for New terminal"
+        - button "Edit shortcut for New terminal"
+        - 'button "New terminal ⌃ `"': "⌃ `"
+  - region "Message input":
+    - heading "Message input" [level=3]
+    - list:
+      - listitem:
+        - text: Send message
+        - button "Send message Enter" [disabled]: Enter
+      - listitem:
+        - text: New line
+        - button "New line ⇧ Enter" [disabled]: ⇧ Enter
+      - listitem:
+        - text: Use the complementary Queue / Steer action
+        - button "Use the complementary Queue / Steer action ⌘ Enter" [disabled]: ⌘ Enter
+      - listitem:
+        - text: Open command menu
+        - button "Open command menu /" [disabled]: /
+      - listitem:
+        - text: Open reference menu
+        - button "Open reference menu @" [disabled]: "@"
+      - listitem:
+        - text: Stop generating
+        - button "Stop generating Esc Esc" [disabled]: Esc Esc
+  - region "Menus and dialogs":
+    - heading "Menus and dialogs" [level=3]
+    - list:
+      - listitem:
+        - text: Move menu selection
+        - button "Move menu selection ↑ ↓" [disabled]: ↑ ↓
+      - listitem:
+        - text: Select menu item
+        - button "Select menu item Enter" [disabled]: Enter
+      - listitem:
+        - text: Close menu or top dialog
+        - button "Close menu or top dialog Esc" [disabled]: Esc
+  - region "Approval area":
+    - heading "Approval area" [level=3]
+    - list:
+      - listitem:
+        - text: Allow once
+        - button "Allow once Enter" [disabled]: Enter
+      - listitem:
+        - text: Reject
+        - button "Reject Esc" [disabled]: Esc
+  - contentinfo:
+    - button "Restore all defaults" [disabled]
+    - text: 0 customized
@@ -0,0 +1,5 @@
+- menu:
+  - menuitem "Pin session"
+  - menuitem "Rename"
+  - menuitem "Fork session"
+  - menuitem "Archive session"
@@ -0,0 +1,5 @@
+- group "Toggle left sidebar":
+  - button "Restore default" [disabled]
+  - button "Press a shortcut"
+  - text: Shortcut configuration or available commands changed. Review the latest bindings before saving. Shortcut configuration or available commands changed. Review the latest bindings before saving.
+  - button "I have reviewed the latest configuration"
@@ -0,0 +1 @@
+- alert: Already used by “Open keyboard shortcuts”
@@ -0,0 +1,10 @@
+- dialog "Keyboard shortcuts":
+  - banner:
+    - heading "Keyboard shortcuts" [level=2]
+    - button "Close keyboard shortcuts"
+  - search "Search shortcuts":
+    - searchbox "Search shortcuts": abc
+  - status: No matching shortcuts
+  - contentinfo:
+    - button "Restore all defaults"
+    - text: 1 customized
@@ -0,0 +1,5 @@
+- group "Toggle left sidebar":
+  - button "Restore default"
+  - button "Remove"
+  - button "Press a shortcut"
+  - text: Use Ctrl+/, Ctrl+,, Ctrl+Alt+key, or Ctrl+Shift+key. Combinations with three or four distinct modifiers are also supported. Browser or system shortcuts may not reach the page.
@@ -0,0 +1,6 @@
+- dialog "Restore all default shortcuts?":
+  - heading "Restore all default shortcuts?" [level=2]
+  - button "Close confirmation"
+  - paragraph: Restore the default shortcuts for this platform. All modified or removed shortcuts will be restored. Other platforms are unaffected.
