@oneciel-ai/ciel-runtime 0.2.22 → 0.2.23

package/docs/journal/2026/08/20/wing-remote-memory-replication-verification.md

@@ -0,0 +1,107 @@
+# Wing remote-memory replication verification
+
+## Scope
+
+- Host: `WING` (`wing\\daniel.yun`, SSH port 1004)
+- Workspace: `C:\Users\daniel.yun.WING`
+- Installed package: `@oneciel-ai/ciel-runtime@0.2.22-nightly.20260821-043829.b7ea382`
+
+## Configuration evidence
+
+- Remote Memory is enabled.
+- Manifest endpoint:
+  `http://100.94.212.25:3600/api/v1/integrations/agent-memory/manifest.json`
+- Authorization is stored; its value was not printed.
+- Destination: `.ciel/memory`
+
+## Replication evidence
+
+- Workspace state file:
+  `C:\Users\daniel.yun.WING\AppData\Roaming\ciel-runtime\workspaces\f895679997f4\remote-memory.json`
+- State timestamp: `2026-08-21T04:45:14.4014143Z`
+- State records `reason=launch`, index `.ciel/memory/index.md`, and 28 files.
+- The destination contains 28 files totaling 50,689 bytes.
+- `index.md` SHA-256:
+  `81A345506C84B8E6D4FD0FA16DD36B4EF625761677CEF6D2B97763C6D64DB1A5`
+- `AGENTS.md` lines 505-507 contain the managed pointer block with
+  `Memory index: .ciel/memory/index.md`.
+
+## Runtime log evidence
+
+- Router log:
+  `C:\Users\daniel.yun.WING\AppData\Roaming\ciel-runtime\router-instances\9139-f895679997f4\router.log`
+- Successful launch synchronizations: 3.
+- Failed synchronizations: 0.
+- The latest success at `2026-08-20T23:45:14` reports
+  `remote_memory_updated runtime=codex files=28 index=.ciel/memory/index.md reason=launch`.
+
+## Conclusion
+
+Wing's workspace memory tree was downloaded from the configured server during
+runtime launch, written to `.ciel/memory`, and projected into `AGENTS.md` via
+the managed local index pointer.
+
+## Scope correction
+
+- The live router health response identifies its workspace as
+  `c:\users\daniel.yun.wing`, which is the Wing user's home directory rather
+  than a project directory.
+- The implementation derives both the memory root and instruction target from
+  `Path.cwd()`: memory is placed at `<workspace>/.ciel/memory`, while the Codex
+  pointer is placed at `<workspace>/AGENTS.md`.
+- Therefore the synchronization mechanism is workspace-relative in source,
+  but this live process selected the user home as that workspace. On Wing the
+  observed placement is consequently home-scoped, not project-scoped.
+- The earlier replication-success conclusion remains valid only for download
+  and projection behavior; it does not establish correct project isolation.
+
+## Repair scope
+
+- Remote Instruction and Remote Memory now use the router's normalized launch
+  workspace rather than independently reading the router process working
+  directory.
+- Remote Memory rejects a user-home or filesystem-root workspace before any
+  HTTP request and removes a stale managed pointer from the native instruction
+  file.
+- The rule is path-scope based and applies to every supported runtime. It does
+  not contain a Wing, user, session, provider, model, or agent exception.
+
+## Repair verification
+
+- Focused Remote Memory and runtime integration suite: 13 tests passed.
+- Full pre-release suite: unit 1,108, router 902, channel 372, and runtime 247
+  tests passed; 136 declared environment-dependent tests were skipped.
+- Ruff, Python compilation, documentation metadata, and `git diff --check`
+  passed.
+- A standalone loopback-HTTP probe synchronized `alpha` and `beta` into two
+  independent `.ciel/memory/index.okf` trees and injected a pointer into each
+  project's `AGENTS.md`. Four HTTP requests were observed: one manifest and one
+  file download for each workspace.
+- The same probe used the synthetic user home as workspace. It returned
+  `failed`, made zero HTTP requests, removed the managed pointer, and did not
+  create a parent/global memory tree.
