@kodax-ai/kodax 0.7.76 → 0.7.78

package/CHANGELOG.md

@@ -6,398 +6,785 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
-## [0.7.76] - 2026-07-25
-
-> Git tag and GitHub Release are published by the release workflow. npm
-> publication remains the operator's final manual step.
-
-### Changed
-
-- **Kimi Code defaults to the official K3 256K route.** The `kimi-code`
-  provider now defaults to `k3-256k` and sends that exact upstream model ID.
-  `kimi-for-coding` remains selectable for K2.7 Code, alongside
-  `kimi-for-coding-highspeed` and the 1M `k3` tier. K3 now exposes the
-  documented `low` / `high` / `max` reasoning levels with `high` as default;
-  media metadata marks `k3-256k` as image-capable but not video-capable, and
-  nominal subscription accounting reflects the 1M `k3` route's roughly 2x
-  quota consumption.
-
-### Verification
-
-- Added direct live-wire smoke coverage for all four Kimi Code subscription
-  routes: `k3-256k`, `k3`, `kimi-for-coding`, and
-  `kimi-for-coding-highspeed`.
-
-## [0.7.75] - 2026-07-24
-
-> The npm package was published manually. The `v0.7.75` Git tag and GitHub
-> Release were skipped; the binary-release changes roll into `v0.7.76`.
-
-### Changed
-
-- **Exact audited npm candidate bytes.** The release script now packs first,
-  audits the generated Sidecar prompt and budget bridge, and publishes that
-  exact tarball so SDK validation and registry publication cannot drift.
-- **Windows GUI background-process hardening.** Runtime
-  Worker-reachable non-interactive child processes now request hidden Windows
-  consoles across memory/Git metadata, provider CLI and ACP, LSP, clipboard,
-  worktree, review, extension-command, checkpoint, and sandbox paths. Explicit
-  editor, terminal, and PTY interaction remains unchanged.
-- **Published Runtime Worker audit and packaged-host regression.** The bundle
-  build now audits statically identifiable child-process calls in the published
-  Runtime Worker, and the packaged Electron daemon smoke runs 20 ordinary
-  queries with a Win32 console-visibility probe. Packaged KodaX Space validation
-  on Windows 10 and Windows 11 remains a non-blocking product follow-up; it does
-  not gate the tag, package build, or npm publication.
-
-### Fixed
-
-- **Sidecar completion and Runtime terminal semantics.** Optional work offered
-  after the current request is complete is accepted rather than reported as
-  blocked; only clarification required to finish the current request remains
-  blocked. Budget-approval state is emitted only for an eligible `revise`, and
-  structured blocked codes and reasons survive live events, persistence,
-  daemon round trips, and restart recovery.
-
-### Documentation
-
-- Updated the release guide, current architecture/design baselines, SDK
-  embedder guidance, feature index, roadmap, issue tracker, English/Chinese
-  READMEs, and the v0.7.75 regression guide for the SDK validation candidate.
-- Rescheduled FEATURE_263 from v0.7.75 to v0.7.77 and then to v0.7.78; moved
-  FEATURE_274 from v0.7.76 to v0.7.77. v0.7.75 and v0.7.76 remain feature-free
-  stabilization releases.
-
-## [0.7.74] - 2026-07-23
-
-> Git tag and GitHub Release are published by the release workflow. npm
-> publication remains a separate manual operator step.
+## [0.7.78] - 2026-07-29
 
 ### Added
 
-- **Absolute automatic-compaction threshold (FEATURE_272).** SDK, Runtime
-  Session settings, daemon protocol, REPL, and KodaX Space now expose an
-  optional token threshold. Missing/zero is inactive; otherwise the smaller of
-  the absolute limit, bounded percentage policy, and physical provider capacity
-  triggers compaction. Percentage defaults to 75% and clamps to 15-90%, while
-  automatic large compaction remains always enabled.
-- **Context-owned compaction telemetry and transcript paging.** Root and child
-  turns now carry stable `contextId`/revision ownership. The canonical
-  `context.compaction.finished` event reports committed before/after and
-  component metrics. Runtime observations use bounded transcript slices,
-  revision-bound pages, and lossless chunks for oversized entries; clients can
-  require `contextCompaction:3`, `transcriptPaging:1`, and
-  `transcriptSearch:1`.
-- **Durable exact-history recovery.** The root host now persists and flushes
-  exact pre-compaction lineage before evicting raw bodies. Island sidecars are
-  committed before the slim main Session, stable entry IDs deduplicate overlap,
-  and failures preserve the last exact live or persisted copy. Root Agents gain
-  bounded `session_history_search` / `session_history_read`; SDK and daemon
-  clients gain revision-bound `sessions.transcriptSearch()`.
-- **Runtime active-run interrupt input.** Embedded Runtime and the shared daemon
-  now advertise `interruptInput:1`. `runtime.runs.submitInput()` queues cloned,
-  ordered input for the current active Actor Run, delivers one FIFO batch as
-  separate user messages at the next safe Runner boundary, and exposes durable
-  queued/delivered lifecycle facts without creating a continuation Run or
-  leaking terminalized input into a later Run.
+- **Evidence-Gated Background Skill Learning (FEATURE_263).** Completed the
+  Memory-first learning loop with durable non-blocking review, immutable
+  project-scoped learned Skill revisions, canonical record/fingerprint-gated
+  discovery, exact-use outcome attribution, bounded three-use canaries,
+  independently verified project activation, and full `/learn`/Runtime Learning
+  Center controls. Protected/formal Skills, global promotion, and Extension
+  authoring remain explicit user actions.
+- **Complete First-Run Split Configuration (FEATURE_276).** `kodax setup`,
+  first-run onboarding, and `--custom` now create and validate the core, MCP,
+  Extensions, and A2A active files plus annotated templates without
+  overwriting existing configuration or collecting secrets. Legacy integration
+  declarations are preserved and all cooperating writers share the same
+  lock/revision boundary.
+- **Standalone Sandbox SDK.** Added the `@kodax-ai/kodax/sandbox` subpath with
+  typed capability, doctor, setup/activation guidance, and explicit
+  host-owned contained command execution. The generic API reports structured
+  unavailability and never silently executes without containment.
+- Added read-only `/sandbox` diagnostics and optional `tool.sandbox` Runtime
+  events. Ordinary startup, history, and command cards remain quiet.
 
 ### Changed
 
-- **Mailbox-driven Agent coordination (FEATURE_273).** Model-visible
-  `wait_agent` now accepts only a bounded timeout and yields on the caller's
-  mailbox, root user input, interruption, or expiry. Progress remains available
-  through Actor snapshots, event replay, and SDK long-poll without waking and
-  resampling the parent model. The tool returns only a wake acknowledgement;
-  authenticated Agent messages and structured completion metadata enter the
-  transcript once at the next safe boundary. `list_agents` owns tree-state
-  inspection and `agent_output` owns targeted result reads.
-- **Resident Goal lifecycle contracts.** `get_goal`, `create_goal`, and
-  `update_goal` keep their complete descriptions on both SA and managed AMA
-  paths. This removes an avoidable discovery round trip while preserving the
-  explicit-create and three-turn blocked-state rules. The remaining deferred
-  set stays at exactly 11 tools; schemas, handlers, permissions, Goal state, and
-  compaction-protected receipts are unchanged.
+- **Intent-Aligned Auto[LLM] Permission and ASRT Execution (FEATURE_277).**
+  Precisely modeled ordinary reads and workspace/system-temp mutations bypass
+  classifier latency independently of sandbox readiness. Other actions are
+  reviewed against bounded user intent and exact side effects; approval timeout
+  cancels only the current operation. ASRT is optional execution containment,
+  not permission authority, and admitted commands reuse a workspace-scoped
+  session instead of paying initialization/reset per command.
+- The published bundle now exposes 12 SDK subpaths (13 entries including the
+  root), adding `/sandbox`; README, README_CN, the SDK embedder guide, and
+  `kodax_manual` describe the same surface.
 
