@andorra-labs/code 0.0.0-stage → 0.1.4

package/tests/zcode-react-engine-test-plan.md

@@ -0,0 +1,396 @@
+# ZCode engine with the Andorra interface
+
+## Scope and prerequisites
+
+The default inner agent loop now uses the pinned ZCode turn machine, scheduler and compaction mechanisms through Andorra ports. Andorra still owns graph routing, Jev, model/provider selection, approvals, workspace boundaries, tool policy, provider streaming, graph handoff validation, cancellation and run evidence. The change also focuses the advertised Edit contract, moves argument normalization before validation, improves atomic-edit failure feedback, adds a persistent browser tool and transfers compatible skills lazily.
+
+Use a dedicated feature worktree on its feature branch; keep the installed CLI checkout on `main`. Local checks require Node.js >=22.19.0 and npm. No provider account is required for deterministic fake-adapter tests. The real browser fixture additionally needs installed Chrome, Edge or an existing Playwright Chromium executable; no browser download occurs automatically. Windows is the primary local environment; POSIX-specific safety checks require a POSIX runner.
+
+Run these commands separately in the feature worktree:
+
+```powershell
+git branch --show-current
+npm ci
+npm run build
+npm run check
+node --test dist/test/zcode-engine.test.js dist/test/engine-edit-preparation.test.js dist/test/coding-tools.test.js dist/test/runtime-skills.test.js dist/test/runtime-skill-resources.test.js dist/test/decision-preflight-execution.test.js dist/test/browser-session.test.js
+```
+
+A live comparison needs a configured provider account, the original Harness prompt, matched served model/reasoning/context settings, an isolated task workspace and independent final functionality checks. Use `<provider-id>`, `<model-id>` and `<graph-id>` in recorded setup; never include credentials. Preserve the historical trajectories as read-only baseline evidence. Run budgets/graph revision/tool capabilities must be recorded because changing them changes the comparison.
+
+## How to use
+
+1. Build and run the deterministic commands above. Inspect the emitted `agent.session.started` event for `executor: andorra-zcode`, ZCode origin and revision `29628c9acdb81b703bbd4080c207a0e7ce5e276e`.
+2. In a disposable task workspace, start the built CLI from your feature worktree with the platform-specific commands below. Replace all placeholders with your actual paths and configured ids; quote paths so spaces are preserved. Answer Orchestrator intake when requested. Existing graph definitions retain their capabilities; browser access requires `browser: playwright` and an allowed `qa.browser_session` tool. A disabled browser policy remains disabled.
+
+   PowerShell:
+   ```powershell
+   $featureWorktree = '<absolute-feature-worktree-path>'
+   Set-Location -LiteralPath '<absolute-disposable-task-workspace-path>'
+   node (Join-Path $featureWorktree 'dist/src/cli.js') --provider '<provider-id>' --model '<model-id>' --graph '<graph-id>'
+   ```
+
+   POSIX shell:
+   ```sh
+   feature_worktree='<absolute-feature-worktree-path>'
+   cd '<absolute-disposable-task-workspace-path>'
+   node "$feature_worktree/dist/src/cli.js" --provider '<provider-id>' --model '<model-id>' --graph '<graph-id>'
+   ```
+
+3. Ask for the original runnable-app task. Verify the model sees focused Edit inputs (`file_path`, `old_string`, `new_string`, `replace_all`) rather than a prominently advertised batch-patch interface. Existing resumed batch calls remain compatible internally. Mutation success updates the fresh snapshot; do not require redundant Read-back.
+4. Ask to use `zcode:control-browser`, then load it with `Skill {skill: 'zcode:control-browser'}`. For visual UI testing also load `zcode:web-gui-tester`. Skill metadata is listed once per invocation; bodies and relative references are read only on demand. Optional Skill `args` are task reference data, never authority.
+5. Use `qa.browser_session {operation: 'open', url: 'http://127.0.0.1:<port>'}` and save its returned `sessionId`. Every later operation needs that id. Take `snapshot`, derive a selector from observed elements, then `fill {selector, value}`, `click {selector}`, `press {key}`, `scroll {deltaY}` or `wait {selector}`. `wait` allows up to 10 seconds for visibility; `wait {durationMs}` instead pauses for a fixed integer 50-5000 ms (for timers and animations). `click {x,y}` clicks screenshot-observed viewport coordinates instead of a selector (canvas games, unlabelled controls); a click names either a selector or coordinates, never both. Continuous keyboard interaction uses `hold {key, durationMs}` with an integer 50-5000 ms duration; pointer motion uses `move {x,y}` with integer viewport coordinates x=0-1279/y=0-799 grounded in a current screenshot. Take `screenshot` for visual inspection, and `close` when done. Opening another URL creates another isolated session; at most three are supported per agent. Do not guess ids/selectors/coordinates or use arbitrary script injection.
+6. Inspect `/usage`, `/status` and the exact run's JSONL/trajectory evidence. Separate main requests, auxiliary summaries, failed tools and cache usage where reported. Observe first syntax/browser integration timestamps and verify the final application against the original acceptance criteria.
+7. Exercise approval denial and Ctrl+C using disposable fixtures. Exit the CLI, close owned browser sessions, and remove only the disposable task workspace. Restore test-only configuration from its backup. Automated fixtures clean up their temporary state.
+
+## Engine, compaction and edit cases
+
+| ID | Preconditions and exact procedure | Expected observable outcome |
+| --- | --- | --- |
+| ENG01 | Run `zcode-engine.test.js`: first fake response declares 12 Read calls, next completes. | Actual imported ZCode phase machine runs provider -> streaming -> tool execution -> aggregation -> next provider. Scheduler concurrency is 10; committed observations retain declaration order. Session event identifies the new engine. |
+| ENG02 | Schedule Read -> Write -> verification dependencies; submit a circular dependency. | Dependent mutations serialize in order; cycle rejects. Independent read-only work can run concurrently without reordering transcript observations. |
+| ENG03 | Inject steering while a turn is active, and attempt an invalid state-machine transition. | Pending input drains exactly once at a safe turn boundary; invalid phase transition rejects. Existing graph/completion/clarification flows still run through host ports. |
+| ENG04 | Make one parallel tool throw a fatal hook error while another started tool finishes. | Already-started tools drain before loop exit. No success aggregation is committed for the failed batch. Follow-up sequential mutations do not start after a fatal failure. |
+| ENG05 | Run existing provider-continuation, hardened-runtime and completion suites with fake adapters. | Native response state, tool/result pairs, approvals, budgets, completion-repair limits and final response contracts remain intact. Truncated model tool batches are never executed. |
+| ENG06 | Supply 20 complete historical groups to compact selection with two preserved groups. | Retired prefix contains 18 complete groups; newest two remain. Original system/user guidance, clarifications, source contracts and incomplete protocol batches stay protected by Andorra integration. |
+| ENG07 | Exercise token thresholds, exact-prefix/schema usage anchors, low-pressure no-op cleanup and forced pressure. Reuse two call IDs across eight bulky shell batches; also reuse one ID across source reads and shell calls. | No old early character soft-trigger cycle. Measured input only anchors unchanged request prefixes/schemas; changed data falls back conservatively. Eligible older outputs shrink only under pressure, preserving errors/denials/recent/source evidence. Only the oldest three of eight eligible groups shrink; the newest five remain byte-for-byte unchanged, and repeating cleanup is a no-op. Source-read protection follows each assistant batch. |
+| ENG08 | Retired prefix contains syntax failure/no changes; retained evidence contains applied Edit and successful syntax/browser check. | Auxiliary checkpoint request receives bounded newer evidence and supersession guidance. Private reasoning stays absent. Inspect live generated summaries separately for model adherence. |
+| ENG09 | Return empty/truncated/oversized/tool-calling/filtered summaries; fail provider or cancel during batching. | Bounded recovery never installs a partial draft or discards history. Pinned/oversized context stops safely with actionable reason. Resume retains completed work and obtains fresh recovery allowance. |
