@ljwei-stak/dsh-model-router 0.22.2 → 0.23.1

package/.dsh-plugin/shared/run-jobs.mjs

@@ -0,0 +1,169 @@
+/**
+ * In-memory Host workbench jobs. Only package identity and state enter progress;
+ * answers and the rest of the workbench response stay in the final result.
+ */
+import { randomUUID } from 'node:crypto'
+
+const ACTIVE = new Set(['running', 'cancelling'])
+const PACKAGE_DONE = new Set(['succeeded', 'failed', 'cancelled', 'blocked', 'skipped'])
+const FAILURE = 'Run failed. Please try again.'
+
+const copy = value => JSON.parse(JSON.stringify(value))
+const label = (value, fallback = '') => typeof value === 'string' ? value : fallback
+
+function positiveLimit(value, name) {
+  if (!Number.isSafeInteger(value) || value < 1) throw new TypeError(`${name} must be a positive integer.`)
+  return value
+}
+
+function completionStatus(item) {
+  if (item.cancelled === true || item.status === 'cancelled') return 'cancelled'
+  if (item.blocked === true || item.status === 'blocked') return 'blocked'
+  if (item.notStarted === true || item.status === 'skipped') return 'skipped'
+  if (item.status === 'succeeded' || item.status === 'failed') return item.status
+  return item.ok === true ? 'succeeded' : 'failed'
+}
+
+/**
+ * start() returns before invoking run(). Cancellation requests abort the same
+ * signal given to run(), but the job remains active until run actually settles.
+ * maxJobs bounds all retained jobs, and only terminal jobs may be evicted.
+ */
+export function createRunJobs({ now = Date.now, maxJobs = 50, maxActive = 4 } = {}) {
+  if (typeof now !== 'function') throw new TypeError('now must be a function.')
+  positiveLimit(maxJobs, 'maxJobs')
+  positiveLimit(maxActive, 'maxActive')
+  const jobs = new Map()
+  let disposed = false
+
+  // A clock supplied by a Host must not turn a settled worker into an unhandled
+  // rejection or make a snapshot impossible to send over JSON.
+  const timestamp = () => {
+    try {
+      const value = now()
+      if (typeof value === 'number' && Number.isFinite(value)) return value
+    } catch { /* retain a usable timestamp if the injected clock fails */ }
+    return Date.now()
+  }
+  const snapshot = job => copy(job.snapshot)
+  const find = jobId => {
+    const job = jobs.get(jobId)
+    if (!job) throw new Error('Unknown run job id.')
+    return job
+  }
+
+  function refreshProgress(job) {
+    const progress = job.snapshot.progress
+    progress.total = progress.packages.length
+    progress.completed = progress.packages.filter(item => PACKAGE_DONE.has(item.status)).length
+    const current = progress.packages.findLast(item => item.status === 'running')
+    progress.current = current ? { id: current.id, name: current.name } : null
+  }
+
+  function packageFor(job, value) {
+    if (!value || typeof value !== 'object') return null
+    const id = label(value.id)
+    if (!id) return null
+    let item = job.snapshot.progress.packages.find(item => item.id === id)
+    if (!item) {
+      item = { id, name: label(value.name, id), status: 'pending' }
+      job.snapshot.progress.packages.push(item)
+    }
+    return item
+  }
+
+  function progressFor(job, event) {
+    if (!ACTIVE.has(job.snapshot.status) || !event || typeof event !== 'object') return
+    // Progress is advisory: malformed events must not break the actual worker.
+    try {
+      if (event.type === 'stage') {
+        if (typeof event.stage === 'string') job.snapshot.progress.stage = event.stage.slice(0, 120)
+        return
+      }
+      if (event.type !== 'package-start' && event.type !== 'package-complete') return
+      const item = packageFor(job, event.package)
+      if (!item || PACKAGE_DONE.has(item.status)) return
+      item.status = event.type === 'package-start' ? 'running' : completionStatus(event.package)
+      refreshProgress(job)
+    } catch { /* progress cannot affect the final workbench response */ }
+  }
+
+  function finish(job, status, result = null) {
+    if (!ACTIVE.has(job.snapshot.status)) return
+    const state = job.snapshot
+    state.status = status
+    state.finishedAt = timestamp()
+    state.result = result
+    state.progress.stage = status
+    for (const item of state.progress.packages) {
+      if (PACKAGE_DONE.has(item.status)) continue
+      // Pending packages were never observed running; once the worker settles,
+      // they cannot start. An interrupted running package has a known outcome.
+      item.status = status === 'cancelled' ? 'cancelled'
+        : item.status === 'running' ? (status === 'failed' ? 'failed' : 'succeeded') : 'skipped'
+    }
+    refreshProgress(job)
+    if (status === 'failed') state.error = FAILURE
+  }
+
+  function fail(job) {
+    finish(job, job.controller.signal.aborted ? 'cancelled' : 'failed')
+  }
+
+  function requestCancel(job) {
+    if (ACTIVE.has(job.snapshot.status) && !job.snapshot.cancelRequested) {
+      job.snapshot.cancelRequested = true
+      job.snapshot.status = 'cancelling'
+      job.snapshot.progress.stage = 'cancelling'
+      job.controller.abort()
+    }
+    return snapshot(job)
+  }
+
+  return {
+    start({ run, packages = [] } = {}) {
+      if (disposed) throw new Error('Run job manager is disposed.')
+      if (typeof run !== 'function') throw new TypeError('Run job requires a run function.')
+      if ([...jobs.values()].filter(job => ACTIVE.has(job.snapshot.status)).length >= maxActive) {
+        throw new Error('Too many active run jobs.')
+      }
+      // Evict the oldest terminal snapshots first. A cancelling worker still
+      // occupies capacity because its process/cleanup may still be running.
+      if (jobs.size >= maxJobs) {
+        const terminal = [...jobs].find(([, job]) => !ACTIVE.has(job.snapshot.status))
+        if (!terminal) throw new Error('Run job capacity reached; active jobs are still running.')
+        jobs.delete(terminal[0])
+      }
+      const job = {
+        controller: new AbortController(),
+        snapshot: {
+          jobId: randomUUID(), status: 'running', startedAt: timestamp(), finishedAt: null,
+          cancelRequested: false,
+          progress: { total: 0, completed: 0, current: null, stage: 'starting', packages: [] },
+          result: null,
+        },
+      }
+      for (const item of Array.isArray(packages) ? packages : []) packageFor(job, item)
+      refreshProgress(job)
+      jobs.set(job.snapshot.jobId, job)
+      // Both rejection paths are attached before the worker can run. Result
+      // cloning also detaches the worker's mutable response from stored state.
+      Promise.resolve().then(() => run({
+        signal: job.controller.signal,
+        onProgress: event => progressFor(job, event),
+      })).then(result => {
+        const value = result == null ? null : copy(result)
+        const cancelled = value?.status === 'cancelled' || value?.execution?.status === 'cancelled'
+        finish(job, cancelled ? 'cancelled' : 'completed', value)
+      }, () => fail(job)).catch(() => fail(job))
+      return snapshot(job)
+    },
+    status(jobId) { return snapshot(find(jobId)) },
+    cancel(jobId) { return requestCancel(find(jobId)) },
+    dispose() {
+      if (disposed) return
+      disposed = true
+      for (const job of jobs.values()) requestCancel(job)
+    },
+  }
+}

package/.dsh-plugin/shared/task-executors.mjs

@@ -1223,6 +1223,12 @@ function aggregateOf(results) {
   return { status, packages: results, aggregate }
 }
 
