@gajae-code/coding-agent 0.17.1 → 0.17.4

package/CHANGELOG.md

@@ -2,6 +2,272 @@
 
 ## [Unreleased]
 
+## [0.17.4] - 2026-09-23
+
+### Changed
+
+- The newly bundled `gpt-6-sol` and `gpt-6-luna` Codex rows are declared in the autorouting tier-map skip list, exactly as `gpt-6-astra` already is, so `check:autorouting-map` and its CI gate keep passing and the two new keys do not silently shift role routing before they are curated.
+
+### Fixed
+
+- ACP startup capability-query failures now report only a bounded safe category from known failure codes, or a fixed generic label, instead of exposing host-supplied error details. A host that does not answer the query remains distinct from a live outdated host, which still receives guidance to stop and reopen the session.
+
+- Release binaries now embed MuPDF WebAssembly only after a pinned upstream source rebuild matches the installed npm artifact byte-for-byte. The matching source archive, build recipe, notices, and provenance are published alongside the binaries instead of relying on an unavailable local release-material bundle.
+
+## [0.17.3] - 2026-09-22
+
+### Added
+
+- Custom-provider setup now starts OpenAI-compatible model discovery as soon as credentials are supplied, preserves manual fallback, and prevents late previews from changing another wizard step's selection. Leaving confirmation to revise inputs cancels an in-flight submission before opening the editor. Cancellation is checked through the configuration commit boundary, and failed credential restoration is reported rather than silently discarded. No-model recovery guidance exposes both manual model IDs and discovery (#5387).
+
+- The in-process SDK now exposes `session.submitUserMessage()` for tracked queued steers and follow-ups. Each submission has a unique identity plus admission, execution, terminal, cancellation, removal, same-run, successor-run, and sequential FIFO lifecycle receipts without relying on private SDK-host correlation hooks.
+
+- `gjc sdk` and `gjc daemon` are now AI-friendly to discover and to recover. A static public command registry is the single source of truth for every public path, flag, risk and recovery note; a bounded help renderer serves concise text or an explicit `--json` machine mode under an 8192-byte cap with deterministic section and page traversal; and an opt-in family dispatch hook (`packages/utils/src/cli.ts`) lets sdk/daemon intercept their own argv before generic help and command loading. Every failure now leaves through one versioned `gjc.command-error` envelope carrying a stable code/category, retryability, outcome certainty, allowlisted references (`sessionId`, `operationRef`, `idempotencyKey`, `claimId`, `commandId`, `turnId`) and concrete next-step commands only when they are fully known; unknown or raw errors collapse to a generic `operation_failed`, and no raw exception text is echoed. A failure too large for the envelope is published to a bounded local evidence store (64 slots, 1 MiB per record, 16 MiB total, 24 h TTL, atomic no-overwrite publish with fsync and read-back verification, owner-only POSIX access, paginated digest-verified retrieval) so the complete record can be reconstructed with `gjc sdk --error-ref <id> --error-sha256 <digest>` instead of retried blindly; an unavailable store reports `unavailable` rather than fabricating a continuation. Mixed `gjc daemon` failures retain the operation results of the targets that already completed (`error.partialResults`), because the envelope warns against replaying applied mutations and must therefore carry the resulting state a caller has to reconcile against. No recovery probe, retry or restart is ever automatic, and successful command output, streaming/serve frames and private worker argv are unchanged.
+
+- **CLI caller contract:** successful operation output remains unchanged, while public help is bounded/static and ordinary failures now use stderr text by default (exit `1` for operation failures and exit `2` for usage failures). Callers that need machine output must pass `--json` and parse the `gjc.command-error` v1 envelope on stdout; `gjc sdk session raw global --op session.lookup --json` is the documented exception, returning its structured reconciliation DTO on stdout with exit `1` for `not_found`/`conflict`. After `gjc sdk serve --stdio` acquires relay ownership, stdout remains frame-only and post-start transport failures are fixed diagnostics on stderr with exit `1`; mixed daemon status failures never emit partial raw rows and instead carry bounded `error.partialStatuses` in the failure envelope. Scripted callers consuming nonzero output must migrate to these explicit channels and shapes rather than parsing legacy failure text.
+
+- Interactive `/fork` opens the user-prompt selector and creates an independently persisted continuation with history before the selected prompt, restoring that prompt as an unsubmitted editor draft. The shared slash/keybinding picker requires persistence, closes active side chats on admission, and synchronizes session UI even when restoration fails after the child is committed. Original transcripts and CLI `--fork` behavior remain unchanged (#5515).
+
+- Bash accepts an optional model-declared activity declaration (`activity: { kind: "browser", provider: "aside", mode: "repl" | "exec" }`) and mirrors the accepted value into `BashToolDetails.activity` on foreground results, background/folded starts, and background job progress/terminal details. The `browser.backend: aside` routing prompt now requires the declaration on every Bash invocation that runs Aside, so embedding consumers can project Aside browser activity from the existing tool-call lifecycle instead of parsing command text. The declaration is schema-validated only: malformed values are dropped (never coerced, never fatal), calls without one are ordinary unchanged Bash, and GJC still neither spawns nor supervises Aside nor inspects the command.
+
+- `gjc skills discover --limit`, `--query`, and `--offset` forward to the discovery library, which clamps `--limit` to 1-50 and treats `--offset` as a zero-based index into the matching set. Paging is stateless: the text output prints a runnable next-page command (echoing the filters you passed) and prints nothing on the final page. `--json` additionally emits `matching` (skills left after the query filter), `offset`, `nextOffset` (omitted on the final page), and `scanned`, the deduped policy-allowed skill count the query filter ran against. The page bounds what is returned, not what is scanned: discovery still reads the whole catalog to build the matching set.
+
+- Add TUI-only `/mcp status`, `suspend`, `resume`, and `reconnect` controls for root interactive sessions started with an explicit `--mcp-config`, with transactional connection replacement and session-local suppression.
+
+- `/rename` with no argument now regenerates the session title from the conversation instead of printing a usage error. The automatic title is generated exactly once, from the first user message, so a throwaway opening prompt (`tmp`, a typo, a pasted stack trace) permanently named the session and `/resume` showed that name forever. Regeneration builds a bounded digest — user messages only, the first plus the five most recent, each capped at 400 characters or at an equal share of the 2,000-character input budget when that is smaller (331 characters for a six-message digest) — and persists the result as a user-set title. With nothing to summarize, or when the model returns no usable title, it reports that and leaves the existing name untouched.
+
+- Star or unstar the selected session directly from the `gjc --resume` and in-session resume pickers with `Ctrl+S`, with a footer hint and immediate starred-first ordering after saving.
+
+- `gjc sdk session close <sessionId>` ends one live SDK session as a first-class verb instead of requiring the raw hatch (`raw global --op session.close --json-input …`). It never attaches to the session, because a Router attachment would renew the host's abandonment window it is meant to end. `--idempotency-key` is optional: the default request key includes the session id and current endpoint generation/incarnation, so retries for one live host replay while a resumed host receives a fresh close identity.
+
+### Fixed
+
+- ACP now makes one bounded, read-only `turn.result` lookup after an uncertain prompt or skill send, using an ACP-owned reference and exact terminal correlation to recover usable retained terminal evidence without replay. Recovery revalidates the current Router attachment before reading, preserves retained truncation metadata, orders recovered text behind queued stream frames, and maps an acknowledged client cancellation to `cancelled`; unrelated provider-registration uncertainty no longer interrupts an already acknowledged prompt. Missing, mismatched, nonterminal, or unavailable evidence remains `terminal_uncertain`; late acknowledgements cannot take ownership of a successor prompt. This recovers retained terminal evidence only: it does **not** settle aborted-tool resources or resolve all of #5401.
+
+- Non-persistent direct CLI sessions no longer acquire the shared SDK SessionIndex lock, while persistent sessions continue to publish their liveness registration and surface lock contention.
+
+- Standalone builds now package MuPDF and its WASM asset for PDF extraction instead of requiring a globally installed module (#5433); npm/Bun package tarballs include the pinned patched converter and declare its matching runtime dependencies. Short and attachment-named PDFs are accepted as readable text, authoritative non-PDF MIME types retain their handlers, and failed or empty extraction reports a failed inspection rather than raw bytes. Tool diagnostics and default debug logs keep local dependency paths private, and release embedding fails closed until corresponding-source materials are supplied. Explicit raw reads remain available.
+
+- Tracked queued SDK submissions now cancel steers rearmed as follow-ups, retain terminal ownership across per-turn attempt-scope rotation, and reject malformed `submitUserMessage` options before dispatch (#5460).
+- Tracked queued submissions settle as removed when successor startup fails before run acceptance, and overloaded AgentSession seams are coalesced in the generated SDK inventory.
+- Accepted tracked submissions now settle as removed when session disposal or identity replacement disconnects the Agent event bridge, while invalid queue policies and legacy `sendUserMessage` tracking flags fail before dispatch.
