@ljwei-stak/dsh-model-route-bot 0.65.0 → 0.66.0

package/docs/assets/workbench-usage.svg

@@ -0,0 +1,119 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1500 1120" role="img" aria-labelledby="title description">
+  <title id="title">模型路由工作台操作示意</title>
+  <desc id="description">示意图而非实机截图。操作顺序为：输入任务描述，选择单任务或团队分工，填写仅用于估算的预算，生成路由建议；向下滚动，经过逐模型价格与能力配置，再查看路由建议；实际执行须在官方会话中显式调用工具。</desc>
+  <defs>
+    <linearGradient id="page" x2="1" y2="1">
+      <stop offset="0" stop-color="#f5f8fd"/>
+      <stop offset="1" stop-color="#edf5f3"/>
+    </linearGradient>
+    <marker id="arrow" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="8" markerHeight="8" orient="auto-start-reverse">
+      <path d="M1 1 L9 5 L1 9" fill="none" stroke="#5379be" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+    </marker>
+    <style>
+      text { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", "Microsoft YaHei", "Noto Sans CJK SC", sans-serif; fill: #1c2a3c; }
+      .page-title { font-size: 34px; font-weight: 740; }
+      .sub { font-size: 17px; fill: #586b81; }
+      .section { font-size: 22px; font-weight: 720; }
+      .label { font-size: 17px; font-weight: 690; }
+      .ui { font-size: 17px; fill: #536274; }
+      .note { font-size: 16px; fill: #62758a; }
+      .num { font-size: 18px; font-weight: 800; fill: #fff; }
+      .button-label { font-size: 18px; font-weight: 720; fill: #fff; }
+      .card { fill: #fff; stroke: #d5e0eb; stroke-width: 2; }
+      .field { fill: #fbfcff; stroke: #cdd9e6; stroke-width: 2; }
+      .arrow { fill: none; stroke: #7393c3; stroke-width: 3; marker-end: url(#arrow); }
+    </style>
+  </defs>
+
+  <rect width="1500" height="1120" rx="25" fill="url(#page)"/>
+  <text x="42" y="59" class="page-title">模型路由工作台：从填写任务到查看建议</text>
+  <rect x="1180" y="25" width="278" height="42" rx="21" fill="#fff2dc" stroke="#dfb36e" stroke-width="2"/>
+  <text x="1208" y="53" font-size="18" font-weight="730" fill="#8b591b">操作示意 · 非实机截图</text>
+  <text x="42" y="91" class="sub">按 0.9.0 工作台控件顺序绘制；示例文字不含真实项目、账号或模型信息。</text>
+
+  <rect x="41" y="119" width="238" height="920" rx="18" fill="#e8edf4" stroke="#d2dce8" stroke-width="2"/>
+  <text x="68" y="162" font-size="20" font-weight="750">DeepSeek Harness</text>
+  <rect x="57" y="204" width="206" height="48" rx="10" fill="#d7e2f5"/>
+  <text x="78" y="235" font-size="18" font-weight="720">模型路由</text>
+  <text x="78" y="292" class="ui">Gal 模块</text>
+  <text x="68" y="352" class="note">示意导航</text>
+
+  <text x="320" y="145" font-size="29" font-weight="740">模型路由工作台</text>
+  <text x="320" y="177" class="sub">任务规划在本机完成；右侧仅显示官方已配置的模型路线。</text>
+
+  <rect x="320" y="204" width="726" height="392" rx="17" class="card"/>
+  <text x="346" y="242" class="section">任务规划</text>
+  <text x="346" y="269" class="note">生成建议不会自动启动模型或团队任务。</text>
+
+  <circle cx="351" cy="308" r="17" fill="#3d65c1"/>
+  <text x="351" y="314" text-anchor="middle" class="num">1</text>
+  <text x="380" y="315" class="label">任务描述</text>
+  <rect x="346" y="328" width="672" height="106" rx="11" class="field"/>
+  <text x="365" y="361" class="ui">例如：梳理需求，完成实现并给出验收清单</text>
+  <text x="365" y="391" class="note">复杂任务可按编号或分行列出独立要求</text>
+
+  <circle cx="351" cy="472" r="17" fill="#3d65c1"/>
+  <text x="351" y="478" text-anchor="middle" class="num">2</text>
+  <text x="380" y="478" class="label">规划模式</text>
+  <rect x="346" y="494" width="275" height="44" rx="10" fill="#edf1f7"/>
+  <rect x="350" y="498" width="125" height="36" rx="8" fill="#fff" stroke="#d7e1ef"/>
+  <text x="381" y="522" class="ui">单任务</text>
+  <text x="497" y="522" class="ui">团队分工</text>
+
+  <circle cx="675" cy="472" r="17" fill="#3d65c1"/>
+  <text x="675" y="478" text-anchor="middle" class="num">3</text>
+  <text x="704" y="478" class="label">本次估算预算（USD）</text>
+  <rect x="671" y="494" width="320" height="44" rx="10" class="field"/>
+  <text x="691" y="522" class="ui">0</text>
+  <text x="346" y="568" class="note">0 表示建议不限预算；这里不设置真实支出上限。</text>
+
+  <rect x="1066" y="204" width="392" height="392" rx="17" class="card"/>
+  <text x="1092" y="242" class="section">模型目录</text>
+  <text x="1092" y="269" class="note">只显示已登记的 provider/model。</text>
+  <rect x="1092" y="295" width="340" height="42" rx="9" class="field"/>
+  <text x="1110" y="322" class="ui">搜索路线</text>
+  <rect x="1092" y="356" width="340" height="72" rx="9" fill="#f8fbff" stroke="#dce5ef"/>
+  <text x="1110" y="385" class="label">已配置路线 A</text>
+  <text x="1110" y="409" class="note">provider / model</text>
+  <rect x="1092" y="440" width="340" height="72" rx="9" fill="#f8fbff" stroke="#dce5ef"/>
+  <text x="1110" y="469" class="label">已配置路线 B</text>
+  <text x="1110" y="493" class="note">provider / model</text>
+  <text x="1092" y="548" class="note">路线可见 ≠ 凭据和网络可用</text>
+
+  <circle cx="351" cy="627" r="17" fill="#3d65c1"/>
+  <text x="351" y="633" text-anchor="middle" class="num">4</text>
+  <rect x="379" y="604" width="177" height="45" rx="10" fill="#315cc8"/>
+  <text x="404" y="633" class="button-label">生成路由建议</text>
+  <text x="577" y="632" class="note">先有任务描述与至少一条官方模型路线</text>
+
+  <path d="M881 652 V690" class="arrow"/>
+  <circle cx="351" cy="694" r="17" fill="#3d65c1"/>
+  <text x="351" y="700" text-anchor="middle" class="num">5</text>
+  <text x="380" y="700" class="label">向下滚动：先经过“逐模型价格与能力”，再看“路由建议”</text>
+
+  <rect x="320" y="714" width="1138" height="125" rx="17" class="card"/>
+  <text x="346" y="748" class="section">逐模型价格与能力</text>
+  <text x="346" y="773" class="note">可为准确的官方路线填写质量评分、输入/输出单价与 CLI 模型名；缺失价格保持未知。</text>
+  <rect x="346" y="793" width="260" height="28" rx="7" class="field"/>
+  <text x="357" y="813" class="note">选择模型路线</text>
+  <rect x="620" y="793" width="245" height="28" rx="7" class="field"/>
+  <text x="631" y="813" class="note">质量评分（可选）</text>
+  <rect x="879" y="793" width="245" height="28" rx="7" class="field"/>
+  <text x="890" y="813" class="note">输入单价（可选）</text>
+  <rect x="1138" y="793" width="294" height="28" rx="7" class="field"/>
+  <text x="1149" y="813" class="note">输出单价（可选）</text>
+
+  <path d="M881 839 V861" class="arrow"/>
+  <rect x="320" y="864" width="1138" height="110" rx="17" fill="#e6eefc" stroke="#92addd" stroke-width="2"/>
+  <text x="346" y="899" class="section">路由建议</text>
+  <text x="346" y="929" class="ui">推荐路线 · 任务复杂度 · 估算总成本</text>
+  <text x="346" y="954" class="note">团队模式还显示工作包、依赖、推荐模型、执行渠道与验收项。</text>
+
+  <circle cx="351" cy="1015" r="17" fill="#259477"/>
+  <text x="351" y="1021" text-anchor="middle" class="num">6</text>
+  <rect x="379" y="987" width="1079" height="66" rx="14" fill="#fff" stroke="#77b6a5" stroke-width="2" stroke-dasharray="8 6"/>
+  <text x="405" y="1016" class="label">需要实际执行时，转到官方会话并显式调用工具</text>
+  <text x="405" y="1042" class="note">model_router_consult · model_router_tool_run · model_router_team_execute</text>
+
+  <text x="320" y="1090" class="sub">示意图只说明操作位置与顺序；生成计划是本地计算，官方 CLI 执行、账号可用性与实际费用需分别核验。</text>
+</svg>