+| ENG10 | Run `context-budget.test.js` with 2000 short assistant/tool exchanges, long call ids and no usage anchor. Repeat with exact measured usage and then changed schemas; grow native image bytes. | The serialized protocol floor includes roles, envelopes and ids, crossing compaction pressure for a 128000-token context. An unchanged measured prefix remains exact without duplicate overhead; changed schemas restore conservative estimation. Image bytes never count as text; each image retains its separate allowance. |
+| ENG11 | Run the 129-step payload-retirement fixture in `zcode-engine.test.js`, alternating tool and no-tool continuations before terminal completion. | After each successful host commit, the phase machine releases its request, streamed text, calls, results and schedule. Lifecycle identity, transitions, pending steering and final response remain correct; no lifetime iteration limit is added. |
+| EDIT01 | Run `engine-edit-preparation.test.js` with JSON-string batch and legacy single-object calls. | Arguments normalize before schema validation and policy hooks. Model sees the focused single-replacement contract; internally accepted legacy batches preserve compatibility. Unknown fields, malformed JSON and invalid values reject before mutation. |
+| EDIT02 | Run the reproduced 16-valid-plus-one-fabricated batch fixture in `coding-tools.test.js`. | All changes are canceled atomically; original bytes unchanged. Error says nothing was applied, supplies bounded actual source/Read guidance, and does not echo a large replacement payload. Model should reread the relevant range rather than resend unchanged speculative patches. |
+| EDIT03 | Test CRLF/LF matching, stale external edits, changed file during approval, denied approval and workspace/symlink escape. | Existing conservative matching/freshness/boundary checks hold. Bytes outside the successful replacement remain unchanged; failed writes have no mutation side effects. |
+| EDIT04 | Run large-file suite: >300 KiB generated HTML tail edit; exact 8 MiB UTF-8 Write; one-byte oversized expansion through Write/Edit/replace_all. | Native edits succeed within bound; BOM/newline/mode and unrelated bytes preserved. Oversized mutation rejects before creating files/directories. Observation/search budgets remain separate from repair capacity. |
+| EDIT05 | Inspect PowerShell description and run the bounded foreground-pipeline fixture documented in migration diagnosis. | Guidance warns against `Select-Object -First` terminating a live child pipeline. Host retains bounded tail output. A pipeline failure is not misreported as proof of application failure. |
+
+## Skill cases
+
+| ID | Preconditions and steps | Expected observable outcome |
+| --- | --- | --- |
+| SK01 | Run `runtime-skills.test.js`; inspect discovery metadata before calling Skill. | Metadata contains project ids plus `zcode:ai-elements`, browser references and unavailable dynamic-workflow entry, without full bodies. Canonical Skill loads on demand; hidden `load_project_skill` compatibility remains callable. Legacy `{name}` input normalizes to `{skill}`. |
+| SK02 | Load `zcode:ai-elements` with optional string args; read `references/artifact.md` with `read_skill_resource` using the returned skill id. | Source/id/catalog-relative base-directory metadata accompanies bundled content; the absolute CLI installation path is absent from provider-facing output. Relative resources stay within the registered skill and load lazily. Args up to 4000 characters remain untrusted data; invalid types/oversized args reject. No installation or script execution is granted by loading. |
+| SK03 | Create project `.agents/skills/ai-elements/SKILL.md`, then request unqualified and qualified names. | Unqualified collision rejects with namespace guidance; project `agents_ai-elements` and bundled `zcode:ai-elements` remain distinct. With an external registry, exact external `ai-elements` delegates through that registry for both Skill and read_skill_resource; use canonical runtime IDs because aliases cannot be proven collision-free. Without an external registry, non-colliding aliases remain usable. Invented names reject. |
+| SK04 | Disable graph browser capability; request web GUI/control-browser skill. Request `zcode:dynamic-workflows` under any graph. | Browser-dependent references are unavailable when tool permission is absent. Dynamic workflow entry explicitly requires unsupported CreateWorkflow/AmendWorkflow/SaveWorkflow/EvalWorkflowSnippet; no phantom tool is advertised as usable. Andorra graph routing is not substituted for that compiler. |
+| SK05 | Try `../` resource traversal, absolute path, symlink, malformed UTF-8, project resources >100000 bytes, bundled resources >262144 bytes and pre-cancellation. | Resource read rejects safely. No outside content is returned; cancellation is honored. Project skill discovery remains bounded and does not alter global installed skills. |
+| SK06 | Run `bundled-skill-provenance.test.js`, the packaged-assets hash test, and inspect package contents. In disposable fixtures add an unlisted hidden asset, change an adapted asset, remove a listed asset, duplicate an entry, or use a traversal path. | Mandatory asset packaging verifies the exact inventory and source/adaptation SHA-256 values before copying any assets, including when `npm pack` runs without tests. Each invalid fixture fails without replacing previous output. `dist/src/skills/bundled` and `dist/vendor/zcode` ship with notices/license. Frontend transfer includes Apache-2.0 AI Elements; React Best Practices is excluded because the pinned upstream notice identifies missing original MIT notice provenance. |
+| SK07 | Run decision-preflight skill cases with selected, explicit, uncertain and failed routing decisions; include tight context budgets. | Bodies never eagerly enter the task/system prompt. Bounded metadata and canonical Skill remain accessible when permitted. Skills cannot override published-plan requirements, user instructions, graph capabilities or approval policy. |
+| SK08 | Configure only `qa.browser_session` with browser enabled and filesystem/shell disabled; place private project skills in the workspace. | Bundled browser references can load, but project skills are neither discovered nor read. No Read/Glob/Grep capability is granted. Disabled browser-only agents receive no browser skill access. |
+| SK09 | Run the manifested-resource regression in `runtime-skills.test.js`; read all available bundled entries, including `scripts/image.tsx` and `scripts/chain-of-thought.tsx`. | Short unpaged resources return plain text. Larger resources return JSON containing content, offset, totalChars and nextOffset; continue with nextOffset until null and concatenate content to recover the exact source. UTF-16 offset is a nonnegative safe integer; limit is 1-20000. Every serialized page stays at or below 23000 characters, including escaped control characters. Invalid ranges reject; EOF returns empty content with null nextOffset. Each resource is reachable in full within the separate 256 KiB bundled limit. Intentionally unavailable skills remain blocked; project limits and provenance are unchanged. |
+| SK10 | Put a uniquely named skill under `.agents/skills/`; run actual agent requests with no decision manager, disabled decisions and `features.toolRouting: false`. Repeat with routing enabled, and with a browser-capable agent while routing is disabled. | Disabled project routing performs no project-skill discovery and exposes no project metadata or bodies. A filesystem-only agent adds no runtime Skill schemas through this path. Enabled routing discovers the project metadata lazily. Compatible bundled browser references remain available through browser capability without exposing project skills. |
+| SK11 | Run selected-skill preflight regressions with a confident available `skill_role`, `none`, uncertainty, and a full catalog larger than the remaining skill context budget. | A confident available selection supplies the exact Skill identifier and a loading instruction within budget before any optional catalog. None/uncertain decisions do not invent a selection. Bodies stay lazy, and routing opt-outs and capability filtering remain effective. |
+
+## Browser and image cases
+
+`test/browser-session.test.ts` serves a disposable local HTML page with input `#name`, button `#add` and counter `#count`. The real browser test opens it, fills `persisted`, clicks Add, verifies DOM state and screenshot projection, checks ownership, then disposes the session and server.