+- Forked sessions now drop predecessor queued SDK work and its ownership before publishing the successor identity, including submissions already consumed by the predecessor run.
+- Manual compaction now terminalizes already-consumed tracked submissions before disconnecting Agent events, reconciles queue displays without duplicate identities, preserves sequential steering, releases deferred follow-ups, wakes every preserved queue, and restores queued work even when abort fails.
+- Session-switch cleanup now scopes terminalization to predecessor-owned tracked submissions, so submissions admitted by the committed successor hook remain executable and retain their lifecycle receipts.
+- Tracked submissions now reject preflight that crosses a session-identity transition, while committed successor hooks use a scoped admission capability across new, fork, handoff, switch, and branch transitions.
+- `cancelAndSubmit()` resolves deferred selections by executable message identity, preserves sequential steer policy when reclassifying queued work, releases deferred SDK work after every relevant queue removal, preserves FIFO and per-message delivery policy when ordinary follow-ups follow deferred SDK work, and terminalizes accepted submissions when a post-admission callback fails.
+- Post-commit `session_compact` and `session_tree` extension hooks now share the scoped successor admission boundary, so tracked hook submissions are accepted after their transition commit instead of being rejected as busy.
+- Successor admission is limited to tracked queued submissions, ordinary prompts remain fenced during transitions, follow-up reservations wake and reject on transition/disposal, and throwing queue lifecycle callbacks cannot strand later cleanup or deferred work.
+- History rewrites now disconnect and settle predecessor runs before fork, branch, or tree navigation commits, while automatic compaction holds the same transition lease and rearms deferred continuations only after the lease is released.
+- Public, prompt, and custom follow-ups now honor the same admission reservation fence as tracked submissions, so preflight windows cannot be overtaken by ordinary queued work.
+- Rearmed steering and TTSR follow-ups now share that cross-store fence and abort generation, preventing older deferred work from being overtaken or stale injections from running after cancellation.
+
+- Resuming a saved session whose complete model chain is no longer registered now uses an authenticated durable profile default as a runtime-only fallback. Saved messages and configured-chain intent remain unchanged; profiles that fail existing catalog, authentication, proxy, alternative-provider, or strict-provider policy still leave resume rolled back (#5512).
+
+- Coordinator delegate reuse now resolves endpoint authority from the persisted managed-worktree workspace, preserving `not_indexed` status and retrying transient workspace canonicalization failures instead of sealing them as terminal errors (#5531).
+- Coordinator delegate reuse reauthorizes the persisted cwd/workspace pair against the current allowed and managed-worktree roots before binding, so a narrowed root or redirected projection refuses with `workspace_mismatch` instead of dispatching outside scope.
+- A same-key coordinator delegate retry after a pre-admission failure on a reused session now recovers into a fresh prompt claim; only retries whose prior attempt already started a prompt claim seal as `terminal_uncertain`.
+
+- Runtime skill discovery no longer truncates silently. When more skills match than fit on one page, the result now carries a diagnostic naming the shown range, the total matching count, and the exact `--offset` to continue from, so a registered skill beyond the page is reachable instead of invisible. The notice is exempt from the bounded diagnostic budget that stale `skills.customDirectories` entries fill, which is exactly the case that hid it (#5536).
+- `gjc skills discover` now defaults to the widest page the library serves (50) instead of the agent-sized 20, so a human paging the catalog does not lose entries. The `skill_discovery` tool default is unchanged.
+
+- Session host abandonment now distinguishes an attached-but-idle chat daemon from active work. Notification adapters identify themselves as observers, while in-flight prompts still keep their host alive, and session activity rows now persist the host's observed active/idle state instead of rewriting every live heartbeat to `active`.
+
+- Managed session scope preparation now reaps replacement staging that was stranded as a second hard link to its own published transcript. Managed replacement publishes `.<transcript>.<uuid>.replacement` by exchanging it with the destination, so an interruption between the exchange and the staging unlink leaves the live successor inode reachable under two names. Every managed capture opens no-follow and rejects `nlink > 1` (`captureManagedFileNoFollowLimit`, `inspectManagedFileNoFollow`), so the surplus name silently removed a fully intact session from managed inventory: `--resume <id>` reported `Session "<id>" not found.` and `--continue` reported `Could not inspect managed session: read-failed`, while resume by absolute `.jsonl` path still worked and the transcript bytes were never damaged. Observed on macOS with an 87 MB transcript whose only fault was the extra name. The remnant reaper now also removes a staging name proven to resolve to the same dev/ino as its own published destination — the surplus NAME only, never the inode — and the same rule applies to the async twin used for descendant scopes. Staging that does not alias its destination (an unpublished attempt or a retired predecessor) is still retained as receipt-recovery evidence (#5552).
+
+- The SDK prompt deadline now arms at the declared `sdk.promptDeadlineMs` default everywhere. Raising the schema default to 60 minutes left the SDK bus and session host each holding their own hardcoded 30-minute fallback, so a settings lookup that missed still retired a legitimate long turn at the old deadline (#5583).
+- A prompt retired by its deadline no longer tears the session down with the agent's work uncommitted. Uncommitted changes in the session's own worktree are autosaved as a `wip(<branch>): autosave on prompt deadline` commit before teardown, so the next run resumes from a commit instead of re-reasoning. The flush is best effort and never changes the deadline outcome: it is skipped on a clean tree, outside a git worktree, and when renewed progress supersedes the expiry, and any git failure is logged and swallowed. Set `sdk.flushWorktreeOnDeadline` to `false` to opt out (#5583).
+- The deadline autosave is bounded and can never hold session teardown. Its git operations run under an abort signal, and the autosave as a whole is raced against a hard 10-second timeout, so a blocking git lock, a credential prompt, or a hanging commit hook is abandoned rather than waited on. Lifecycle ownership and the deadline lease are always released and the prompt still fails with `prompt_deadline_exceeded` (#5583).
+- Sessions running on the notification-bus route now autosave on a deadline too. That route owns an independent deadline timer and terminalization path, so it previously terminalized `prompt_deadline_exceeded` and tore the session down with the agent's edits still uncommitted. It uses the same bound, the same `sdk.flushWorktreeOnDeadline` opt-out, and only ever commits on the deadline path — a cancelled or failed turn never autosaves (#5583).
+- Progress that arrives while the deadline autosave is running no longer tears down a live prompt. The expiry pass re-checks supersession after the autosave, so a prompt whose lease was renewed during that window keeps its ownership and its rescheduled deadline instead of being retired by the stale expiry (#5583).
+- A deadline autosave never writes your index and never runs your commit hooks. It stages into a throwaway index inside the worktree's own git directory, builds the commit with `git write-tree`/`git commit-tree`, and adopts it only after a compare-and-swap ref update against the HEAD it started from. So a failing or abandoned autosave leaves your real index byte-identical — intent-to-add, skip-worktree, sparse-index and index extensions included, none of which the previous snapshot-and-restore could carry — and an autosave that wakes up after the session is gone finds HEAD moved and drops its commit instead of clobbering whatever landed meanwhile. `pre-commit`/`commit-msg` no longer execute during teardown, and a repository with an unmerged index is left alone entirely (#5583).
+- The deadline autosave now only applies its default to a worktree the session owns. `sdk.flushWorktreeOnDeadline` still defaults to `true`, but the implicit default is honoured only in a linked git worktree — what an agent or task session runs in, and the situation the original report describes. In your primary checkout the autosave is skipped unless you write `sdk.flushWorktreeOnDeadline: true` yourself. It deliberately still stages the whole dirty worktree, untracked files included, because saving exactly the work the agent produced is the point; the ownership boundary is what makes that safe rather than narrowing what gets staged (#5583).
+- The deadline autosave now runs before the prompt's terminal outcome is persisted, not after. It sits between the durable pending claim and the durable terminal on both the SDK host and the notification-bus routes, so a process death anywhere in that window leaves the record pending and restart recovery retries the prompt — instead of a record that reports the prompt finished while the work it claims to have saved is still only in the worktree. The trade-off is that the durable terminal is delayed by at most the autosave's existing 10-second bound (#5583).
+
+- An SDK prompt whose `sdk.promptDeadlineMs` lookup misses — no settings object, an unwritten key, or a non-finite stored value — is now bounded by the declared one-hour default instead of a hardcoded 30 minutes, so a long prompt is no longer terminalized at half the timeout the published schema promises.
+- The schema entries and the SDK bus and host lease fallbacks now read the same `sdk.promptDeadlineMs` / `sdk.promptMaxRuntimeMs` default constants, so the armed deadline cannot drift from the documented default again (#5583).