 ### Fixed
 
-- **Large compaction coverage and protected-tail basis.** Major compaction now
-  protects 20% of the effective trigger rather than 20% of the model maximum,
-  summarizes the complete eligible prefix in one transaction, and uses
-  map-once/reduce-once only for physical overflow. Exact main-request prefix
-  reuse preserves prompt/KV cache on both ordinary and managed-task paths while
-  explicitly excluding the protected raw tail from the summary.
-- **User intent retention across repeated and degraded compaction.** Genuine
-  user queries are mechanically retained in a stable JSONL checkpoint ledger,
-  including text carried beside tool results. A query is represented exactly
-  once: raw while it remains in the protected tail, then in the ledger when its
-  prefix is compacted. The explicit emergency-pruning fallback installs query
-  recovery before removing old raw evidence.
-- **SDK/UI accounting and daemon frame safety.** The legacy compact callback now
-  reports post-compact tokens on both execution paths, and automatic managed
-  compaction emits the same post-commit canonical event/report as the standard
-  agent path. Persisted anchors include admitted post-compact attachments.
-  Space ignores child context metrics for the root gauge/activity/cost display,
-  displays the last root transition, labels active model input separately from
-  complete visible history, and reads transcripts directly through bounded
-  page/chunk calls. The legacy full-transcript daemon method rejects responses
-  above 512 KiB instead of risking the 8 MiB frame.
-- **Compacted-history loss and maintenance replay.** Full-lineage loads now
-  merge exact sidecar entries over slim placeholders, compaction writes use a
-  durable-before-evict boundary, child compaction cannot overwrite root
-  lineage, and maintenance preserves its append watermark instead of archiving
-  the same island entries again.
-- **Agent completion delivery and resumed transcripts.** Unacknowledged root
-  completions persist an explicit pending-delivery set and are republished after
-  a hard restart; same-process Runtime reconstruction deduplicates the projected
-  queue by child turn ID, while acknowledged and legacy historical completions
-  are not replayed. Completion acknowledgement remains after authoritative
-  transcript persistence. Session restore also deduplicates and canonically
-  repositions tool groups by tool-use ID and binds repeated text to the latest
-  persisted suffix.
-- **Deterministic reads, bounded tool attention, and compaction round exits.**
-  Auto Mode now handles complete risk-free static reads deterministically while
-  sensitive paths, credential stores, process environments, and named secret
-  variables require confirmation. Grep clips pathological lines and exposes
-  bounded offset continuation; one batch-admission owner separates physical
-  capacity from tool-attention spill. Current user-shaped and legacy compaction
-  checkpoints no longer cause a compacted query/final pair to be appended twice.
-- **Release-review boundary fixes.** Emergency compaction fallback accounts for
-  system/tool overhead and response reserve before pruning and reports no
-  success for unchanged or still-oversized candidates. Runtime-backed REPL paths
-  use one Session writer, first-run headless compaction seeds Session metadata,
-  persistence failure rolls back tentative context revision, and history search
-  consistently excludes system/hidden/checkpoint/placeholder content. Auto
-  permission analysis samples the middle of long operation lists, POSIX paths
-  are not mistaken for Windows switches, and continuation errors identify
-  `runtime.runs.submitInput` accurately.
-- **Release-candidate checkpoint and PowerShell boundary closure.** Session
-  lineage now consumes and re-renders the exact compaction checkpoint bytes,
-  including recovery guidance, so the compaction entry, first-kept pointer, and
-  post-compact attachments remain on the active path; legacy suffix-free
-  checkpoints still resume. Auto Mode treats bracket wildcards on PowerShell
-  path parameters as incomplete and escalates them, while exact `LiteralPath`
-  filenames containing brackets remain supported.
-- **Reliable continue-most-recent selection.** `kodax -c`, classic/Ink startup,
-  one-shot CLI execution, and coding-runtime auto-resume now scan beyond the
-  legacy ten-session window, skip zero-message ACP/bootstrap placeholders, and
-  preserve an explicit session ID. Interactive resume restores the saved
-  workspace runtime together with messages, UI history, lineage, artifacts,
-  extensions, title, tag, and session identity before the next turn.
-- **Deterministic Auto mode switching.** Entering Auto now displays the resolved
-  configured engine immediately instead of a transient bare `Auto`, and Runtime
-  setting writes are serialized per Session so rapid shortcut cycling is
-  last-action-wins. Persisted or automatic `Auto[RULES]` fallback remains sticky
-  by design and can be changed explicitly with `/auto-engine llm`.
-- **Release-review debt closure.** Imperative manual compaction now reconciles
-  the exact flat Session history into lineage before creating the compaction
-  island. A failed durable interrupt-delivery event leaves the input queued,
-  rethrows the persistence error, and emits a bounded `runtime.warning` without
-  copying user input content into diagnostics.
+- The v0.7.78 semantic release gates now use frozen, resumable current-policy
+  runners instead of absent or historical fixtures. F263 revision
+  `f263-v0.7.78.4` freezes production learning-review and downstream action
+  bytes; F277 revision `f277-v0.7.78.4` freezes the intent-aligned permission
+  prompt and exact action evidence. Both default to zero provider calls, require
+  explicit owner authorization plus a feature-specific generation flag, keep
+  raw/blind-review evidence outside the repository, and fail closed on
+  case/prompt/scorer drift.
+- The first F263 paid validity pilot (`f263-v0.7.78.2`) correctly stopped after
+  4 calls: three outputs were rejected by the production normalizer and neither
+  positive sample produced a project canary. The production report contract now
+  requires `memoryPlan` and `capabilityDecision` as top-level siblings and
+  states the governed `requiresApproval=true` invariant without weakening the
+  strict normalizer or changing Skill admission policy.
+- The subsequent F263 `.3` safety panel found no credible high-severity harm:
+  no negative case normalized to a project canary and all nine positive raw
+  decisions selected `project_canary`. It also exposed one systematic utility
+  mismatch: six human-readable Skill names failed the production slug
+  invariant, leaving only 3/9 normalized positive canaries. The production
+  prompt/tool schema now state the existing lowercase hyphenated-slug and
+  64-character constraints. Strict validation, evidence thresholds, scope,
+  canary admission, and promotion policy remain unchanged; downstream expansion
+  stopped and fresh `.4` revisions bind the corrected bytes to one exact
+  candidate.
+- Runtime Actor trees now persist one exclusive owner per Session. A second live
+  Runtime can no longer recover another Runtime's active child turns; stale
+  controllers self-fence on CAS conflict, physically abort local executors,
+  refresh durable state and mailbox events, and expose actionable
+  `actor_owner_conflict` diagnostics. Runtime close and Session deletion release
+  ownership safely; archive/delete retain the owner through the filesystem
+  operation, while deletion quiesces executors before removing the file and
+  then performs a no-write local dispose. A per-Session gate closes Run/Agent
+  admission races with archive/delete, and SA root Runs now claim the same
+  owner fence. A Runtime-scoped loopback identity challenge now distinguishes
+  a live owner from an unrelated process that reused its PID: refused or
+  completed mismatched challenges prove stale, while timeouts and unknown
+  failures stay fail-closed. Legacy snapshots without an identity challenge
+  remain fail-closed because their live owner cannot be proven. Archived Sessions
+  reject Run/Agent execution and in-place mutation until unarchived, and
+  archived Actor CAS writes stay in the exact archived file instead of
+  recreating an active duplicate. Failed deletion retains its authoritative
+  snapshot and owner for retry, paired archive moves roll back on sidecar
+  failure, and external task aborts cover queued, preflight, pending, and
+  ambiguous start admission with a prompt `AbortSignal`, A2A request-level
+  propagation, retained per-Agent start ordering, coalesced reference-aware
+  cancellation, and bounded Actor-turn convergence.
+  Actor recovery preflight is byte-for-byte read-only, and Session recovery re-reads under the
+  cross-process lock without bypassing Actor ownership or moving archived data.
+  Stale full Session saves cannot replace the Actor CAS sub-snapshot, and all
+  full rewrites/island maintenance retain the resolved archived path.
+  Failed initialization releases a newly claimed fence and supports
+  same-instance/double-failure cleanup. Raw maintenance and retention reject
+  owned/non-terminal trees, complete Session file sets delete through
+  rollback-safe staging, and cross-process append revalidates and merges stale
+  watermarks plus same-length identity rewrites on the exact resolved path.
+  Runtime client, Worker, hosted-daemon, host, lease, and executor-plane close
+  attempts are shared and retryable after partial failure or timeout.
+- SDK daemon auto-start accepts an opt-in `daemonOrphanExitMs` lifecycle
+  contract. A newly ready daemon arms bootstrap grace even if its launching
+  client crashes before initialize; attach cancels the timer, and loss of the
+  final logical client starts a fresh full grace period. Other clients cancel
+  it, governed active work defers shutdown until terminal/idle state, and only
+  then does the daemon release its endpoint, state, and owner lock. Ordinary
+  CLI persistent daemons remain unchanged. The dedicated
+  `daemonOrphanExit:1` capability reports that the current host actually has
+  the policy enabled, and both Runtime facades safely replace an idle
+  persistent owner before relying on it.
+- Invalid optional MCP, A2A, or Extension configuration no longer aborts
+  daemon cold start. Each domain fails independently to a visible safe-empty
+  state, retains last-known-good data on later invalid edits, watches legacy
+  `config.json` fallbacks, and hot-recovers without mutating user files.
+  Detached bootstrap output is retained in continuously bounded logs, and the
+  daemon advertises the versioned `integrationConfigResilience` contract.
+- Auto[LLM] now retries classifier timeout/provider/contract failures once,
+  enforces its deadline even when a provider ignores cancellation, exposes
+  bounded prompt-size and TTFT phase diagnostics, and then degrades at the
+  Accept-edits boundary without switching to Auto[rules]. Classifier
+  concerns request user confirmation instead of hard-blocking. Exact,
+  explicitly requested workspace copy/move/rename/delete/write/create shell
+  calls can proceed without an LLM round trip independently of sandbox
+  readiness. ASRT adds optional execution containment; unavailable or
+  pre-launch-failed local containment falls back to the ordinary path without
+  another classifier/approval. Admitted commands in one workspace reuse a
+  long-lived ASRT session, so session-level initialization/reset is not paid
+  on every command. Normal history stays quiet, while `/sandbox` provides
+  explicit diagnostics and SDK hosts can opt into structured events.
+- Runtime Auto capability negotiation now requires
+  `runtimeAutoModeGuardrail:4` for daemon auto-start and consistently reports
+  `fallbackPersistsEngine:false` from embedded, Worker, and daemon hosts. An
+  idle v3 daemon is replaced before a v0.7.78 client relies on the
+  intent-preserving, non-Rules fallback contract.
+- The built-in A2A listener now rejects explicit Fetch-blocked ports and
+  retries ephemeral allocation when the operating system selects one, so a
+  successfully returned loopback URL is usable by Fetch-compatible clients.
+- `/learn promote` now has dedicated help, strict `--scope user` validation,
+  name/slug/capability-ID disambiguation, command completion, v2 learned-record
+  transport across inline/Worker/daemon, reviewed `ready` or `active_learned`
+  admission, and atomic non-overwriting publication with symlink/junction
+  containment and idempotent repeat behavior.
+- Learned Skill canaries now remain in `testing` until all three exact-revision
+  outcomes settle, activate only with at least one independently verified
+  success, and revalidate revision/fingerprint inside the second locked
+  invocation mutation. A stale artifact identity cannot consume a canary slot
+  or be attributed to the current revision.
+- Root AMA runs now execute the same governed MemorySession lifecycle as the
+  standard Agent path. The new root-only `memory_intent` signal binds an exact
+  current-user quote, distinguishes captured/queued/applied states, retains
+  durable review evidence, serializes review drains, and prevents generated
+  resume text or child Agents from authorizing Memory writes. Explicit
+  host-bound intent survives a later root cancellation without preserving
+  observations or lessons from the cancelled task; foreground completion still
+  stops at durable review enqueue rather than waiting for semantic review.
+- Workspace ASRT shell containment now denies reads from sensitive home
+  credential paths and the complete resolved agent home. Home-local executable
+  search paths cannot carve access back into a denied subtree; ordinary
+  external reads, workspace/temp writes, bootstrap execution, and the existing
+  network policy remain unchanged.
+- Edit mode no longer sends already-allowed static Skill loading to the client
+  permission broker, and Plan mode can load static instructions without
+  authorizing their later side effects. Dynamic Skill commands are blocked
+  live in Plan and otherwise require an explicit host-controlled executor;
+  protected writes and non-read-only shell actions keep their normal gates.
+- Managed Workflow Actor waits no longer turn the Actor API's internal
+  30-second polling window into a misleading `undefinedms` failure when the
+  workflow has no explicit timeout. Explicit deadlines remain authoritative,
+  and terminal Actor output closes event-delivery races.
+- The resume Session picker now renders stored timestamps in the host's local
+  timezone instead of presenting UTC values without a timezone marker.
+- The Windows ordinary-query regression now gives temporary recursive removal
+  a bounded native retry window for the intentionally non-blocking governed
+  Memory review queue. The release gate no longer fails with transient
+  `ENOTEMPTY`, without making background review block foreground completion.
 