package/docs/releases/0.20.0-validation.md

@@ -0,0 +1,26 @@
+# 0.20.0 validation — 2026-10-15
+
+This release was developed against DeepSeek Harness Desktop 0.2.0-rc.2 on Windows. Declared rc.1 compatibility is not a claim of a second real host run.
+
+## Real executions
+
+- **Workbench execution:** the real desktop profile's authenticated preview/start RPC selected `official-team`, `workspace-write`, and explicitly confirmed `cli-native`. Claude read a small repository fixture, created a JSON file, ran a Python validation command and completed. The source repository received the Git patch; independent file readback matched the expected values. This was one work package, not a multi-agent team result.
+- **Cross-vendor dependency:** the installed production team runtime ran a predeclared Claude analysis package followed by a MiniMax delivery package consuming its result. No mock CLI adapters were injected. Both used their existing vendor configuration. MiniMax read the fixture, wrote the handoff JSON and reported a successful PowerShell JSON check. The patch was integrated and independently read back. This second check directly invoked the installed runtime; it was not a workbench UI automation or an automatic-routing comparison. Ledger recording used the same checkout function with its development peers, since standalone import of the Desktop entry lacks host-provided peers.
+- Both successful checks retained CLI defaults. The MiniMax result reported `minimax/MiniMax-M3`; Claude's actual model remained unknown in the saved records. Recommendation IDs are not proof of backend identity.
+- The successful calls reported API amounts of $0.1381192 and $0.1157288. MiniMax supplied token usage under a subscription login, with no verified reference price. Earlier attempts with missing usage/prices remain unknown; $0.253848 is a known subtotal, not the batch's reconciled supplier bill.
+
+## Failures that shaped the fix
+
+- Original terminal execution and managed execution differed in model arguments, environment, writable state and tool restrictions. Catalog IDs are now passed only through explicit CLI model mappings.
+- The Windows ACL backend rejected worktree initialization on a source drive lacking WRITE_OWNER, before any CLI started. A no-model SDK probe reproduced that failure and succeeded in private user temporary storage. A real confined-write and cross-drive patch integration probe passed after relocating Windows worktrees.
+- MiniMax then reached its CLI but could not write its original state directory. The SDK also limits libuv pipe creation by confined descendant processes, affecting some shell and MCP paths. Additional filesystem grants alone do not restore normal vendor behavior.
+- The explicit `cli-native` option uses current user permissions outside Harness's process sandbox, retains Git worktree integration checks, and always requires its own confirmation. It is never an automatic response to a failed restricted run. Existing restricted records keep their environment when retried.
+- A Claude restricted-environment attempt reported gateway 529 errors with a complete zero-usage/zero-cost terminal result. Codex attempts failed connection checks. These failures remain recorded rather than being silently replaced by API calls.
+
+## Scope and limits
+
+Default execution remains Harness-restricted. Claude read-only disables shell, skills and existing MCP, and ignores user settings. Editable native execution offers normal vendor tools under user permissions; the worktree collects changes and is not an OS security boundary. Configured external MCP services may have their own effects.
+
+The successful experiments exercised file and shell tools, dependency context, and patch integration. They do not establish that every vendor, model, skill or MCP service works. Codex network execution, remote MCP effects, and statistical quality–cost improvements remain unverified. Raw experiments, credentials, machine paths and screenshots stay in the private local archive.
+
+Automated validation covers confirmation gates, stale previews, selected installation entries, native package trust, default-model behavior, partial/failed accounting, exceptions, retries, and Git isolation/integration. Final test totals are recorded in the release notes.