+
+- `spawn_failed` responses now report a bounded, sanitized cause (including child exit status when available), and Bun `ENOENT` for a missing absolute executable is handled as a normal broker failure instead of crashing the broker.
+
+- Ultragoal succession now permits an explicitly named sibling Git worktree as a target while still rejecting physical aliases of the source worktree and unavailable bound roots; repository-family matching and exact named-target pinning remain unchanged.
+
+- Answering a workflow gate no longer reports success for a turn whose continuation was never resolved. `WorkflowGateBroker.resolve()` commits `advanced:true` before it resolves the continuation waiter, so a fence, quarantine, or session transition landing between those two steps left a durably advanced record with an unresolved waiter. `lookupCompletedResolution` could not tell that apart from a genuine completion, so `workflow.gate_answer` returned `ok:true` / `status:"accepted"` with a real `resolved_at` while the originating prompt stayed `in_flight` with `receiptState:"absent"` — and no recovery path would replay it, because `recover()` skips every record already marked advanced. A lost continuation is now recorded and the lookup downgrades to `accepted_incomplete`, which routes through the existing recover-then-recheck branch and surfaces the documented `terminal_uncertain` instead of a false success (#5599).
+- The same false success no longer returns after a process restart. The lost-continuation marker is in-memory and the durable record cannot carry it (an `accepted` record may not hold a `lifecycle`; a `quarantined` one must be `advanced:false`), so a gate owned by a previous runtime is now treated as unprovable rather than completed — a continuation waiter is process-local and cannot survive a restart (#5599).
+- Q12 `workflow.gates.list` now exposes a redacted accepted-answer diagnostic with the originating `runtime_turn_id`, `answer_recorded`, resolution time, and one post-accept disposition; a lost continuation also aborts the owning agent turn so it cannot remain `in_flight` indefinitely (#5599).
+
+- Keep settled lifecycle outcomes intact when post-persistence read-back is unavailable, preventing successful session creates from being wedged by a spurious `terminal_uncertain` record.
+
+- `transition_claim_timeout` now names why the stale-transition reclaim refused instead of collapsing structurally different situations into one message. A wedged coordinator state claim could previously be a released tombstone from another installation, a tombstone with no installation identity, a same-installation tombstone still inside its release grace window, a live owner, a claim an external process restamped between inspection and capture, or a non-empty claim — all of which needed different operator action and all of which read identically. The error now carries a bounded classifier (for example `(reclaim refused: released_owner_foreign_host)`); it is a fixed enum member and never a path, token, host id, pid, or errno (#5606).
+- Same-installation released transition tombstones now hand off after their grace window instead of timing out, so a waiter can reclaim the aged empty claim. Windows file-lock publication also retries a bounded sequence of pre-mutation `sharing_violation` results before surfacing the persistence failure (#5606).
+
+- The managed atomic-rewrite overflow error no longer advises `gjc export <session-file>`, which is not a command. `SessionNearLimitRewriteError` was added with its own hardcoded copy of the recovery advice and reintroduced the exact string #5621 had removed; it now reuses `SESSION_LIMIT_RECOVERY_ACTIONS` like the append path, so both near-limit errors stay in sync. The guidance regression test covers every near-limit error class rather than only the append one (#5621).
+
+- Session transcript limit errors no longer advise `gjc export <session-file>`, which is not a subcommand: running it literally started a fresh agent that read `export` as a prompt while the unwritable session was left untouched, and the root `--export` flag only renders HTML. The near-limit append error and its tool-result copy now share one constant naming `/compact` and `/clear` — both dispatchable over ACP as well as the TUI, and both keeping the session manager alive so a retained near-limit entry still persists on the next successful write. The oversized-resume message no longer names an in-session command at all, since it is emitted before any session is open. A regression test resolves every referenced command against the CLI, builtin, and ACP registries (#5621).
+
+- An expired SDK prompt deadline now aborts the run at a tool-call boundary instead of through a tool that is still executing (issue #5637). Terminal fencing aborts the run's cancellation domain first and only proves settlement afterwards, so a tool that was mid-write when the deadline expired observed the aborted signal *during* its write — which is how a deadline-killed turn left a torn `apply_patch` in the worktree, logging `Failed: apply_patch` immediately before `Prompt deadline exceeded.`. Expiry now waits for the in-flight dispatched call's own `tool_execution_end` under a short, finite grace (5s) before fencing. The wait is attributed exactly like deadline renewal — correlated to the accepted prompt, dispatched calls only, never pairing-only synthetic tool pairs — so it can neither be held open by an unrelated turn nor by a call that never ran, and a prompt with nothing executing at expiry takes the unchanged path with no timer and no added delay.
+- A prompt whose tool does not reach its boundary within the grace is still force-terminated on exactly the same schedule as before, and the force-termination is now recorded rather than being indistinguishable from a clean expiry: the terminal diagnostic carries a distinct reason naming the grace and how many calls were still executing, and a structured warning carries the correlation, the grace and the pending tool-call ids (ids only — never tool arguments, output or paths). The failure code, provenance, category and message are unchanged (`prompt_deadline_exceeded` / `deadline`), so downstream retry classification is untouched.
+- Whether a tool is executing is now answered by the run resource ledger rather than by `tool_execution_start` arriving through the asynchronous extension fanout. The agent loop takes that ledger lease synchronously, before the tool's `execute` is invoked, and releases it at the call's real end; the start event, by contrast, is queued on the agent event stream and handed to listeners without being awaited, behind any extension registered ahead of the SDK bus. An extension that awaited in its `tool_execution_start` handler therefore left the deadline believing nothing was running and force-aborted mid-`apply_patch` anyway — the exact kill this fix exists to prevent. Whenever that ledger can be read it is now the sole authority, including when it reads back empty. The fanout was wrong in both directions, not one: it could report idle while a tool was mid-write, and — because the same asynchrony that delays a start also delays or drops an end — it could report a call still running long after it had returned, burning the whole grace and recording a forced mid-tool kill for a tool that was already done. The fanout is still tracked for observability and still wakes the boundary wait early, but it is the pending authority only when the ledger cannot be consulted: an older host without the seam, no run bound yet, or a read that failed, each of which falls back to the previous event-derived behaviour.
+- The SDK-only host now threads the same run-resource-ledger seam the notification/SDK bus host does, so the two mutually exclusive host routes expose one seam contract instead of one silently missing a member. This closes a latent asymmetry rather than a live mid-tool kill: the SDK-only deadline path publishes its `agent_failed`/`agent_end` terminal frames and cleans up lifecycle references without aborting the run at all, so there is no mid-execution cancellation to prevent on that route today and no tool-boundary wait is required there. The value is forward-looking — anyone who later adds a boundary wait or a deadline abort to the SDK-only path reads the authoritative ledger instead of silently getting the event-derived fallback. A regression case pins the no-abort property so that change cannot be made silently.
+- An expired deadline now opens at most one boundary wait per submission. At an already-due maximum runtime the deadline cannot be renewed past, so every streamed `tool_execution_update` re-armed a zero-delay timer that immediately opened another concurrent grace wait; a single expiry could accumulate ~100 overlapping waits and timers. Progress is still recorded and the lease renewal is unchanged.
+
+- Session host liveness now tracks admitted, queued, and continuing session work with a reference-counted lease, preventing idle reaping while work remains pending (#5652).
+
+- A post-start prompt failure classified `provider_transport` now says so in operator-facing wording instead of reading as a failure of the user's task. The reported `server_is_overloaded` case surfaced only as `Internal error: Provider failure after execution started.`, which names no cause an operator can act on; the failure payload now carries an `operatorMessage` stating that the model provider ended the turn. The wording is gated on the bounded classifiers `phase === "post_start"` and `category === "provider_transport"`, so a submission-phase provider failure — where nothing executed — is never described as a turn the provider ended. Because `post_start` proves execution began but not that it was without effect, the message explicitly qualifies that work the turn had already performed may have taken effect, rather than asserting the operator's task was untouched. It is assembled solely from those safe classifier tokens and a `providerCode` that passes `isSafePromptFailureCode`, so no provider text reaches the wire. The JSON-RPC code, the `code`/`details` pair, and every `PROMPT_FAILURE_MESSAGE_*` constant are unchanged, and the message travels alongside them rather than replacing them. Failures in any other phase or category are unchanged: their `phase` and `category` already describe them, so no prose is added. Retry behaviour is unchanged.
+