-### Documentation
-
-- Root and generated JSONC templates, both READMEs, architecture/design docs,
-  the SDK embedder guide, feature/issue trackers, release verification guide,
-  package READMEs, and `kodax_manual` now describe the complete v0.7.74
-  compaction, mailbox-wait, active-run input, Goal-tool, resume, Auto-switch,
-  and recovery contracts.
+## [0.7.77] - 2026-07-27
 
-## [0.7.73] - 2026-07-20
+> Released as Git tag `v0.7.77`, GitHub Release, and
+> `@kodax-ai/kodax@0.7.77` on npm. Frozen F274/F275 paid evaluation completed
+> with a joint owner `SHIP` decision; no unmeasured task-effect, token, or
+> latency improvement is claimed.
 
 ### Added
 
-- **Qwen Token Plan provider.** The new `qwen-token-plan` alias uses the
-  Anthropic-compatible Alibaba Cloud Token Plan endpoint and
-  `QWEN_TOKEN_API_KEY`. It defaults to `qwen3.8-max-preview`, exposes the
-  supported Qwen 3.7/3.6, GLM-5.2, and DeepSeek V4 Pro routes with one-million-
-  token context metadata, and declares verified reasoning, image-input, and
-  nominal subscription-cost capabilities without changing the existing `qwen`
-  provider.
-- **First-run provider setup (FEATURE_271).** A bare interactive `kodax`
-  launch with no selected provider and no supported local credential now opens
-  a focused provider/model setup flow before Runtime, daemon, session, or REPL
-  startup. `kodax setup` reruns the same flow explicitly. It stores only
-  non-secret metadata, preserves unrelated config through a revision-checked
-  atomic write, refuses malformed existing custom providers and credential-
-  bearing endpoint URLs, and then names the required environment variable and
-  terminal restart steps.
-- **Typed Auto Mode SDK contract (FEATURE_271).** The root and REPL SDK
-  entries now export one pure `resolveAutoModeSettings()` plus the authoritative
-  loader and related types; `loadConfig().autoMode` is declared, Runtime Session
-  settings persist `autoModeSpeculativeWindowMs` (including `0`), and side
-  queries return prompt-free provider/model/timing/retry/phase diagnostics.
-- **Runtime-owned concrete permission grants.** Embedded and daemon SDK clients
-  can submit concrete `toolInput` and `executionCwd`, receive only opaque
-  Runtime-issued Session/persistent grant suggestions, and select a suggestion
-  without constructing or widening its hidden matcher. Exact command, known
-  file-tool path, and generic exact-call matchers remain revisioned and audited;
-  dynamic or dangerous shell calls never receive a persistent suggestion.
+- **Host-configurable Shell Execution Contract.** Runtime callers can persist a
+  JSON-only `shellExecution` policy per Session or override it per Run,
+  selecting pwsh, Windows PowerShell, cmd, bash, zsh, or an explicit Git Bash
+  path. Configured runs resolve a credential-filtered environment through the
+  selected shell in the effective cwd, cache it by contract/cwd with strict
+  TTL or `refreshToken` invalidation, and execute through that same explicit
+  interpreter. Native child Agents and AMA deterministic evaluators inherit
+  the policy, command grants bind to its hash, and unconfigured callers retain
+  legacy shell behavior.
+- **Pattern-aware adaptive AMA (FEATURE_274).** Ordinary AMA now shares one
+  six-pattern problem-solving catalog with Workflow semantics while continuing
+  to execute through the existing Runtime-owned Actor/Turn tree. Optional
+  `quality_strategy` metadata distinguishes coverage, replication, opposition,
+  filtering, judging, and challenge intent; Runtime derives a bounded,
+  fact-only `PatternTrace`, and the existing Sidecar remains the sole
+  terminal-answer quality adjudicator. Pattern presence does not activate a
+  Workflow, force a child, create a fixed topology, or add another verifier.
+- **Governed event-triggered memory intervention (FEATURE_275).** Tool failure,
+  verification failure, and durably committed compaction can rebuild a closed,
+  prompt-safe candidate set before the next Action-LLM request.
+  `MemorySession.intervene()` performs deterministic exact selection by
+  default; an in-process host may opt into the bounded `memoryRecallRunner` or
+  `createCodingMemoryInterventionRunner()`. F228 remains the only durable
+  memory authority, daemon DTOs reject the function binding, and malformed,
+  unknown, stale, timed-out, or cancelled selector output fails silent.
+- **Public Kimi K3 route.** The `kimi` provider now exposes `kimi-k3` with a
+  1,048,576-token context and the same K3 reasoning profile used by Kimi Code,
+  while preserving `kimi-k2.7-code` as the public default.
 