+
+## Wing post-deployment recheck
+
+- Wing is running installed nightly
+  `0.2.22-nightly.20260821-051020.13f5d91`; router health reports the same
+  version and source fingerprint `7e5d2ce08c25c07e`.
+- The only registered and launched workspace remains
+  `C:\Users\daniel.yun.WING`, the user's home directory.
+- Four post-deployment launches logged `remote_memory_failed` with the exact
+  project-scope rejection. No post-deployment `remote_memory_updated` entry
+  exists.
+- The old state and 28 downloaded files remain on disk with their original
+  `2026-08-21T04:45:14Z` timestamps. They are stale artifacts from the earlier
+  home-scoped implementation, not a new project-scoped dump.
+- `AGENTS.md` contains zero managed memory-pointer matches. Its pointer-removal
+  write occurred at `2026-08-21T06:39:34Z`.
+- The active Codex process started at `2026-08-21T06:39:51Z`, after pointer
+  removal, so this active session did not start with the stale memory index
+  pointer.
+
+## Post-deployment conclusion
+
+The scope guard is working, but Wing does not currently have a usable
+project-scoped memory dump because it is still launched from the user home.
+The 28 files visible under the home directory are stale and unreferenced.

package/docs/journal/2026/08/21/alibaba-singapore-qwen38-official-alignment.md

@@ -0,0 +1,64 @@
+# Alibaba Singapore Qwen3.8 official alignment
+
+## Scope
+
+- Align Ciel Runtime's Alibaba Model Studio Singapore provider data with the
+  official `qwen3.8-max` model page supplied by the user.
+- Preserve user-selected custom models and avoid inventing a Workspace ID.
+
+## Confirmed evidence
+
+- Alibaba's official model page, updated 2026-08-03, lists `qwen3.8-max` for
+  Singapore International scope.
+- Official limits are a 1,000,000-token context window, 991,808-token normal
+  input, 983,616-token thinking input, and 131,072-token output.
+- Singapore supports text, image, and video input; function calling; structured
+  outputs; web search; partial mode; and context caching.
+- The official Singapore endpoints contain an account-specific Workspace ID:
+  `https://{WorkspaceId}.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1`
+  and the corresponding `/apps/anthropic` route.
+- A live authenticated Token Plan `/models` request returned HTTP success and
+  exactly one `qwen3.8-max` entry. The response did not expose context metadata.
+
+## Changes
+
+- `alims-intl` now defaults to `qwen3.8-max`, includes it in the fallback
+  catalog, records `ap-southeast-1`, and uses the official context/output
+  limits.
+- `alitoken` and `alitoken-individual` use the same confirmed 1,000,000-token
+  context value when `qwen3.8-max` is selected.
+- A dated migration adds Qwen3.8 to existing Model Studio catalogs. It upgrades
+  only the exact former Qwen3.7 default profile and preserves non-default model
+  selections and custom catalog entries.
+- The legacy default endpoint remains available because the official sources
+  checked here do not prove that it has been retired. The provider accepts the
+  account-specific official workspace URL through `base_url` and derives its
+  Anthropic route from it.
+
+## Verification
+
+- Focused Ruff checks passed.
+- Alibaba provider tests passed: 31.
+- Codex runtime tests passed: 69, with 12 environment-dependent skips.
+- Documentation metadata and `git diff --check` passed.
+- An in-memory migration of the current legacy configuration produced
+  `qwen3.8-max`, region `ap-southeast-1`, context/max model length `1000000`,
+  max output `131072`, and effort `xhigh` for the applicable Alibaba providers.
+- Full repository verification passed: unit 1,113, router 905, channel 379,
+  runtime 247; 2,644 total tests with 136 environment-dependent skips.
+- Full Ruff, documentation metadata, `git diff --check`, compilation, and npm
+  package dry-run checks passed. The package contains 387 files, including the
+  changed provider, migration, documentation, and journal files.