+- Coordinator namespace reads no longer fail with `Coordinator service is unavailable.` when a single session's WAL record is unreadable. Retention no longer compacts away the prompt request that proves an active turn's runtime receipt, legacy `report-<uuid>` ids are migrated onto the canonical digest form instead of being rejected forever, and one `state_corrupt` session is now skipped with a `Coordinator projection recovery skipped session` warning rather than aborting the whole sweep.
+
+- Keep coordinator WAL observations lock-free and read-only. Restrict durable legacy report-ID migration to projection recovery, with cancellable, non-waiting lock acquisition and per-session contention isolation.
+
+- `gjc sdk session tail` now resumes without dropping observations: callers receive a signed continuation claim after replay/live follow, must provide the last processed transcript id on `--cursor` resumes, and transcript checkpoint failures fall back to the exchanged snapshot instead of returning partial success. Stopped-session tails apply the same boundary and fail with `retention_gap` when it is older than the bounded replay window.
+- Live tail cursors advance after the delivered event position is finalized, so the next CLI invocation does not replay events already returned; frame collection freezes before the final watermark is minted, and a failed final mint fails closed for resumable observations while a session close still returns its complete terminal tail. Tail revision stamping retains the newest explicit revision across checkpoint races, and a bounded live wait returns all collected items with `terminal: false` rather than discarding them.
+
+- `gjc sdk serve --stdio` now waits for the upstream hello before forwarding downstream frames and preserves the downstream client's exact v3 capability selection, so capability-gated `tool_activity` frames and live turn content are relayed instead of stopping at the final lifecycle result. A client that explicitly opts into both `turn_stream` and the observer role receives mid-turn tool and assistant frames even when another SDK connection submitted the turn, matching direct socket delivery.
+
+- Explain the bounded MCP startup wait and per-server `--timeout` remedy in `gjc mcp list`, and log the server name and actionable reason when startup disconnects or intentionally skips an autoload registration.
+
+- `gjc update` no longer fails outright when `api.github.com` has exhausted its 60 requests/hour unauthenticated budget: a rate-limited stable lookup now resolves the latest tag through the `github.com/<repo>/releases/latest` redirect, which is the same origin the release binaries already download from and is not API-rate-limited. The redirect is accepted only from that exact origin and release-tag route, the existing stable-tag and checksum verification are unchanged, and the rate-limit failure (including the nightly channel, which has no web listing to fall back to) now names `GITHUB_TOKEN`/`GH_TOKEN` as the workaround. `scripts/install.sh` gained the same fallback (#5703).
+
+- SDK broker startup now reaps aged, empty lock tombstones whose owner record is gone, while retaining non-empty or otherwise ambiguous tombstones and aggregating retention warnings to keep recovery logs actionable (#5705).
+
+- Handled tool refusals, policy denials, command failures, and other designed outcomes no longer appear in the crash recorder. Unexpected tool failures retain their original error class and are fingerprinted by their failing frame so repeated failures deduplicate.
+
+- Reduced expected startup noise by suppressing duplicate MCP timeout warnings, normalizing model-host preconnect URLs (with a Bun 1.4 fallback), sharing usage polls through the local SQLite cache, and namespacing extension commands that collide with built-ins.
+
+- The `/model` picker now treats a successful LiteLLM proxy model discovery response as authoritative, hiding bundled reference models that the proxy did not enroll while retaining the bundled catalog when discovery is unavailable (#5720).
+
+- File-lock reclaim and release now tolerate filesystems that do not provide a creation time while retaining stable file identity and content checks for safe cleanup (#5549).
+
+- Reconcile macOS SDK child-spawn registration failures durably, retaining launch proof until cleanup state is persisted so retries can close or report an uncertain substrate instead of leaking it.
+
+- SDK lifecycle spawn failures now report the readiness stage, child status, and a write-bounded sanitized stderr tail through a detached drainer; launch-scoped and remote MCP header credentials remain redacted and the diagnostic provenance is preserved through uncertain cleanup.
+
+- Auto-compaction recovery now reports missing models and credentials as failures instead of silently skipping maintenance. Recovery model-switch notices are emitted only after the candidate's credentials are validated, so credentialless candidates are not reported as used.
+
+- Preserve the discovered MCP catalog only while deferred exact-config startup has not published or fenced its first manager snapshot, so startup reports the real tool count without replaying tools suppressed by a concurrent exact control.
+
+- Materialized model-profile assignments now resolve against the descriptor-backed profile-activation catalog, so a bare profile assignment can no longer persist a bundled model that fresh live profile evidence excludes.
+
+- The advertised `CoordinatorQuestionAnswerV1` answer schema now declares its allowed fields in a sibling `properties` map, so `additionalProperties: false` no longer rejects every selection, free-text (`other`/`custom`), and `clarify` payload in standards-compliant client validators before the coordinator is called. Each `oneOf` branch stays closed, so valid field combinations are unchanged.
+
+- Login recovery now defaults to adding a fresh account when the first OAuth account is disabled and an add-account action is available. Interactive authentication bootstrap no longer displays misleading model-fallback warnings; ordinary startup and noninteractive warnings remain unchanged.
+
+- Return expired coordinator turn observations without an MCP tool error, preventing normal waits from triggering host failure breakers. Preserve the legacy timeout payload and add `wait_expired:true`; actual request failures remain errors.
+
+- The coordinator MCP test fixtures no longer hardcode a workflow-gate `resolved_at`, so the answer-receipt and WAL-quarantine cases cannot age out of the 30-day compaction retention window and turn red on a calendar boundary with no code change.
+
+- The coordinator session reaper can now retire an idle ephemeral session whose host is gone while the SDK broker still indexes its unchanged endpoint identity. Such a session previously failed every sweep with `session-reaper: failed to reap <id>: close_failed` and was never force-evicted, because the broker's `endpoint_stale` close answer reached the reaper as `close_failed` and the eviction re-proof accepted any exact identity match as current. The reaper now counts that close as `endpoint_stale`, and force eviction treats a matching broker row as stale only when the broker reports it not live and has recorded no host heartbeat for ten heartbeat intervals. Rows that are still live, or that went quiet only briefly, are never evicted this way. A delete intent that an earlier reap left behind no longer blocks a later `gjc_coordinator_stop_session` once the session has been evicted.
+
+- The coordinator session reaper no longer stops reaping for the whole namespace when one ephemeral session's persisted `cwd` or broker workspace falls outside the current `GJC_COORDINATOR_MCP_WORKDIR_ROOTS` (or has no broker workspace). That session is left untouched and skipped with a `Coordinator session reaper skipped an unauthorized session` warning naming it, instead of every sweep being refused with `session-reaper: sweep refused: coordinator_workdir_outside_allowed_roots`. An empty root list still refuses the sweep. The persisted-location authority error keeps its exact message and now carries the escaping `cwd`/`workspace` path in `cause`.
+
+- Keep diagnostic-only HTTP/2 failures from authorizing session retry or model fallback.
+
+- The utility quarantine contract and the SDK operation inventory now record `/fork` as a restored first-class built-in, matching the shipped `/fork` command from #5515. The quarantine still rejects a headless or standalone utility surface for it, and the inventory maps it to `session.branch` — the operation the prompt selector actually commits through — with every chat, MCP, ACP, and daemon-CLI adapter marked prohibited.
+
+- `read` now resolves the `embedded:gjc/...` identifiers that the skill tool and skill discovery report for bundled workflow skills, so reading a bundled `SKILL.md` no longer fails with "Path not found". Line selectors work on those identifiers too.
+- Register the `skill://` protocol handler that was implemented but never wired into the internal URL router, so `skill://<name>` resolves as documented.
+
+- GJC sessions no longer crash on a plugin `registry.lock` left behind by a dead writer: lock acquisition now publishes complete host-tagged tokens atomically and evicts locks only when the holder PID on this host is provably dead. Legacy `pid-nonce` tokens have no trustworthy host identity and remain fail-closed, as do live or foreign-host holders; replacement-safe identity checks prevent stale recovery from deleting a successor lock.
+- A registry lock held by a concurrent install no longer fails session startup: `readRegistry` degrades to its already-computed in-memory migration result and leaves persistence to a later uncontended session. Install/mutate paths keep the fail-loud `install_conflict` error.
+
+- A server-declared HTTP/2 `REFUSED_STREAM` now falls back to HTTP/1.1 because that protocol error proves the request was never processed. Generic `RST_STREAM`, connection resets, and connection closes preserve their original transport errors instead of replaying a request whose body may already have reached the peer. `HTTP2StreamReset` and `HTTP2RefusedStream` remain classified as transport failures so surfaced messages name the failing host (`transport=<code> url=…`) instead of Bun's context-free hint.
+- Mutable `ArrayBuffer`/view, `FormData`, and `URLSearchParams` bodies fail closed rather than being replayed after an asynchronous refusal, and effective request headers are snapshotted before the HTTP/2 attempt so a caller mutation cannot change the HTTP/1.1 retry.