 ### Fixed
 
-- **Reasoning, Auto Mode, and confirmation regressions.** Native
-  disabled-thinking requests now send the provider's explicit disabled form
-  only for models that declare support (including verified Qwen Token Plan 3.7
-  routes); always-thinking variants retain their declared behavior. Sidecar
-  queries preserve a supported `none` effort, persisted Runtime Auto engines
-  are not overwritten by a fresh REPL, `/mode` synchronizes before reporting
-  success, and concurrent confirmation prompts are serialized instead of
-  replacing one another.
-- **Legacy permission-grant upgrade safety.** Matcherless grants persisted by
-  older releases remain visible and revocable but can no longer authorize a
-  concrete tool call. The next invocation requires a fresh Runtime-issued
-  matcher, so old coarse Bash grants cannot bypass exact-command, dynamic-shell,
-  or absolute-deny protections.
-- **Classifier credential boundary.** Auto[LLM] now redacts explicitly named
-  credential values inside shell-escaped JSON before sending an action to its
-  side provider, while retaining adjacent operational fields. Redaction is
-  documented as defense in depth; arbitrary Base64/hex values are not treated
-  as secrets without a credential signal.
-- **Todo/Actor semantic progress checkpoint (FEATURE_270 follow-up).** Worker
-  guidance now treats Todo rows as user-visible milestones rather than Actor
-  instances and requires timely updates at milestone boundaries. Structured
-  terminal child results arm one deduplicated, warn-only reconciliation
-  reminder; transcript scans are append-incremental with safe compaction
-  fallback, and Sidecar accept-time residual reconciliation emits a diagnostic
-  without changing its existing bridge contract.
-- **Auto LLM classifier timeout and missing-model escalation.** Runtime now
-  treats omitted Auto engine as the documented LLM default and still owns the
-  guardrail, while a missing/blank/malformed effective classifier model fails
-  as a typed recoverable Runtime error or a local block in the shared
-  `createAutoModeToolGuardrail` boundary. The final guardrail check runs before
-  provider lookup and cannot invoke `askUser`, record a circuit-breaker error,
-  or downgrade to rules. Classifier requests strip assistant prose/thinking,
-  cap normalized transcript/tool-result/action/prompt bytes, remove image
-  paths, and cap the structured response at 256 tokens. The 20-second deadline remains bounded:
-  a four-call `zai-coding/glm-5.2` probe completed representative Windows
-  permission verdicts in 1.9–2.8 seconds, while the matching production session
-  revealed a 1.625 MB tool result that had bypassed the existing sanitizer.
-- **Auto guardrail daemon and tracing semantics.** Auto-started Runtime clients
-  now require `runtimeAutoModeGuardrail:3`. It retains v2's effective
-  timeout/window defaults, bounded classifier input, and diagnostics metadata,
-  and adds opaque concrete-grant semantics. Capability negotiation is monotonic
-  (v3 satisfies v2/v1); idle older daemons use the existing fenced upgrade path,
-  while busy daemons are left untouched with a recoverable error. Guardrail
-  spans now cover the awaited callback instead of timing only final verdict
-  emission.
-- **Concurrent daemon startup publication race.** A cleanly exiting loser now
-  gives the elected owner a bounded publication grace period, preventing an
-  SDK starter from reporting failure during the short lock/state handoff gap.
-- **Guardrail/permission execution parity.** Both Runner paths now commit each
-  guardrail rewrite before permission policy and execution, reject correlation-
-  id rewrites, propagate blocks as visible audited tool results, and preserve
-  embedded host policy hooks while rejecting non-transportable daemon hooks.
-  Calls rewritten into Bash retain serialized shell ordering.
-- **Managed-run capacity and tool-dispatch accounting.** A complete system
-  prompt override no longer double-counts Skills, missing provider usage rebases
-  from the final request envelope, and authoritative provider usage remains
-  intact. Non-Bash tool calls keep parallel dispatch, Bash remains sequential,
-  and aggregate tool-result spill decisions use the complete batch budget.
-
-## [0.7.72] - 2026-07-19
-
-### Added
-
-- **Learning Center and learned-capability Runtime control plane
-  (FEATURE_266).** KodaX now owns learned capability lifecycle, notification
-  cursors, lower-precedence learned Skill discovery, F224 proposal projection,
-  promotion/rollback actions, and inline/Worker/daemon SDK parity through one
-  agent-layer service. `/learn`, status summaries, and the Ink learning segment
-  expose the same durable state without creating a second runtime engine.
-- **Unified adaptive Actor/Turn control plane (FEATURE_270).** AMA collaboration
-  now uses one Runtime-owned actor tree and scheduler across native, recursive,
-  Workflow-owned, constructed, and external Agent work. The canonical
-  `spawn_agent`, `send_message`, `followup_task`, `wait_agent`,
-  `interrupt_agent`, `list_agents`, and `agent_output` surface supports reusable
-  Actor identities, durable Turn history, direct-parent completion, recursive
-  delegation, shared capacity, and SDK/daemon recovery. A manifest-first,
-  fail-closed behavioral eval driver freezes the released/current production
-  prompt and tool bytes, call graphs, budgets, raw evidence, and blind review
-  mapping before any separately authorized provider call.
-
-### Changed
-
-- **Current coding-eval aliases and MiniMax default model.** Newly authored or
-  revised evals now route Zhipu through `zhipu/glm52` (`glm-5.2`) and MiniMax
-  through `mmx/m3` (`MiniMax-M3`). `minimax-coding` now defaults to M3 while
-  the old `zhipu/glm51` and `mmx/m27` aliases remain explicitly selectable for
-  historical replay; existing raw evidence and reports keep their original
-  route labels.
-- **AMA and Workflow orchestration cutover.** AMAW and the old model-visible
-  child-task vocabulary are retired. Persisted `amaw`/`ama-workflow` settings
-  migrate once to AMA, while new inputs fail with a migration hint. Workflow
-  remains available for explicit natural-language, command, named-pattern, and
-  SDK requests, but its child Agents now use the unified Actor scheduler and
-  task complexity alone no longer activates Workflow.
-
-### Fixed
+- Daemon startup now waits for the matching healthy owner state to publish
+  `status: ready` before returning, unrefing its child, or attaching a
+  concurrent CLI/SDK starter. Owned, competing, and pre-existing-owner paths
+  share the same bounded, cancellable identity fence, preventing successful
+  starts or SDK connections from observing a stale `starting` state.
+- Missing local files referenced by historical image blocks no longer poison every later
+  Provider request. Anthropic-compatible user/tool-result images and OpenAI-compatible user
+  images now degrade only `ENOENT`/`ENOTDIR` to a path-free text marker; unrelated filesystem
+  errors remain visible. OpenAI-compatible tool-result image blocks also use path-free
+  missing/unsupported markers instead of serializing absolute local paths.
+- Added stable, opaque Provider prompt-cache affinity for Kimi Code and other
+  verified endpoints. AMA/SA root requests reuse one logical-context key across
+  runs, retries, fallback, resume, and compaction; child Agents use stable
+  canonical-path keys isolated from their parent and physical worker Sessions.
+  Kimi Code lowers it to Anthropic-compatible `metadata.user_id`, public Kimi
+  and official OpenAI use `prompt_cache_key`, strict compatible gateways remain
+  opt-in, and the effective SDK/run-scoped/env `disablePromptCache` policy
+  removes all cache-routing metadata. Cache diagnostics expose only a separate
+  hash of an affinity key actually supported by the configured wire, never the
+  key or logical identity itself.
+- Preserved official CLI cache usage end to end. Codex CLI
+  `cached_input_tokens` / `cache_write_input_tokens` and Gemini CLI
+  `stats.cached` now survive the JSONL parser, pseudo-ACP, normalized Provider
+  usage, and Runtime diagnostics. Explicit Provider zero remains `0`; missing
+  or invalid fields remain absent, and input totals are never recomputed by
+  adding cache breakdowns. The bridge now also keeps generated ACP IDs separate
+  from native Codex/Gemini session IDs: first prompts start fresh, only
+  CLI-reported native IDs may be resumed, stateless calls cannot share a
+  process-global session, failed/disconnected pseudo transports are recreated,
+  pending handshakes and later transport deaths are invalidated for reconnect,
+  and missing or non-zero-exit CLI completion fails visibly even when a
+  successful completion event was reported earlier. Default aborts remain
+  user cancellation, while hard/idle timeout abort reasons propagate into the
+  normal retry and failure path instead of becoming an empty success. The
+  configured CLI executor timeout is now enforced through process-tree
+  termination, including after a CLI reports success but never exits; native
+  ACP prompts also stop waiting at the caller deadline even if a server ignores
+  the best-effort cancel request.
+- Hardened the Shell Execution Contract after adversarial review: configured
+  commands now deny credentials for every registered Provider, preserve a
+  Session contract when a Run context contains explicit `undefined`, rebuild
+  Windows Registry environments without stale `%PATH%` or tool-manager
+  variables, reject unsupported PowerShell profile/command switches, remove
+  `NODE_OPTIONS` before probing, honor explicit environment denies, and avoid
+  cmd-only hints under PowerShell or Git Bash. Last-waiter cancellation now
+  terminates an in-flight profile probe without interrupting shared waiters.
+  A targeted Windows CI gate covers the cross-platform shell paths.
+- Rebuilt the supplied v0.7.77 package from the cache-stability fix and added
+  an end-to-end AMA automatic-compaction regression. Before and after
+  compaction, native and legacy Providers now prove the Skills addendum and
+  selected Skill are injected exactly once per Worker request, remain visible
+  to context-budget diagnostics, and never persist in compactable history.
+- Repaired nested `agent-turn:` evidence fence sanitization so downstream child
+  briefings use invisible zero-width separators instead of visible mojibake.
+- Made queued Runtime interrupt validation atomic at the batch boundary:
+  invalid artifacts now leave every accepted prompt queued and append no
+  partial user-message batch.
+- Extended governed-memory prompt safety to qualified credential sentences and
+  advanced its frozen evidence fingerprint to cover the policy identity and
+  renderer limits.
+- Aligned terminal contracts by emitting `onComplete` on iteration exhaustion
+  and deriving live-turn status from the final result; pattern-disposition
+  output Schema now enforces the parser's exclusive target forms.
+- Taught the workflow structured-output validator to honor `oneOf`
+  (exactly-one-variant), so Schemas using it—including the
+  pattern-disposition envelope—are genuinely validated instead of silently
+  passing, and remain legal for workflow `outputSchema` declarations.
+- Completed the Runtime diagnostics query contract for reconnecting hosts.
+  Budget, tool-exposure, compaction-skip, and provider-cache diagnostics now
+  carry stable logical `contextId` / `parentContextId` identity while retaining
+  isolated child transcript Sessions. Inline and daemon Runtime services expose
+  `latestProviderCacheDiagnostic(filter?)`; root defaults and child
+  Session/Agent isolation share the same strict matching semantics. Existing
+  hash-only request-envelope, ephemeral-suffix, retry/fallback/repair, and
+  compaction diagnostics remain intact.
+- Extended prompt-cache and context-budget diagnostics to the SA substrate used
+  by Runtime child Agents, including retries, non-streaming fallback, workflow
+  digest, structured-output repair, and compaction summary requests. Diagnostics
+  now hash the Provider-visible projection, endpoint query, ephemeral suffix,
+  and complete request envelope while reporting only Provider-supplied cache
+  usage. Child cache controls preserve explicit `true` and `false` end to end.
+- Kept the default child leading System prefix stable while restoring the
+  documented full specialist System override and write-child project mutation
+  rules. Runtime Actor children retain recursive AMA collaboration semantics on
+  the direct Runner substrate; actorless and protocol-owned Workflow leaves
+  remain SA with collaboration tools and guidance hidden.
+- Separated Runtime Actor mailbox routing and logical context identity from
+  each child's isolated transcript session so child-to-grandchild wait/output
+  delivery completes reliably, follow-up diagnostics keep stable identities,
+  and synthetic digest/repair calls cannot advance canonical history revisions.
+- Enforced specialist tool ceilings across descendants, Actor provider ceilings
+  across final routing and fallback, and model-visible collaboration guidance
+  against the final tool table. Direct children no longer see an unbound
+  `run_workflow`; actorless Workflow leaves execute under their admitted Actor
+  capability snapshot and use collision-free Actor paths for diagnostics.
+- Kept canonical context revisions aligned with core-owned compaction storage:
+  a post-commit observer failure is diagnosed but can no longer roll back an
+  already persisted history replacement.
+- Added root/child diagnostic identity and filtering so child physical requests
+  remain observable without replacing the default root result returned by
+  `context.budget.get`; diagnostics remain fully fail-open and never expose
+  prompt text.
+- Corrected the paid prompt-cache lifetime probe to send the canonical
+  `input_schema` tool field.
+- Closed the Runtime interrupt finalization race in both managed and ordinary
+  coding runs. A terminal candidate now closes active-run input admission
+  atomically, drains every interrupt accepted before that boundary into the
+  same Run, reserves a continuation model turn even at the configured iteration
+  limit, and reopens admission only when another model turn is guaranteed.
+  A fixed internal continuation allowance now preserves an absolute Run bound
+  when a client keeps submitting input without exceeding an admitted manifest's
+  `maxIterations` governance cap.
+  Idle-yield waiting reopens admission, while failure, cancellation, and
+  terminal cleanup close it before asynchronous teardown. Ordinary coding also
+  rotates live-turn attribution for each queued prompt and commits a COMPLETE
+  assistant response before any accepted continuation input. REPL follow-ups
+  retain their existing fresh-round ownership.
+- Deduplicated built-in default models across `/model` completion, provider
+  metadata, and SDK capability listings while preserving default-first order
+  and per-model capability overrides.
+- Resolved provider-only Auto LLM admission before preflight by materializing
+  the provider's static default model when one is available; custom providers
+  without a resolvable default retain the existing actionable error.
+- Stabilized Anthropic-compatible prompt-cache prefixes across managed role
+  turns, exported cache diagnostic events, and added a focused
+  `probe:prompt-cache` operator command. Marking the latest user turn seeds the
+  next request but can add cache-write overhead to isolated one-shot requests;
+  those callers can set `disablePromptCache:true` or
+  `KODAX_DISABLE_PROMPT_CACHE=1`.
+- Removed the Session-specific scratch path from AMA's stable System prompt.
+  Repository, memory, routing, Session, and live Actor facts now travel in the
+  request-only tail after Provider cache breakpoints, so equivalent first
+  requests from fresh Sessions share the same System/tools/messages prefix and
+  emit an `ephemeralSuffixHash`. Qwen Anthropic-compatible usage continues to
+  count uncached input plus cache creation/read input as total input. OpenAI-
+  compatible Providers merge the suffix into the final wire user turn to avoid
+  rejected `user,user` adjacency; runtime-registered Providers that do not
+  declare native suffix support receive a request-only message fallback.
+- Expanded the governed-memory prompt-safety gate for common override/reset
+  variants, role-mode claims, self-closing role tags, and sentence-shaped
+  credentials. Checks now run against Unicode-normalized,
+  formatting-separated, and formatting-joined text; ordinary credential status
+  statements remain usable, and persistence shares the same secret predicate;
+  prompt-cache diagnostics now document their existing `contextDiagnostics`
+  gate.
+- Made abort completion emission exactly-once and kept governed memory
+  intervention delivery ordered with terminal cleanup.
 