+
+| ID | Preconditions and exact procedure | Expected observable outcome |
+| --- | --- | --- |
+| BR01 | Run the real browser fixture with an installed browser; open local page, snapshot, fill observed `#name`, click observed `#add`. | Same session retains input `persisted`; DOM count becomes 1. Current page text/elements and errors are bounded. No generated Python/Playwright probe or arbitrary JS tool input is needed. |
+| BR02 | Submit the real session id from a different agent owner; open four sessions without closing; then close one. | Foreign owner rejects; maximum three owned sessions enforced. Closing permits a replacement session. Parallel agents cannot operate each other's sessions. |
+| BR03 | Open `file:///...`, credential-bearing URL or denied HTTP target. Submit missing/invalid operation fields. | Unsupported/unsafe URLs and malformed input reject before launch/action; denied approval causes no browser launch. Existing browser-disabled graph strips the tool. |
+| BR04 | Screenshot the fixture; inspect `resultImages` and provider body adapters. | JPEG image <=512 KiB appears as native image content, never base64 in text/events. Projection is consumed once. OpenAI/Anthropic and Codex requests retain actual image input; unsupported provider behavior must be reported explicitly. Wire-image unit checks do not establish a live provider's visual comprehension. |
+| BR05 | Accumulate screenshots over more than five tool turns; inspect continuation and telemetry. Run the trajectory screenshot/privacy fixture. | Old image payloads prune to the bounded five-turn history policy; current screenshots remain visible. Reuse the same call IDs across 100 turns with two screenshots per turn: only the newest five tool batches retain images. Orphan observations cannot borrow later IDs; repeated pruning is idempotent and a zero-turn allowance removes all images. Persisted `agent.context.images_pruned` retains its numeric `data.images` count. Event persistence and textual tool observations do not contain base64 image data. |
+| BR06 | Cancel a pending action or finish/fail the agent invocation. Run the deferred-launch and deferred-page-creation fixtures, abort before each settles, then settle with either a resource or an error. Stall snapshot evaluation during both open and a later snapshot, then cancel or advance the fake clock ten seconds while browser cleanup also remains pending. | Cancellation returns before launch settles, does not try another browser channel, and closes any browser arriving later without opening a page. Page creation also has an independent ten-second deadline without cancellation: fake time 9999 ms remains pending and 10000 ms rejects. Cancellation/deadline closes the browser, cleans up a late page without awaiting stalled/rejected closes and never registers/navigates an expired page. Late rejection is owned; retrying with the same non-aborted signal succeeds and clears the deadline. Snapshot evaluation rejects within its ten-second observation deadline or on cancellation, invalidates the session immediately, and does not wait for stalled cleanup. Late observations are ignored. Owned sessions close through cleanup; unrelated sessions/processes survive. Subsequent use of disposed ids rejects. No automatic browser download or personal authenticated profile access occurs. |
+| BR07 | Load web-gui-tester, take both snapshot and screenshot after each meaningful GUI state change. | Formal black-box checks use observed selectors and screenshots actually viewed. Unsupported operations and broken paths are reported, not bypassed through JS/storage/HTTP injection. A saved image path alone is not visual verification. |
+| BR08 | In a disposable flight/control fixture, use `hold {key: 'w', durationMs: 500}`, observe movement, then cancel a hold. Submit duration 49/5001/noninteger. Move to current screenshot-grounded x/y; submit x=-1/1280 or y=-1/800. | Valid bounded hold/move executes through typed GUI operations; key is released even on cancellation. Invalid durations/coordinates reject before interaction. No generated shell probe is required for continuous movement. Drag, upload and arbitrary JavaScript remain unsupported. |
+| BR09 | Save a graph whose tools explicitly include `qa.browser_session`; inspect authenticated editor bootstrap and role tool options with shell disabled. Toggle parent/child browser capabilities off. Test omitted and explicit `shared-read-only` workspace policies, inherited and explicit role tool lists, and YOLO execution. | Tool name is registered and graph save validates. Bootstrap reports implemented browser support and lists the tool. Browser permission alone gates it; disabled parent/child and default read-only child do not inherit access. Validation rejects an explicitly listed child browser tool without a capability grant; runtime filters it from inherited tools even in YOLO mode. An explicit child browser capability remains available within the parent's ceiling. |
+| BR10 | Run held-key cancellation fixtures: cancel during keydown, the duration wait, and key release. Inject key-release failure with an open or already closed page. Stall keydown or key release and browser close. Without cancellation, advance the fake clock to 9999 ms then 10000 ms from hold start. Separately cancel, then advance 249 ms followed by 1 ms; settle the stalled keyboard operation with success or failure afterward. Complete a successful hold, then advance past the old deadline and abort its former invocation signal. | Responsive key release finishes before cancellation closes the browser. Open-page release failures remain visible; only already-closed-page failures are tolerated. A stalled keyboard operation gets at most 250 ms after cancellation before rejection with the cancellation reason, immediate session invalidation and detached close. Late settlement is handled without publishing another observation. The complete focus/down/duration/up sequence also rejects at its independent ten-second deadline without a run wall-time limit or abort signal. Timed-out sessions cannot be reused and publish no late observation; successful holds clear both timers and their cancellation listener. Canceled sessions cannot be reused. Physical termination of an unresponsive transport remains unverified. |
+| BR11 | Run the trajectory browser-fill and snapshot regressions using values absent from configured/environment secrets, including `xy` and JSON-escaped input. Inspect response calls, tool-start/completion events and later provider-request tool observations in JSONL, including observations without their original call history and JSON snapshot strings nested inside compaction `retiredMessages`/`latestRetainedEvidence` payloads. | Persisted fill arguments are redacted and snapshot copies retain only session identity, observation kind, element/error counts and a `[REDACTED]` page-content marker. All page-derived fields are omitted, including reflected inputs in text/title/URL/errors/element labels and selectors, unknown fields and encoded variants. The live tool inputs, snapshots and provider messages remain unchanged. Repeat without fill history and inside nested compaction payloads; page-content omission must still apply. Malformed identified browser observations fail closed. Nested and array-held browser argument `value` fields (including encoded JSON in unsupported fields) are redacted before schema validation in raw event JSONL and trajectory response/history/compaction copies. CSS attribute selectors remain visible; live arguments stay exact and unrelated tool arguments retain their `value` fields. Malformed browser argument JSON and excessive structure/encoding depth fail closed. Ordinary diagnostic `value` keys remain visible. Submit thousands of nested object/array containers directly and as JSON strings, then write another model/runtime record: only the over-deep branch is replaced and trajectory recording remains available. |
+| BR12 | Run screenshot retention fixtures with more than ten concurrent browser owners and blocked completion-event publication. Also claim every screenshot immediately, exhaust the shared agent batch count/byte allowance across multiple sessions, close/reopen a session, then advance to another model tool batch. | Each successful owning result receives its exact native image once despite delayed publication. Unconsumed images are never evicted by another owner; capacity exhaustion reports an explicit error. Claiming images and closing/reopening sessions do not reset the shared ten-image/2 MiB batch allowance. A new model tool batch renews the allowance, while disposal clears pending bytes. Embedders without a batch marker retain a per-owner lifetime allowance until disposal. Public events contain no image bytes. |
+| BR13 | Run `decision-preflight-execution.test.js` with active hosted routing: `needs_external_docs: false`, `tool_family_browser: true`, and browser capability enabled. Repeat with the browser family explicitly disabled. | The first model request includes `qa.browser_session` for local GUI work while external web lookup is omitted. Explicit browser-family denial still removes the tool; capability filtering remains authoritative. |
+| BR14 | Load `zcode:web-gui-tester` and test a transient through separate snapshot/screenshot/action/optional observed-selector wait/screenshot calls on the same session. | Guidance matches the single-operation schema without scripts or parallel dependent actions. A missed transient screenshot is reported as incomplete visual evidence, separately from observed DOM feedback and stable-state results; it does not establish an application failure or visual pass. Live transient timing remains manual QA. |
+| BR15 | Run the real browser snapshot-bounds fixture with oversized element/ancestor IDs and JSON-escaping-heavy page data. Use the returned selectors to operate the fixture controls. | IDs are bounded before CSS escaping; individual selectors fit the 1024-character tool limit. The complete serialized observation is bounded inside the page before transfer, remains valid JSON, and selectors identify the intended controls. |
+| BR16 | Run the real browser viewport fixture with 80 controls near the top and another at 1800 px. Snapshot at the top, scroll down using the typed operation, then operate the newly observed later control. | Each snapshot includes only controls intersecting the current viewport; the first 60 document elements no longer crowd out newly visible controls. Offscreen controls are omitted and the later control can be clicked through its observed selector. |
+| BR17 | Run `browser-session-review.test.js` and inspect the raw `.andorracode/runs/fixture.jsonl` fixture, without trajectory sanitation. Approve and deny a browser fill with `fixture-private-fill-token`, which is absent from environment/configured secrets. | Runtime tool-start and approval events redact the fill value before publication; raw run JSONL contains no token. Approved execution and subsequent live provider arguments retain the original value. Denial executes no fill. |
+| BR18 | Run the mocked success, cancellation and 100 ms wall-time fixtures with a browser whose close promise never settles. Retry the retired session ID after each runtime result. | The runtime returns succeeded/cancelled/exhausted respectively, cleanup starts once, and the session is immediately unusable. Browser transport close is detached with rejection ownership; a stalled transport does not delay final budget cleanup. This test establishes logical disposal, not physical termination of an unresponsive browser process. |
+| BR19 | Run the installed-browser form fixture. Fill textarea and password, focus the select and press End, then click checkbox and radio. Inspect returned snapshot and its persisted trajectory copy. | Textarea and select expose live values bounded to 120 characters; select exposes numeric selectedIndex and at most 20 selected options with bounded value/text. Checkbox/radio checked state is observable. Password values are omitted. Persisted snapshots retain only session identity, observation kind, counts and a page-content redaction marker without mutating live observations. Full snapshot remains within 20 KiB. |
+| BR20 | Run the trajectory reused-ID fixture: alternate browser and Read calls under the same two IDs across four mixed batches, with reversed observation order. Include orphan diagnostics before the first batch and after a final assistant without calls. Record direct history and actual compaction requests. | Malformed browser observations are redacted only in their own batch; ordinary plain-text results and orphan diagnostics remain exact. The same rules apply in retired and retained compaction evidence. Live messages remain unchanged. |
+| PKG01 | After build, run `npm pack --dry-run --ignore-scripts --json` and inspect its file paths. | `docs/zcode-engine-replay.md`, `scripts/zcode-engine-replay.mjs` and `dist/src/hardened-runtime.js` are included together. Run the shipped script from the package root against a known text-only recording (20-200 responses); built package imports resolve and the documented reproduction entry point exists. |
+
+## Live comparison and acceptance
+
+Offline replay regression command: `node --test dist/test/zcode-engine-replay.test.js` (after building).