package/docs/releases/0.22.0-validation.md

@@ -0,0 +1,28 @@
+# 0.22.0 release acceptance
+
+Date: 2026-10-19. Package: `@ljwei-stak/dsh-model-router@0.22.0`.
+
+This release combines routing algorithm improvements and the algorithm/manual work-package assignment choice. It retains the existing plugin identity, saved configuration, execution history and supported DSH SDK versions.
+
+## Automated and UI checks
+
+- Full suite: 966 tests, 963 passed, 0 failed, 3 existing platform-dependent skips. Skipped PTY/process checks do not count as real execution acceptance.
+- The manual-assignment increment adds 45 tests covering strict targets, task-decomposition identity, complete preflight validation, pinned APIs, exact tools, subscription restrictions, budget behavior, mixed dependency context, stored intent and retries.
+- Twelve Chromium interactions against the actual workbench component and offline fixtures passed: default algorithm mode, per-package manual controls, unavailable tool choices, mixed-target preview, stale confirmation invalidation, simulated execution and stored tool intent, restore, return to algorithm mode, single-package adjustment, direct mode, 390-pixel layout and stale asynchronous responses. Screenshots were inspected. These use simulated data and no paid model calls.
+- `pnpm install --frozen-lockfile --strict-peer-dependencies` with pinned pnpm 10.34.6, the actual client build, generated-client consistency, workbench preview compilation, package preflight and `git diff --check` passed.
+- Before publication, the generated tarball is checked against the exact release commit's Git blobs; after publication, registry and GitHub Release assets are downloaded and compared with that verified tarball. The release audit records the commit and tarball digests separately.
+
+One development run of the existing Windows multi-process state test encountered an `EPERM` while opening its lock file. Five isolated rechecks and the final full suite passed. This release does not claim to fix that intermittent locking behavior.
+
+## Behavioral boundaries
+
+- Manual mixed API/tool execution is read-only. Editing remains in the existing official-team workflow with its isolated worktree and permission checks.
+- An explicit API target uses the selected provider/model and adapter-default effort. It is not replaced by CLI preference, budget downgrade or automatic quality escalation. Subscription-only and coding-plan routes cannot bypass their billing policy by being selected as ordinary APIs.
+- A selected official tool uses its own configured default model. Missing installation, execution support or readiness blocks execution before the first paid package; failure does not silently switch to API. Unknown tool prices stay unknown.
+- Objective task evidence requires valid training observations and enough matching samples. Resource P90 values are empirical estimates, not joint budget guarantees. Beam search remains approximate over retained candidates. The tests establish mechanisms rather than measured production routing quality or savings.
+- JSON validation checks structure, not semantic truth. Automatic escalation defaults to off and permits at most one eligible API upgrade after budget approval, retaining every attempt's known or unknown cost.
+- Exact SDK effort requests do not establish the provider's actual internal reasoning effort. Official CLI effort mappings remain unsupported.
+
+No new real provider or vendor CLI model execution was performed for 0.22.0. Earlier real execution evidence remains in the dated [0.20.0 report](0.20.0-validation.md); it is not relabeled as evidence for this release's new behavior. Hermes/Pi managed execution remains unverified.
+
+Upgrade by fully quitting Harness, including its tray and Host process, updating the plugin to 0.22.0, and restarting.

package/docs/releases/0.23.0-validation.md

@@ -0,0 +1,30 @@
+# 0.23.0 release acceptance
+
+Date: 2026-10-23. Package: `@ljwei-stak/dsh-model-router@0.23.0`.
+
+This release adds observable workbench execution and cancellation, retaining the plugin identity, saved configuration, execution history and supported DSH SDK versions. It also fixes the incomplete-history marker after a failed corrupt-state recovery.
+
+## Accepted behavior
+
+- `startRun` returns a Host job snapshot after fresh preview, budget and permission checks; strict `runStatus` and `cancelRun` requests accept only a job ID. Existing internal synchronous execution helpers remain available.
+- The workbench shows elapsed time, current package and individual package states. Status transport failures retry serially without losing cancellation. Old status/cancel responses cannot replace newer progress, a terminal result or another job.
+- Cancellation reaches the same AbortSignal used by API streams and official CLI teams. The job stays cancelling until execution and cleanup settle. Already completed answers and reported usage/cost remain in the execution ledger, including cancellation during optional result review. Cancelled editable teams do not begin integration.
+- Closing the panel does not cancel execution. Reopening in the same browser reconnects using only an opaque job ID in session storage. Reopening before the start acknowledgement waits for and takes over the original job, preventing duplicate launch. A failed launch is never automatically resubmitted.
+- If corrupt-state recovery fails before it can commit a notice, a later read/write preserves the incomplete-history marker. Budget checks continue to treat lost cost history as incomplete.
+
+## Validation
+
+- Full suite: 1035 tests, 1032 passed, 0 failed, 3 existing platform-dependent skips. Skipped PTY/process checks do not count as execution acceptance.
+- Fifty new feature tests cover job lifecycle and capacity, a real Host and typed gateway with inert adapters, execution progress, cancellation accounting, optional review cancellation and UI races/reconnection.
+- The strict frozen pnpm installation, actual client build, generated-client consistency, paired README checks, workbench preview compilation and `git diff --check` passed. README formulas were not changed.
+- Browser inspection of the actual workbench component with offline fixtures covered running progress, cancelling cleanup and the final cancelled ledger. Screenshots were inspected; browser warning/error logs were empty. The [progress screenshot](../assets/workbench-run-progress.png) uses simulated tasks and prices.
+- An independent GPT read-only review checked the runtime package file/import closure, strict RPCs, cancellation/accounting paths, sensitive-token patterns and the pending-start panel recovery race.
+- The release process compares every package member against the exact release commit's Git blobs, then downloads the npm payload and GitHub Release asset to verify their bytes. Commit IDs and tarball hashes are recorded in the external publication audit.
+
+## Boundaries
+
+Jobs are held in Host memory, with at most four active jobs and fifty retained snapshots. A Host restart loses live job snapshots; the workbench directs users to the persisted execution history instead of starting another job. Host disposal requests cancellation; a running adapter must honor its AbortSignal before cancellation can finish. Costs already incurred remain chargeable, and unavailable prices/usage remain unknown.
+
+This release was not tested end to end in an installed DSH Desktop or with real paid provider/vendor CLI inference. No new provider execution claims are made. Earlier real execution evidence remains in the dated [0.20.0 report](0.20.0-validation.md), and Hermes/Pi managed execution remains unverified.
+
+Upgrade by fully quitting Harness, including its tray and Host process, updating the plugin to 0.23.0, and restarting.