+
+- The binary installer now refuses a symlinked destination before downloading instead of after. `scripts/install.sh` tested `[ -h "$DEST_PATH" ]` only after fetching and checksumming the full release binary, so a checkout linked by `bun run dev:link` waited out the entire download to be told no. The check runs as soon as the destination path is resolved, remains at its original position as the pre-replace TOCTOU guard, and names the development-link case alongside `GJC_INSTALL_DIR`.
+
+- A running `job` await now folds on a user steer after the shared foreground grace window, returning promptly while the job keeps its original deadline and remains eligible to wake a later turn with its result. `task` and `subagent` waits remain non-foldable. The fold chord and the SDK `bash.background` control never target a `job` await (its jobs are already in the background), so a `job poll` cannot steal the chord from the foreground bash the user is watching, and a folded await reports the trigger that actually folded it.
+
+- The `job` tool result renderer no longer drops the whole component render when a snapshot carries the `paused` status of a folded background job. `Unknown theme color: undefined` came from `statusToColor` returning `undefined` for a status outside its switch, which `formatBadge` then handed to `theme.fg`; paused and unknown snapshot statuses now resolve to a defined icon (`pending`) and badge color (`muted`).
+- Paused snapshots are no longer reported as finished work. The result text partitions terminal jobs (`completed` / `failed` / `cancelled`) under `## Completed` and lists paused or unknown-status snapshots under `## Waiting` with their raw status, and the renderer header counts them as unsettled (`waiting on N of M`) instead of reporting success over a "settled" job list.
+
+- Managed session startup failures now report allowlisted identity and filesystem error classifications instead of collapsing them into `binding_invalid`. Unknown or path-bearing messages remain redacted, and the existing top-level error code contract is unchanged.
+
+- Release live legacy HTTP and SSE MCP sessions during signal and fatal-exit cleanup, so terminated GJC processes no longer leave server-side `Mcp-Session-Id` state behind.
+
+- Interactive and skill turns no longer wait up to 30s on SDK `agent_start` durable persist. The inline host handler no longer times out with `Extension "<inline-N>" error: handler timed out after 30000ms`; SDK consumers still observe start before content.
+
+- `gjc sdk serve --session <id>` now recovers a session whose host self-reaped after a detached idle window instead of failing terminally. An explicit session that the broker still indexes but reports as not live is re-materialized once through the existing `session.resume` authority the index already carries, then resolved and served normally. A session that is still not live after that attempt fails with the same `endpoint_stale` error as before, and no other targeting outcome retries (#5633).
+
+- SDK: `turn.result` / `skill.invoke_status` retain the bounded final assistant text for completed `skill.invoke` invocations (ralplan, ultragoal); a content-less promise-settlement terminal no longer pre-empts the correlated `agent_end` finalization.
+
+- Managed session rewrites that exceed the per-file transcript cap no longer leak a raw `content_too_large` rejection. The atomic rewrite path now reports a typed `SessionNearLimitRewriteError` with the rejected transcript size and cap, while the append recovery path keeps converting the same overflow into `SessionNearLimitAppendError` with fields derived from the appended entry.
+
+- Live SDK sessions periodically ensure their broker remains available instead of requiring a new CLI invocation after broker loss. Recovery uses the existing ownership-fenced startup path and stops with the session runtime.
+- Retire a broker registration that completes after session shutdown without removing a replacement host's registration.
+- Keep standalone Telegram command reception alive across periods with no attached sessions, so a temporary routing outage does not remove the remote recovery interface.
+- Stop standalone Telegram ingress when refreshed configuration is disabled, incomplete, changed, or cannot be verified, without logging credentials or bypassing ownership fencing.
+
+## [0.17.2] - 2026-09-18
+
+### Added
+
+- Add a project-local Bash pre-tool hook example that invokes HOL Guard directly and blocks execution unless Guard classifies the command as explicitly benign with an `allow` minimum action.
+
+### Fixed
+
+- The detached-owner lifecycle suite (`gjc harness start --detach`, B1) no longer skips wholesale on non-Linux hosts. Its `tmux` is a bash fixture and its cgroup inputs are injected through `GJC_HARNESS_TEST_*`, so six of its seven cases carried no real Linux dependency yet only ever ran in CI — leaving a red `dev` undiagnosable for anyone developing on macOS. Only the case that drives the Linux-only `unsafe_service` cgroup branch stays gated.
+- An owner-routed `harness finalize` that never reaches its owner answers `{ completed: false, reason: "owner-not-live" }` with no `finalize` key, so the suite's assertion reported a bare `Received: undefined` and hid the routing reason. It now projects that reason into the assertion and names it.
+
+- The coordinator platform-capability test no longer swaps `process.platform` process-wide (which made valid native lock publication receipts look invalid before the artifact handler ran); platform discovery and refusal are now driven entirely through the resolved server platform option.
+
+- Endpoint-manager ownership is now released only after disposal and retained async authority actually settle, so a replacement endpoint can no longer be admitted while the outgoing one is still tearing down. Disposal is idempotent, rekey applies the same guard, and SDK startup rollback no longer eagerly unregisters an endpoint that has not finished disposing (#5603).
+
+- The detached SDK broker's discovery budget is now published as a composition (`BROKER_DISCOVERY_BUDGET`) instead of three module-private constants and a restated sum, and every deadline and poll on that path runs on an injectable clock. The spawn single-flight regression now spends that budget one leg at a time on a virtual clock, so each leg's cost is measured exactly and a change to any single constant fails an assertion in milliseconds instead of silently re-tuning a wall-clock race (#5604).
+
+- Added real external stdio ACP regression coverage and documented stale-broker startup-control provenance failures.
+
+- A prompt failure that reaches an ACP client now carries the classification the terminal already computed, instead of collapsing to an untyped `-32603` with `{code: "prompt_failed", details: "Prompt submission failed."}` (issue #5615). The failure's execution `phase`, its bounded origin `category`, and the provider classifier that produced it were derived at settlement and carried on the rejection, then discarded at the single JSON-RPC translation point, so a client watching a mid-session turn die could not tell a transient provider blip from a session that will never answer again without parsing an English message. The JSON-RPC code stays `-32603` (pinned ACP core-v1 conformance expects it for this class) and the redacted message is unchanged; the classification travels in `data`, which additionally exposes a derived `retryability` of `transient`, `terminal`, or `unknown` so a caller does not have to re-implement the category matrix. Only `provider_transport` is transient — the same class the shipped first-turn gate already treats as re-submittable — while a provider rejection, a deadline, and an agent runtime failure are terminal for that turn, and an uncertain attribution stays `unknown` rather than being guessed. `providerCode` is forwarded only when it is a bounded safe token and omitted otherwise, so the redaction contract still holds on this newly exposed field. Retry behaviour is unchanged.
+
+- A first-turn startup-readiness failure whose terminal carries only whitespace as final text is now retried once instead of being surfaced as a hard failure, because whitespace carries no assistant content, matching the trimmed presence contract already applied by prompt reconciliation.
+- Such a terminal no longer publishes its whitespace as an assistant message chunk alongside the retry's real answer: final-text resolution and the terminal publication gate now share one trimmed presence predicate, which also suppresses a whitespace-only final-text delta.
+
+- Chat daemon replay retention-gap concessions now warn once per session stream and gap range. Reconnect and polling duplicates are demoted to debug, while a new gap range still emits the original warning; the bounded memo prevents long-running daemons from retaining unbounded stream history (issue #5619).
+
+- Restore MiniMax-M3 reasoning on/off controls in model selection and reasoning menus for the international and China MiniMax and Coding Plan routes. Send the native `adaptive`/`disabled` switch instead of unsupported reasoning-effort or token-budget parameters, and explicitly disable thinking when the agent selects off (#5626).
+- Show MiniMax M2.x reasoning as always on rather than offering ineffective effort or off controls. Keep model-role labels and the status line consistent with these capabilities.
+- Restrict MiniMax-native thinking behavior to validated first-party HTTPS endpoints and API paths, including the resolved endpoint at request time. Custom proxies retaining a MiniMax provider ID no longer inherit the native thinking contract.
+
+- `gjc sdk serve` no longer surfaces a session-selection failure as an uncaught exception with the failure code buried in a message string. Selection failures (`not_found`, `ambiguous_session`, `endpoint_stale`, `no_live_endpoint`, `multiple_live_endpoints`) and the broker-reach failures on the same path now raise a typed error carrying a stable `code`, a broker `SdkClientError` keeps both its `code` and its `details` instead of being downgraded, and the command boundary writes a `{"ok":false,"error":{"code","message"}}` envelope to stderr — never the stdout frame channel — and exits 1 (#5633).