+
+| ID | Preconditions and exact procedure | Expected observable outcome |
+| --- | --- | --- |
+| REP01 | Run the interleaved multi-run fixture with reused request/tool ids and a preceding auxiliary-only run. | The first eligible tool-bearing run supplies task, schemas, responses, observations and historical usage. Other runs cannot overwrite evidence or counters. |
+| REP02 | Run the fixture with 10 responses in the selected run and 20 in another run, requesting 20. | Replay fails with insufficient selected-run responses instead of borrowing another run's records. |
+| REP03 | Run the fixture with 20 responses containing three calls each against the built production engine. | All 60 observations execute, 21 main requests finish successfully, and no tool budget exhaustion occurs. These are deterministic correctness checks, not provider efficiency or task-quality measurements. |
+| REP04 | Replay a fixture whose public tool-event output differs from its subsequent model-request tool message. Also try missing or redacted model-visible evidence. | Replay consumes the model-visible message and verifies it at the next provider boundary. Unrecoverable evidence fails explicitly instead of substituting public projections or claiming exact historical replay. |
+| REP05 | Add a tool only to later matching request schemas and call it there; separately call it before it is advertised. | Replay builds its schema union from matching requests, accepts the later advertised tool, and rejects a call absent from its own request. |
+| REP06 | Replay 20 recorded failed calls with their actual model-visible error messages. | All 20 remain failures, and the next model request carries the exact original observation text. Different host diagnostics fail explicitly. |
+| REP07 | Add `[REDACTED:browser-input]` to selected task text, response text, call arguments, tool schema or model-visible observation. | Each replay fails before execution with an explicit sanitized-evidence error and no private payload in the error. Ordinary unsanitized fixtures still pass. |
+| REP08 | Replay 20 selected responses, then append an unselected response reusing the first call ID with the inverse completion status. Repeat with selected success and selected failure, then remove the selected completion event. Add duplicate or conflicting status events to selected and unselected occurrences separately. | Selected success/failure counts and observation hashes remain exact despite later ID reuse. Missing selected status fails explicitly; it cannot borrow the later call's status. Duplicate/conflicting selected statuses reject as ambiguous; unselected duplicates do not invalidate exact selected evidence. |
+| REP09 | Interleave independent agent invocations under one graph run, including different nodes and same-node retries or parallel copies reusing request/tool IDs. Remove invocation identity from selected legacy evidence. | Only one invocation supplies the selected task, schemas, responses, observations, completion statuses and usage. Other invocations cannot overwrite or supplement it. Missing invocation identity fails explicitly instead of claiming matched replay. |
+| REP10 | Run `engine-invocation-identity.test.js`: execute three production runtime invocations under the same graph run/node/subagent, two concurrently and one later, including compaction. Inspect recorded main/auxiliary model contexts and runtime tool events. | Each invocation has a distinct runtime-generated identity; its model requests/responses and completion events carry the same identity. Invocation metadata is host recording context and does not enter provider messages. Private reasoning does not enter persisted records. |
+
+Run the original Harness prompt with matched provider/model/reasoning settings, graph/tool capabilities and acceptance criteria. Record exact branch/head, provider configuration without secrets, model context, operating system and run/trajectory ids. Compare completed artifacts and independently verify primary flows, failure paths and rendered UI before evaluating efficiency.
+
+Collect input/output/cache telemetry, main/auxiliary requests, compaction retries, tool failures by exact reason, repeated reads, first browser boot and total elapsed time. Distinguish absent/stale Edit matches, host argument normalization failures, shell quoting/pipeline failures and real application defects. Compare against the historical ZCode and Andorra trajectories with provenance. A stopped run, a smaller serialized context, fewer tests generated or reduced tool errors alone is not proof of equal-result provider-token savings. The migration passes live performance acceptance only if it completes equivalent results with fewer measured tokens.
+
+## Edge cases and potential bugs
+
+Provider token/context metadata can be absent or inaccurate; fallback budgeting and overflow recovery remain necessary. Compaction is still model-generated and can omit contracts or ignore newer evidence despite correct inputs. Host-transformed tool contexts, opaque reasoning and tool schemas affect pressure. The scheduler must drain fatal/canceled in-flight operations without starting dependent mutations. Resume, clarification and graph retries must not replay completed side effects.
+
+Bundled skills are reference data. Collision handling, registry delegation and path containment must survive malicious project text, swapped symlinks and unavailable capabilities. Script resources require ordinary shell permission before execution. Browser sessions are separate isolated profiles; application authentication/setup may be needed. Offscreen/hidden/duplicate selectors, slow loads, absent installed browsers, unsupported uploads/downloads/gestures and provider image limitations require explicit failed/blocked results. Browser operations are not a replacement for production authorization. Keep screenshot/privacy evidence confined to authorized targets.
+
+## Gaps and limitations
+
+No matched completed provider-backed Harness run has yet established token savings or equivalent quality for this migration. Live provider screenshot understanding, resumed long-run behavior and POSIX-only safety checks remain pending unless separately recorded below. ZCode's desktop browser/plugin host and dynamic workflow compiler were not ported; Andorra supplies a typed browser integration and marks unsupported workflow skills unavailable. No hardware frame-rate claim follows from DOM/browser fixture correctness. Known local failures, skips and remaining gaps must be recorded explicitly rather than treated as passed coverage.
+
+Relative project skill resource reads now require Linux with `/proc/self/fd` and fail explicitly on Windows/macOS; bundled references and the existing project `SKILL.md` entry loader remain available. The pinned-handle protection applies to the new relative resource reader, not to unrelated pre-existing file loaders. macOS rejection follows the same non-Linux guard verified on Windows but was not run on a macOS host.
+
+## Additional review regression cases
+
+| ID | Preconditions and exact procedure | Expected observable outcome |
+| --- | --- | --- |
+| BR20 | Serve a local page with duplicate IDs on interactive controls and their ancestors. Open it with `qa.browser_session`; use each observed selector to fill, click and wait for the intended control. | Every returned selector matches exactly its intended element; duplicate direct and ancestor IDs use bounded structural fallbacks. Unique IDs still use compact selectors. |
+| BR21 | Run the mocked raw-input tests with `mouse.move`, `mouse.wheel` and `keyboard.press` stalled along with browser close. Cancel, or advance the fake clock to ten seconds; then settle the transport late. | Each action rejects promptly on cancellation or by its deadline, invalidates the session and owns late rejection. No late snapshot is published, and reuse of the session rejects. A stalled focus that succeeds after the press deadline must not dispatch a keypress on the retired session. Responsive held-key release remains covered separately by BR10. |
+| BR22 | Open a local page with a document `click`/`auxclick` listener that prints `clientX,clientY`. Call `click {x:690,y:335}`, then `click {x:640,y:700,button:"middle"}`, then `wait {durationMs:5000}`. Also send `click {x:640}`, `click {selector:"#add",x:1,y:1}`, `wait {durationMs:60000}` and `wait {}`. | Both clicks succeed and the page reports `690,335` and `640,700` with button 1 for the middle click; the timed wait returns a snapshot after at least 5 s. The invalid calls fail before any input with `click requires observed viewport coordinates…`, `click takes either a selector or x/y coordinates, not both`, `wait requires integer durationMs between 50 and 5000` and `wait requires a selector or integer durationMs between 50 and 5000`, never the generic `selector must be a nonempty string…` that exhausted run 50ca6b55. The stalled-transport cases of BR21 also cover `mouse.click`. |
+| TR01 | Record formatted JSON tool results and request fields containing exponent/fraction numeric spelling, integer-like keys, escaped strings and nested JSON strings. Include a browser snapshot requiring redaction and an unchanged browser metadata result. | Unchanged JSON strings round-trip byte-for-byte through trajectory persistence; sensitive content still gets recursively sanitized. Duplicate keys, including escaped aliases and overwritten private objects, produce an explicit redaction marker instead of restoring discarded values. Live inputs stay unchanged. Existing replay recovery checks continue to reject redacted evidence. |
+| TR02 | Record a browser fill with a short value, nested/encoded values, and a value that is itself JSON. Echo them in the same response, later ordinary assistant text and a compaction summary after the calls retire. Repeat in an independent trajectory session. | The originating session persists redaction markers for all echoes, including JSON keys and values. Live calls remain exact. The independent session does not inherit the first session's private values. |
+| TR03 | Record a non-browser JSON observation with an ordinary `signature` field, including nested encoded JSON, and pass the persisted trajectory to the replay script. | Sanitized private-named fields leave explicit markers; exact replay rejects the changed evidence. Actual private reasoning remains absent. Unchanged JSON fixtures still retain exact bytes. |
+| SK-RACE01 | On Linux with `/proc/self/fd`, run `node scripts/run-tests.mjs dist/test/runtime-skill-resources.test.js`. The intercepted-open regression replaces a project skill ancestor with an outside symlink during the read; other cases exercise nested resource reads and final symlink rejection. Run the same command on Windows/macOS for rejection coverage. | Reads use held directory handles and never return outside content. Ordinary project reads retain bounds and cancellation; symlinks reject. On Windows/macOS, relative project resource reads reject explicitly before opening a resource. Bundled resources and existing project `SKILL.md` loading remain available. |
+
+## Review privacy regression cases
+
+| ID | Preconditions and steps | Expected observable outcome |
+| --- | --- | --- |
+| BR-PRIV01 | Run `browser-session-privacy.test.js` and `trajectory.test.js`. Emit unsupported `type`, omitted, numeric and `open` operations with `value: "xy"`. | Runtime events and persisted request/response copies redact value before validation; live provider calls retain exact original arguments. Unrelated tools retain ordinary value fields. |
+| BR-PRIV02 | Feed browser results valid JSON lacking elements, containing scalar elements, or extra text on screenshot/close metadata, in requests, compaction and event objects. Mock a page returning these payloads from its overridden serializer. | Correlated persisted observations fail closed, including short values; the live snapshot rejects wrong shapes. A snapshot containing elements keeps live page text but host identity replaces page-provided identity and extra metadata cannot impersonate screenshot/close output. Real screenshot and close metadata remain usable. |
+
+## Validation evidence
+
+PR #98 browser-echo, exact-replay and resource-containment remediation on 2026-10-02: `npm run build`, `npm run check`, replay-script syntax, working-tree whitespace and the complete-range whitespace check against current `origin/main` with the five documented provenance exclusions passed. Windows / Node.js v24.16.0 passed **183/183** focused tests with no failures, cancellations or skips:
+
+```powershell
+node scripts/run-tests.mjs dist/test/browser-session-privacy.test.js dist/test/browser-session-review.test.js dist/test/browser-session.test.js dist/test/trajectory.test.js dist/test/trajectory-nodes.test.js dist/test/hardened-runtime.test.js dist/test/context-compaction.test.js dist/test/engine-provider.test.js dist/test/provider-continuation.test.js dist/test/zcode-engine-replay.test.js dist/test/runtime-skills.test.js
+node scripts/run-tests.mjs dist/test/runtime-skill-resources.test.js
+```
+
+The second command passed **2** Windows resource cases, skipping the **3** Linux-only cases. Running that same resource command under WSL Ubuntu / Linux Node.js v22.22.0 passed **4**, skipping the Windows/non-Linux rejection case. These are overlapping platform checks, not six distinct cases. Linux verified actual pinned-handle ancestor swapping, final/ancestor symlink rejection, bounds, pagination and all manifested bundled resource reconstruction; Windows verified rejection before any filesystem call and bundled resources. The initial combined WSL suite could not import Windows `node-pty`; extracting the pure resource suite removed that unrelated native dependency without installing or changing dependencies.