package/docs/releases/0.23.1-validation.md

@@ -0,0 +1,23 @@
+# 0.23.1 release acceptance
+
+Date: 2026-10-23. Package: `@ljwei-stak/dsh-model-router@0.23.1`.
+
+## Reproduced problems and fixes
+
+- A retry could pass a daily budget of USD 0.5 with a USD 0.2 target, then also start its USD 0.4 downstream package without approval. Retry budgets now cover the target plus every unfinished downstream package that will execute. Both routed and official-team retries use that same set; completed downstream packages are excluded. Changed routes use the selected route estimate, unchanged routes retain their planned reasoning effort estimate and unknown prices remain unknown under the existing unknown-price budget policy.
+- A never-settling progress request permanently stopped polling; a never-settling cancel request permanently disabled the cancel button. Preview/progress/cancel now have a 15-second deadline and a real SDK transport AbortSignal outside the business JSON. Progress retries use the same job, cancellation can be retried explicitly and late replies cannot replace newer state. Task starts are never automatically replayed.
+
+## Validation
+
+- Full suite: 1055 tests, 1052 passed, 0 failed, 3 existing platform-dependent skips.
+- Twenty new regressions: 11 offline Host retry-budget tests, 6 actual SDK transport tests and 3 hung-request UI tests. Budget rejection asserts zero model calls; approval, transitive downstream, completed-package exclusion, reassignment, planned effort and unknown prices are covered.
+- Strict frozen pnpm installation, actual client build, generated-client consistency, README translation/formula checks, workbench preview compilation, npm dry-run and diff checks passed. Formula content was not changed.
+- Actual workbench browser inspection with the offline hanging-request scenario confirmed resumed package progress after a stalled status read, a re-enabled cancel button with explicit failure feedback, and successful retry cancellation with completed results retained. Browser warning/error logs were empty. The [timeout screenshot](../assets/workbench-run-timeout.png) is simulated, with no model, credentials or real workspace access.
+- An independent GPT review checked estimate/actual-retry set consistency, reasoning effort, unknown prices, SDK signal wiring, cleanup and late-response fences.
+- Every packaged file is checked against the exact release commit's Git blobs; npm and GitHub Release assets are anonymously downloaded for byte comparison, with digests in the external publication audit.
+
+## Boundaries
+
+A transport deadline only stops waiting for the request. It does not prove that a cancellation reached Host or that the task stopped; the UI keeps the original job and checks status. Execution/cancellation cleanup can exceed 15 seconds, and a pending start is not retried automatically. Jobs remain in Host memory and do not survive a Host restart. Reported costs already incurred remain chargeable.
+
+No real paid-provider or vendor CLI inference or installed-DSH end-to-end acceptance was performed in this patch. Prior execution evidence remains dated in the [0.20.0 report](0.20.0-validation.md). Fully quit Harness, including tray/Host processes, update the plugin, then restart.

package/docs/releases/0.24.0-validation.md

@@ -0,0 +1,41 @@
+# 0.24.0 release acceptance
+
+Date: 2026-10-24. Package: `@ljwei-stak/dsh-model-router@0.24.0`.
+
+Source acceptance: passed. Local tests and the actual Windows/Linux matrix below verify the implementation. The final tagged commit, archive digests and post-publication anonymous download checks are recorded separately in the dated release/archive evidence, so this document does not need to embed the checksum of its own containing archive.
+
+## Problems and resulting behavior
+
+- Concurrent executions could each pass a budget check against the same historical balance. Admission now checks recorded API spending plus other executions' remaining reservations under the shared state lock, then persists the new run and reservation atomically. Known estimated capacity is reserved before the call; missing prices and unresolved fees remain unknown and require explicit confirmation under a finite daily/monthly limit.
+- A Host interruption could lose completed-step records because the run was saved only at the end. Required checkpoints now save launch state before an external call and available receipts before the next paid step. A receipt replaces its portion of the remaining estimate with actual accounting. Routed runs, retry/reassignment, official teams, single-tool executions and session consultations use the lifecycle. Optional stronger-model reviews and quality upgrades reserve extra capacity before their additional calls.
+- Before every later paid call, admission rechecks fresh actual spending and remaining reservations. If earlier charges exceed estimates or unresolved fees prevent a finite budget from being verified, downstream calls stop. Subscription-to-API fallback must re-estimate its actual route; unknown pricing or exceeded budget prevents the call. Quality upgrades first save the initial receipt and pending additional attempt.
+- A budget stop preserves completed receipts and releases unused reservations only after the worker settles. It differs from a crash or storage failure, which retains holds for reconciliation.
+- Checkpoint persistence failure stops later calls. Confirmed dead owners become interrupted while retaining reservations and unresolved usage evidence. Live or uncertain owners are not expired by elapsed time. Protected run records remain in the bounded ledger, and active/interrupted reservations block rerun and reassignment.
+- Receipt timestamps remain attached to observed package receipts across later checkpoints and final saves, including day/month rollovers. Windows lock-file sharing races use the existing bounded contention wait; PATH and ZCode discovery use the declared platform path syntax.
+- Actual spending and reserved estimates are separate in the workbench. State schema v2 retains ownership, remaining reservations and checkpoints and accepts readable v1 state without dropping its ledger. Older plugin versions reject v2 state instead of silently rewriting away protected reservations.
+- A Windows/Linux Node 24 workflow runs strict frozen dependency installation, the complete test suite, committed-client consistency, actual client build/check, offline preview compilation and archive verification. Package verification compares every file byte to the selected Git revision and checks the local runtime import closure.
+
+## Validation record
+
+| Check | Observed evidence |
+| --- | --- |
+| Focused reservation/state regressions | `npm test` includes reservation/state tests for cross-process admission, receipt settlement, protected retention, dead-owner recovery, unknown costs, ownership checks and v1 migration; the final local suite has 1,126 passes, 0 failures and 3 environment skips. |
+| Host and executor integration | Full suite coverage includes required checkpoint failures, stopping downstream calls, retry accounting once, official team/tool/consultation/review/upgrade entry points, fallback repricing, fresh dispatch checks and receipt timestamps. Host path tests: 11/11; dispatch rechecks: 9/9; receipt-time regressions: 6/6. |
+| UI inspection | The actual client was inspected in the offline browser fixture `budget-reservations`: recorded spend, remaining reservations, interrupted-state guidance and disabled reruns; 0 browser console errors. [Screenshot](../assets/workbench-budget-reservations.png). All amounts and executions are simulated. |
+| Full local suite | `npm test`: 1,129 tests, 1,126 passed, 0 failed, 3 skipped. Full logs are retained in the release archive. |
+| Dependency/client/docs checks | `pnpm install --frozen-lockfile --strict-peer-dependencies` passed; actual client build and `check:client` passed (988,427 bytes); README pairing/hashes and offline preview compilation passed. Formula content is unchanged. |
+| Windows/Linux CI | [Implementation matrix run](https://github.com/Alice-Marx/dsh-model-router/actions/runs/40003924460) on `4795ade7adbd2a3075e3d9fde29f70372b542c03`: Node 24 / ubuntu-latest **success**; Node 24 / windows-latest **success**. Both ran the complete suite, strict installation, actual build/check, preview compilation and package verification. The final documentation commit runs the same matrix again before publication. |
+| Package integrity | Local candidate archive: 75 files match raw Git blobs, including all 40 local runtime modules. Final `v0.24.0` commit and archive digests are recorded in the Release assets, which avoid embedding an archive checksum in a document inside that same archive. |
+| Public release | After tag/upload, the publication audit anonymously downloads the npm archive, GitHub Release page and every attached asset and compares bytes and registry integrity. The dated public-npm/public-github verification JSON files are retained with the release archive. Neither version metadata nor a pushed tag alone establishes complete publication. |
+
+## Boundaries and upgrade
+
+Reservations represent remaining local estimates, not actual billed charges or a hard provider cap. Final charges can exceed estimates, and provider bills remain authoritative. Unknown or incomplete usage is not assigned zero. Subscription reference costs remain separate from recorded API spending. Calendar accounting retains its existing package-level settlement granularity; quality-cascade attempts are not split into separate daily/monthly invoices.
+
+A normal completed, cancelled or budget-stopped executor releases its remaining reservation only after its cleanup settles; completed receipts remain chargeable. A Host crash or checkpoint failure does not prove the provider stopped or establish its final charge. The reservation and any unresolved fee evidence remain available for reconciliation. This release has no manual reconciliation/release control, no automatic call replay and no arbitrary timeout that makes an interrupted reservation free. Inspect the original task, retained worktree and provider bill before considering recovery; do not erase state to bypass accounting.
+
+Live job/progress handles remain in Host memory and do not survive a restart. Persistent package checkpoints and reservations survive successful state writes; they do not restore an active worker or provide one-click continuation. Confirmed dead-owner detection is conservative; an owner whose liveness is uncertain remains reserved.
+
+Required checkpoints are part of the managed execution paths. Arbitrary imports or external provider calls outside these paths are not brought under the router's budget accounting by this change. Deliverable correctness, real vendor access, account eligibility and settled charges are not established by offline fixtures or CI.
+
+No new real paid-provider or vendor CLI inference or installed-DSH end-to-end acceptance is claimed for this release. Prior execution evidence remains dated in the [0.20.0 report](0.20.0-validation.md). Fully quit Harness, including tray/Host processes, update the plugin, then restart. Back up state/profile data before migration or downgrade; older plugin versions cannot read schema v2 state.