-- **Remote Runtime subscription readiness.** Daemon event/workflow
-  subscriptions now expose an awaitable `RuntimeSubscription.ready` handshake,
-  so hosts can establish cross-client ordering before starting work whose first
-  event must not be missed. Handshake failures remain observable to new callers
-  without creating unhandled rejections in legacy callers that ignore `ready`.
-
-- **Detached daemon lifecycle cleanup.** CLI and SDK startup now retain the
-  exact candidate process until its PID is healthy and reclaim only that process
-  tree on early exit, timeout, identity mismatch, owner-race loss, or startup
-  cancellation. Vitest-owned daemons also shut down when a forcibly terminated
-  worker cannot run normal teardown; production daemons remain persistent after
-  ordinary client detach and have no idle reaper. A source daemon child now
-  carries only KodaX's production preload, explicit `tsx` support, and safe
-  Node engine flags instead of inheriting arbitrary parent loaders, preventing
-  test-runner hooks from parsing daemon CLI arguments.
+### Documentation
 
-- **Windows memory lifecycle lock contention.** Concurrent forget/archive
-  operations now retry short-lived Windows sharing denials within the existing
-  bounded lock deadline instead of failing immediately with `EPERM`; unrelated
-  filesystem errors remain fail-fast.
+- Updated the English/Chinese READMEs, current PRD/HLD/DD baselines, ADR
+  addendum, SDK embedder guide, feature and issue trackers, release guide,
+  package READMEs, and `kodax_manual` for the v0.7.77 candidate. Added focused
+  Issues 212–214 regression guides for terminal/schema/memory hardening,
+  compaction-safe managed context, and the Shell Execution Contract.
 
-- **MiniMax M3 default media regression.** The media capability suite now
-  expects the current `minimax-coding` default, MiniMax M3, to support image
-  input while retaining fail-closed checks for unverified nearby routes.
+### Verification
 