+
+Trajectory regressions verify same-response and later echoes, short/JSON-shaped inputs, nested arguments, JSON keys, escaped prose/code fences through eight encoding levels, session isolation and unchanged live messages. Actual persisted generic JSON with removed private-named fields is rejected by replay. Installed headless-browser fixtures, private continuation and compaction checks passed. The first focused run was 182/183 because an old assertion expected known browser input to remain in later diagnostic output; it now requires redaction while separately verifying unrelated values and live data. Scoped review caught the escaped-prose case before final validation. Broad baseline tests and live provider quality/token benchmarks were not rerun. GitHub had no Actions runs/checks on the inspected head; local checks do not establish CI success.
+
+PR #98 recursive-argument-privacy and held-key-deadline remediation on 2026-10-02 (Windows, Node.js v24.16.0): final `npm run build`, `npm run check`, working-tree whitespace check and the complete-range check against current `origin/main` with the five documented provenance exclusions passed. The first command passed **120/120**. After correcting CSS attribute-selector telemetry preservation, the four affected suites passed **83/83** again; these counts overlap, with zero failures/cancellations/skips.
+
+```powershell
+node scripts/run-tests.mjs dist/test/browser-session-privacy.test.js dist/test/browser-session-review.test.js dist/test/browser-session.test.js dist/test/trajectory.test.js dist/test/hardened-runtime.test.js dist/test/zcode-engine-replay.test.js
+node scripts/run-tests.mjs dist/test/browser-session-privacy.test.js dist/test/browser-session-review.test.js dist/test/browser-session.test.js dist/test/trajectory.test.js
+```
+
+Regression checks cover nested/array-held/encoded browser argument values before validation in raw event JSONL and trajectory request/response/compaction copies, unchanged live calls and unrelated diagnostics, literal CSS selectors, malformed input and bounded deep/encoded structures. Fake-clock tests verify stalled keydown/keyup rejects at ten seconds without cancellation, late success/failure is owned, session reuse fails, cancellation keeps its 250 ms release grace, and successful holds remove old timers/listeners. Installed headless-browser fixtures passed. Independent scoped review found and corrected the CSS-selector regression before final validation. Logical session disposal is verified; physical termination of an unresponsive browser is not. Broad baseline defects and live provider quality/token benchmarks were not rerun. GitHub reported no check runs/statuses at inspection; local success is not a CI build result.
+
+PR #98 page-creation/privacy/resource-paging remediation on 2026-10-02 (Windows, Node.js v24.16.0): final `npm run build`, `npm run check` and `git diff --check` passed. The first command below passed **145/145**, with zero failures/cancellations/skips. After final snapshot output bounding, the affected four suites in the second command passed **75/75** again; these are overlapping checks, not additional distinct coverage.
+
+```powershell
+node scripts/run-tests.mjs dist/test/browser-session-privacy.test.js dist/test/browser-session-review.test.js dist/test/browser-session.test.js dist/test/trajectory.test.js dist/test/runtime-skills.test.js dist/test/hardened-runtime.test.js dist/test/decision-preflight-execution.test.js dist/test/zcode-engine-replay.test.js
+node scripts/run-tests.mjs dist/test/browser-session-privacy.test.js dist/test/browser-session-review.test.js dist/test/browser-session.test.js dist/test/trajectory.test.js
+```
+
+New deterministic regressions cover independent page-creation deadlines with late settlement/stalled cleanup, pre-validation input privacy, wrong-shaped browser observations in event/request/compaction copies, host-owned snapshot identity and the final 20 KiB bound, exact external skill collisions, and full bundled-resource reconstruction from bounded pages. Existing installed headless browser fixtures passed. Runtime-skill fixtures temporarily add generated resources and clean up afterward. Broad baseline defects and live provider quality/token benchmarks were not rerun; this establishes focused correctness only. GitHub reported no check runs/statuses on the inspected pre-push head, not a successful CI build.
+
+PR #98 JSON-fidelity/selected-skill/browser-input remediation on 2026-10-02 (Windows, Node.js v24.16.0): final `npm run build`, `npm run check`, replay script syntax, working-tree diff check and the explicitly scoped complete-range whitespace check below passed. The final selected suite passed **133/133**, with no failures, cancellations or skips:
+
+```powershell
+node scripts/run-tests.mjs dist/test/trajectory.test.js dist/test/browser-session-review.test.js dist/test/browser-session.test.js dist/test/decision-preflight-execution.test.js dist/test/runtime-skills.test.js dist/test/hardened-runtime.test.js dist/test/zcode-engine-replay.test.js
+```
+
+Regressions cover byte-exact unchanged JSON through provider requests/responses, tool results and compaction, fail-closed duplicate-key payloads, valid confident/none/uncertain skill decisions and actual lazy loading with an oversized catalog, duplicate direct/ancestor IDs in the installed headless browser, and mocked stalled pointer/key transports with cancellation/deadline/late settlement. A separate stalled-focus regression prevents keypress dispatch after the session deadline. Existing snapshot deadlines, held-key release, image privacy, routing opt-outs and exact replay checks also pass. The initial run was 130/132: a stale skill fixture omitted bundled choices and silently fell back, and a new JSON test incorrectly required unchanged fixed system instructions despite ambient secret redaction. Both assertions/fixtures were corrected before the final run; runtime redaction was preserved. The five documented provenance whitespace exceptions remain. Broad baseline tests and live provider quality/token benchmarks were not rerun; no performance claim follows from these checks.
+
+
+PR #98 reflected-input privacy and project-skill opt-out remediation on 2026-10-02 (Windows, Node.js v24.16.0): `npm run build`, `npm run check`, final `npx tsc --pretty false`, working-tree diff check and the explicitly scoped complete-range whitespace check below pass.