package/docs/releases/0.25.0-validation.md

@@ -0,0 +1,41 @@
+# 0.25.0 release acceptance
+
+Date: 2026-10-24. Package: `@ljwei-stak/dsh-model-router@0.25.0`.
+
+Source acceptance: passed. Local tests and the actual Windows/Linux matrix below verify the implementation. The final tagged commit, archive digests and post-publication anonymous download checks are recorded separately in the dated release/archive evidence, so this document does not embed the checksum of its own containing archive.
+
+## Problems and resulting behavior
+
+- API and subscription execution need different units. API results retain monetary charges and budget reservations. Subscription results have a separate quantity ledger: calls, reported input/output/cache tokens, and unknown/incomplete-usage counts, with daily/monthly and provider/tool/model summaries.
+- Confirmed subscriptions are not refused solely because an API money budget is exhausted or an API price is missing. Execution metadata and ownership remain durable for recovery, while subscription work does not consume API monetary capacity. Unknown authentication or unsupported execution capabilities are not treated as proof of an available subscription.
+- Unverified CLI authentication is not labelled as a confirmed subscription. It receives conservative API monetary admission; the resulting amount stays unknown rather than treating a reported reference figure as a settled bill. A failed unknown-billing CLI pauses before starting an extra API call.
+- Any actual API call, including fallback from a subscription, must estimate its actual API route and pass the applicable confirmation and atomic budget reservation before dispatch. CLI calls using API credentials remain API-billed. API quality escalation and optional API reviewers continue to incur API costs.
+- Mixed execution retains subscription-attempt usage evidence alongside the API financial result. Mandatory attempt/package checkpoints preserve available evidence. Retry replacement and detailed-history retention do not erase prior charges or subscription quantities and do not count the same receipt twice.
+- The workbench separates API money and subscription usage in the budget page, history and execution preview. A missing token counter stays unknown; a reported zero stays zero. Partial observed counters remain visible, while incomplete usage is identified. Old Host summaries that lack quantity data are unavailable rather than shown as a zero token balance.
+- State schema v3 accepts readable v1/v2 history and retains old reference fields and protected execution state. Old reference dollars are not used as current subscription monetary statistics, and absent historical tokens cannot be reconstructed from them. Older Hosts reject v3 instead of silently discarding the new state.
+
+## Validation record
+
+| Check | Observed evidence |
+| --- | --- |
+| Independent subscription quantities | 13 new quantity/state tests pass: reported zero, partial/unknown counters, provider/tool/model grouping, calendar rollover, legacy migration, retry replacement and history eviction. |
+| Host admission and fallback | 11 new Host tests pass, including full/unknown API budgets with a subscription, missing subscription prices, API-only/manual/key CLI admission, fallback repricing, an independent plan consultation, unknown CLI billing and a real killed child process at API dispatch. |
+| Receipt persistence and cancellation | 12 new runtime receipt tests and 11 reservation tests pass. They cover mandatory subscription receipt writes before fallback, cancellation, storage failure, independent API/quantity evidence, concurrent admission, pending API crash recovery and subscription steps between API steps. |
+| Workbench UI | Actual client inspected in the offline browser `billing-split` simulation: separate API money/subscription quantities, provider/tool/model rows and unknown counters. Browser console errors: 0. [Quantity screenshot](../assets/workbench-subscription-usage.png). New UI tests: 10/10. Amounts, usage and executions are simulated. |
+| Complete local suite | `npm test`: 1,186 tests; 1,183 pass, 0 fail, 3 environment skips. Full logs are retained in the release archive. |
+| Dependencies/client/docs | Strict frozen pnpm installation passed. Actual client build/check passed (986,763 bytes); syntax simplification retains readable names/lines and the existing under-1-MB bundle guard. README pairing/hashes and offline preview compile passed. Formula contents are unchanged. |
+| Windows/Linux CI | [Implementation matrix run](https://github.com/Alice-Marx/dsh-model-router/actions/runs/40082683345) on `2912b5b3bdebdd49ea7648bf87f2e252d4349c6d`: Node 24 / ubuntu-latest **success**; Node 24 / windows-latest **success**. Both ran strict installation, the complete suite, actual build/check, preview compilation and package verification. The final documentation commit runs the same matrix again before publication. |
+| Package/source integrity | Local candidate archive: 79 files match raw Git blobs, including all 42 local runtime modules. Final `v0.25.0` commit and archive digests are recorded in Release assets. The complete source ZIP is constructed from raw Git blobs and separately checked byte for byte. |
+| Public distribution | After tag/upload, the publication audit anonymously downloads the npm archive, GitHub Release page and every attached asset and compares bytes and registry integrity. Dated public-npm/public-github verification JSON files are retained with the release archive. Neither version metadata nor a pushed tag alone establishes complete publication. |
+
+## Boundaries and upgrade
+
+Subscription token counts are observed local usage, not a vendor allowance or quota meter. Different vendors may use different windows, token/cache rules or other charging units. The plugin does not infer a total allowance, remaining quota or percentage from API-equivalent prices or reported tokens. Quota exhaustion/reset information is only as reliable as vendor output and existing detection rules; a cooldown does not prove actual account eligibility.
+
+API estimates are not a hard provider billing cap, and the provider bill remains authoritative. A valid API zero applies to the observed attempt, not to earlier unknown attempts. A CLI can use its own configured API credentials even though it is launched as an official tool. Execution previews separate monetary API estimates from subscription token estimates; predicted quantities are not observed usage.
+
+Historical reference-dollar fields may remain for compatibility. Unknown old token usage remains unknown; already discarded records cannot be reconstructed. Existing package-level settlement/calendar granularity remains; this change does not claim independently settled provider invoices for every internal quality attempt.
+
+Crash or storage-failure recovery preserves unresolved execution evidence. There is no automatic paid replay, arbitrary timeout that clears live ownership, or new manual reconciliation/release control. Inspect the original task, retained worktree and provider usage/bill before recovery. Live progress handles remain in Host memory and are not restored as live workers after restart.
+
+No new real paid-provider/vendor CLI inference or installed-DSH end-to-end acceptance is claimed for this release. Prior real execution evidence remains dated in the [0.20.0 report](0.20.0-validation.md). Fully exit Harness, including tray and all Host processes, before updating; restart after installation. Back up state/profile data before migration or downgrade. Older plugin versions cannot read schema v3 state.