+/** Host-only observation hooks must never discard execution or billing evidence. */
+export async function observeExecutionProgress(hook, value) {
+  if (typeof hook !== 'function') return
+  try { await hook(value) } catch { /* Progress reporting does not control execution. */ }
+}
+
 function checkedPackageSelections(packages, routes, overrides, runVerified, targets) {
   const preceding = new Set()
   const selected = {}
@@ -1299,10 +1305,12 @@ async function runManualTool(target, prompt, options) {
  */
 async function runPackages({ packages, task, routingBypassed, routes, previous = [], targets = null, overrides = {}, choices = {}, options }) {
   const routeList = Array.isArray(routes) ? routes : []
-  const { credentialsFor, onPackage, billing, ...runOptions } = options
+  const { credentialsFor, onPackageStart, onPackage, onStage, billing, ...runOptions } = options
+  await observeExecutionProgress(onStage, 'preparing')
   const effectivePackages = checkedPackageSelections(packages, routeList, overrides, runOptions.runVerified, targets)
   const results = []
   const ranIds = []
+  if (!runOptions.signal?.aborted) await observeExecutionProgress(onStage, 'executing')
   for (const item of effectivePackages) {
     const kept = previous.find(result => result.id === item.id)
     if (targets && !targets.has(item.id) && kept) {
@@ -1315,14 +1323,17 @@ async function runPackages({ packages, task, routingBypassed, routes, previous =
     const provider = target?.kind === 'tool' ? 'official-tool' : target?.provider ?? override?.provider ?? item.recommendedProvider
     const model = target?.kind === 'tool' ? target.toolId : target?.model ?? override?.model ?? item.recommendedModel
     const identity = { ...selection, ...(item.type ? { type: item.type } : {}), ...(item.purpose ? { purpose: item.purpose } : {}) }
-    if (runOptions.signal?.aborted) {
+    const cancelledBeforeStart = async () => {
       // Cancelled: later packages are not started (no CLI process, no API spend).
       const cancelled = { id: item.id, name: item.name, ok: false, provider, model,
         channel: target?.kind === 'tool' ? 'official-cli' : 'harness-llm', ...(target?.kind === 'tool' ? { toolId: target.toolId } : {}),
         ...identity, answer: '', fallback: null, cancelled: true, notStarted: true, error: '执行已取消，此步骤未开始。' }
       results.push(cancelled)
       ranIds.push(item.id)
-      if (typeof onPackage === 'function') await onPackage(cancelled)
+      await observeExecutionProgress(onPackage, cancelled)
+    }
+    if (runOptions.signal?.aborted) {
+      await cancelledBeforeStart()
       continue
     }
     const unmet = (item.dependsOn ?? []).filter(id => results.find(result => result.id === id)?.ok !== true)
@@ -1338,7 +1349,7 @@ async function runPackages({ packages, task, routingBypassed, routes, previous =
       }
       results.push(blocked)
       ranIds.push(item.id)
-      if (typeof onPackage === 'function') await onPackage(blocked)
+      await observeExecutionProgress(onPackage, blocked)
       continue
     }
     const plannedRoute = routeList.find(candidate => candidate.provider === provider && candidate.model === model)
@@ -1347,13 +1358,24 @@ async function runPackages({ packages, task, routingBypassed, routes, previous =
       : target?.kind === 'tool' ? { provider, model } : reasoningRouteForAssignment(plannedRoute, item, override)
     if (target?.kind === 'api') delete route.reasoningEffort
     const promptText = routingBypassed ? checkedTask(task) : packagePrompt(task, item, results)
+    const credentials = !target ? (typeof credentialsFor === 'function' ? await credentialsFor(route) : runOptions.credentials ?? null) : null
+    if (runOptions.signal?.aborted) {
+      await cancelledBeforeStart()
+      continue
+    }
     const startedAt = Date.now()
+    await observeExecutionProgress(onPackageStart, { ...item, ...identity, provider, model, startedAt,
+      channel: target?.kind === 'tool' ? 'official-cli' : 'harness-llm',
+      ...(target?.kind === 'tool' ? { toolId: target.toolId } : {}) })
+    if (runOptions.signal?.aborted) {
+      await cancelledBeforeStart()
+      continue
+    }
     let result
     if (target?.kind === 'tool') result = await runManualTool(target, promptText, runOptions)
     else if (target?.kind === 'api') result = { ...await useApi(runOptions.apiFallback, { route, task: promptText,
       signal: runOptions.signal, preference: 'api', reason: '按工作包手动选择模型目录 API。' }), fallback: null }
     else {
-      const credentials = typeof credentialsFor === 'function' ? await credentialsFor(route) : runOptions.credentials ?? null
       result = await executeRouteWithBilling({
         ...runOptions,
         billing: billing ? { ...billing, routes: billing.routes ?? routeList, ...(choices[item.id] ? { choice: choices[item.id] } : {}) } : null,
@@ -1382,7 +1404,7 @@ async function runPackages({ packages, task, routingBypassed, routes, previous =
     }
     results.push(entry)
     ranIds.push(item.id)
-    if (typeof onPackage === 'function') await onPackage(entry)
+    await observeExecutionProgress(onPackage, entry)
   }
   return { ...aggregateOf(results), ranIds }
 }