+- Code commit `fe7c4b09ad4178adabc73162b3c6dc2cbb5870f2` passed CI run
+  `32507635324` and npm publication run `32507635197`.
+- npm published `0.2.22-nightly.20260821-172249.fe7c4b0`; its registry
+  `gitHead` exactly matches the code commit.
+- The exact published version was installed globally. The npm shim reported the
+  same version, and SHA-256 hashes for the installed provider and migration
+  files exactly matched the workspace files.
+- Executing the npm-installed code produced the expected `alims-intl` defaults:
+  `qwen3.8-max`, `ap-southeast-1`, context/max model length `1000000`, max
+  output `131072`, and effort `xhigh`.
+- Executing its migration upgraded the untouched Qwen3.7 Model Studio profile,
+  preserved `private-model`, corrected Qwen3.8 Token Plan context to `1000000`,
+  and left a separately selected private Token Plan model at `1048576`.

package/docs/journal/2026/08/21/codex-visible-sse-wake-submit-regression.md

@@ -0,0 +1,85 @@
+# Codex visible SSE wake submit regression
+
+## Observed failure
+
+- WING showed the injected wake body collapsed in the Codex editor as
+  `[Pasted Content 1048 chars]`, with the cursor still in the editor.
+- Runtime log message `1221` recorded two full-prompt injections at 10:03:54
+  and 10:04:15, followed by `channel_windows_console_body_fallback`; no Codex
+  transcript user record exists for `1221`.
+- Message `1220` recorded injections at 10:02:36 and 10:02:56. Its Codex
+  transcript user record at 15:02:57.722Z contains the same complete wake body
+  twice in one submitted turn.
+
+## Confirmed code path
+
+- The affected WING process logged `transport=conpty`, `enter=cr`,
+  `submit_retries=4`, `confirm_submit=True`, `bracketed_paste=True`, and
+  `display_body=True`.
+- `ChannelPromptInjector` performed multiple submit attempts only when its
+  pre-submit snapshot was non-empty.
+- The Windows ConPTY transport returned no input snapshot, while the injected
+  host snapshot callback is the tmux reader and returned no snapshot on WING.
+- Therefore the configured four attempts reduced to one Enter per full-prompt
+  injection. The later inflight retry injected the entire body again rather
+  than retrying only Enter.
+
+## Correction
+
+- Windows ConPTY now exposes its captured child-output tail as a submission
+  snapshot.
+- The injector uses the transport snapshot only when the host snapshot is
+  unavailable. A lack of output change after Enter now advances to the next
+  configured submit attempt without rewriting the prompt body.
+- ConPTY deliberately keeps `supports_input_snapshot=False` for body-prefix
+  verification. Codex replaces long pasted text with a placeholder, so the
+  output tail cannot prove that the original prompt prefix is present.
+- SSE receiving, event persistence, wake formatting, and Claude/AGY launch
+  policies are unchanged.
+
+## Local verification
+
+- Focused injection tests: 4 passed.
+- Windows ConPTY tests, including native transport execution: 13 passed.
+- Full unittest discovery: 2,640 passed, 136 skipped, in 296.415 seconds.
+- Ruff: passed.
+- Documentation metadata check: passed before this journal was added.
+- npm dry-run package: 385 entries.
+
+## Deployment verification
+
+- First nightly `0.2.22-nightly.20260821-152001.fc290a0` passed CI and npm
+  publication, but its WING execution did not satisfy the task:
+  - event `1223` remained in the Codex input editor;
+  - the runtime incorrectly logged `channel_stdin_proxy_submit_confirmed
+    attempt=1`;
+  - a physical Enter delivered through the same SSH PTY immediately cleared
+    the editor and started the turn.
+- This disproved output-tail change alone as submission evidence. The delayed
+  prompt redraw was the observed change, meaning automatic Enter was sent
+  before Codex completed rendering the injected paste.
+- Follow-up correction waits for a ConPTY output change to settle before the
+  submit delay and Enter attempts begin.
+- Follow-up focused suites passed: injection 5, injection architecture 4,
+  Windows ConPTY 13, and the affected channel bridge regression 1.