package/docs/releases/0.25.1-validation.md

@@ -0,0 +1,36 @@
+# 0.25.1 release acceptance
+
+Date: 2026-10-24. Package: `@ljwei-stak/dsh-model-router@0.25.1`.
+
+Source acceptance: passed. The published SDK comparison, local results and actual Windows/Linux matrix below verify the implementation. The final tagged commit, archive digests and post-publication anonymous download checks are recorded separately in the dated release/archive evidence, avoiding an archive digest embedded inside its own containing archive.
+
+## Problem and resulting behavior
+
+- Harness Desktop 0.2.1-rc.3 is outside 0.25.0's exact Host peer range. This update adds 0.2.1-rc.3 while retaining the existing 0.2.0-rc.1, 0.2.0-rc.2 and 0.2.1-rc.2 declarations.
+- Source development pins the published 0.2.1-rc.3 SDK graph and regenerates the Desktop client against that SDK. SDK checks must inspect the Host/client interfaces actually imported by the plugin, including remotes, settings, tools, model execution and the client loader.
+- Current bilingual installation examples and workbench documentation identify 0.25.1 and the declared Host versions. Historical release notes, tags and acceptance reports retain their original versions and evidence.
+- API monetary accounting, the independent subscription quantity ledger, durable execution checkpoints, progress and cancellation retain their existing behavior. This compatibility update does not introduce a state schema beyond v3 from 0.25.0.
+
+## Validation record
+
+| Check | Observed evidence |
+| --- | --- |
+| Published SDK comparison | Compared 51 direct DSH SDK packages across rc.2/rc.3 and verified all 102 official tarballs against registry SHA512 integrity. After excluding version strings, 46 packages' runtime/declarations are unchanged. Host core interfaces, model-catalog DTO and layout/settings contracts are unchanged; changed packages add telemetry fields, declaration comments, plugin-list navigation, menu/tooltip helpers and sidebar menus/pin controls. The imported interfaces remain available. Detailed package/diff evidence is retained in the release archive. |
+| Host/client contract regressions | 32/32 focused tests passed against the actual installed rc.3 SDK: app-boot compatibility without exemptions, Cordis Host/remote injection, settings ACK/revision/timeout behavior and generated-client loading. The old 0.25.0 manifest reproduces rc.3 rejection; the new manifest accepts the four declared candidates and still rejects unaudited rc.4/final releases. Older Host declarations are retained, not represented as new installed-Desktop tests. |
+| Dependency graph | `pnpm install --frozen-lockfile --strict-peer-dependencies` passed. All 51 direct DSH development packages are pinned to 0.2.1-rc.3 in package.json and the lockfile; the six DSH Host peer ranges retain the old candidates and add rc.3. |
+| Client and preview | Actual rc.3 client rebuild and `check:client` passed (986,763 bytes), preserving the existing under-1-MB guard. The real workbench component and offline fixtures compile successfully. |
+| README pairing | `npm run check:readme` passed after reviewing both translations: 6 paired display formulas, 33 paired inline expressions and current translation hashes. Formula contents are unchanged; no new GitHub MathJax rendering claim is made. |
+| Complete local suite | `npm test`: 1,187 tests; 1,184 passed, 0 failed, 3 environment skips. Full logs are retained in the release archive. |
+| Windows/Linux CI | [Implementation matrix run](https://github.com/Alice-Marx/dsh-model-router/actions/runs/40084735167) on `d90931a7f9c96a985eccc1b9eb59a2b69edf608c`: Node 24 / windows-latest **success**; Node 24 / ubuntu-latest **success**. Both ran strict frozen installation, the complete suite, committed-client consistency, actual build/check, preview compilation and package byte/runtime verification. The final documentation commit runs the same matrix again before publication. |
+| Package/source integrity | The local candidate archive's 80 files match raw Git blobs and include all 42 local runtime modules. Final `v0.25.1` commit and archive digests are recorded in Release assets. The complete source ZIP is constructed from raw Git blobs and separately verified byte for byte before upload. |
+| Public distribution | After publication, anonymously download the npm archive, GitHub Release page and every attached asset; compare exact bytes, registry integrity, main and tag. Neither metadata nor a pushed tag proves release completion. |
+
+## Boundaries and upgrade
+
+The [official rc.3 release](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.2.1-rc.3) adds sidebar/session menus and changes the official API-key route's model-list refresh. The router's existing `sidebar.panellist` registration remains visible by default and participates in the new menu; no forced pin preference is needed. Its existing asynchronous `session.modelCatalog` call continues to consume the Host-owned directory. No provider endpoint, key lookup or model identifier is reimplemented by this update.
+
+The rc.3 SDK dependency graph and offline contracts provide source/build evidence. They do not establish that every declared older Host has been newly tested in an installed Desktop, or that a vendor login, model identity or account entitlement is available. Installed-DSH end-to-end acceptance and new paid-provider/vendor CLI inference are not claimed unless separately recorded with their actual date, environment and results. Earlier real execution evidence remains in the [0.20.0 report](0.20.0-validation.md); API/subscription separation and accounting limits remain in the [0.25.0 report](0.25.0-validation.md).
+
+Fully quit Harness, including tray and all Host processes, before updating the plugin; restart after installation. Back up profile/state data before updating or downgrading. Existing v3 state is retained; plugin versions predating schema v3 cannot read it. Do not erase unresolved reservations or replay interrupted paid work to test compatibility.
+
+Subscription quantities are observed usage, not remaining vendor quota. API estimates are not a hard provider billing cap. Mock execution, local preview and successful automated tests do not validate provider billing or deliverable correctness.