+- `gjc sdk serve` no longer lets broker teardown replace the failure it is reporting. A rejected `broker.close()` in the cleanup path used to overwrite the typed serve error with its own; the primary failure now always wins and the teardown failure rides alongside it as `cleanupError`. When teardown is the only thing that failed, it surfaces as a typed `serve_cleanup_failed` instead of an untyped rejection, and teardown still always runs (#5633).
+- `gjc sdk serve` no longer escapes untyped when the broker discovery record itself is unreadable. A permission, file-kind, or unsupported-state-version failure reading `<agent dir>/sdk/broker.json` used to throw past the command boundary with no stderr envelope and no exit code; it now raises the typed `broker_discovery_unreadable` with the record's path in `details`, never its token. A missing record still reports `broker_unavailable` (#5633).
+- `gjc sdk serve` no longer starts a relay on an endpoint record with an empty credential. A missing, non-string, or empty `token` used to become `""` and be written into the upstream WebSocket URL, where it resurfaced much later as a generic transport failure; it is now refused at the broker boundary with the same typed `unavailable` failure an invalid `url` already produces, before either the stdio or the socket relay starts (#5633).
+- The `gjc sdk serve` stderr envelope no longer drops the broker-teardown diagnostics it records. When a serve failure and a failing `broker.close()` coincide, the envelope now carries `error.cleanupError` alongside `code`, `message` and `details`, so an embedder can see that the session may not have been released cleanly. An envelope with no teardown failure is unchanged — the key is absent, not present and empty (#5633).
+
+- Codex session import now recognizes the same credential shapes as its sibling import scrubber. `session-import/codex.ts` listed only `ghp_` of the five GitHub token prefixes and only `AKIA` of the four AWS access-key id prefixes, and knew none of the Google, Slack, npm, GitLab, or Hugging Face shapes that `session-import/redact.ts` already covers — reaching a new session transcript verbatim from an imported Codex file. Stripe restricted keys (`rk_live_`/`rk_test_`) are included: the generic `sk` branch reached the secret-key forms only because they share that prefix. The cheap pre-check that gates the scan is widened with it so the added shapes are actually reached.
+
+- Documentation now states the real `sdk.promptDeadlineMs` default. Raising it from 30 to 60 minutes updated the schema but left both READMEs, the Japanese and Korean translations, `docs/sdk.md`, `docs/bot-integration.md`, `docs/hermes-mcp-bridge.md`, `docs/acp-local-development.md`, and the shipped `gjc-sdk-operate` skill telling SDK clients their turn dies after 30 minutes. A new parity test derives the expected figure from the schema default rather than restating it, so the next change to the default fails the build instead of silently misinforming callers (#5637).
+
+- The terminal-abort-chain test suite no longer leaks temp agent-state directories. The per-case `finally` already reclaimed the directory on the throwing path, but two paths escaped it: an `afterEach` that exceeds its hook budget is abandoned mid-await so the `finally` never runs, and a writer that outlives teardown can recreate a root the `finally` already removed. Each root is now registered on creation and swept from `afterAll`, which runs in both cases and re-sweeps after a short settle window to catch late writers. A start-of-suite reap also removes roots left by earlier runs, but only ones it can prove are abandoned: each root carries a marker naming the owning pid and host, and a root is removed only when the marker is well-formed, names this host, names a process other than the running one, that process probes as exited (`ESRCH`), and the two-hour age gate has passed. A probe the OS refuses to answer, a missing or malformed marker, and a foreign host all keep the root, so a live shard's directory is never deleted; roots written before the marker existed are consequently never reaped. Measured on macOS, where `os.tmpdir()` is `$TMPDIR` rather than `/tmp`: nine leaked roots per run before, zero after (#5665).
+
+- An ACP prompt abandoned by the inactivity watchdog now reports whether the turn's plan was still unfinished instead of collapsing into a generic internal error. The rejection keeps its `prompt_abandoned` code and message, and its JSON-RPC `data` additionally carries `planIncomplete`, `planPendingCount`, `planTotalCount`, and a bounded `planPending` list of the steps the turn never completed, so a wrapper can tell "the agent finished" from "the agent stopped with work left" instead of publishing unverified work as complete. An abandon that never observed a plan omits those fields entirely rather than guessing. A step dropped via `/todo drop` (internal status `abandoned`) counts as unfinished too, even though ACP's three-value plan status projects it as `completed` for the client's plan UI (#5669).
+
+- Compiled binaries no longer abort at startup with `SyntaxError: Unexpected identifier 'init_model_registry'`. Resolving MuPDF's embedded WASM no longer makes its module asynchronous, so the bundler keeps emitting a valid module initializer for the `model-registry`/`model-resolver` import cycle.
+
+- Managed owner admission now says why it blocked a child. A child that fails closed writes the
+  platform and the exact-evidence reader state into its durable handoff and prints one reason line
+  to stderr before exiting 75, instead of exiting silently. On platforms without the Linux-only
+  recovery-fs authority this reports `exact binding reader unsupported` rather than leaving the
+  operator with only the broker's registration-uncertain timeout.
+
+- File-lock acquisition exhaustion now reports the real liveness of a holder running on this host instead of calling every host-qualified record "liveness unknown from this host". A lock owned under this installation's current or previous host identity is probed and described as live, dead but not reaped, or indeterminate; only a genuinely foreign owner stays opaque. Reclamation authority is unchanged — the diagnostic and the stale verdict now share one host predicate so they can never disagree about whose PID a record names (#5653).
+- A file-lock holder whose record carries no host identity at all is now described as held "on an unrecorded host" instead of "on host undefined". Such a record is still treated as foreign by a host-aware acquirer — its PID is never probed and its lock is never reclaimed — so only the wording changes (#5653).
+
+- ACP prompts no longer hang forever in provider preflight. The inactivity watchdog is now armed from the moment the prompt owns the session, so a `session/prompt` blocked in `ensureProviders()` is rejected as `prompt_abandoned` — naming provider preflight as the phase — instead of reporting `running` with no output, no tool calls and no error.
+- SDK provider activation no longer retries without limit. The registration loop now has an attempt cap and a wall-clock budget, and exhaustion throws `provider_activation_exhausted` naming the contended capability, so lease contention between concurrent session hosts fails attributably instead of spinning.
+
+- Model profile activation now diagnoses a required provider this build does not know (neither a built-in provider id nor declared in `models.yml`) as a build/config mismatch with the exact provider names, instead of telling the user to run `/login` for a provider the running binary cannot serve — for example a profile authored on a newer or custom build.
+
+- npm-installed source commands no longer resolve MuPDF's embedded WASM through a monorepo-only path. Source installs let MuPDF load its adjacent sidecar, while compiled binaries keep the embedded asset used for PDF conversion.
+
+- Allow explicitly configured preset proxy routing through automatically discovered OpenCodex in activation, the preset picker, and SDK availability queries, matching upstream wire model IDs while preserving stored GJC selectors and direct-provider fallback preferences.
+
+- A prompt that reaches its SDK deadline now delivers the correlated terminal failure frame to ACP and other SDK clients instead of leaving `session/prompt` waiting behind the watchdog (issue #5583).
+- A prompt whose deadline expires while its real `agent_end` is in flight now publishes exactly one correlated terminal boundary instead of two, so SDK clients no longer see a duplicate `agent_end` for a turn that reconciled to a single durable outcome.
+- A busy session no longer republishes a terminal boundary it already delivered. The single-boundary claim is bounded by capacity, and a publisher parked on its durable writes could have its claim evicted by later turns, so its delayed `agent_end` published a second boundary for an already-terminalized correlation. A correlation with a publisher still able to reach its claim is now never evicted.
+- A prompt deadline that fails to publish its correlated diagnostic still delivers its correlated terminal boundary. The two frames were emitted as one unguarded sequence, so a failure on the first suppressed the second and left the request with no terminal frame at all; each frame is now published independently and a publication failure is logged instead of swallowed.
+- A prompt that reaches its deadline on the notification-bus route — the route a live `--mode acp` session actually uses — no longer supersedes its own expiry. Fencing the run aborts the tool that was still executing, and that tool's completion counted as fresh progress, so the expiry backed off and re-armed forever: no terminal frame ever reached the client and the durable record stayed frozen on its pending claim. Progress caused by the expiry's own abort is now discounted, while progress observed before it still protects a genuinely live prompt.
+
+- The skill-discovery genuine-emptiness case pins an empty home directory instead of reading the developer's real `~/.claude/skills`. Convention-import diagnostics from a populated home made the notice appear locally and vanish on a clean CI runner, so the case asserted opposite outcomes per machine. The contract it pins is unchanged: an explicit user-scope request that scans nothing and diagnoses nothing carries no `notice`, while the same empty environment under source `all` always scans the four bundled workflow skills and therefore explains the conjunctive filter.
+
 ## [0.17.1] - 2026-09-17
 