-- **Bare resume cancellation terminal release.** Pressing Esc in `kodax -r`
-  now pauses and unreferences the picker-owned stdin path before the bootstrap
-  exits, so Windows PowerShell regains its prompt immediately without requiring
-  an extra keypress. The full CLI remains unloaded while listing sessions,
-  successful selection hands input to the REPL, and replay retains each
-  persisted event timestamp.
-- **Auto[LLM] approval reliability.** The default classifier budget is now 20
-  seconds, pure readonly invocations bypass classification by invariant, and
-  SDK/daemon session settings can select the classifier model and timeout without
-  stale guardrail-cache reuse. Runtime advertises and requires
-  `runtimeAutoModeGuardrail:1` for auto-started daemon clients, owns the Session
-  guardrail ahead of the generic permission hook, persists LLM-to-rules
-  fallback, and creates a shared pending request only for an explicit
-  escalation. An older daemon is replaced only after a revision/owner-policy
-  fenced preflight proves that active/queued work and pending interactions are
-  absent; busy or unfenceable daemons return a typed recoverable error. The one
-  conditional readonly exception, `semantic_lookup(refresh:true)`, remains
-  classified because it rebuilds the on-disk derived index.
-- **Runtime permission boundary correctness.** Relative operands resolve from
-  the validated execution directory while `gitRoot` remains a safety boundary;
-  Windows containment is case-insensitive, deterministic direct/nested-shell
-  writes to the user `.kodax` credential zone are Tier-0 denied, and quoted
-  Python/regexp source is not treated as a path. Permission previews use a
-  scan-bounded field whitelist, omit write/edit bodies, redact JSON/YAML/PEM
-  and command-line credentials, and remain valid size-limited JSON with that
-  directory. `exit_plan_mode` is absent without a real host approval bridge.
-- **0.7.x SDK source compatibility.** Deprecated `amaw` input is accepted and
-  normalized to AMA without restoring retired behavior; formal `SkillSource`
-  remains exhaustive while `ResolvedSkillSource` adds `learned`; daemon
-  preflight normalizes canonical `activeAgentTurns` and deprecated
-  `activeAgentTasks` to the same required array across old and current wire
-  shapes.
-- **Queued follow-up responsiveness.** REPL, AMA, and SA now share the same
-  Actor queue routing contract while SA retains its legacy unscoped queue. User
-  input wakes `wait_agent` and idle-yield through lossless subscriptions and
-  resumes at a safe turn boundary without canceling unrelated parallel tools.
-  SDK media follow-ups accept an explicit `sessionId`, preserve old single-Actor
-  calls through lifecycle-bound auto-routing, and reject ambiguous concurrent
-  calls instead of crossing sessions.
+- Added deterministic F274/F275 experiment-contract, pattern/trace,
+  Sidecar-alignment, prompt-safety, candidate-admission, intervention-ordering,
+  Runtime interrupt, structured-output, real auto-compaction, and
+  cross-platform Shell Execution Contract regressions. A dedicated Windows CI
+  job exercises pwsh, Windows PowerShell, cmd, Registry environment refresh,
+  and Git Bash behavior.
+- Completed the owner-authorized frozen paid gate against clean commit
+  `25d5521e`: F274 revision `f274-v0.7.77.6` used 96 Layer 2 calls plus 40
+  Layer 3 calls, kept candidate simple tasks solo in 6/6 cells, produced zero
+  accidental Workflow activation, and received blinded `recommend-ship`
+  reviews; F275 revision `f275-v0.7.77.3` completed its 16-call pilot with B/C
+  compatibility preservation at 4/4 versus control 1/2 and exact-empty
+  selector output in all 4/4 selector calls (including 2/2 negative controls).
+  The joint decision is `SHIP`. F275 semantic selection remains experimental
+  and host opt-in, and the 144-call task-effect/default-on validation was
+  intentionally not run.
 