package/docs/releases/0.25.2-validation.md

@@ -0,0 +1,48 @@
+# 0.25.2 release acceptance
+
+Date: 2026-10-26. Package: `@ljwei-stak/dsh-model-router@0.25.2`.
+
+## Behavior
+
+The `zcode` registry entry now installs the complete standalone runtime from
+[Alice-Marx/zcode-cli](https://github.com/Alice-Marx/zcode-cli), a community extraction
+of ZCode. It keeps existing route bindings and uses the common tool-card
+install/update/repair/uninstall controls and shared directory setting. The default
+runtime directory is `~/.zcode/runtime`; a configured shared root uses its
+`zcode-cli` child. Existing desktop files and the obsolete desktop-directory
+setting are not used by the new adapter.
+
+The installer verifies the fixed GitHub Release archive against the matching
+published SHA256 file, safely extracts the complete runtime and records file
+digests outside the installation. Discovery and execution compare the installed
+tree with that record. This is source/file integrity checking, not a Z.AI
+publisher signature. Local installation and trust-record files remain part of
+the trusted Host boundary.
+
+TUI, login and managed headless tasks use `bin/zcode.mjs` with Node 24.14.0 or a
+newer Node 24. Login uses `zcode login` or `zcode login bigmodel`. No login-status
+command is available, so the plugin does not infer authentication from an
+undocumented API-key variable. Headless tasks preserve the configured CLI model,
+disable interactive workflow changes and retain the existing approved editable
+workspace boundary.
+
+## Verification
+
+| Check | Observed local result |
+| --- | --- |
+| Dependency graph | Pinned pnpm 10.34.6 frozen installation with strict peer dependencies passed. |
+| Complete suite | 1,193 tests: 1,190 passed, 0 failed, 3 environment skips on Windows / Node 24.20.0. |
+| Client and preview | Actual Desktop client rebuilt (980,558 bytes); `check:client`, README pairing and offline workbench compilation passed. The ZCode CLI tool card was visually inspected in the local preview. |
+| Installer and launch regressions | Cover SHA256 failure, redirects, unsafe tar members, changed/missing/added runtime files, repair, ownership and uninstall boundaries; cross-platform terminal/login launch, Node constraints and obsolete desktop cache/settings rejection. Canonical temporary-path aliases are accepted while actual installation ancestor links/junctions remain rejected. |
+| Real upstream distribution | Freshly downloaded the complete 3.16.2 public release tarball through the user's existing system proxy; SHA256 matched both the public checksum file and GitHub asset digest. Verified installed tree, actual `--version` and `--help`, native executor readiness, TUI/login launch resolution and owned-runtime uninstall on Windows. No model request was made. The earlier cached-archive smoke is retained separately; the fresh download supersedes its network limitation. |
+| Windows/Linux CI | [Implementation matrix](https://github.com/Alice-Marx/dsh-model-router/actions/runs/40217818723) on `2507889b0ff7a6b45d472bce6bff185d2a375c1c`: both Node 24 / ubuntu-latest and Node 24 / windows-latest passed dependency installation, complete tests, client build/check, preview and package byte/runtime-closure verification. |
+| Publication gates | npm dry-run and local verification of all 81 packaged files against committed Git bytes passed; all 42 runtime files are included. Final immutable commit/tag references, package digests and registry/Release download verification are retained with release notes and the dated export archive. |
+
+Upstream runtime SHA256:
+`70e2ca3ab681605aa4b9503d1f8455f28ae3a6dc79488a1e988837b8992d78a6`.
+Detailed logs and final package digests remain outside the package, avoiding a
+self-referential archive digest.
+
+Cross-platform fixtures and CI are separate from installed Desktop operation.
+No new paid inference or installed-DSH UI end-to-end result is claimed. macOS
+runtime support is not represented as a new native macOS acceptance test.

package/docs/releases/0.25.3-validation.md

@@ -0,0 +1,50 @@
+# 0.25.3 release acceptance
+
+Date: 2026-10-26. Package: `@ljwei-stak/dsh-model-router@0.25.3`.
+
+## Behavior
+
+ZCode CLI now offers npm in addition to the existing default GitHub Release
+method. npm installs the fixed `@ljwei-stak/zcode-cli@latest` package using the
+common npm prefix and configured registry. The selected method controls
+installation, update, repair, removal, version checks and terminal/task entry
+selection. The two version channels retain separate caches and in-flight
+requests; missing or invalid npm installations do not use an archive copy.
+
+The npm package includes the complete runtime archive. The plugin verifies its
+metadata, launcher, payload manifest and compressed runtime against the exact
+npm registry release, then checks every expanded runtime file before direct
+launch. It reuses a valid package runtime; when install scripts are disabled it
+prepares a dedicated verified cache under the DSH state directory. It does not
+run the npm bootstrap in the Host or fetch a separate GitHub runtime. npm
+uninstall removes its selected package and may retain the verified runtime
+cache, configuration and sessions.
+
+Node 24.14.0 or a newer Node 24 remains required. The existing configured CLI
+model, login commands and approved editable-workspace boundary are preserved.
+
+## Validation
+
+- Pinned frozen pnpm installation with strict peer dependencies passed.
+- Complete local regression suite: 1,219 tests, 1,216 passed, 0 failed,
+  3 environment skips on Windows / Node 24.20.0. Actual Desktop client rebuild
+  (980,828 bytes), client check, bilingual README pairing and offline preview
+  compilation passed. The new npm choice and its effective command/directory
+  were visually inspected in the local workbench preview.
+- Source-specific latest caches, captured health settings, npm prefix binding,
+  method switching, runtime integrity, unsafe links, missing/changed resources,
+  concurrency and decompression limits have targeted regressions.
+- Actual Windows / Node 24.20.0 smoke used the published npm package 3.16.2.
+  Both ordinary installation and explicit `ignore-scripts` installation passed
+  through the real Host install job, npm registry attestation, version/help,
+  terminal/login launch resolution and managed readiness. Each was uninstalled
+  through the selected npm method; sibling files and session fixtures remained.
+  Missing npm after uninstall could not become an archive or cached-runtime
+  installation. No model request was made.
+- Publication is gated on Windows/Linux CI and npm archive verification against
+  the committed Git files and runtime import closure. Exact CI references,
+  counts, package digests and anonymous post-publication download checks are
+  retained in release notes and the dated export evidence.
+
+This verifies installation and launch contracts, not new paid inference or an
+installed-DSH UI end-to-end run. Native macOS operation is not newly tested here.