+- Follow-up full unittest discovery passed: 2,641 tests, 136 skipped, in
+  290.103 seconds.
+- Final code nightly: `0.2.22-nightly.20260821-153910.b410b4c` with npm
+  `gitHead=b410b4cc8ef791c0e0066c70fc703b709ed3fafd`.
+- GitHub CI run `32498550524`: passed.
+- GitHub npm publish run `32498550502`: passed, including tarball
+  verification.
+- WING installed that exact version and executed Codex 0.149.0 in the actual
+  `C:\Users\daniel.yun.WING` workspace through Windows ConPTY.
+- External SSE connection event `1224` was rendered in the Codex editor and,
+  without any manual input, the editor cleared and changed to `Working`.
+- Router evidence:
+  - `channel_input_prompt_ready result=observed` at 10:44:18;
+  - `channel_stdin_proxy_submit_confirmed attempt=1` and injected `1224` at
+    10:44:20;
+  - LLM context injection at 10:44:21;
+  - transcript completion evidence and cursor confirmation to `1224` at
+    10:44:35.
+- The latest Codex transcript contains one user record for `1224`. No record
+  contains `pending_ids=1224` more than once, proving the former duplicate-body
+  retry did not recur.

package/docs/journal/2026/08/21/external-sse-wake-only-change-analysis.md

@@ -0,0 +1,131 @@
+# External SSE wake-only TTY change analysis
+
+## Observation
+
+- External SSE messages previously appeared with their full body in the active
+  CLI terminal.
+- Current routed sessions display only `[ciel-wake] pending_ids=...` in the
+  terminal.
+
+## Confirmed history
+
+- Commit `66eb29c3d1ee1b90fbca84f27d18cb590b46ff4c` on 2026-08-18
+  (`feat: restore router-backed chat injection`) changed
+  `format_channel_llm_delivery_wake_prompt` from the full-body formatter to a
+  dedicated wake-only formatter.
+- That commit's tests explicitly changed from asserting that the external body
+  is present in TTY bytes to asserting that it is absent and only message IDs
+  are present.
+- Commit `0208728356504baf432e85b442a646b2e9ff7359` later on 2026-08-18
+  (`fix: prevent router wake loss behind tty entries`) shortened the marker to
+  the current `[ciel-wake] pending_ids=...` form.
+
+## Current delivery path
+
+- External SSE receivers submit the exact decoded event through
+  `RuntimeInputGateway.submit_external_event` without an `input_transport`
+  override.
+- `message_input_transport` treats a missing persisted transport as `router`.
+- Routed CLI launches enable `wake_for_llm_delivery` whenever router mode is
+  active.
+- The terminal injection path therefore writes only the wake marker. On the
+  subsequent routed model request, `inject_pending_channel_context` removes the
+  marker and appends the full formatted external-event body to the LLM request.
+- The exact event remains model input, but it is no longer rendered as full TTY
+  input in this path.
+
+## WING evidence
+
+- The active WING launch state identifies the affected process as
+  `mode=codex-router`, model `deepseek-v4-pro:0813`.
+- WING's workspace-local `runtime-inputs.jsonl` contains both screenshot IDs:
+  - `1217`: the exact `net.ai-net.connected` event from Dave.
+  - `1218`: the exact `net.ai-net.room.activity` event, including room,
+    message, author, and instruction data.
+- This proves SSE receive and durable storage succeeded for those two events;
+  the missing terminal body was the wake formatter's presentation policy.
+
+## Runtime-specific correction
+
+- Kept `format_llm_delivery_wake_prompt` unchanged as the short, shared
+  router marker.
+- Added a visible wake formatter whose first line remains
+  `[ciel-wake] pending_ids=...` and whose following text is the existing exact
+  LLM batch projection.
+- Enabled that visible formatter only from the Codex launch path. Claude and
+  AGY retain the existing marker-only behavior; this preserves Claude's
+  separately verified terminal/turn semantics instead of assuming every CLI
+  handles wake input identically.