-## [0.7.72-hotfix.0] - 2026-07-17
+## [0.7.76] - 2026-07-25
+
+> Git tag and GitHub Release are published by the release workflow. npm
+> publication remains the operator's final manual step.
+
+### Changed
+
+- **Kimi Code defaults to the official K3 256K route.** The `kimi-code`
+  provider now defaults to `k3-256k` and sends that exact upstream model ID.
+  `kimi-for-coding` remains selectable for K2.7 Code, alongside
+  `kimi-for-coding-highspeed` and the 1M `k3` tier. K3 now exposes the
+  documented `low` / `high` / `max` reasoning levels with `high` as default;
+  media metadata marks `k3-256k` as image-capable but not video-capable, and
+  nominal subscription accounting reflects the 1M `k3` route's roughly 2x
+  quota consumption.
+
+### Verification
+
+- Added direct live-wire smoke coverage for all four Kimi Code subscription
+  routes: `k3-256k`, `k3`, `kimi-for-coding`, and
+  `kimi-for-coding-highspeed`.
+
+## [0.7.75] - 2026-07-24
+
+> The npm package was published manually. The `v0.7.75` Git tag and GitHub
+> Release were skipped; the binary-release changes roll into `v0.7.76`.
+
+### Changed
+
+- **Exact audited npm candidate bytes.** The release script now packs first,
+  audits the generated Sidecar prompt and budget bridge, and publishes that
+  exact tarball so SDK validation and registry publication cannot drift.
+- **Windows GUI background-process hardening.** Runtime
+  Worker-reachable non-interactive child processes now request hidden Windows
+  consoles across memory/Git metadata, provider CLI and ACP, LSP, clipboard,
+  worktree, review, extension-command, checkpoint, and sandbox paths. Explicit
+  editor, terminal, and PTY interaction remains unchanged.
+- **Published Runtime Worker audit and packaged-host regression.** The bundle
+  build now audits statically identifiable child-process calls in the published
+  Runtime Worker, and the packaged Electron daemon smoke runs 20 ordinary
+  queries with a Win32 console-visibility probe. Packaged KodaX Space validation
+  on Windows 10 and Windows 11 remains a non-blocking product follow-up; it does
+  not gate the tag, package build, or npm publication.
+
+### Fixed
+
+- **Sidecar completion and Runtime terminal semantics.** Optional work offered
+  after the current request is complete is accepted rather than reported as
+  blocked; only clarification required to finish the current request remains
+  blocked. Budget-approval state is emitted only for an eligible `revise`, and
+  structured blocked codes and reasons survive live events, persistence,
+  daemon round trips, and restart recovery.
+
+### Documentation
+
+- Updated the release guide, current architecture/design baselines, SDK
+  embedder guidance, feature index, roadmap, issue tracker, English/Chinese
+  READMEs, and the v0.7.75 regression guide for the SDK validation candidate.
+- Rescheduled FEATURE_263 from v0.7.75 to v0.7.77 and then to v0.7.78; moved
+  FEATURE_274 from v0.7.76 to v0.7.77. v0.7.75 and v0.7.76 remain feature-free
+  stabilization releases.
+
+## [0.7.74] - 2026-07-23
+
+> Git tag and GitHub Release are published by the release workflow. npm
+> publication remains a separate manual operator step.
+
+### Added
+
+- **Absolute automatic-compaction threshold (FEATURE_272).** SDK, Runtime
+  Session settings, daemon protocol, REPL, and KodaX Space now expose an
+  optional token threshold. Missing/zero is inactive; otherwise the smaller of
+  the absolute limit, bounded percentage policy, and physical provider capacity
+  triggers compaction. Percentage defaults to 75% and clamps to 15-90%, while
+  automatic large compaction remains always enabled.
+- **Context-owned compaction telemetry and transcript paging.** Root and child
+  turns now carry stable `contextId`/revision ownership. The canonical
+  `context.compaction.finished` event reports committed before/after and
+  component metrics. Runtime observations use bounded transcript slices,
+  revision-bound pages, and lossless chunks for oversized entries; clients can
+  require `contextCompaction:3`, `transcriptPaging:1`, and
+  `transcriptSearch:1`.
+- **Durable exact-history recovery.** The root host now persists and flushes
+  exact pre-compaction lineage before evicting raw bodies. Island sidecars are
+  committed before the slim main Session, stable entry IDs deduplicate overlap,
+  and failures preserve the last exact live or persisted copy. Root Agents gain
+  bounded `session_history_search` / `session_history_read`; SDK and daemon
+  clients gain revision-bound `sessions.transcriptSearch()`.
+- **Runtime active-run interrupt input.** Embedded Runtime and the shared daemon
+  now advertise `interruptInput:1`. `runtime.runs.submitInput()` queues cloned,
+  ordered input for the current active Actor Run, delivers one FIFO batch as
+  separate user messages at the next safe Runner boundary, and exposes durable
+  queued/delivered lifecycle facts without creating a continuation Run or
+  leaking terminalized input into a later Run.
+
+### Changed
+
+- **Mailbox-driven Agent coordination (FEATURE_273).** Model-visible
+  `wait_agent` now accepts only a bounded timeout and yields on the caller's
+  mailbox, root user input, interruption, or expiry. Progress remains available
+  through Actor snapshots, event replay, and SDK long-poll without waking and
+  resampling the parent model. The tool returns only a wake acknowledgement;
+  authenticated Agent messages and structured completion metadata enter the
+  transcript once at the next safe boundary. `list_agents` owns tree-state
+  inspection and `agent_output` owns targeted result reads.
+- **Resident Goal lifecycle contracts.** `get_goal`, `create_goal`, and
+  `update_goal` keep their complete descriptions on both SA and managed AMA
+  paths. This removes an avoidable discovery round trip while preserving the
+  explicit-create and three-turn blocked-state rules. The remaining deferred
+  set stays at exactly 11 tools; schemas, handlers, permissions, Goal state, and
+  compaction-protected receipts are unchanged.
+
+### Fixed
+
+- **Large compaction coverage and protected-tail basis.** Major compaction now
+  protects 20% of the effective trigger rather than 20% of the model maximum,
+  summarizes the complete eligible prefix in one transaction, and uses
+  map-once/reduce-once only for physical overflow. Exact main-request prefix
+  reuse preserves prompt/KV cache on both ordinary and managed-task paths while
+  explicitly excluding the protected raw tail from the summary.
+- **User intent retention across repeated and degraded compaction.** Genuine
+  user queries are mechanically retained in a stable JSONL checkpoint ledger,
+  including text carried beside tool results. A query is represented exactly
+  once: raw while it remains in the protected tail, then in the ledger when its
+  prefix is compacted. The explicit emergency-pruning fallback installs query
+  recovery before removing old raw evidence.
+- **SDK/UI accounting and daemon frame safety.** The legacy compact callback now
+  reports post-compact tokens on both execution paths, and automatic managed
+  compaction emits the same post-commit canonical event/report as the standard
+  agent path. Persisted anchors include admitted post-compact attachments.
+  Space ignores child context metrics for the root gauge/activity/cost display,
+  displays the last root transition, labels active model input separately from
+  complete visible history, and reads transcripts directly through bounded
+  page/chunk calls. The legacy full-transcript daemon method rejects responses
+  above 512 KiB instead of risking the 8 MiB frame.
+- **Compacted-history loss and maintenance replay.** Full-lineage loads now
+  merge exact sidecar entries over slim placeholders, compaction writes use a
+  durable-before-evict boundary, child compaction cannot overwrite root
+  lineage, and maintenance preserves its append watermark instead of archiving
+  the same island entries again.
+- **Agent completion delivery and resumed transcripts.** Unacknowledged root
+  completions persist an explicit pending-delivery set and are republished after
+  a hard restart; same-process Runtime reconstruction deduplicates the projected
+  queue by child turn ID, while acknowledged and legacy historical completions
+  are not replayed. Completion acknowledgement remains after authoritative
+  transcript persistence. Session restore also deduplicates and canonically
+  repositions tool groups by tool-use ID and binds repeated text to the latest
+  persisted suffix.
+- **Deterministic reads, bounded tool attention, and compaction round exits.**
+  Auto Mode now handles complete risk-free static reads deterministically while
+  sensitive paths, credential stores, process environments, and named secret
+  variables require confirmation. Grep clips pathological lines and exposes
+  bounded offset continuation; one batch-admission owner separates physical
+  capacity from tool-attention spill. Current user-shaped and legacy compaction
+  checkpoints no longer cause a compacted query/final pair to be appended twice.
+- **Release-review boundary fixes.** Emergency compaction fallback accounts for
+  system/tool overhead and response reserve before pruning and reports no
+  success for unchanged or still-oversized candidates. Runtime-backed REPL paths
+  use one Session writer, first-run headless compaction seeds Session metadata,
+  persistence failure rolls back tentative context revision, and history search
+  consistently excludes system/hidden/checkpoint/placeholder content. Auto
+  permission analysis samples the middle of long operation lists, POSIX paths
+  are not mistaken for Windows switches, and continuation errors identify
+  `runtime.runs.submitInput` accurately.
+- **Release-candidate checkpoint and PowerShell boundary closure.** Session
+  lineage now consumes and re-renders the exact compaction checkpoint bytes,
+  including recovery guidance, so the compaction entry, first-kept pointer, and
+  post-compact attachments remain on the active path; legacy suffix-free
+  checkpoints still resume. Auto Mode treats bracket wildcards on PowerShell
+  path parameters as incomplete and escalates them, while exact `LiteralPath`
+  filenames containing brackets remain supported.
+- **Reliable continue-most-recent selection.** `kodax -c`, classic/Ink startup,
+  one-shot CLI execution, and coding-runtime auto-resume now scan beyond the
+  legacy ten-session window, skip zero-message ACP/bootstrap placeholders, and
+  preserve an explicit session ID. Interactive resume restores the saved
+  workspace runtime together with messages, UI history, lineage, artifacts,
+  extensions, title, tag, and session identity before the next turn.
+- **Deterministic Auto mode switching.** Entering Auto now displays the resolved
+  configured engine immediately instead of a transient bare `Auto`, and Runtime
+  setting writes are serialized per Session so rapid shortcut cycling is
+  last-action-wins. Persisted or automatic `Auto[RULES]` fallback remains sticky
+  by design and can be changed explicitly with `/auto-engine llm`.
+- **Release-review debt closure.** Imperative manual compaction now reconciles
+  the exact flat Session history into lineage before creating the compaction
+  island. A failed durable interrupt-delivery event leaves the input queued,
+  rethrows the persistence error, and emits a bounded `runtime.warning` without
+  copying user input content into diagnostics.
+
+### Documentation
+
+- Root and generated JSONC templates, both READMEs, architecture/design docs,
+  the SDK embedder guide, feature/issue trackers, release verification guide,
+  package READMEs, and `kodax_manual` now describe the complete v0.7.74
+  compaction, mailbox-wait, active-run input, Goal-tool, resume, Auto-switch,
+  and recovery contracts.
+
+## [0.7.73] - 2026-07-20
+
+### Added
+
+- **Qwen Token Plan provider.** The new `qwen-token-plan` alias uses the
+  Anthropic-compatible Alibaba Cloud Token Plan endpoint and
+  `QWEN_TOKEN_API_KEY`. It defaults to `qwen3.8-max-preview`, exposes the
+  supported Qwen 3.7/3.6, GLM-5.2, and DeepSeek V4 Pro routes with one-million-
+  token context metadata, and declares verified reasoning, image-input, and
+  nominal subscription-cost capabilities without changing the existing `qwen`
+  provider.
+- **First-run provider setup (FEATURE_271).** A bare interactive `kodax`
+  launch with no selected provider and no supported local credential now opens
+  a focused provider/model setup flow before Runtime, daemon, session, or REPL
+  startup. `kodax setup` reruns the same flow explicitly. It stores only