+
+```powershell
+node scripts/run-tests.mjs dist/test/trajectory.test.js dist/test/browser-session-review.test.js dist/test/browser-session.test.js dist/test/decision-preflight-execution.test.js dist/test/runtime-skills.test.js dist/test/hardened-runtime.test.js dist/test/zcode-engine-replay.test.js
+node scripts/run-tests.mjs dist/test/browser-session-review.test.js
+```
+
+The initial run passed 114 of 115 checks; the existing real-browser persistence assertion still expected retained element fields. After updating that assertion to the intentional metadata-only persistence contract and recompiling, all six browser-review checks passed with no skips, retaining and extending the live form-state assertions. Together these runs validate all 115 distinct selected checks; counts are not additive. Reflected-input tests cover short/escaped/Unicode/URL-encoded values in every page-derived field and unknown keys, missing fill history, copied/nested compaction snapshots, unchanged live inputs and unrelated tool outputs. Routing tests cover absent/off/shadow/disabled routing, active hosted routing, browser-only bundled availability and unchanged registered plugin resource tools. The real installed-browser form and existing browser fixtures passed. This intentionally makes persisted browser page content unavailable for reconstruction; live observations stay complete. Broad baseline and provider token/quality benchmarks were not rerun.
+
+PR #98 cancellation/invocation remediation and main merge on 2026-10-02 (Windows, Node.js v24.16.0): `npm run build`, `npm run check` and `node --check scripts/zcode-engine-replay.mjs` passed. Main `1343cbe` was merged with the tool-registration conflict resolved by retaining its QA/file permission wrappers and this PR's browser tool. Working diff and the current-main complete range pass whitespace checks with only the five previously documented provenance exclusions.
+
+Core checks passed **153/153**, with no failures, cancellations or skips, using disposable configuration:
+
+```powershell
+node scripts/run-tests.mjs dist/test/browser-session.test.js dist/test/browser-session-review.test.js dist/test/engine-invocation-identity.test.js dist/test/zcode-engine-replay.test.js dist/test/trajectory.test.js dist/test/trajectory-nodes.test.js dist/test/context-compaction.test.js dist/test/context-budget.test.js dist/test/hardened-runtime.test.js dist/test/zcode-engine.test.js dist/test/engine-provider.test.js dist/test/provider-continuation.test.js
+```
+
+This includes the 250 ms stalled-key cancellation boundary with late success/failure, real installed-browser fixtures, exact per-invocation replay, independent concurrent/retry identities, auxiliary compaction attribution and provider/persisted-record privacy. Independent scoped source review found no additional defect. Historical replay and live provider quality/token benchmarks were not rerun; old recordings without invocation identity now fail explicitly.
+
+Merge integration checks passed **75/76**, with one unrelated baseline expectation failure and no cancellations/skips:
+
+```powershell
+node scripts/run-tests.mjs dist/test/engine-edit-preparation.test.js dist/test/coding-tools.test.js dist/test/large-file-tools.test.js dist/test/tools.test.js dist/test/grep-fallback.test.js dist/test/grep-discovery-budget.test.js dist/test/grep-regex-budget.test.js dist/test/permissions-file-grant-provenance.test.js dist/test/permissions-decision-revocation.test.js dist/test/permissions-qa-audit.test.js dist/test/permissions-approval-serialization.test.js dist/test/subagent-worktree-permissions.test.js
+```
+
+`tools.test.ts` case `edit validates uniqueness and detects changes during approval` still expects a 262,145-byte legacy read to reject, although unchanged main `src/tools.ts` already permits 8 MiB. The same assertion failed in an isolated main-source probe at `1343cbe`: the unmodified main tools module and test were transpiled into a temporary directory with relative imports remapped to existing built dependencies. This is source-isolated reproduction, not a full clean baseline build. No branch/worktree or user configuration was changed. The required 8 MiB boundary and separate observation/search budgets pass their dedicated suite; the stale unrelated assertion remains unchanged. The broad baseline suite was not rerun.
+
+PR #98 repeated-call-ID and exact-replay remediation on 2026-10-02 (Windows, Node.js v24.16.0): `npm run build`, `npm run check`, `node --check scripts/zcode-engine-replay.mjs`, working-tree diff check and the explicitly scoped complete-range whitespace check below passed. The following checks passed **122/122**, with no failures, cancellations or skips, using the runner's disposable configuration:
+
+```powershell
+node scripts/run-tests.mjs dist/test/context-budget.test.js dist/test/context-compaction.test.js dist/test/compaction-recovery.test.js dist/test/continuation-state.test.js dist/test/provider-continuation.test.js dist/test/zcode-engine.test.js dist/test/hardened-runtime.test.js dist/test/trajectory.test.js dist/test/zcode-engine-replay.test.js
+```
+
+Regressions verify positional microcompaction with five recent eligible groups retained, per-batch source-read protection, browser/non-browser ID reuse in direct and compaction histories, full redaction-marker rejection across selected replay evidence, inverse statuses on later unselected ID reuse, and explicit rejection of missing or ambiguous selected completion statuses. Live messages, pinned guidance, private continuation and tool protocols remain covered. An initial build found a new test's optional-property narrowing error; it was corrected before the successful build/check and compiled suite above. Independent scoped review was completed. The broad baseline suite, historical comparison and live provider quality/token benchmarks were not rerun; no performance improvement is claimed.
+
+PR #98 observation-deadline/retention/recording/package remediation on 2026-10-02 (Windows, Node.js v24.16.0): `npm run build`, `npm run check`, script syntax check and the explicitly scoped complete-range whitespace check below passed. The following compiled checks passed **129/129**, with no failures, cancellations or skips:
+
+```powershell
+node scripts/run-tests.mjs dist/test/browser-session.test.js dist/test/trajectory.test.js dist/test/context-budget.test.js dist/test/hardened-runtime.test.js dist/test/context-compaction.test.js dist/test/engine-provider.test.js dist/test/provider-continuation.test.js dist/test/zcode-engine-replay.test.js dist/test/bundled-skill-provenance.test.js dist/test/publish-artifacts.test.js
+```
+
+Fake-clock regressions stall evaluation and browser cleanup during open and snapshot, proving deadline/cancellation rejection and immediate session invalidation. Image retention covers 100 turns reusing call IDs, multiple images per turn, orphan observations, idempotence and zero retention. Trajectory tests cover 6,000 nested object/array levels in both serialized and direct values, unchanged live inputs, retained sibling diagnostics and successful subsequent records. Existing real-browser and provider/context/replay checks passed. `npm pack --dry-run --ignore-scripts --json` confirms the replay guide, replay script and built runtime ship together; `node --check scripts/zcode-engine-replay.mjs` passes. The five documented full-range whitespace exceptions remain; broad baseline and live provider quality/token benchmarks were not rerun.
+
+PR #98 nested-privacy/cancellation/image-budget remediation on 2026-10-02 (Windows, Node.js v24.16.0): `npm run build`, `npm run check`, working-tree diff check and the explicitly scoped complete-range whitespace check below passed. The following compiled checks passed **113/113**, with no failures, cancellations or skips, using disposable configuration:
+
+```powershell
+node scripts/run-tests.mjs dist/test/browser-session.test.js dist/test/trajectory.test.js dist/test/hardened-runtime.test.js dist/test/context-compaction.test.js dist/test/engine-provider.test.js dist/test/provider-continuation.test.js dist/test/zcode-engine-replay.test.js dist/test/bundled-skill-provenance.test.js dist/test/publish-artifacts.test.js
+```
+
+Regression evidence covers actual compaction request payloads with retired/retained browser observations, nested encoded summaries, malformed observations and depth/size fail-closed limits, while preserving live requests. Deferred page creation cancels before either creation or browser close settles and cleans up late success/failure. A production-engine batch immediately claims 12 requested screenshots but retains only ten; a later model turn can capture again. Four 512 KiB captures exhaust the shared byte allowance despite claiming and closing/reopening sessions. Captures reserve the maximum image size before starting, so less than 512 KiB remaining can conservatively reject a smaller capture. Existing real-browser, context, provider, replay and packaging checks also passed. Independent scoped code review found no further defect. The five documented full-range whitespace exceptions remain; broad baseline tests and live provider quality/token benchmarks were not rerun.
+
+PR #98 snapshot/privacy/validation remediation on 2026-10-02 (Windows, Node.js v24.16.0): `npm run build` and `npm run check` passed. The following compiled checks passed **81/81**, with no failures, cancellations or skips, using the runner's disposable configuration home:
+
+```powershell
+node scripts/run-tests.mjs dist/test/browser-session.test.js dist/test/trajectory.test.js dist/test/hardened-runtime.test.js dist/test/engine-provider.test.js dist/test/provider-continuation.test.js dist/test/zcode-engine-replay.test.js dist/test/bundled-skill-provenance.test.js dist/test/publish-artifacts.test.js
+```
+
+The real installed-browser fixture verifies pre-transfer 20 KiB UTF-8 JSON bounds under escaped-text pressure, oversized child/ancestor ID fallback selectors, successful clicks and scroll exposure after 80 earlier controls. Trajectory checks verify persisted snapshot value redaction for short/unregistered/escaped input while preserving live provider messages, screenshot metadata and unrelated diagnostics; missing original calls and malformed identified observations are covered. Runtime/provider/replay tests retain private continuation, native image ownership and fail-closed replay semantics. Build/provenance checks verified all 10 core modules and 134 bundled assets. The remediation working diff and the explicitly scoped complete-range check below pass; the unscoped complete range has the documented exceptions. Broad baseline tests and live provider quality/token benchmarks were not rerun.