 ### Fixed

package/dist/types/async/job-manager.d.ts

@@ -341,14 +341,15 @@ export declare class AsyncJobManager {
      *  instead of the last-created process-global instance (review thread P1).
      *  Returns TRUE when the mapping was installed (or already held by this
      *  manager); returns FALSE when the endpoint id is already held by a
-     *  FOREIGN live manager — a second top-level session constructed or
-     *  resumed under that endpoint must then fail construction instead of
-     *  silently replacing the first manager, which would make the first
-     *  session's tools resolve the second manager and let same-id jobs be
-     *  queried, registered, or cancelled across sessions (review thread P1). */
+     *  FOREIGN manager whose authority has not fully settled — a second
+     *  top-level session constructed or resumed under that endpoint must then
+     *  fail construction instead of silently replacing the first manager, which
+     *  would make the first session's tools resolve the second manager and let
+     *  same-id jobs be queried, registered, or cancelled across sessions
+     *  (review thread P1). */
     static registerForEndpoint(endpointId: string, manager: AsyncJobManager): boolean;
     static forEndpoint(endpointId: string | undefined): AsyncJobManager | undefined;
-    static unregisterForEndpoint(endpointId: string): void;
+    static unregisterForEndpoint(endpointId: string, manager?: AsyncJobManager): void;
     /** Reverse lookup: the endpoint this manager is registered under, if any
      *  (review thread P1 — endpoint-scoped lineage resolution). */
     static endpointIdOf(manager: AsyncJobManager | undefined): string | undefined;

package/dist/types/cli/daemon-cli.d.ts

@@ -6,10 +6,11 @@
  */
 import { Settings } from "../config/settings";
 import type { BuiltInDaemonController, DaemonKind } from "../daemon/control-types";
+import { PublicCommandFailure } from "./public-command-errors";
 export type DaemonCliAction = "list" | "status" | "stop" | "restart";
 export type DaemonInternalCliAction = "discord-internal" | "slack-internal";
 export type DaemonCommandAction = DaemonCliAction | DaemonInternalCliAction;
-export declare class UnknownDaemonKindError extends Error {
+export declare class UnknownDaemonKindError extends PublicCommandFailure {
     readonly kinds: readonly string[];
     readonly knownKinds: readonly DaemonKind[];
     constructor(kinds: readonly string[], knownKinds: readonly DaemonKind[]);
@@ -34,6 +35,7 @@ export interface DaemonCommandArgs {
 export interface DaemonCommandDeps {
     settings?: Settings;
     controllers?: BuiltInDaemonController[];
+    /** Internal update orchestration retains result rendering and failure aggregation. */
     setExitCode?: (code: number) => void;
 }
 export declare function parseDaemonArgs(argv: string[]): DaemonCommandArgs | undefined;

package/dist/types/cli/github-release.d.ts

@@ -5,6 +5,7 @@
 import type { UpdateChannel } from "../config/update-channel";
 export declare const RELEASE_REPO = "Yeachan-Heo/gajae-code";
 export declare const GITHUB_API_ORIGIN = "https://api.github.com";
+export declare const GITHUB_WEB_ORIGIN = "https://github.com";
 export declare const GITHUB_RELEASE_DOWNLOAD_ORIGIN = "https://github.com/Yeachan-Heo/gajae-code/releases/download";
 export declare const BINARY_SHA256_ASSET = "gajae-release-binaries.sha256";
 export declare const BINARY_MANIFEST_ASSET = "gajae-release-binaries-v1.json";
@@ -21,12 +22,28 @@ export interface GithubReleaseLookupOptions {
     fetchImpl?: GithubFetch;
     lookupEnv?: (name: string) => string | undefined;
     apiOrigin?: string;
+    webOrigin?: string;
     timeoutMs?: number;
     useAmbientToken?: boolean;
 }
+/** A GitHub REST response that failed, carrying the status the caller must branch on. */
+export declare class GithubApiStatusError extends Error {
+    readonly url: string;
+    readonly status: number;
+    constructor(url: string, status: number);
+    /** 403/429 is how api.github.com reports an exhausted unauthenticated budget. */
+    get isRateLimited(): boolean;
+}
 export declare function isSafeReleaseTag(tag: string): boolean;
 export declare function versionFromTag(tag: string): string;
 export declare function githubReleaseHeaders(token: string | undefined): Record<string, string>;
+/**
+ * Resolve the stable tag through the `github.com` web route, which 302s from
+ * `/releases/latest` to `/releases/tag/<tag>`. That origin serves the binary
+ * downloads too and is not bound by the api.github.com rate limit, so it keeps
+ * `gjc update` working on a shared IP whose unauthenticated budget is spent.
+ */
+export declare function resolveStableReleaseTagFromWeb(options?: GithubReleaseLookupOptions): Promise<string>;
 export declare function fetchGithubChannelRelease(options?: GithubReleaseLookupOptions): Promise<GithubReleaseInfo>;
 export declare function parseChecksumForAsset(text: string, assetName: string): string | undefined;
 export declare function parseManifestChecksum(payload: unknown, assetName: string): string | undefined;