+- Codex still submits the combined text as one bracketed-paste turn. The router
+  recognizes the leading marker, removes the entire terminal-originated turn,
+  and injects the durable queued body once. The model therefore does not
+  receive a duplicate event.
+- For visible wakes, correlation IDs are now read only from the trusted first
+  marker line. Untrusted event text such as `id=999` cannot claim another
+  queued message.
+
+## Memory-path cross-check
+
+- WING's workspace state records:
+  - workspace: `C:\Users\daniel.yun.WING`
+  - root: `.ciel/memory`
+  - index: `index.md`
+  - index address: `C:\Users\daniel.yun.WING\.ciel\memory\index.md`
+- That exact file exists. The malformed
+  `C:\Users\daniel.yun.WING.ciel\memory\index.md` does not exist.
+- The latest Codex transcript contains the correctly escaped wire value
+  `C:\\Users\\daniel.yun.WING\\.ciel\\memory\\index.md`. Therefore the
+  malformed address was not produced by runtime path composition or prompt
+  injection.
+
+## Verification before deployment
+
+- Focused suites:
+  - channel message prompt: 15 passed.
+  - wake claim repository: 5 passed.
+  - pending poll: 6 passed.
+  - channel bridge: 206 passed, 80 skipped.
+  - Codex runtime: 69 passed, 12 skipped.
+- Full `npm test`:
+  - unit: 1,112 passed, 44 skipped.
+  - router: 902 passed.
+  - channel: 377 passed, 80 skipped.
+  - runtime: 247 passed, 12 skipped.
+- `npm run lint`: passed.
+- `npm run check:docs`: passed.
+- `npm pack --dry-run --json`: package generated, 385 entries.
+
+## Deployment
+
+- Code commit: `72a2474dedbc9048f4605486d29840d5000f7ca3`.
+- Pushed to `origin/nightly`.
+- GitHub CI run `32470113497`: passed all quality, minimum-Python,
+  unit, router, channel, and runtime jobs.
+- npm publish run `32470113566`: passed package tests, publish, and tarball
+  verification.
+- Published and installed on WING:
+  `0.2.22-nightly.20260821-095648.72a2474`.
+- npm registry `gitHead`:
+  `72a2474dedbc9048f4605486d29840d5000f7ca3`.
+
+## Installed-package verification
+
+The WING-installed package was executed against its actual durable record
+`1218`:
+
+- record kind: `external_event`.
+- raw SHA-256:
+  `3f98b234c39a32373eb310dff8f022efef8ce789056ade3cb47455452bf406b5`.
+- visible first line: `[ciel-wake] pending_ids=1218`.
+- exact raw occurrence in visible prompt: one.
+- raw occurrence in shared short prompt: zero.
+- parsed correlation IDs after appending hostile `id=999` text: `{1218}`.
+- wake recognized: true.
+- complete terminal wake turn removed before router injection: true.
+- installed Codex launch enables body display: true.
+- installed Claude launch enables body display: false.
+
+The already-running WING TUI process loaded the previous package before the
+global npm replacement. It was deliberately not killed over SSH because that
+would terminate the user's attached interactive session. A newly launched
+Codex session loads the verified installed package.

package/docs/journal/2026/08/21/hyundai-invalid-replayed-tool-name-repair.okf

@@ -0,0 +1,88 @@
+okf_version: "1.0"
+knowledge:
+  task:
+    id: hyundai-invalid-replayed-tool-name-repair-20260821
+    date: "2026-08-21"
+    objective: >-
+      Diagnose and repair the OpenAI Responses rejection reported from the
+      Hyundai workspace for input[696].name.
+
+  observed_failure:
+    workspace: "C:\\Users\\djlov\\source\\repos\\Hyundai"
+    session: >-
+      C:\Users\djlov\.codex\sessions\2026\05\27\
+      rollout-2026-05-27T11-18-11-019e6a3a-b011-7720-adc1-f97e3cc98da7.jsonl
+    upstream_error: >-
+      Invalid 'input[696].name': string does not match pattern.