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.23.1 — 2026-10-23
+
+- Check retry budgets against the target and every unfinished downstream package that will execute. Reassignment uses the selected route estimate; successful downstream packages are excluded and unknown prices remain unknown.
+- Bound workbench preview, progress and cancel requests to 15 seconds, abort stalled transport waits, retry progress against the same job and allow an unacknowledged cancellation to be retried. Never automatically replay task starts.
+- Preserve late-response fences and clear request lifetimes on panel close. Add offline Host budget, real SDK cancellation transport and hung-request UI regressions.
+
+
+## 0.23.0 — 2026-10-23
+
+- Return an observable Host job when a workbench execution starts. Show elapsed time, the current work package and per-package states, with status reads and cancellation through the typed desktop gateway.
+- Propagate cancellation to API streams and official CLI teams, wait for execution cleanup, retain completed results and reported usage, and prevent cancelled editable worktrees from starting integration. Closing the panel does not cancel execution.
+- Keep preview and permission checks before job acceptance, preserve legacy synchronous execution helpers, and cover job lifecycles, gateway boundaries, cancellation accounting and UI races with offline fixtures.
+
+- Preserve the incomplete-history budget marker when a corrupt-state recovery fails before a later read or write commits its pending notice, so missing charge history cannot become a zero-spend assumption.
+
 ## 0.22.2 — 2026-10-19
 
 - Render the README's mathematical symbols and expressions in running prose as inline math in both languages, while retaining code formatting for actual API fields. Keep ordinary display equations on one line.

package/README.i18n.yaml

@@ -1,4 +1,4 @@
 # README translation pairing for this repository.
 # Reviewed together; Git blob hashes identify the exact synchronized texts.
-README.md: e73aada4df85277816f1d06c66d76c4e2c8a45b7
-README.zh.md: ff34db2cb3b95a5472d8e165c447ab36e844cd66
+README.md: 3bb1e3507fc7451861fb3463f52f68827fb71690
+README.zh.md: 1d15eb0bf9c5ebeac41b74d349b0a709f16288c8

package/README.md

@@ -2,15 +2,53 @@
 
 [English](README.md) · [简体中文](README.zh.md)
 
+[![npm version](https://flat.badgen.net/npm/v/@ljwei-stak/dsh-model-router)](https://www.npmjs.com/package/@ljwei-stak/dsh-model-router) [![dshfind](https://dshfind.com/api/badge/alice-marx/dsh-model-router)](https://dshfind.com/en/plugins/alice-marx/dsh-model-router?ref=badge) [![Listed in the DSH plugin directory](https://dsh-plugin.org/badges/listed.svg)](https://dsh-plugin.org/plugins/alice-marx/dsh-model-router) [![Awesome DSH Plugin](https://awesome-dsh-plugin.com/badge.svg)](https://awesome-dsh-plugin.com)
+
+[![dshfind](https://dshfind.com/api/card/Alice-Marx/dsh-model-router)](https://dshfind.com/en/plugins/Alice-Marx/dsh-model-router?ref=badge)
+
+Want release notes only? Click **Watch → Custom → Releases** (you do not need Watching all activity).
+
 A cost-aware model-routing workbench for **DeepSeek Harness Desktop**. Plan locally, compare configured routes, inspect execution permissions, and run dependent work packages through model APIs or supported official vendor CLIs.
 
-Current version: **0.22.2** (`@ljwei-stak/dsh-model-router`). Choose algorithm recommendations or manually assign each decomposed package to an exact model API or official tool, preserving dependencies, refreshed cost previews and retry targets. Routing now supports task-specific quality evidence, joint model/effort selection, historical P90 resource estimates and dependency-aware search. Manual mixed execution is read-only; tools use their configured default model, while the existing editable official-team workflow remains available. Compatibility remains **DeepSeek Harness Desktop 0.2.0-rc.1 / 0.2.0-rc.2 / 0.2.1-rc.2**, including Hermes/Pi installation and terminal support; neither has a verified managed runner yet. Real vendor execution evidence remains tied to **0.20.0**, with no new model experiments in this release. The router and [GAL](https://github.com/Alice-Marx/deepseek-harness-galgame) have been independent plugins since 0.12.0.
+Current version: **0.23.1** (`@ljwei-stak/dsh-model-router`). Retries now check the whole unfinished downstream group against the budget, and stalled progress/cancel requests recover after a bounded wait. Workbench execution shows live elapsed time and per-package progress, supports cancellation with completed results and reported costs retained, and reconnects to the active job when the panel is reopened. Choose algorithm recommendations or manually assign each decomposed package to an exact model API or official tool, preserving dependencies, refreshed cost previews and retry targets. Routing now supports task-specific quality evidence, joint model/effort selection, historical P90 resource estimates and dependency-aware search. Manual mixed execution is read-only; tools use their configured default model, while the existing editable official-team workflow remains available. Compatibility remains **DeepSeek Harness Desktop 0.2.0-rc.1 / 0.2.0-rc.2 / 0.2.1-rc.2**, including Hermes/Pi installation and terminal support; neither has a verified managed runner yet. Real vendor execution evidence remains tied to **0.20.0**, with no new model experiments in this release. The router and [GAL](https://github.com/Alice-Marx/deepseek-harness-galgame) have been independent plugins since 0.12.0.
 
 Official CLI teamwork runs packages sequentially with dependency context and no automatic model-directory API fallback. Editable teams explicitly choose the Harness sandbox or the vendor CLI's normal environment. In the latter, Git worktrees collect edits but do not restrict OS access. CLIs retain their configured model unless explicitly mapped. See [real Windows validation and its limits](docs/releases/0.20.0-validation.md).
 
 Both README versions describe the same interfaces, formulas, defaults and limits. [Changelog](CHANGELOG.md) preserves release history. More walkthroughs: [workbench](docs/WORKBENCH_USER_GUIDE.zh.md), [installation](docs/INSTALLATION_GUIDE.zh.md), [migration](docs/archive/MIGRATION.md), and [experiment protocol](docs/ROUTING_SELFTEST_STEPS.zh.md).
 