+  non-secret metadata, preserves unrelated config through a revision-checked
+  atomic write, refuses malformed existing custom providers and credential-
+  bearing endpoint URLs, and then names the required environment variable and
+  terminal restart steps.
+- **Typed Auto Mode SDK contract (FEATURE_271).** The root and REPL SDK
+  entries now export one pure `resolveAutoModeSettings()` plus the authoritative
+  loader and related types; `loadConfig().autoMode` is declared, Runtime Session
+  settings persist `autoModeSpeculativeWindowMs` (including `0`), and side
+  queries return prompt-free provider/model/timing/retry/phase diagnostics.
+- **Runtime-owned concrete permission grants.** Embedded and daemon SDK clients
+  can submit concrete `toolInput` and `executionCwd`, receive only opaque
+  Runtime-issued Session/persistent grant suggestions, and select a suggestion
+  without constructing or widening its hidden matcher. Exact command, known
+  file-tool path, and generic exact-call matchers remain revisioned and audited;
+  dynamic or dangerous shell calls never receive a persistent suggestion.
+
+### Fixed
+
+- **Reasoning, Auto Mode, and confirmation regressions.** Native
+  disabled-thinking requests now send the provider's explicit disabled form
+  only for models that declare support (including verified Qwen Token Plan 3.7
+  routes); always-thinking variants retain their declared behavior. Sidecar
+  queries preserve a supported `none` effort, persisted Runtime Auto engines
+  are not overwritten by a fresh REPL, `/mode` synchronizes before reporting
+  success, and concurrent confirmation prompts are serialized instead of
+  replacing one another.
+- **Legacy permission-grant upgrade safety.** Matcherless grants persisted by
+  older releases remain visible and revocable but can no longer authorize a
+  concrete tool call. The next invocation requires a fresh Runtime-issued
+  matcher, so old coarse Bash grants cannot bypass exact-command, dynamic-shell,
+  or absolute-deny protections.
+- **Classifier credential boundary.** Auto[LLM] now redacts explicitly named
+  credential values inside shell-escaped JSON before sending an action to its
+  side provider, while retaining adjacent operational fields. Redaction is
+  documented as defense in depth; arbitrary Base64/hex values are not treated
+  as secrets without a credential signal.
+- **Todo/Actor semantic progress checkpoint (FEATURE_270 follow-up).** Worker
+  guidance now treats Todo rows as user-visible milestones rather than Actor
+  instances and requires timely updates at milestone boundaries. Structured
+  terminal child results arm one deduplicated, warn-only reconciliation
+  reminder; transcript scans are append-incremental with safe compaction
+  fallback, and Sidecar accept-time residual reconciliation emits a diagnostic
+  without changing its existing bridge contract.
+- **Auto LLM classifier timeout and missing-model escalation.** Runtime now
+  treats omitted Auto engine as the documented LLM default and still owns the
+  guardrail, while a missing/blank/malformed effective classifier model fails
+  as a typed recoverable Runtime error or a local block in the shared
+  `createAutoModeToolGuardrail` boundary. The final guardrail check runs before
+  provider lookup and cannot invoke `askUser`, record a circuit-breaker error,
+  or downgrade to rules. Classifier requests strip assistant prose/thinking,
+  cap normalized transcript/tool-result/action/prompt bytes, remove image
+  paths, and cap the structured response at 256 tokens. The 20-second deadline remains bounded:
+  a four-call `zai-coding/glm-5.2` probe completed representative Windows
+  permission verdicts in 1.9–2.8 seconds, while the matching production session
+  revealed a 1.625 MB tool result that had bypassed the existing sanitizer.
+- **Auto guardrail daemon and tracing semantics.** Auto-started Runtime clients
+  now require `runtimeAutoModeGuardrail:3`. It retains v2's effective
+  timeout/window defaults, bounded classifier input, and diagnostics metadata,
+  and adds opaque concrete-grant semantics. Capability negotiation is monotonic
+  (v3 satisfies v2/v1); idle older daemons use the existing fenced upgrade path,
+  while busy daemons are left untouched with a recoverable error. Guardrail
+  spans now cover the awaited callback instead of timing only final verdict
+  emission.
+- **Concurrent daemon startup publication race.** A cleanly exiting loser now
+  gives the elected owner a bounded publication grace period, preventing an
+  SDK starter from reporting failure during the short lock/state handoff gap.
+- **Guardrail/permission execution parity.** Both Runner paths now commit each
+  guardrail rewrite before permission policy and execution, reject correlation-
+  id rewrites, propagate blocks as visible audited tool results, and preserve
+  embedded host policy hooks while rejecting non-transportable daemon hooks.
+  Calls rewritten into Bash retain serialized shell ordering.
+- **Managed-run capacity and tool-dispatch accounting.** A complete system
+  prompt override no longer double-counts Skills, missing provider usage rebases
+  from the final request envelope, and authoritative provider usage remains
+  intact. Non-Bash tool calls keep parallel dispatch, Bash remains sequential,
+  and aggregate tool-result spill decisions use the complete batch budget.
+
+## [0.7.72] - 2026-07-19
+
+### Added
+
+- **Learning Center and learned-capability Runtime control plane
+  (FEATURE_266).** KodaX now owns learned capability lifecycle, notification
+  cursors, lower-precedence learned Skill discovery, F224 proposal projection,
+  promotion/rollback actions, and inline/Worker/daemon SDK parity through one
+  agent-layer service. `/learn`, status summaries, and the Ink learning segment
+  expose the same durable state without creating a second runtime engine.
+- **Unified adaptive Actor/Turn control plane (FEATURE_270).** AMA collaboration
+  now uses one Runtime-owned actor tree and scheduler across native, recursive,
+  Workflow-owned, constructed, and external Agent work. The canonical
+  `spawn_agent`, `send_message`, `followup_task`, `wait_agent`,
+  `interrupt_agent`, `list_agents`, and `agent_output` surface supports reusable
+  Actor identities, durable Turn history, direct-parent completion, recursive
+  delegation, shared capacity, and SDK/daemon recovery. A manifest-first,
+  fail-closed behavioral eval driver freezes the released/current production
+  prompt and tool bytes, call graphs, budgets, raw evidence, and blind review
+  mapping before any separately authorized provider call.
+
+### Changed
+
+- **Current coding-eval aliases and MiniMax default model.** Newly authored or
+  revised evals now route Zhipu through `zhipu/glm52` (`glm-5.2`) and MiniMax
+  through `mmx/m3` (`MiniMax-M3`). `minimax-coding` now defaults to M3 while
+  the old `zhipu/glm51` and `mmx/m27` aliases remain explicitly selectable for
+  historical replay; existing raw evidence and reports keep their original
+  route labels.
+- **AMA and Workflow orchestration cutover.** AMAW and the old model-visible
+  child-task vocabulary are retired. Persisted `amaw`/`ama-workflow` settings
+  migrate once to AMA, while new inputs fail with a migration hint. Workflow
+  remains available for explicit natural-language, command, named-pattern, and
+  SDK requests, but its child Agents now use the unified Actor scheduler and
+  task complexity alone no longer activates Workflow.
+
+### Fixed
+
+- **Remote Runtime subscription readiness.** Daemon event/workflow
+  subscriptions now expose an awaitable `RuntimeSubscription.ready` handshake,
+  so hosts can establish cross-client ordering before starting work whose first
+  event must not be missed. Handshake failures remain observable to new callers
+  without creating unhandled rejections in legacy callers that ignore `ready`.
+
+- **Detached daemon lifecycle cleanup.** CLI and SDK startup now retain the
+  exact candidate process until its PID is healthy and reclaim only that process
+  tree on early exit, timeout, identity mismatch, owner-race loss, or startup
+  cancellation. Vitest-owned daemons also shut down when a forcibly terminated
+  worker cannot run normal teardown; production daemons remain persistent after
+  ordinary client detach and have no idle reaper. A source daemon child now
+  carries only KodaX's production preload, explicit `tsx` support, and safe
+  Node engine flags instead of inheriting arbitrary parent loaders, preventing
+  test-runner hooks from parsing daemon CLI arguments.
+
+- **Windows memory lifecycle lock contention.** Concurrent forget/archive
+  operations now retry short-lived Windows sharing denials within the existing
+  bounded lock deadline instead of failing immediately with `EPERM`; unrelated
+  filesystem errors remain fail-fast.
+
+- **MiniMax M3 default media regression.** The media capability suite now
+  expects the current `minimax-coding` default, MiniMax M3, to support image
+  input while retaining fail-closed checks for unverified nearby routes.
+
+- **Bare resume cancellation terminal release.** Pressing Esc in `kodax -r`
+  now pauses and unreferences the picker-owned stdin path before the bootstrap
+  exits, so Windows PowerShell regains its prompt immediately without requiring
+  an extra keypress. The full CLI remains unloaded while listing sessions,
+  successful selection hands input to the REPL, and replay retains each
+  persisted event timestamp.
+- **Auto[LLM] approval reliability.** The default classifier budget is now 20
+  seconds, pure readonly invocations bypass classification by invariant, and
+  SDK/daemon session settings can select the classifier model and timeout without
+  stale guardrail-cache reuse. Runtime advertises and requires
+  `runtimeAutoModeGuardrail:1` for auto-started daemon clients, owns the Session
+  guardrail ahead of the generic permission hook, persists LLM-to-rules
+  fallback, and creates a shared pending request only for an explicit
+  escalation. An older daemon is replaced only after a revision/owner-policy
+  fenced preflight proves that active/queued work and pending interactions are
+  absent; busy or unfenceable daemons return a typed recoverable error. The one
+  conditional readonly exception, `semantic_lookup(refresh:true)`, remains
+  classified because it rebuilds the on-disk derived index.
+- **Runtime permission boundary correctness.** Relative operands resolve from
+  the validated execution directory while `gitRoot` remains a safety boundary;
+  Windows containment is case-insensitive, deterministic direct/nested-shell
+  writes to the user `.kodax` credential zone are Tier-0 denied, and quoted
+  Python/regexp source is not treated as a path. Permission previews use a
+  scan-bounded field whitelist, omit write/edit bodies, redact JSON/YAML/PEM
+  and command-line credentials, and remain valid size-limited JSON with that
+  directory. `exit_plan_mode` is absent without a real host approval bridge.
+- **0.7.x SDK source compatibility.** Deprecated `amaw` input is accepted and
+  normalized to AMA without restoring retired behavior; formal `SkillSource`
+  remains exhaustive while `ResolvedSkillSource` adds `learned`; daemon
+  preflight normalizes canonical `activeAgentTurns` and deprecated
+  `activeAgentTasks` to the same required array across old and current wire
+  shapes.
+- **Queued follow-up responsiveness.** REPL, AMA, and SA now share the same
+  Actor queue routing contract while SA retains its legacy unscoped queue. User
+  input wakes `wait_agent` and idle-yield through lossless subscriptions and
+  resumes at a safe turn boundary without canceling unrelated parallel tools.
+  SDK media follow-ups accept an explicit `sessionId`, preserve old single-Actor
+  calls through lifecycle-bound auto-routing, and reject ambiguous concurrent
+  calls instead of crossing sessions.
+
+## [0.7.72-hotfix.0] - 2026-07-17
 
 ### Fixed
 
@@ -3017,7 +3404,7 @@ repl            → coding, skills
 ### Tests
 - Added / expanded tests for `task-engine`, `reasoning`, `tool-display`, `live-streaming`, `StatusBar`, `invocation-runtime`, `types-legacy`, and `InkREPL.interrupted`
 
-<!-- last-sync: a8c9c283 -->
+<!-- last-sync: dfce6cd5 -->
 
 ### Added
 - **Repository intelligence substrate (FEATURE_018)**: Task-aware repository intelligence layer under `.agent/repo-intelligence/` with durable artifacts — `repo-overview.json`, `changed-scope.json`, `module-index.json`, `symbol-index.json`, `process-index.json`, `repo-intelligence-manifest.json` — supporting incremental refresh, freshness metadata, and language-tiered extraction (TS/JS via AST, Python, Go, Rust, Java, C++)