+      Expected a string that matches the pattern '^[a-zA-Z0-9_-]+$'.
+    repeated_at_utc:
+      - "2026-08-21T19:44:46.101Z"
+      - "2026-08-21T19:44:55.944Z"
+      - "2026-08-21T19:46:15.730Z"
+    router_evidence:
+      provider: codex
+      path: /backend-api/codex/responses
+      responses:
+        - "2026-08-21T14:44:46 400"
+        - "2026-08-21T14:44:55 400"
+        - "2026-08-21T14:46:15 400"
+
+  confirmed_cause:
+    invalid_item:
+      transcript_line: 4511
+      type: function_call
+      input_index_reported_by_upstream: 696
+      name: multi_tool_use.parallel
+      call_id: call_00_nbmPi78JjzHHzM5agBXa9326
+    paired_output:
+      transcript_line: 4512
+      output: "unsupported call: multi_tool_use.parallel"
+    transcript_name_scan:
+      total_name_fields: 946
+      invalid_names:
+        - multi_tool_use.parallel
+    conclusion: >-
+      A historical unsupported function call containing a period was replayed
+      to the Codex Responses backend. The period violates the exact name
+      pattern returned by the upstream validator.
+
+  implementation:
+    boundary: >-
+      ciel_runtime_support.responses_input_compatibility.
+      repair_replayed_response_items
+    behavior: >-
+      When a replayed function_call or custom_tool_call has a present name that
+      violates ^[a-zA-Z0-9_-]+$, omit that call. Existing family-and-call_id
+      balancing then omits its matching output.
+    preserved_behavior:
+      - Valid function and custom tool pairs are retained.
+      - Missing synthetic name fields retain their previous behavior.
+      - The source request body remains unchanged.
+      - No provider, model, user, machine, or workspace exception is added.
+    rejected_behavior: >-
+      The invalid name is not rewritten to multi_tool_use_parallel because that
+      would describe a tool invocation that did not occur; its recorded output
+      says the original call was unsupported.
+
+  references:
+    official_openai_function_calling: >-
+      https://developers.openai.com/api/docs/guides/function-calling
+    observed_contract: >-
+      Function call outputs are associated with their original calls by
+      call_id; replay must keep or remove a call and its output consistently.
+
+  verification:
+    focused_compatibility_tests: "18 passed"
+    routed_codex_tests: "17 passed"
+    full_suite:
+      unit: "1115 passed, 44 skipped"
+      router: "906 passed"
+      channel: "379 passed, 80 skipped"
+      runtime: "249 passed, 12 skipped"
+      total: "2649 passed, 136 skipped"
+    lint: passed
+    exact_regression:
+      input_696_name: multi_tool_use.parallel
+      invalid_pair_removed: true
+      valid_pair_preserved: true
+      original_body_unchanged: true

package/docs/journal/2026/08/21/local-stale-temporary-runtime-pin-repair.okf

@@ -0,0 +1,118 @@
+okf_version: "1.0"
+knowledge:
+  task:
+    id: local-stale-temporary-runtime-pin-repair-20260821
+    date: "2026-08-21"
+    objective: >-
+      Diagnose and correct the local bare ciel-runtime launch failure that tried
+      to execute ciel_runtime.py from a deleted Windows temporary directory.
+
+  environment:
+    machine:
+      user: djlov
+      failing_workspace: "G:\\OneCielDMSUI"
+      shell_observed: cmd.exe
+    installed_nightly:
+      version: 0.2.22-nightly.20260821-191423.5d24d79
+      npm_root: >-
+        C:\Users\djlov\AppData\Roaming\npm\node_modules\
+        @oneciel-ai\ciel-runtime
+
+  evidence:
+    failing_command:
+      command: "ciel-runtime --continue"
+      python: >-
+        C:\Users\djlov\AppData\Local\Python\pythoncore-3.14-64\python.exe
+      missing_script: >-
+        C:\Users\djlov\AppData\Local\Temp\tmp6fs9_fba\share\
+        ciel-runtime\ciel_runtime.py
+      errno: 2
+    path_resolution:
+      first_launcher: "C:\\Users\\djlov\\.local\\bin\\ciel-runtime.cmd"
+      later_npm_launcher: >-
+        C:\Users\djlov\AppData\Roaming\npm\ciel-runtime.cmd
+      confirmed_order: standalone_launcher_before_npm_launcher
+    registered_runtime_home:
+      before: >-
+        C:\Users\djlov\AppData\Local\Temp\tmp6fs9_fba\share\
+        ciel-runtime
+      script_present: false
+      launcher_behavior: >-
+        The first CMD launcher reads HKCU\Environment\CIEL_RUNTIME_HOME and
+        constructs the Python script path from it.