-**Contents:** [Capabilities](#capabilities) · [Install](#install) · [Workbench](#workbench) · [Architecture](#architecture) · [Session tools](#session-tools) · [Official tools](#official-tools) · [Team lifecycle](#team-lifecycle) · [Costs](#costs) · [Routing algorithm](#routing) · [Data](#data) · [Development](#development) · [Troubleshooting](#troubleshooting)
+<a id="quick-evaluation"></a>
+
+## Quick evaluation
+
+**One-line value:** A cost-aware DSH workbench for planning tasks, routing model calls, and running dependent work packages with explicit execution permissions.
+
+**Category:** **Models & Reasoning** (模型与推理), the best fit in the [community directory's category list](https://www.alldsh.com/categories/); this is a community taxonomy, not an official DSH classification.
+
+**Install (DSH Plugin Hub / web profile):** With the DSH CLI available, install the published npm package with:
+
+```sh
+dsh plugin --profile web add @ljwei-stak/dsh-model-router@0.23.1
+```
+
+**Install in Harness Desktop:** Launch Desktop once to initialize its `desktop` profile, quit Desktop fully, then run:
+
+```sh
+dsh plugin --profile desktop add @ljwei-stak/dsh-model-router@0.23.1
+```
+
+You can also paste the package spec into **Harness Desktop → Plugins → Add plugin**. Restart Desktop after installation. A global `npm install -g` by itself does not register a Desktop plugin.
+
+**Package and entry point:** [`@ljwei-stak/dsh-model-router@0.23.1` on npm](https://www.npmjs.com/package/@ljwei-stak/dsh-model-router) is published. The root [`package.json`](package.json) declares the package and bundle patch; [`.dsh-plugin/index.mjs`](.dsh-plugin/index.mjs) exports the required `apply(ctx)` entry point. License: [MIT](LICENSE).
+
+**Configuration:** There is no supported import of a user-authored JSON/YAML configuration file. Configure providers, models, and credentials on Harness's **Models** page; configure routing profiles and preferences in the plugin settings. Persistent router state is stored in `$DSH_HOME/model-router/state.json` (default: `~/.dsh/model-router/state.json`). Provider CLIs retain their own login and configuration. The router does not copy API keys into model profiles or terminal logs.
+
+**Screenshots and evidence:** The [workbench screenshot](docs/assets/workbench-task-preview.jpg) uses fixture models, prices, and health data; it is a simulated UI preview, not a live Harness or model run. See the [routing workflow diagram](docs/assets/routing-workflow.svg) for the execution flow. The [real Windows validation report](docs/releases/0.20.0-validation.md) documents specific 0.20.0 executions and their limits; 0.23.1 has no verified end-to-end vendor run. The [live progress screenshot](docs/assets/workbench-run-progress.png) is an offline simulation; see the [0.23.1 acceptance report](docs/releases/0.23.1-validation.md) for cancellation, recovery and validation boundaries.
+
+**Permissions and risks:** Planning is local and makes no model call. Execution sends the selected task/context to the chosen model API or vendor CLI and may incur charges. The default Harness-restricted environment separates read-only runs from approved `workspace-write` runs. An explicitly selected `cli-native` editable team runs with the current OS user's permissions, outside the Harness process sandbox; a Git worktree collects changes but does not restrict OS access. External providers and CLI services apply their own data handling and billing terms.
+
+**Compatibility:** Declared host support is DeepSeek Harness Desktop **0.2.0-rc.1**, **0.2.0-rc.2**, and **0.2.1-rc.2**. Node.js **>=22.19** and pnpm **10.34.6** are source development/build requirements, not plugin runtime prerequisites. Compatibility beyond the declared host versions is not claimed.
+
+**Contents:** [Quick evaluation](#quick-evaluation) · [Capabilities](#capabilities) · [Install](#install) · [Workbench](#workbench) · [Architecture](#architecture) · [Session tools](#session-tools) · [Official tools](#official-tools) · [Team lifecycle](#team-lifecycle) · [Costs](#costs) · [Routing algorithm](#routing) · [Data](#data) · [Development](#development) · [Troubleshooting](#troubleshooting)
 
 <a id="capabilities"></a>
 
@@ -40,16 +78,16 @@ Generating a route recommendation is local: it does not start a vendor CLI or ma
 Open **Plugins → Add plugin** and enter:
 
 ```text
-@ljwei-stak/dsh-model-router@0.22.2
+@ljwei-stak/dsh-model-router@0.23.1
 ```
 
-Use the official HTTPS npm source `https://registry.npmjs.org/` when a mirror lacks that exact version. Enable the plugin, then fully quit Harness (including its tray process) and restart it. Plugin details should show **0.22.2** and the sidebar should contain **模型路由** (Model Router). A global `npm install -g` alone does not register a Desktop plugin.
+Use the official HTTPS npm source `https://registry.npmjs.org/` when a mirror lacks that exact version. Enable the plugin, then fully quit Harness (including its tray process) and restart it. Plugin details should show **0.23.1** and the sidebar should contain **模型路由** (Model Router). A global `npm install -g` alone does not register a Desktop plugin.
 
 You can instead install a local `.tgz` archive or its extracted inner `package` directory through the plugin manager. Both must contain `package.json` and `.dsh-plugin`. See [releases](https://github.com/Alice-Marx/dsh-model-router/releases) for archived builds, or build your own checkout below.
 
 ### Upgrade from the old package name
 
-The old name `@ljwei-stak/model-router-galgame` ended at 0.13.0. Remove that plugin entry while retaining your profile/application data, then add `@ljwei-stak/dsh-model-router@0.22.2`. Do not keep both entries installed: they share the internal plugin id `model-router-galgame` and tool names. The retained id lets existing router settings and history carry over.
+The old name `@ljwei-stak/model-router-galgame` ended at 0.13.0. Remove that plugin entry while retaining your profile/application data, then add `@ljwei-stak/dsh-model-router@0.23.1`. Do not keep both entries installed: they share the internal plugin id `model-router-galgame` and tool names. The retained id lets existing router settings and history carry over.
 
 For the combined 0.11.x package, back up the profile and export the GAL saves you want to preserve before upgrading. Story playback, artwork, music and saves now belong to the independent `@ljwei-stak/dsh-galgame` package. The detailed save limitations are in [MIGRATION.md](docs/archive/MIGRATION.md).
 
@@ -79,6 +117,10 @@ Switching tabs keeps the panels mounted, preserving in-progress installation and
 5. In **在工作台执行**, choose **模型路由（只读）** for the existing routed executor, or first select **团队分工** and choose **官方工具协作**. For official teamwork, select **只读检查** (read-only) or **编辑文件** (edit files). Editable teams also choose **Harness 受限环境** (Harness sandbox, the default) or **厂商 CLI 正常环境** (normal vendor environment, outside the Harness sandbox). Enter an existing absolute workspace path, or reuse the last run's path. Click **预览执行计划**, review each package, its permissions and required confirmations, then explicitly confirm execution. The Host rechecks the plan before starting; changed conditions can require confirmation again.
 6. Inspect **执行记录与子任务** for the actual channel, response, failures, cost and ratings. Official teamwork replans using only installed CLIs ready for the selected permission mode. Edits require approval and a clean Git repository; successful worktree changes are conditionally integrated. An unavailable or failed CLI never silently becomes an API call in this mode.
 