package/docs/releases/0.25.4-validation.md

@@ -0,0 +1,41 @@
+# 0.25.4 release acceptance
+
+Date: 2026-10-26. Package: `@ljwei-stak/dsh-model-router@0.25.4`.
+
+## Behavior
+
+Windows npm installation now handles the three observed legacy ZCode desktop
+launcher templates occupying its selected prefix. It scans all command files
+before moving anything, recognizes complete fixed-path templates only, and
+preserves their original bytes in a unique `.zcode-legacy-shims-*` directory
+with a hash manifest. The install log records that directory before npm runs.
+
+Failure, cancellation or failed verification restores missing old launchers
+without overwriting new npm or user files. Backups remain available after
+success and rollback. Unknown files, mismatched desktop targets, command links
+and linked prefix ancestors are not migrated. No `--force` is added. Existing
+desktop resources, configuration, login and sessions are preserved.
+
+## Validation
+
+- Pinned frozen pnpm installation with strict peer dependencies passed.
+- Complete local regression suite: 1,230 tests, 1,227 passed, 0 failed and
+  3 environment skips on Windows / Node 24.20.0. Actual Desktop client rebuild
+  (980,828 bytes), client check, bilingual README pairing and offline preview
+  compilation passed.
+- Eleven focused migration regressions cover complete template recognition,
+  BOM/CRLF bytes, shell metacharacters, backup preservation, exclusive rollback,
+  existing npm/user files, mixed collisions, links/junctions, repeated attempts,
+  mismatched desktop targets, cancellation and changed backup bytes.
+- Actual Windows repair identified and backed up all three legacy launchers,
+  then installed the published `@ljwei-stak/zcode-cli@3.16.2` into the same npm
+  prefix. npm registry attestation, complete runtime verification, version
+  output, terminal entry selection and managed readiness passed. No model
+  request was made; private machine paths and logs are kept in the dated export.
+- Publication is gated on Windows/Linux CI and npm archive verification against
+  committed Git bytes and the runtime import closure. Exact CI references,
+  archive counts, digests and anonymous npm/GitHub download verification are
+  retained in release notes and the dated export evidence.
+
+The local repair verifies the actual installation and launch path. It does not
+claim a new installed-Desktop UI end-to-end run or new paid vendor inference.

package/docs/releases/0.25.5-validation.md

@@ -0,0 +1,40 @@
+# 0.25.5 acceptance report
+
+The reported ZCode TUI corruption was reproduced with the published ZCode
+3.16.2 runtime and the router's actual Windows ConPTY dependency. UTF-8 native
+output was interpreted with the console's legacy code page before it reached
+xterm.js, damaging box drawing and some adjacent VT sequences. Starting Node
+inside a UTF-8 console restores that output; a preload after Node startup did
+not resolve the issue and is not used.
+
+## Change
+
+Only Windows ZCode PTY launches use a profile-free PowerShell bootstrap. It
+sets that new console's input/output encoding to UTF-8, runs the already
+verified Node/runtime entry with literal arguments, and forwards its exit
+status. No system, registry, user profile, npm package or global console
+setting is changed. Both npm and GitHub Release selections use this path.
+Other tools, POSIX launches and pipe fallback retain their existing behavior.
+
+## Evidence
+
+- Actual router `CliTerminalCard`, `TerminalConnection`, session manager and
+  Windows ConPTY rendered the published ZCode 3.16.2 TUI in a local browser.
+  The logo, box drawing, colors and Chinese draft input were inspected. At
+  a 960-pixel viewport the TUI redrew to the narrower terminal. Ctrl+C input
+  ended the real session and the UI reported exit code 0. The draft was not
+  submitted; no model was called.
+- `node scripts/check-terminal-utf8.mjs` uses native file-descriptor output,
+  truecolor VT, a Unicode path containing spaces, apostrophes, ampersands and
+  `%PATH%`, Unicode keyboard input, resize and an exit-7 fixture. It verifies
+  the real process handle's exit status and cleanup, without a vendor CLI or
+  network. The Windows CI job runs this regression explicitly.
+- Terminal unit/gateway tests cover the fixed launch marker, literal quoting
+  and unchanged POSIX/non-ZCode behavior. Full-suite, frozen dependency graph,
+  generated client and package-byte checks gate publication. Exact results,
+  CI references and registry digests are retained in release notes/exports.
+
+This is a real native PTY and real client-component validation in an isolated
+local harness. It does not claim a new installed-Desktop application run,
+vendor login or paid model inference. The standalone ZCode npm package remains
+3.16.2 because the defect and fix are in the router's Windows terminal host.

package/docs/releases/0.26.0-preview.0-validation.md

@@ -0,0 +1,23 @@
+# 0.26.0-preview.0 validation report
+
+## Release contract
+
+This is a **preview release**, not a stable or production-migration release. It publishes the integrated DS Bot and Model Router product for evaluation and controlled use. npm installs must use the `preview` dist-tag or the exact version; the stable `latest` tag remains on 0.25.5.
+
+The preview includes a single DS Bot + Model Router plugin composition, stable Bot identities and exact-model policy, private Bot state, managed tasks and dependency plans, funding and receipt accounting, remote machines/files/browser controls, unified wide/narrow UI and offline task recovery. The source repository also contains an owner-only private migration archive restore component with process-crash recovery; it is not wired into product activation or exposed as a production migration feature.
+
+## Verified evidence
+
+- Integration ledger at the preview source: 44/63 acceptance scenarios passed; 0/20 work packages formally completed; M0 11/12.
+- Frozen upstream DS baseline: `de55888a93983fc51c94f7d22bc94b4f8293205d`; 297 source files verified without modification.
+- Full root regression: 1989 tests, 1901 passed, 0 failed, 88 explicitly skipped. `npm run check:client` passed.
+- Frozen upstream suite: 1062 tests, 1061 passed, 0 failed, 1 skipped.
+- Real default product browser checks cover offline errors, task recovery and refresh without repeated side effects. Migration tests use actual child `exit(86)` crashes and schema 5 SQLite archives.
+- `pnpm install --frozen-lockfile --strict-peer-dependencies` passed before release preparation.
+- No real model inference, production credentials or real user profiles were used in the integration acceptance.
+
+## Known limits
+
+Production activation, all-domain stop-write and post-activation rollback remain closed. `activationSupported`, `postActivationRollbackSupported` and `stopWriteProvable` remain false. Windows separate-account isolation, scheduled-task acceptance, multi-monitor/DPI, UAC/RDP, remote CLI/PTY, clean-install topology, public deployment, performance and final release audits remain incomplete.
+
+Do not use this preview as an automatic upgrade of a production profile. Back up data and use an isolated profile for evaluation. The preview tag does not change the support status of earlier stable releases.