+  - button "Cancel"
+  - button "Restore default"
@@ -0,0 +1 @@
+- alert: Modified
@@ -0,0 +1,133 @@
+- dialog "Keyboard shortcuts":
+  - banner:
+    - heading "Keyboard shortcuts" [level=2]
+    - button "Close keyboard shortcuts"
+  - search "Search shortcuts":
+    - searchbox "Search shortcuts"
+  - region "Application":
+    - list:
+      - listitem:
+        - text: Open keyboard shortcuts
+        - button "Remove shortcut for Open keyboard shortcuts"
+        - button "Edit shortcut for Open keyboard shortcuts"
+        - button "Open keyboard shortcuts Ctrl + /": Ctrl + /
+      - listitem:
+        - text: Toggle left sidebar
+        - button "Remove shortcut for Toggle left sidebar"
+        - button "Edit shortcut for Toggle left sidebar"
+        - button "Toggle left sidebar Ctrl + Alt + B": Ctrl + Alt + B
+      - listitem:
+        - text: Toggle right sidebar
+        - button "Remove shortcut for Toggle right sidebar"
+        - button "Edit shortcut for Toggle right sidebar"
+        - button "Toggle right sidebar Ctrl + Shift + B": Ctrl + Shift + B
+      - listitem:
+        - text: Split
+        - button "Remove shortcut for Split"
+        - button "Edit shortcut for Split"
+        - button "Split Ctrl + \\": Ctrl + \
+      - listitem:
+        - text: Toggle panel fullscreen
+        - button "Remove shortcut for Toggle panel fullscreen"
+        - button "Edit shortcut for Toggle panel fullscreen"
+        - button "Toggle panel fullscreen Ctrl + Alt + Enter": Ctrl + Alt + Enter
+      - listitem:
+        - text: Close current page or window
+        - button "Remove shortcut for Close current page or window"
+        - button "Edit shortcut for Close current page or window"
+        - button "Close current page or window Ctrl + Alt + W": Ctrl + Alt + W
+      - listitem:
+        - text: Refresh current page
+        - button "Remove shortcut for Refresh current page"
+        - button "Edit shortcut for Refresh current page"
+        - button "Refresh current page Ctrl + Alt + R": Ctrl + Alt + R
+      - listitem:
+        - text: New Session
+        - button "Remove shortcut for New Session"
+        - button "Edit shortcut for New Session"
+        - button "New Session Ctrl + Alt + N": Ctrl + Alt + N
+      - listitem:
+        - text: Search sessions
+        - button "Remove shortcut for Search sessions"
+        - button "Edit shortcut for Search sessions"
+        - button "Search sessions Ctrl + Alt + K": Ctrl + Alt + K
+      - listitem:
+        - text: Add workspace
+        - button "Remove shortcut for Add workspace"
+        - button "Edit shortcut for Add workspace"
+        - button "Add workspace Ctrl + Alt + O": Ctrl + Alt + O
+      - listitem:
+        - text: Rename session
+        - button "Remove shortcut for Rename session"
+        - button "Edit shortcut for Rename session"
+        - button "Rename session Ctrl + Shift + R": Ctrl + Shift + R
+      - listitem:
+        - text: Fork session
+        - button "Remove shortcut for Fork session"
+        - button "Edit shortcut for Fork session"
+        - button "Fork session Ctrl + Shift + F": Ctrl + Shift + F
+      - listitem:
+        - text: Archive session
+        - button "Remove shortcut for Archive session"
+        - button "Edit shortcut for Archive session"
+        - button "Archive session Ctrl + Alt + A": Ctrl + Alt + A
+      - listitem:
+        - text: Open settings
+        - button "Remove shortcut for Open settings"
+        - button "Edit shortcut for Open settings"
+        - button "Open settings Ctrl + ,": Ctrl + ,