package/dist/types/cli/public-command-entry.d.ts

@@ -0,0 +1,56 @@
+import { type CommandCtor, type CommandEntryContext } from "@gajae-code/utils/cli";
+import { type PublicCommandDescriptor, type PublicCommandFamily, type PublicHelpSection } from "./public-command-registry";
+export type PublicUsageIssueCode = "unknown-path" | "unknown-flag" | "missing-value" | "invalid-value" | "duplicate-flag" | "missing-flag" | "missing-argument" | "unexpected-argument" | "conflict" | "requires" | "exclusive";
+/** Only descriptor-owned names and static messages are safe for output. Never include argv values. */
+export interface PublicUsageIssue {
+    code: PublicUsageIssueCode;
+    message: string;
+    field?: string;
+}
+export interface PublicHelpOptions {
+    section: PublicHelpSection;
+    page: number;
+    revision?: string;
+}
+export interface PublicRetrievalOptions {
+    id: string;
+    sha256: string;
+    page: number;
+    agentDir?: string;
+}
+interface PublicScanBase {
+    descriptor: PublicCommandDescriptor;
+    mode: "text" | "json";
+    args: Record<string, string | string[] | undefined>;
+    flags: Record<string, unknown>;
+    /** Family-relative argv, retaining child paths and operation tokens in their original order. */
+    operationArgv: string[];
+    help: PublicHelpOptions;
+    retrieval?: PublicRetrievalOptions;
+}
+export type PublicCommandScan = PublicScanBase & ({
+    kind: "usage";
+    issues: PublicUsageIssue[];
+} | {
+    kind: "help" | "retrieval" | "operation";
+    issues: [];
+});
+/** Inert, descriptor-driven scanner. argv excludes the already resolved family token. */
+export declare function scanPublicCommand(family: PublicCommandFamily, argv: readonly string[]): PublicCommandScan;
+export interface PublicCommandDispatchContext extends CommandEntryContext {
+    command: PublicCommandFamily;
+    load: () => Promise<CommandCtor>;
+    /** Only operations may initialize settings, transports, themes or runtime globals. */
+    setup?: (report: (diagnostic: {
+        code: "macos_nofile_limit_low";
+        successStderr: string;
+    }) => void) => Promise<void>;
+}
+export declare function isSafeSdkInternalAgentDir(value: string): boolean;
+/** Mirrors commands/sdk.ts parseSdkInternalArgv without eagerly loading its runtime. */
+export declare function isSdkInternalArgv(argv: readonly string[]): boolean;
+/** Mirrors the exact private argv emitted by chat-daemon controller spawns. */
+export declare function isDaemonInternalArgv(argv: readonly string[]): boolean;
+/** Single family boundary, shared by early bootstrap routing and registered utility dispatch. */
+export declare function dispatchPublicCommand(argv: readonly string[], context: PublicCommandDispatchContext): Promise<void>;
+export {};

package/dist/types/cli/public-command-errors.d.ts

@@ -0,0 +1,126 @@
+import type { DaemonOperationResult, DaemonRecovery, DaemonStatus } from "../daemon/control-types";
+import { type EvidenceClassification, type EvidenceContinuation, type EvidenceReference, type EvidenceUnavailableReason } from "./public-command-evidence";
+export type PublicFailureKind = "usage" | "invalid_json" | "unavailable" | "broker_unavailable" | "endpoint_stale" | "broker_restarting" | "authorization_denied" | "timeout" | "wait_timeout" | "uncertain_after_send" | "daemon_unhealthy" | "daemon_stale" | "daemon_mixed" | "operation_failed" | "internal";
+export type PublicEffectProof = "pre-send" | "pre-effect" | "accepted" | "completed" | "sent" | "unknown";
+export interface PublicDaemonTargetOutcome {
+    kind: "telegram" | "discord" | "slack";
+    outcome: "not-applied" | "applied" | "unknown";
+}
+export interface PublicCommandFailureInput {
+    kind: PublicFailureKind;
+    proof?: PublicEffectProof;
+    references?: readonly EvidenceReference[];
+    daemonKind?: "telegram" | "discord" | "slack";
+    restartJustified?: boolean;
+    targets?: readonly PublicDaemonTargetOutcome[];
+    partialStatuses?: readonly DaemonStatus[];
+    /**
+     * Operation results already completed before a later target failed. Without them
+     * a `daemon_mixed` failure tells the caller not to repeat applied mutations but
+     * withholds the resulting state it would have to reconcile against.
+     */
+    partialResults?: readonly DaemonOperationResult[];
+    diagnostics?: readonly PublicCommandDiagnosticCode[];
+}
+export declare class PublicCommandFailure extends Error {
+    readonly input: PublicCommandFailureInput;
+    constructor(input: PublicCommandFailureInput);
+}
+export interface PublicRecoveryStep {
+    description: string;
+    disruption: "none" | "interrupts-work" | "force-kill";
+    requiresConfirmation: boolean;
+    executable?: "gjc";
+    argv?: string[];
+}
+export interface ClassifiedPublicCommandFailure extends EvidenceClassification {
+    message: string;
+    references: EvidenceReference[];
+    nextSteps: PublicRecoveryStep[];
+    partialStatuses?: DaemonStatus[];
+    partialResults?: PublicDaemonOperationResult[];
+    exitCode: 1 | 2;
+}
+/** Bounded projection of a completed daemon operation result for failure envelopes. */
+export interface PublicDaemonOperationResult {
+    kind: "telegram" | "discord" | "slack";
+    action: DaemonOperationResult["action"];
+    ok: boolean;
+    before?: DaemonStatus;
+    after?: DaemonStatus;
+    /**
+     * Typed allowlisted recovery category only. The failure envelope never echoes
+     * controller-supplied free text, so the message, warnings, and remediation
+     * strings of a completed operation stay out of it.
+     */
+    recovery?: {
+        reason: DaemonRecovery["reason"];
+    };
+}
+export declare const EVIDENCE_UNAVAILABLE_WARNING = "Necessary reconciliation evidence could not be retained; no lossless continuation is available. Do not blindly retry the original operation.";
+export type PublicEvidenceStatus = {
+    status: "inline";
+} | {
+    status: "retained";
+    id: string;
+    sha256: string;
+    bytes: number;
+    expiresAt: string;
+} | {
+    status: "unavailable";
+    reason: EvidenceUnavailableReason;
+    requiredBytes: number | null;
+    missingKinds: string[];
+    warning: typeof EVIDENCE_UNAVAILABLE_WARNING;
+};
+export declare const PUBLIC_COMMAND_DIAGNOSTICS: {
+    readonly macos_nofile_limit_low: "The macOS open-file limit is below the recommended minimum; increase it before starting additional concurrent work.";
+    readonly router_cleanup_failed: "SDK session Router cleanup failed.";
+    readonly broker_cleanup_failed: "SDK broker client cleanup failed.";
+    readonly usage_transport_exclusive: "Specify exactly one of --stdio or --socket <path>.";
+    readonly usage_duplicate_option: "Each option on this command may occur at most once.";
+    readonly usage_unknown_argument: "An unrecognized argument was supplied; re-read the command help for its accepted grammar.";
+    readonly usage_missing_value: "An option that requires a value was supplied without one.";
+    readonly usage_invalid_option_value: "An option value is invalid; re-read the command help for its accepted values.";
+};
+export type PublicCommandDiagnosticCode = keyof typeof PUBLIC_COMMAND_DIAGNOSTICS;
+export interface PublicCommandDiagnostic {
+    code: PublicCommandDiagnosticCode;
+    message: string;
+}
+export interface PublicCommandErrorEnvelope {
+    schema: "gjc.command-error";
+    version: 1;
+    ok: false;
+    command: string[];
+    error: Omit<ClassifiedPublicCommandFailure, "exitCode">;
+    diagnostics?: PublicCommandDiagnostic[];
+    omittedOptional: {
+        path: string;
+        reason: string;
+    }[];
+    complete: boolean;
+    evidence: PublicEvidenceStatus;
+    continuation: EvidenceContinuation | null;
+}
+export interface RenderPublicCommandFailureOptions {
+    command: readonly string[];
+    json?: boolean;
+    agentDir?: string;
+    scopeAgentDir?: string;
+    diagnostics?: readonly PublicCommandDiagnosticCode[];
+}
+export interface RenderedPublicCommandFailure {
+    stdout: string;
+    stderr: string;
+    exitCode: 1 | 2;
+    envelope: PublicCommandErrorEnvelope;
+}
+export declare function normalizePublicCommandFailure(error: unknown): PublicCommandFailure;
+export declare function classifyPublicCommandFailure(error: unknown, command: readonly string[]): ClassifiedPublicCommandFailure;
+export declare function renderPublicCommandFailure(error: unknown, options: RenderPublicCommandFailureOptions): Promise<RenderedPublicCommandFailure>;
+/** Retrieval failures never recursively publish evidence or replay an operation. */
+export declare function renderPublicEvidenceUnavailable(unavailable: {
+    reason: EvidenceUnavailableReason;
+    requiredBytes: number | null;
+}, options: RenderPublicCommandFailureOptions): RenderedPublicCommandFailure;