+After execution starts, the workbench shows elapsed time, the current package and each package's state. **取消执行** requests cancellation of the active call and stops later packages from starting; **正在取消** remains visible until the executor finishes cleanup. Completed results and reported usage remain in history. Cancelling cannot undo charges already incurred or changes already integrated. Closing the panel does not cancel a run; reopening it in the same browser session can reconnect while the Host retains that job. Host restarts clear these in-memory jobs, and completed ledger records remain available.
+
+Preview, progress and cancellation requests stop waiting after 15 seconds. Progress reads retry against the same job; an unacknowledged cancellation can be retried explicitly. A transport timeout does not establish that the Host task stopped and never automatically resubmits `startRun`. Before retrying a recorded step, budget checks include that step and all unfinished downstream packages that will execute; reassignment uses the selected route estimate and unknown prices remain unknown. The [timeout recovery screenshot](docs/assets/workbench-run-timeout.png) is an offline simulation.
+
 Changing task text, planning mode, profiles, directory or relevant settings invalidates the prior recommendation. Changing execution inputs also discards the pending or completed preview, so execution requires a new preview of the current request. Previewing execution uses current Host state and can differ from a previous local plan.
 
 Example task:
@@ -151,6 +193,8 @@ Replace the workspace with an existing clean Git root. Call `previewRun(request)
 
 Native editing normally requires `workspace-write` and `unsandboxed`; an exceeded budget adds `over-budget`. Do not hardcode this list or populate it without consent. `startRun` replans and repeats preflight; it does not consume a frozen preview token. New confirmation requirements return `needs-confirmation` with `missing` and updated reasons. Changing task, mode, workspace or profiles requires a fresh preview. Workbench requests use saved route `cliModel` mappings; temporary `cliModelsJson` bindings belong to the session tool below.
 
+An accepted `startRun` returns a job snapshot with `jobId`, `status` and `progress` before execution finishes. Poll `runStatus({ jobId })`; request cancellation with `cancelRun({ jobId })`. Job states are `running`, `cancelling`, `completed`, `cancelled` or `failed`. A terminal snapshot's `result` contains the final workbench response and ledger `runId` when saved. `completed` means the worker settled; inspect `result.status` for the actual task outcome. Progress contains package identities and states, not answer text. A failed poll does not establish that execution stopped, and clients must not retry `startRun` automatically.
+
 <a id="session-tools"></a>
 
 ## Session tools

package/README.zh.md

@@ -2,15 +2,53 @@
 
 [English](README.md) · [简体中文](README.zh.md)
 
+[![npm 版本](https://flat.badgen.net/npm/v/@ljwei-stak/dsh-model-router)](https://www.npmjs.com/package/@ljwei-stak/dsh-model-router) [![dshfind](https://dshfind.com/api/badge/alice-marx/dsh-model-router?lang=zh)](https://dshfind.com/zh/plugins/alice-marx/dsh-model-router?ref=badge) [![已收录至 DSH 插件目录](https://dsh-plugin.org/badges/listed.svg)](https://dsh-plugin.org/plugins/alice-marx/dsh-model-router) [![Awesome DSH Plugin](https://awesome-dsh-plugin.com/badge.svg)](https://awesome-dsh-plugin.com)
+
+[![dshfind](https://dshfind.com/api/card/Alice-Marx/dsh-model-router?lang=zh)](https://dshfind.com/zh/plugins/Alice-Marx/dsh-model-router?ref=badge)
+
+想跟进版本更新？点右上角 **Watch → Custom → 勾选 Releases**（不必 Watching 全部活动）。
+
 面向 **DeepSeek Harness Desktop** 的成本感知模型路由工作台。在本地规划任务、比较已配置路线、检查执行权限，并通过模型 API 或支持的厂商官方 CLI 执行有依赖关系的工作包。
 
-当前版本：**0.22.2**（`@ljwei-stak/dsh-model-router`）。新增“按算法推荐分配 / 手动调整分配”：拆分后的工作包可逐个指定模型 API 或官方工具，保留依赖、重新预览费用，并保存重跑目标。同时接入任务相关质量证据、模型与推理档位联合选择、历史资源 P90 估计与依赖感知搜索。手动混合执行当前只读；官方工具使用自身默认模型，原有官方团队编辑流程保留。继续兼容 **DeepSeek Harness Desktop 0.2.0-rc.1 / 0.2.0-rc.2 / 0.2.1-rc.2**，沿用 Hermes/Pi 安装与终端支持；两者仍无经过验证的托管执行器。真实厂商执行证据仍见 **0.20.0** 报告，本版未新增模型实测。路由器与 [GAL](https://github.com/Alice-Marx/deepseek-harness-galgame) 自 0.12.0 起已拆分为独立插件。
+当前版本：**0.23.1**（`@ljwei-stak/dsh-model-router`）。重跑预算现在覆盖实际会执行的未完成下游，进度和取消请求挂起后可恢复。工作台支持实时耗时、逐工作包进度和取消，保留已完成结果与已报告费用；关闭重开面板可接管原任务。支持“按算法推荐分配 / 手动调整分配”：拆分后的工作包可逐个指定模型 API 或官方工具，保留依赖、重新预览费用，并保存重跑目标。同时接入任务相关质量证据、模型与推理档位联合选择、历史资源 P90 估计与依赖感知搜索。手动混合执行当前只读；官方工具使用自身默认模型，原有官方团队编辑流程保留。继续兼容 **DeepSeek Harness Desktop 0.2.0-rc.1 / 0.2.0-rc.2 / 0.2.1-rc.2**，沿用 Hermes/Pi 安装与终端支持；两者仍无经过验证的托管执行器。真实厂商执行证据仍见 **0.20.0** 报告，本版未新增模型实测。路由器与 [GAL](https://github.com/Alice-Marx/deepseek-harness-galgame) 自 0.12.0 起已拆分为独立插件。
 
 官方 CLI 协作按依赖顺序逐包执行、传递依赖上下文，不会自动回退到模型目录 API。可编辑团队需明确选择 Harness 沙箱或厂商 CLI 正常环境。后者通过 Git worktree 收集修改，但不限制操作系统访问。未显式设置模型映射时，各 CLI 沿用自身配置的模型。参见[真实 Windows 验证及其局限](docs/releases/0.20.0-validation.md)。
 
 两个 README 版本同步说明接口、公式、默认值与限制。[更新日志](CHANGELOG.md)保留版本历史。更多操作说明：[工作台](docs/WORKBENCH_USER_GUIDE.zh.md)、[安装](docs/INSTALLATION_GUIDE.zh.md)、[迁移](docs/archive/MIGRATION.md)、[实验规程](docs/ROUTING_SELFTEST_STEPS.zh.md)。
 