+
+### Diff-check scope correction
+
+Earlier `git diff --check` statements below describe working-tree checks only; they did **not** establish a whitespace-clean complete PR range. Rechecking `git diff --check 264a1436bb000eeb852949ca87cf99f51a71ffcd HEAD` reports trailing whitespace in four imported AI Elements assets and a final blank line in the adapted compact module. These bytes are intentionally retained with their recorded source/adaptation hashes; this is an explicit validation exception, not a clean full-range result:
+
+- `src/skills/bundled/ai-elements/references/inline-citation.md`
+- `src/skills/bundled/ai-elements/references/tool.md` (includes Markdown hard-break spaces)
+- `src/skills/bundled/ai-elements/scripts/artifact.tsx`
+- `src/skills/bundled/ai-elements/scripts/sandbox.tsx`
+- `vendor/zcode/source/compact/manual.ts`
+
+The following complete-range check, excluding only those five provenance-tracked files, passes. Keep the exclusions explicit so whitespace errors elsewhere remain failures:
+
+```powershell
+git diff --check 264a1436bb000eeb852949ca87cf99f51a71ffcd HEAD -- . ':(exclude)src/skills/bundled/ai-elements/references/inline-citation.md' ':(exclude)src/skills/bundled/ai-elements/references/tool.md' ':(exclude)src/skills/bundled/ai-elements/scripts/artifact.tsx' ':(exclude)src/skills/bundled/ai-elements/scripts/sandbox.tsx' ':(exclude)vendor/zcode/source/compact/manual.ts'
+```
+
+### Previous validation runs
+
+PR #98 screenshot/routing/payload/documentation remediation on 2026-10-02 (Windows, Node.js v24.16.0): `npm run build` and `npm run check` passed. The following compiled checks passed **210/210**, with no failures, cancellations or skips, using the runner's disposable configuration home:
+
+```powershell
+node scripts/run-tests.mjs dist/test/browser-session.test.js dist/test/hardened-runtime.test.js dist/test/zcode-engine.test.js dist/test/decision-preflight-execution.test.js dist/test/trajectory.test.js dist/test/context-budget.test.js dist/test/context-compaction.test.js dist/test/compaction-recovery.test.js dist/test/continuation-state.test.js dist/test/provider-continuation.test.js dist/test/completion-control.test.js dist/test/unified-engine.test.js dist/test/engine-provider.test.js dist/test/codex.test.js
+node scripts/run-tests.mjs dist/test/runtime-skills.test.js
+node scripts/run-tests.mjs dist/test/bundled-skill-provenance.test.js dist/test/publish-artifacts.test.js
+```
+
+Counts are 191, 10 and 9 respectively. This covers 12 concurrent screenshot owners with delayed event sinks, exact one-time image claims before hooks, rewritten-output privacy, bounded pending-image capacity and disposal, the real installed-browser fixture, initial hosted browser schema routing without external docs, and 129 committed steps with retired phase-machine payloads. Provenance verifies all 10 core modules and 134 bundled assets; `npm pack --dry-run --ignore-scripts --json` confirms inclusion of the replay document. `git diff --check` passed. Portable PowerShell/POSIX launch instructions and sequential transient-state guidance were inspected; live provider launches on other QA machines and transient timing were not executed. Broad baseline and live quality/token benchmarks were not rerun.
+
+PR #98 observation/privacy/budget remediation on 2026-10-02 (Windows, Node.js v24.16.0): `npm run build`, `npm run check`, `node --check scripts/zcode-engine-replay.mjs` and `git diff --check` passed. The following compiled checks passed **156/156**, with no failures, cancellations or skips:
+
+```powershell
+node --test dist/test/context-budget.test.js dist/test/context-compaction.test.js dist/test/zcode-engine.test.js dist/test/compaction-recovery.test.js dist/test/continuation-state.test.js dist/test/provider-continuation.test.js dist/test/completion-control.test.js dist/test/hardened-runtime.test.js dist/test/unified-engine.test.js dist/test/trajectory.test.js
+node --test dist/test/runtime-skills.test.js
+node --test dist/test/bundled-skill-provenance.test.js dist/test/publish-artifacts.test.js
+node --test dist/test/zcode-engine-replay.test.js
+```
+
+The respective counts are 128, 10, 9 and 9. Run runtime-skill fixtures separately from package inventory scans because an oversized-resource fixture temporarily occupies the generated bundled directory and is cleaned afterward. Coverage includes protocol-heavy fallback pressure, unchanged usage anchors, private browser fill persistence with live inputs preserved, every available manifested resource, actual model-visible replay observations, lazy schema union and explicit rejection of unavailable evidence. The earlier projected-observation historical comparison is withdrawn as matched-payload evidence in `docs/zcode-engine-replay.md`; it was not rerun. Broad baseline defects and live provider quality/token acceptance remain unchanged and unverified by these focused checks.
+
+PR #98 packaging/privacy/cancellation remediation on 2026-10-02 (Windows, Node.js v24.16.0): `npm run build`, `npm run check` and `git diff --check` passed. `node --test dist/test/bundled-skill-provenance.test.js dist/test/runtime-skills.test.js dist/test/browser-session.test.js dist/test/publish-artifacts.test.js` passed **28/28**, with no failures, cancellations or skips. This includes exact inventory verification for all 134 bundled assets, disposable packaging tamper fixtures, relative skill metadata and lazy resource access, key-release-before-close ordering at three cancellation points, explicit release-error handling, and the real installed-browser fixture. The broad baseline suite and live provider benchmark were not rerun; this establishes focused correctness, not token savings or quality superiority.
+
+PR #98 review remediation on 2026-10-02 (Windows, Node.js v24.16.0): `npm run build`, `npm run check` and `git diff --check` passed. `node --test dist/test/browser-session.test.js dist/test/trajectory.test.js dist/test/graphs.test.js dist/test/zcode-engine-replay.test.js` passed **44/44**, including the real installed browser fixture, deferred-launch cancellation, persisted numeric pruning counts with screenshot bytes excluded, graph permission defaults, isolated replay runs, and a 60-call/20-response production-engine replay. `node --test --test-name-pattern='default read-only children|configured child roles|disabled delegation' dist/test/agent-execution.test.js` passed **3/3**, covering default child browser denial with both workspace defaults and tool-inheritance modes in YOLO execution. No tests in these runs failed, skipped or canceled. The historical comparison table and broad baseline suite were not rerun for these fixes; live provider efficiency/quality acceptance remains pending.
+
+On 2026-10-02, Windows / Node.js v24.16.0 validation completed an integration build. The skills/graph follow-up ran:
+
+```powershell
+node --test dist/test/runtime-skills.test.js dist/test/decision-preflight-execution.test.js dist/test/graphs.test.js dist/test/graph-server.test.js dist/test/graph-ui-client-validation.test.js
+```
+
+All **81/81** passed, zero failures/cancellations/skips. This includes browser-only bundled references without project reads, disabled capability handling, graph registration/editor availability, lazy loading and all 134 packaged source/adaptation hashes. Compiled code was checked for exclusion of unavailable skills from Jev's usable capability catalog. `tsc --noEmit` and `git diff --check` passed during integration.
+
+Final root-agent validation ran `node --test dist/test/browser-session.test.js dist/test/engine-provider.test.js dist/test/codex.test.js dist/test/trajectory.test.js`: **39/39** passed with zero skips in about 16.9 seconds. This includes real installed headless browser input/click, 100 ms key hold/release, pointer movement and cancellation/session cleanup; screenshot projection; mocked OpenAI/Anthropic image-bearing request bodies; and Codex native image input. It does not establish live provider visual comprehension. Canonical coding-tool checks passed **30/30**. Separate provider/provenance/continuation checks passed **29/29**, including 18 overlapping engine-provider cases; these counts must not be summed as distinct coverage.
+
+Final engine integration reported **59/59** passing across ZCode machine/scheduler, context-budget, context-compaction, hardened runtime, completion, unified-engine, compaction-recovery and private-state checks. The corrected isolated parallel-copy fixture passed **1/1**. Final typecheck passed. These targeted results are distinct from the incomplete broad attempts below and do not imply a clean full repository suite.
+
+The broad repository attempts were **not clean or fully completed**: feature counted 1986 tests (1891 pass, 88 fail, 1 canceled, 6 skipped) before bounded termination of stalled workers after about 8.5 minutes; unchanged baseline `264a143` counted 1967 (1881 pass, 79 fail, 1 canceled, 6 skipped) after 9 minutes 17 seconds with the same stalled workers. Exact local output is in `C:/tmp/zcode-engine-feature-full.txt` and `C:/tmp/zcode-engine-baseline-full.txt`. Compare names, not totals: three eager-skill fixtures were corrected to lazy loading, four package-verifier fixtures gained their missing dependency, and a parallel-copy fixture now uses actual copy event identity instead of request-start index. Isolated no-ripgrep/CLI-update checks passed; CLI-debug/CLI-live-control checks failed identically on baseline in isolated runs.