+      - listitem:
+        - text: Workspace files
+        - button "Remove shortcut for Workspace files"
+        - button "Edit shortcut for Workspace files"
+        - button "Workspace files Ctrl + Alt + P": Ctrl + Alt + P
+      - listitem:
+        - text: New terminal
+        - button "Remove shortcut for New terminal"
+        - button "Edit shortcut for New terminal"
+        - 'button "New terminal Ctrl + `"': "Ctrl + `"
+  - region "Message input":
+    - heading "Message input" [level=3]
+    - list:
+      - listitem:
+        - text: Send message
+        - button "Send message Enter" [disabled]: Enter
+      - listitem:
+        - text: New line
+        - button "New line Shift + Enter" [disabled]: Shift + Enter
+      - listitem:
+        - text: Use the complementary Queue / Steer action
+        - button "Use the complementary Queue / Steer action Ctrl + Enter" [disabled]: Ctrl + Enter
+      - listitem:
+        - text: Open command menu
+        - button "Open command menu /" [disabled]: /
+      - listitem:
+        - text: Open reference menu
+        - button "Open reference menu @" [disabled]: "@"
+      - listitem:
+        - text: Stop generating
+        - button "Stop generating Esc Esc" [disabled]: Esc Esc
+  - region "Menus and dialogs":
+    - heading "Menus and dialogs" [level=3]
+    - list:
+      - listitem:
+        - text: Move menu selection
+        - button "Move menu selection ↑ ↓" [disabled]: ↑ ↓
+      - listitem:
+        - text: Select menu item
+        - button "Select menu item Enter" [disabled]: Enter
+      - listitem:
+        - text: Close menu or top dialog
+        - button "Close menu or top dialog Esc" [disabled]: Esc
+  - region "Approval area":
+    - heading "Approval area" [level=3]
+    - list:
+      - listitem:
+        - text: Allow once
+        - button "Allow once Enter" [disabled]: Enter
+      - listitem:
+        - text: Reject
+        - button "Reject Esc" [disabled]: Esc
+  - contentinfo:
+    - button "Restore all defaults" [disabled]
+    - text: 0 customized
@@ -0,0 +1 @@
+- alert: 已被「快捷键速查」占用
@@ -0,0 +1,10 @@
+- dialog "快捷键":
+  - banner:
+    - heading "快捷键" [level=2]
+    - button "关闭快捷键"
+  - search "搜索快捷键":
+    - searchbox "搜索快捷键": abc
+  - status: 没有匹配的快捷键
+  - contentinfo:
+    - button "恢复全部默认"
+    - text: 1 项已自定义
@@ -0,0 +1,5 @@
+- group "展开／收起左侧栏":
+  - button "恢复默认"
+  - button "移除"
+  - button "按下快捷键"
+  - text: 可设置 Command+/、Command+,、Command+反斜杠、Control+反引号、Command+Option+按键或 Command+Shift+按键。也支持三个或四个不同修饰键的组合。浏览器或系统占用的组合可能无法送达页面。
@@ -0,0 +1,6 @@
+- dialog "恢复全部默认快捷键？":
+  - heading "恢复全部默认快捷键？" [level=2]
+  - button "关闭确认"
+  - paragraph: 将恢复当前平台的默认快捷键。你修改或移除的快捷键都会恢复，其他平台不受影响。
+  - button "取消"
+  - button "恢复默认"
@@ -0,0 +1 @@
+- alert: 已修改
@@ -0,0 +1,132 @@
+- dialog "快捷键":
+  - banner:
+    - heading "快捷键" [level=2]
+    - button "关闭快捷键"
+  - search "搜索快捷键":
+    - searchbox "搜索快捷键"
+  - region "应用操作":
+    - list:
+      - listitem:
+        - text: 快捷键速查
+        - button "移除快捷键速查快捷键"
+        - button "修改快捷键速查快捷键"
+        - button "快捷键速查 ⌘ /": ⌘ /
+      - listitem:
+        - text: 展开／收起左侧栏
+        - button "移除展开／收起左侧栏快捷键"
+        - button "修改展开／收起左侧栏快捷键"
+        - button "展开／收起左侧栏 ⌥ ⌘ B": ⌥ ⌘ B
+      - listitem:
+        - text: 展开／收起右侧栏
+        - button "移除展开／收起右侧栏快捷键"
+        - button "修改展开／收起右侧栏快捷键"
+        - button "展开／收起右侧栏 ⇧ ⌘ B": ⇧ ⌘ B
+      - listitem:
+        - text: 分栏
+        - button "移除分栏快捷键"
+        - button "修改分栏快捷键"
+        - button "分栏 ⌘ \\": ⌘ \
+      - listitem:
+        - text: 面板全屏／退出全屏