-**目录：** [功能](#capabilities) · [安装](#install) · [工作台](#workbench) · [架构](#architecture) · [会话工具](#session-tools) · [官方工具](#official-tools) · [团队生命周期](#team-lifecycle) · [费用](#costs) · [路由算法](#routing) · [数据](#data) · [开发](#development) · [排障](#troubleshooting)
+<a id="quick-evaluation"></a>
+
+## 提交前快速评估
+
+**一句话价值：** 面向 DSH 的成本感知模型路由工作台，可本地规划任务、选择模型路线，并在明确权限下执行有依赖关系的工作包。
+
+**类别：** **模型与推理（Models & Reasoning）**，是[社区目录分类](https://www.alldsh.com/categories/)中最贴切的一类；这是社区分类，并非 DSH 官方分类。
+
+**安装（DSH Plugin Hub / web profile）：** 确保 DSH CLI 可用，然后安装已发布的 npm 包：
+
+```sh
+dsh plugin --profile web add @ljwei-stak/dsh-model-router@0.23.1
+```
+
+**安装到 Harness Desktop：** 首次先启动一次 Desktop 初始化 `desktop` 配置，再彻底退出 Desktop，运行：
+
+```sh
+dsh plugin --profile desktop add @ljwei-stak/dsh-model-router@0.23.1
+```
+
+也可以在 **Harness Desktop → 插件 → 添加插件** 中粘贴包名。安装后重启 Desktop。单独运行全局 `npm install -g` 不会注册 Desktop 插件。
+
+**发布包与入口：** [npm 上的 `@ljwei-stak/dsh-model-router@0.23.1`](https://www.npmjs.com/package/@ljwei-stak/dsh-model-router) 已发布。根目录[`package.json`](package.json)声明包名和 bundle patch；[`.dsh-plugin/index.mjs`](.dsh-plugin/index.mjs)导出所需的 `apply(ctx)` 入口。[许可证：MIT](LICENSE)。
+
+**配置文件与配置入口：** 当前不支持导入用户编写的 JSON/YAML 配置文件。Provider、模型和凭据在 Harness **模型**页面配置；路由档案与偏好在插件设置中配置。路由器持久状态存于 `$DSH_HOME/model-router/state.json`（默认：`~/.dsh/model-router/state.json`）。Provider CLI 沿用各自的登录和配置；路由器不会把 API 密钥复制进模型档案或终端日志。
+
+**截图与证据：** [工作台截图](docs/assets/workbench-task-preview.jpg)使用固定的模型、价格和健康状态数据，是模拟 UI 预览，不是实时 Harness 或模型运行。[路由流程图](docs/assets/routing-workflow.svg)展示执行路径。[真实 Windows 验证报告](docs/releases/0.20.0-validation.md)记录了 0.20.0 的具体执行及局限；0.23.1 尚无经过验证的端到端厂商运行。[实时进度截图](docs/assets/workbench-run-progress.png)是离线模拟；取消、重开恢复与验证边界见[0.23.1 验收报告](docs/releases/0.23.1-validation.md)。
+
+**权限与风险：** 任务规划在本地完成，不调用模型。实际执行会把选定任务和上下文发送到所选模型 API 或厂商 CLI，并可能产生费用。默认使用 Harness 受限环境；只读运行不修改工作区，`workspace-write` 需要用户明确批准。明确选择 `cli-native` 的可编辑团队会在 Harness 进程沙箱之外，以当前操作系统用户权限运行；Git worktree 只收集修改，不限制操作系统访问。外部 Provider 和 CLI 服务各自适用其数据处理及计费规则。
+
+**兼容性：** 声明支持 DeepSeek Harness Desktop **0.2.0-rc.1**、**0.2.0-rc.2**、**0.2.1-rc.2**。Node.js **>=22.19** 与 pnpm **10.34.6** 仅为源码开发/构建要求，不是插件运行时前置条件；不承诺超出上述 Host 版本的兼容性。
+
+**目录：** [快速评估](#quick-evaluation) · [功能](#capabilities) · [安装](#install) · [工作台](#workbench) · [架构](#architecture) · [会话工具](#session-tools) · [官方工具](#official-tools) · [团队生命周期](#team-lifecycle) · [费用](#costs) · [路由算法](#routing) · [数据](#data) · [开发](#development) · [排障](#troubleshooting)
 
 <a id="capabilities"></a>
 
@@ -40,16 +78,16 @@
 打开 **插件 → 添加插件**，输入：
 
 ```text
-@ljwei-stak/dsh-model-router@0.22.2
+@ljwei-stak/dsh-model-router@0.23.1
 ```
 
-镜像缺少该精确版本时，使用官方 HTTPS npm 源 `https://registry.npmjs.org/`。启用插件，然后完全退出 Harness（包括托盘进程）并重启。插件详情应显示 **0.22.2**，侧栏应出现 **模型路由**。仅执行全局 `npm install -g` 不会把插件注册到 Desktop。
+镜像缺少该精确版本时，使用官方 HTTPS npm 源 `https://registry.npmjs.org/`。启用插件，然后完全退出 Harness（包括托盘进程）并重启。插件详情应显示 **0.23.1**，侧栏应出现 **模型路由**。仅执行全局 `npm install -g` 不会把插件注册到 Desktop。
 
 也可以通过插件管理器安装本地 `.tgz` 压缩包，或解压后的内部 `package` 目录。两者都必须包含 `package.json` 和 `.dsh-plugin`。历史构建见 [Releases](https://github.com/Alice-Marx/dsh-model-router/releases)，也可按下文从源码构建。
 
 ### 从旧包名升级
 
-旧名称 `@ljwei-stak/model-router-galgame` 停留在 0.13.0。保留配置档/应用数据，移除旧插件条目，再添加 `@ljwei-stak/dsh-model-router@0.22.2`。不要同时保留两条插件：它们共用内部插件 id `model-router-galgame` 和工具名。保留该 id 能让现有路由设置与历史记录继续使用。
+旧名称 `@ljwei-stak/model-router-galgame` 停留在 0.13.0。保留配置档/应用数据，移除旧插件条目，再添加 `@ljwei-stak/dsh-model-router@0.23.1`。不要同时保留两条插件：它们共用内部插件 id `model-router-galgame` 和工具名。保留该 id 能让现有路由设置与历史记录继续使用。
 
 从合包 0.11.x 升级前，先备份配置档，并导出需要保留的 GAL 存档。剧情播放、立绘、音乐与存档现属于独立的 `@ljwei-stak/dsh-galgame`。详细存档限制见 [MIGRATION.md](docs/archive/MIGRATION.md)。
 