+
+Five focused runtime failures also reproduced on unchanged baseline: `hidden tool schemas do not consume context when no tool calls remain`; `all nested provider references are preflighted before any Agent work`; `custom planning and QA roles do not inherit the default implementation directive`; `custom graph pins a revision, runs nodes in order and aggregates usage under one run id`; `custom graph rejects unavailable downstream providers before any model or tool execution`. Local focused output: `C:/tmp/zcode-engine-focused-tests.txt`. These are unresolved baseline failures, not passed migration coverage. An executor-identity assertion was intentionally updated. Full provider benchmark, visual task acceptance and live cases remain pending; no provider-token win is claimed.
+
+
+PR #98 browser review follow-up on 2026-10-02 (Windows, Node.js v24.16.0): `npm run build`, `npm run check`, direct TypeScript compilation and `git diff --check` passed. The focused command below used the repository launcher with a disposable `ANDORRACODE_HOME` and passed **61/61**, with zero failures/cancellations/skips:
+
+```powershell
+node scripts/run-tests.mjs dist/test/browser-session-review.test.js dist/test/browser-session.test.js dist/test/trajectory.test.js dist/test/hardened-runtime.test.js
+```
+
+The new raw-event privacy and stalled-close runtime fixtures use mocked Playwright resources. The new live textarea/select/checkbox/radio/password fixture used the installed headless browser and passed; the existing real browser GUI/hold/pointer and viewport/serialized-bounds fixtures also passed. Final cleanup now invalidates sessions synchronously and detaches caught Playwright close promises, including late launches and page-creation failures. Physical termination of a permanently unresponsive browser transport is not established by this change. Provider messages remain live while runtime event/run JSONL copies redact fill inputs before publication and trajectory copies redact new selected-option fields. These checks establish focused browser correctness/privacy, not live provider visual comprehension or performance; the broad baseline suite and historical token/quality comparison were not rerun.
+
+
+## Native lifecycle migration QA (2026-10-02)
+
+Prerequisites: dedicated branch/worktree, Node >=22.19 and installed npm dependencies.
+No device, browser or credential is needed for these adapter-based cases. Run:
+
+```powershell
+npm run check
+npm run build
+node scripts/run-tests.mjs dist/test/hardened-runtime.test.js dist/test/zcode-engine.test.js dist/test/zcode-validation.test.js dist/test/goal-completion-verification.test.js dist/test/engine-edit-preparation.test.js
+```
+
+| ID | Steps and concrete input | Expected result |
+| --- | --- | --- |
+| STOP01 | Fake model returns Part G, H and J announcements, each followed by successful Edit; continue with two more such episodes and then declared `completed` JSON. | Every edit runs once; five progress continuations do not consume completion repairs; exactly one accepted handoff. |
+| STOP02 | Return four consecutive `Next I will implement it.` prose responses to a graph node. | Three continuation messages, then exhausted `stopHookContinuation`, no graph completion. Repeat with failed tools or only todo metadata between announcements; neither resets the bound. |
+| STOP03 | Standalone response `The answer is 42.` without a goal option. | One provider request, successful prose summary, no verifier request or JSON rejection. |
+| STOP04 | Queue a steering message at a text boundary; repeat with cancellation during tool execution. | Steering precedes stop processing; abandoned batch effects are never replayed; cancellation reports cancelled and checkpoints retain paired observations. |
+| OUT01 | Return `Partial answer` with each native output-limit reason followed by a normal ending. Repeat four consecutive partial responses. | Partial transcript preserved; completed prose includes every chunk; fourth truncation exhausts outputTokenLimit independently of completion repair limit. |
+| OUT02 | Return an opening half of a graph JSON envelope with length stop, then full valid replacement. | Guidance requires full replacement; only replacement validates, no malformed suffix concatenation. |
+| OUT03 | Return a truncated batch containing a mutation tool. | No mutation executes; recovery asks fewer complete calls. Duplicate IDs likewise execute zero tools. |
+| JSON01 | Missing required argument, extra property, wrong nested type, malformed argument JSON, and normalized legacy Edit inputs. | Native actionable validation error before effect; valid normalized edits retain approval and freshness checks. |
+| JSON02 | Unknown graph outcome, unsafe integer, unknown artifact reference and artifact wrong shape. | Handoff rejected; no routing with invalid graph data. |
+| GOAL01 | Enable `goalCompletionVerification: {goal: 'Implement and verify the requested feature'}`; return incomplete then complete verdicts. | Native prompt used; incomplete verdict continues; complete verdict permits handoff. Model usage includes auxiliary request. |
+| GOAL02 | Verifier returns malformed JSON, tools, output-limit stop, filtered response, or throws; cancel another verifier request. | No malformed response asserts completion; bounded stop recovery; cancellation propagates. |
+
+Use API fixtures in the named test files to reproduce individual cases. Tests isolate
+state; manual CLI runs must use a disposable workspace and configuration home,
+never the installed checkout. Restore any test-specific configuration after running.
+Full-file prose continuation must retain opening/closing code fences. New steering
+must clear an obsolete output prefix. Checkpoint/resume must retain stop/output
+recovery counts; successful substantive tools reset only graph progress episodes.
+
+Known limitations: native provider streaming/account retry APIs and persistent goal
+session storage are not migrated. Partial tool batches deliberately execute no tools.
+The native validator supports a subset of JSON Schema; the host supplements external constraints with TypeBox. A valid model verdict does
+not independently verify a runnable artifact. Live model quality, original simulator
+completion and matched performance remain pending unless separately recorded.
+
+Validation evidence: Windows, Node v24.16.0; `npm run build`, `tsc --noEmit`, native provenance verification and `git diff --check` passed. All 54 focused runtime/native-engine/schema/goal/edit tests in the command above passed. Independent broader-suite and live-model results are recorded in the PR. Proposed manual cases above are not claims of completed live validation.
+
+Follow-up verification: the goal-steering, invalid-goal setup and standalone-prompt
+regressions plus external oneOf/anyOf schema compatibility passed in a 43-test
+focused rerun. Compilation, provenance and asset checks passed; Windows prevented
+the final `dist` directory swap with EPERM while other validation processes held
+the prior output tree. The rerun used the complete new staging build. This is a
+local output-publication limitation; repeat `npm run build` after consumers exit.
+
+
+### Independent validation update
+
+- Live smoke used the real GX10 provider with `qwen3.8-flash-next-fast` and an isolated counter-app workspace. The graph succeeded; independent Node syntax validation passed and all 11 Playwright interaction checks passed. The axe check was blocked, so accessibility validation is not established.
+- The original full simulator task was still running at the evidence checkpoint (iteration 14; approximately 92 KB generated). This is progress evidence, not completed simulator or matched-quality validation.
+- The broader suite reported failures. Context-persistence failures were reproduced on the untouched baseline; CLI timeout failures remained untriaged. The native-lifecycle regression that discarded the intake guard reason was fixed, and all 43 targeted agent-execution-review/runtime checks passed afterward.
+- A separate TypeScript emission and native provenance verification passed for that guard fix. The active live run held `dist`, so the targeted tests used isolated compiled output; no further normal build was attempted during the live run.
+
+## Review regression coverage
+
+- Standalone raw or fenced JSON, including summary/tests-shaped data and truncated JSON, must be returned as requested without enforcing a graph envelope. Graph and complete_agent handoffs remain strict.
+- Invalid explicit handoffs emit exactly one rejection event per attempt, including the exhausted attempt.
+- External tuple items reject incorrect positional types; structurally equal object/array const and enum inputs execute exactly once, while unequal values execute no tool.
+- Blank or whitespace-only verifier reasons fail closed. Verifier requests consolidate system instructions into one leading message for GX10 compatibility, without mutating original history.
+- Steering arriving in the completion-verified event must resume work before accepting the previous candidate.
+
+The broad-suite run was stopped after stalling among CLI tests. Context-persistence failures and the Anthropic retry-count assertion (4 requests versus 1 expected) reproduced on untouched main; other broad-suite failures remain untriaged. A subsequent normal build completed after stalled test consumers exited.
+
+Final review validation: normal npm run build passed, then 81/81 combined runtime, graph-review, engine, schema, goal-verifier and edit-preparation tests passed. Two real GX10 verifier fixtures passed after consolidating system instructions: unfinished Part J announcement rejected with a concrete next action; completed READY answer accepted. Earlier HTTP 500 probes reproduced GX10 rejecting late system messages; the final helper fixes that provider compatibility issue. Original simulator completion remains pending.