+        - button "移除面板全屏／退出全屏快捷键"
+        - button "修改面板全屏／退出全屏快捷键"
+        - button "面板全屏／退出全屏 ⌥ ⌘ Enter": ⌥ ⌘ Enter
+      - listitem:
+        - text: 关闭当前页面／窗口
+        - button "移除关闭当前页面／窗口快捷键"
+        - button "修改关闭当前页面／窗口快捷键"
+        - button "关闭当前页面／窗口 ⌥ ⌘ W": ⌥ ⌘ W
+      - listitem:
+        - text: 刷新当前页面
+        - button "修改刷新当前页面快捷键"
+        - button "刷新当前页面 暂无快捷键": 暂无快捷键
+      - listitem:
+        - text: 新会话
+        - button "移除新会话快捷键"
+        - button "修改新会话快捷键"
+        - button "新会话 ⌥ ⌘ N": ⌥ ⌘ N
+      - listitem:
+        - text: 搜索会话
+        - button "移除搜索会话快捷键"
+        - button "修改搜索会话快捷键"
+        - button "搜索会话 ⌥ ⌘ K": ⌥ ⌘ K
+      - listitem:
+        - text: 添加工作区
+        - button "移除添加工作区快捷键"
+        - button "修改添加工作区快捷键"
+        - button "添加工作区 ⌥ ⌘ O": ⌥ ⌘ O
+      - listitem:
+        - text: 重命名会话
+        - button "移除重命名会话快捷键"
+        - button "修改重命名会话快捷键"
+        - button "重命名会话 ⇧ ⌘ R": ⇧ ⌘ R
+      - listitem:
+        - text: 分叉会话
+        - button "移除分叉会话快捷键"
+        - button "修改分叉会话快捷键"
+        - button "分叉会话 ⇧ ⌘ F": ⇧ ⌘ F
+      - listitem:
+        - text: 归档会话
+        - button "移除归档会话快捷键"
+        - button "修改归档会话快捷键"
+        - button "归档会话 ⌥ ⌘ A": ⌥ ⌘ A
+      - listitem:
+        - text: 打开设置
+        - button "移除打开设置快捷键"
+        - button "修改打开设置快捷键"
+        - button "打开设置 ⌘ ,": ⌘ ,
+      - listitem:
+        - text: 工作区文件
+        - button "移除工作区文件快捷键"
+        - button "修改工作区文件快捷键"
+        - button "工作区文件 ⌥ ⌘ P": ⌥ ⌘ P
+      - listitem:
+        - text: 新建终端
+        - button "移除新建终端快捷键"
+        - button "修改新建终端快捷键"
+        - 'button "新建终端 ⌃ `"': "⌃ `"
+  - region "消息输入":
+    - heading "消息输入" [level=3]
+    - list:
+      - listitem:
+        - text: 发送消息
+        - button "发送消息 Enter" [disabled]: Enter
+      - listitem:
+        - text: 换行
+        - button "换行 ⇧ Enter" [disabled]: ⇧ Enter
+      - listitem:
+        - text: 使用互补的 Queue／Steer 方式
+        - button "使用互补的 Queue／Steer 方式 ⌘ Enter" [disabled]: ⌘ Enter
+      - listitem:
+        - text: 打开命令菜单
+        - button "打开命令菜单 /" [disabled]: /
+      - listitem:
+        - text: 打开引用菜单
+        - button "打开引用菜单 @" [disabled]: "@"
+      - listitem:
+        - text: 停止生成
+        - button "停止生成 Esc Esc" [disabled]: Esc Esc
+  - region "菜单与弹层":
+    - heading "菜单与弹层" [level=3]
+    - list:
+      - listitem:
+        - text: 移动菜单选择
+        - button "移动菜单选择 ↑ ↓" [disabled]: ↑ ↓
+      - listitem:
+        - text: 选择菜单项
+        - button "选择菜单项 Enter" [disabled]: Enter
+      - listitem:
+        - text: 关闭菜单或顶层弹窗
+        - button "关闭菜单或顶层弹窗 Esc" [disabled]: Esc
+  - region "审批区域":
+    - heading "审批区域" [level=3]
+    - list:
+      - listitem:
+        - text: 允许一次
+        - button "允许一次 Enter" [disabled]: Enter
+      - listitem:
+        - text: 拒绝
+        - button "拒绝 Esc" [disabled]: Esc
+  - contentinfo:
+    - button "恢复全部默认" [disabled]
+    - text: 0 项已自定义
@@ -10,9 +10,8 @@
 - button "meeting notes.md"
 - text: and confirm the fixture wiring {{clock}}
 - button "Copy"
- button "Thought for a while" [expanded]
- button "Context injection runtime-context"
- button "Context injection user-invoke-demo"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: USER_INVOKE_REPLY acknowledged; following the injected skill.
 - button "Copy"
 - button "Good response"
@@ -10,7 +10,8 @@
 - button "meeting notes.md"
 - text: and confirm the fixture wiring {{clock}}
 - button "Copy"
- button "Thought for a while"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: USER_INVOKE_REPLY acknowledged; following the injected skill.