@@ -79,6 +117,10 @@
 5. 在 **在工作台执行** 中，选择 **模型路由（只读）** 使用现有路由执行器；或先选择 **团队分工**，再选择 **官方工具协作**。官方协作可选择 **只读检查** 或 **编辑文件**。可编辑团队还需选择 **Harness 受限环境**（默认沙箱）或 **厂商 CLI 正常环境**（在 Harness 沙箱外运行）。填入已存在的工作区绝对路径，或沿用上次运行路径。点击 **预览执行计划**，查看各包、权限与所需确认，然后显式确认执行。Host 启动前会重新检查计划；条件变化可能要求重新确认。
 6. 在 **执行记录与子任务** 查看实际通道、回答、失败、费用与评分。官方协作仅使用已安装、且在所选权限模式下就绪的 CLI 重新规划。编辑需要批准和干净的 Git 仓库；成功的 worktree 修改有条件地合入。该模式下，不可用或失败的 CLI 不会静默变成 API 调用。
 
+执行开始后，工作台显示已耗时、当前工作包与每包状态。**取消执行**会请求停止当前调用，并阻止后续工作包启动；执行器完成收尾前持续显示**正在取消**。已完成结果和已报告用量仍保留在历史中。取消不能撤销已经产生的费用或已经整合的改动。关闭面板不会取消执行；同一浏览器会话重新打开后，可在 Host 仍保留该任务时重新连接。Host 重启会清除内存任务，已保存的历史记录仍可查看。
+
+预览、进度和取消请求最长等待 15 秒。进度读取超时后继续查询同一任务；取消未确认时可手动重试。网络等待超时不代表 Host 任务已停止，也不会自动重发 `startRun`。重跑历史步骤前，预算覆盖该步及实际会执行的全部未完成下游；改派使用所选路线估价，未知价格仍保持未知。[超时恢复截图](docs/assets/workbench-run-timeout.png)为离线模拟。
+
 修改任务文本、规划模式、路线配置、目录或相关设置，会使旧建议失效。修改执行输入也会丢弃待确认或已完成的预览，必须对当前请求重新预览。执行预览使用 Host 当前状态，因此可能与先前本地计划不同。
 
 任务示例：
@@ -151,6 +193,8 @@ flowchart TD
 
 正常环境编辑通常要求 `workspace-write` 和 `unsandboxed` 确认；超预算还会增加 `over-budget`。不要硬编码该列表，也不要未经同意自动填入。`startRun` 会重新规划和预检，不会消费一个冻结的预览令牌。出现新的确认要求时，返回 `needs-confirmation`，并给出 `missing` 与更新后的原因。修改任务、模式、工作区或路线配置后必须重新预览。工作台请求使用已保存路线的 `cliModel` 映射；临时 `cliModelsJson` 绑定属于下文的会话工具。
 
+`startRun` 接受执行后，在任务完成前返回含 `jobId`、`status` 和 `progress` 的任务快照。通过 `runStatus({ jobId })` 读取状态，通过 `cancelRun({ jobId })` 请求取消。任务状态为 `running`、`cancelling`、`completed`、`cancelled` 或 `failed`。终态快照的 `result` 包含最终工作台响应，以及成功保存后的账本 `runId`。`completed` 表示后台执行已结束，任务实际结果仍查看 `result.status`。进度仅包含工作包身份与状态，不包含回答正文。读取状态失败不代表执行已停止，客户端不得因此自动重发 `startRun`。
+
 <a id="session-tools"></a>
 
 ## 会话工具

package/docs/WORKBENCH_USER_GUIDE.zh.md

@@ -1,6 +1,6 @@
 # 模型路由工作台：配置、规划与实际执行
 
-适用版本：`@ljwei-stak/dsh-model-router@0.22.2`。声明兼容 DeepSeek Harness Desktop `0.2.0-rc.1 / 0.2.0-rc.2 / 0.2.1-rc.2`。安装与开发见[中文 README](../README.zh.md)，旧包迁移见[迁移说明](archive/MIGRATION.md)。
+适用版本：`@ljwei-stak/dsh-model-router@0.23.1`。声明兼容 DeepSeek Harness Desktop `0.2.0-rc.1 / 0.2.0-rc.2 / 0.2.1-rc.2`。安装与开发见[中文 README](../README.zh.md)，旧包迁移见[迁移说明](archive/MIGRATION.md)。
 
 0.22.0 新增“按算法推荐分配 / 手动调整分配”：生成任务建议后，可为每个工作包选择模型 API 或官方工具；修改后重新预览费用与渠道，再确认执行。任务依赖与重跑目标保留。手动混合执行当前只读，官方工具使用自身默认模型；编辑文件继续选择官方工具协作。详见[手动分配说明](MANUAL_TASK_ASSIGNMENT.zh.md)。Hermes 自定义程序目录、原配置/登录/历史位置，以及工具页顶部终端的行为继续保留。
 
@@ -93,6 +93,10 @@ Windows 独立工作树保存在用户私有临时目录中，按原仓库路径
 4. 明确确认执行后才调用模型/CLI。期间状态变化可能导致宿主拒绝旧确认，需重新审阅。
 5. 在下方**执行记录与子任务**看结果、状态、实际渠道、原始失败原因和费用。实际运行可能计费。
 
+执行期间会显示当前工作包、逐包状态、已处理数量和已耗时。点击**取消执行**后，先显示**正在取消**；后台收到请求后停止当前调用，等待进程或模型流收尾，再保存已完成结果、已报告用量和最终状态。取消不会撤销已经产生的费用；可编辑团队尚未整合时会保留独立工作树，取消后不开始新的整合步骤，已经完成的整合无法通过取消撤回。
+
+状态读取失败时保留当前任务并提示重试，不自动再次启动执行。关闭工作台仅停止界面读取；同一浏览器会话重新打开时可恢复仍在 Host 内存中的任务。Host 重启或任务快照被清理后，界面会提示查看执行记录，不能恢复尚未保存的运行过程。浏览器只保存任务 ID，不保存任务正文、回答或凭据。
+
 修改任务、规划模式、执行方式、任务权限、路由方案或工作区等输入后，正在请求或已经返回的旧预览会被丢弃。重新预览并核对当前请求后才能确认执行。官方协作不代替缺失的 CLI，不支持当前权限的工具也不会进入该模式的计划。
 
 **预览不会启动模型，确认会启动。** 模型 API 将任务文本发给供应商；CLI 可能读取工作区或其他其权限允许的文件。只读不等于所有 CLI 只能读取工作区，先看**预算与安全 → 安全边界**。
@@ -281,3 +285,5 @@ Windows Codex 在 Harness 环境仅支持只读：其原 `CODEX_HOME` 状态仍
 | 工具名在会话中不可用 | 确认插件启用，重新开始会话；记录宿主/插件版本与脱敏错误。 |
 