+    confirmed_origin:
+      test: test_powershell_installer_reads_assets_from_its_own_directory
+      mechanism: >-
+        The test supplied a Python TemporaryDirectory as PREFIX and ran
+        install.ps1. It preserved the user PATH but did not restore the user
+        CIEL_RUNTIME_HOME changed by the installer. TemporaryDirectory cleanup
+        then removed the registered share/ciel-runtime directory.
+      path_shape_match: >-
+        The observed tmp6fs9_fba/share/ciel-runtime path exactly matches that
+        test's PREFIX/share/ciel-runtime construction.
+      live_reproduction: >-
+        Running install.ps1 with a temporary PREFIX changed the registered home
+        to that PREFIX's share/ciel-runtime path; restoring the saved value
+        returned bare launches to the npm installation.
+    npm_installation:
+      npm_shim_direct_version_succeeded: true
+      installed_ciel_runtime_py_present: true
+      conclusion: >-
+        The npm package and generated npm shim were intact. The bare command
+        failed because the earlier standalone launcher consumed the stale
+        registered temporary home.
+
+  immediate_repair:
+    registered_home_after: >-
+      C:\Users\djlov\AppData\Roaming\npm\node_modules\@oneciel-ai\
+      ciel-runtime
+    verification:
+      working_directory: "G:\\OneCielDMSUI"
+      command: "ciel-runtime version"
+      output: "ciel-runtime 0.2.22-nightly.20260821-191423.5d24d79"
+      exit_code: 0
+
+  package_repair:
+    windows_installer:
+      behavior: >-
+        install.ps1 now treats any CIEL_RUNTIME_HOME below the expanded Windows
+        TEMP root as ephemeral, in addition to the existing version-snapshot
+        name check. An explicit CIEL_RUNTIME_INSTALL_HOME still has precedence.
+    windows_launchers:
+      behavior: >-
+        CMD launchers now discard the registered runtime home when its
+        ciel_runtime.py is absent, matching the existing PowerShell launcher
+        validation, before falling back to the installed default home.
+      unchanged_cases:
+        - A registered runtime home whose ciel_runtime.py exists.
+        - An explicit CIEL_RUNTIME_HOME_OVERRIDE.
+        - npm lifecycle scripts remain disabled.
+    test_isolation:
+      behavior: >-
+        The PowerShell installer path test now snapshots the user
+        CIEL_RUNTIME_HOME and restores it in a finally block, including the
+        originally-unset case, then asserts equality after the test.
+    rejected_approach:
+      npm_postinstall: >-
+        Removed after CI proved it violated the repository invariant that npm
+        packages have no install lifecycle scripts. The final repair does not
+        execute package code during npm installation.
+    exceptions_added:
+      machine: false
+      user: false
+      workspace: false
+
+  verification:
+    unit_tests: "1114 passed, 44 skipped"
+    runtime_tests: "248 passed, 12 skipped"
+    installer_path_tests: "4 passed, 1 skipped"
+    windows_installer_source_tests: "4 passed"
+    powershell_parse: passed
+    python_lint: passed
+    registry_preserved_across_installer_test: true
+    installer_live_state_transition:
+      ephemeral_home_ignored: true
+      default_prefix_install_succeeded: true
+      registered_home_matched_default_prefix: true
+      original_value_restored: true
+      temporary_test_directory_removed: true