 - button "Copy"
 - button "Good response"
@@ -36,6 +36,8 @@
  - button "Jump to turn 28"
 - text: m1 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r1
 - button "Copy"
 - button "Good response"
@@ -43,6 +45,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m2 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r2
 - button "Copy"
 - button "Good response"
@@ -50,6 +54,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m3 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r3
 - button "Copy"
 - button "Good response"
@@ -57,6 +63,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m4 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r4
 - button "Copy"
 - button "Good response"
@@ -64,6 +72,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m5 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r5
 - button "Copy"
 - button "Good response"
@@ -71,6 +81,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m6 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r6
 - button "Copy"
 - button "Good response"
@@ -78,6 +90,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m7 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r7
 - button "Copy"
 - button "Good response"
@@ -85,6 +99,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m8 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r8
 - button "Copy"
 - button "Good response"
@@ -92,6 +108,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m9 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r9
 - button "Copy"
 - button "Good response"
@@ -99,6 +117,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m10 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r10
 - button "Copy"
 - button "Good response"
@@ -106,6 +126,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m11 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r11
 - button "Copy"
 - button "Good response"
@@ -113,6 +135,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m12 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r12
 - button "Copy"
 - button "Good response"
@@ -120,6 +144,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m13 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r13
 - button "Copy"
 - button "Good response"
@@ -127,6 +153,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m14 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r14
 - button "Copy"
 - button "Good response"
@@ -134,6 +162,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m15 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r15
 - button "Copy"
 - button "Good response"
@@ -141,6 +171,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m16 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r16
 - button "Copy"
 - button "Good response"
@@ -148,6 +180,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m17 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r17
 - button "Copy"
 - button "Good response"
@@ -155,6 +189,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m18 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r18
 - button "Copy"
 - button "Good response"
@@ -162,6 +198,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m19 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r19
 - button "Copy"
 - button "Good response"
@@ -169,6 +207,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m20 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r20
 - button "Copy"
 - button "Good response"
@@ -176,6 +216,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m21 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r21
 - button "Copy"
 - button "Good response"
@@ -183,6 +225,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m22 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r22
 - button "Copy"
 - button "Good response"
@@ -190,6 +234,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m23 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r23
 - button "Copy"
 - button "Good response"
@@ -197,6 +243,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m24 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r24
 - button "Copy"
 - button "Good response"
@@ -204,6 +252,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m25 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r25
 - button "Copy"
 - button "Good response"
@@ -211,6 +261,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m26 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r26
 - button "Copy"
 - button "Good response"
@@ -218,6 +270,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m27 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r27
 - button "Copy"
 - button "Good response"
@@ -225,6 +279,8 @@
 - button "Branch into a new conversation"
 - text: 7/25 {{clock}} m28 7/25 {{clock}}
 - button "Copy"
+- status: Worked
+- button "Took {{duration}}" [disabled]
 - paragraph: r28
 - button "Copy"
 - button "Good response"
@@ -8,9 +8,9 @@
    - tab "Trajectory"
 - text: Use the ask_user_question tool to ask me exactly one question with id "checkpoint", question "Ready to continue?", header "Checkpoint", and options labeled "Yes" and "No". After I answer, reply with one short sentence acknowledging my answer and stop. {{clock}}
 - button "Copy"
- button "Context injection runtime-context"
- button "Think"
 - status: Deep diving...
+- button "Deep diving for {{duration}}" [disabled] [expanded]
+- button "Analyzing the request"
 - text: "Interjection: include the word BANANA in your final reply."
 - button "Copy"
 - text: "Interjection: include the word ORANGE in your final reply."
@@ -8,8 +8,9 @@
    - tab "Trajectory"
 - text: Use the ask_user_question tool to ask me exactly one question with id "checkpoint", question "Ready to continue?", header "Checkpoint", and options labeled "Yes" and "No". After I answer, reply with one short sentence acknowledging my answer and stop. {{clock}}
 - button "Copy"
- button "1 tool call" [expanded]
- button "Context injection runtime-context"
+- status: Worked
+- button "Took {{duration}}" [disabled]
+- button "Asked questions" [expanded]
 - button "Think"
 - button "Ask question 1/1 answered"
 - text: "Interjection: include the word BANANA in your final reply. {{clock}}"
@@ -8,7 +8,9 @@
    - tab "Trajectory"
 - text: Use the ask_user_question tool to ask me exactly one question with id "checkpoint", question "Ready to continue?", header "Checkpoint", and options labeled "Yes" and "No". After I answer, reply with one short sentence acknowledging my answer and stop. {{clock}}
 - button "Copy"
- button "1 tool call"
+- status: Worked
+- button "Took {{duration}}" [disabled]
+- button "Asked questions"
 - text: "Interjection: include the word BANANA in your final reply. {{clock}}"
 - button "Copy"
 - text: "Interjection: include the word ORANGE in your final reply. {{clock}}"
				`@@ -0,0 +1 @@`
				`- alert: This session has no completed turn`
				`@@ -0,0 +1 @@`
				`- alert: Already used by “Open keyboard shortcuts”`