 问题反馈请附宿主/插件版本、执行模式、工具状态及脱敏错误，勿提供密钥。源码、安装和资料入口见[中文 README](../README.zh.md)。
+
+执行恢复：预览、进度与取消请求等待超过15秒会终止该次网络等待；进度会重试同一任务，取消未确认可手动重试，任务不会自动重新启动。历史步骤重跑前，预算按目标及未成功的下游步骤合计；整组超限时先确认再运行，改派按所选路线重估，缺失价格不视为零费用。

package/docs/releases/0.23.0-validation.md

@@ -0,0 +1,30 @@
+# 0.23.0 release acceptance
+
+Date: 2026-10-23. Package: `@ljwei-stak/dsh-model-router@0.23.0`.
+
+This release adds observable workbench execution and cancellation, retaining the plugin identity, saved configuration, execution history and supported DSH SDK versions. It also fixes the incomplete-history marker after a failed corrupt-state recovery.
+
+## Accepted behavior
+
+- `startRun` returns a Host job snapshot after fresh preview, budget and permission checks; strict `runStatus` and `cancelRun` requests accept only a job ID. Existing internal synchronous execution helpers remain available.
+- The workbench shows elapsed time, current package and individual package states. Status transport failures retry serially without losing cancellation. Old status/cancel responses cannot replace newer progress, a terminal result or another job.
+- Cancellation reaches the same AbortSignal used by API streams and official CLI teams. The job stays cancelling until execution and cleanup settle. Already completed answers and reported usage/cost remain in the execution ledger, including cancellation during optional result review. Cancelled editable teams do not begin integration.
+- Closing the panel does not cancel execution. Reopening in the same browser reconnects using only an opaque job ID in session storage. Reopening before the start acknowledgement waits for and takes over the original job, preventing duplicate launch. A failed launch is never automatically resubmitted.
+- If corrupt-state recovery fails before it can commit a notice, a later read/write preserves the incomplete-history marker. Budget checks continue to treat lost cost history as incomplete.
+
+## Validation
+
+- Full suite: 1035 tests, 1032 passed, 0 failed, 3 existing platform-dependent skips. Skipped PTY/process checks do not count as execution acceptance.
+- Fifty new feature tests cover job lifecycle and capacity, a real Host and typed gateway with inert adapters, execution progress, cancellation accounting, optional review cancellation and UI races/reconnection.
+- The strict frozen pnpm installation, actual client build, generated-client consistency, paired README checks, workbench preview compilation and `git diff --check` passed. README formulas were not changed.
+- Browser inspection of the actual workbench component with offline fixtures covered running progress, cancelling cleanup and the final cancelled ledger. Screenshots were inspected; browser warning/error logs were empty. The [progress screenshot](../assets/workbench-run-progress.png) uses simulated tasks and prices.
+- An independent GPT read-only review checked the runtime package file/import closure, strict RPCs, cancellation/accounting paths, sensitive-token patterns and the pending-start panel recovery race.
+- The release process compares every package member against the exact release commit's Git blobs, then downloads the npm payload and GitHub Release asset to verify their bytes. Commit IDs and tarball hashes are recorded in the external publication audit.
+
+## Boundaries
+
+Jobs are held in Host memory, with at most four active jobs and fifty retained snapshots. A Host restart loses live job snapshots; the workbench directs users to the persisted execution history instead of starting another job. Host disposal requests cancellation; a running adapter must honor its AbortSignal before cancellation can finish. Costs already incurred remain chargeable, and unavailable prices/usage remain unknown.
+
+This release was not tested end to end in an installed DSH Desktop or with real paid provider/vendor CLI inference. No new provider execution claims are made. Earlier real execution evidence remains in the dated [0.20.0 report](0.20.0-validation.md), and Hermes/Pi managed execution remains unverified.
+
+Upgrade by fully quitting Harness, including its tray and Host process, updating the plugin to 0.23.0, and restarting.

package/docs/releases/0.23.1-validation.md

@@ -0,0 +1,23 @@
+# 0.23.1 release acceptance
+
+Date: 2026-10-23. Package: `@ljwei-stak/dsh-model-router@0.23.1`.
+
+## Reproduced problems and fixes
+
+- A retry could pass a daily budget of USD 0.5 with a USD 0.2 target, then also start its USD 0.4 downstream package without approval. Retry budgets now cover the target plus every unfinished downstream package that will execute. Both routed and official-team retries use that same set; completed downstream packages are excluded. Changed routes use the selected route estimate, unchanged routes retain their planned reasoning effort estimate and unknown prices remain unknown under the existing unknown-price budget policy.
+- A never-settling progress request permanently stopped polling; a never-settling cancel request permanently disabled the cancel button. Preview/progress/cancel now have a 15-second deadline and a real SDK transport AbortSignal outside the business JSON. Progress retries use the same job, cancellation can be retried explicitly and late replies cannot replace newer state. Task starts are never automatically replayed.
+
+## Validation
+
+- Full suite: 1055 tests, 1052 passed, 0 failed, 3 existing platform-dependent skips.
+- Twenty new regressions: 11 offline Host retry-budget tests, 6 actual SDK transport tests and 3 hung-request UI tests. Budget rejection asserts zero model calls; approval, transitive downstream, completed-package exclusion, reassignment, planned effort and unknown prices are covered.
+- Strict frozen pnpm installation, actual client build, generated-client consistency, README translation/formula checks, workbench preview compilation, npm dry-run and diff checks passed. Formula content was not changed.
+- Actual workbench browser inspection with the offline hanging-request scenario confirmed resumed package progress after a stalled status read, a re-enabled cancel button with explicit failure feedback, and successful retry cancellation with completed results retained. Browser warning/error logs were empty. The [timeout screenshot](../assets/workbench-run-timeout.png) is simulated, with no model, credentials or real workspace access.
+- An independent GPT review checked estimate/actual-retry set consistency, reasoning effort, unknown prices, SDK signal wiring, cleanup and late-response fences.
+- Every packaged file is checked against the exact release commit's Git blobs; npm and GitHub Release assets are anonymously downloaded for byte comparison, with digests in the external publication audit.
+
+## Boundaries
+
+A transport deadline only stops waiting for the request. It does not prove that a cancellation reached Host or that the task stopped; the UI keeps the original job and checks status. Execution/cancellation cleanup can exceed 15 seconds, and a pending start is not retried automatically. Jobs remain in Host memory and do not survive a Host restart. Reported costs already incurred remain chargeable.
+
+No real paid-provider or vendor CLI inference or installed-DSH end-to-end acceptance was performed in this patch. Prior execution evidence remains dated in the [0.20.0 report](0.20.0-validation.md). Fully quit Harness, including tray/Host processes, update the plugin, then restart.