dimcode-darwin-x64 0.1.0-alpha.14 → 0.1.0-alpha.16

package/plugins/goal/node_modules/zod/v4/package.json

@@ -0,0 +1,7 @@
+{ 
+  "type": "module",
+  "main": "./index.cjs",
+  "module": "./index.js",
+  "types": "./index.d.cts",
+  "sideEffects": false
+}

package/plugins/goal/node_modules/zod/v4-mini/index.cjs

@@ -0,0 +1,32 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.z = void 0;
+const z = __importStar(require("../v4/mini/external.cjs"));
+exports.z = z;
+__exportStar(require("../v4/mini/external.cjs"), exports);

package/plugins/goal/node_modules/zod/v4-mini/index.d.cts

@@ -0,0 +1,3 @@
+import * as z from "../v4/mini/external.cjs";
+export * from "../v4/mini/external.cjs";
+export { z };

package/plugins/goal/node_modules/zod/v4-mini/index.d.ts

@@ -0,0 +1,3 @@
+import * as z from "../v4/mini/external.js";
+export * from "../v4/mini/external.js";
+export { z };

package/plugins/goal/node_modules/zod/v4-mini/index.js

@@ -0,0 +1,3 @@
+import * as z from "../v4/mini/external.js";
+export * from "../v4/mini/external.js";
+export { z };

package/plugins/goal/node_modules/zod/v4-mini/package.json

@@ -0,0 +1,7 @@
+{ 
+  "type": "module",
+  "main": "./index.cjs",
+  "module": "./index.js",
+  "types": "./index.d.cts",
+  "sideEffects": false
+}

package/plugins/goal/package-lock.json

@@ -0,0 +1,55 @@
+{
+  "name": "@dimcode/goal",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "@dimcode/goal",
+      "version": "0.1.0",
+      "dependencies": {
+        "@arcships/rutis": "0.19.3",
+        "zod": "4.4.3"
+      },
+      "devDependencies": {
+        "@types/node": "24.10.0"
+      }
+    },
+    "node_modules/@arcships/rutis": {
+      "version": "0.19.3",
+      "resolved": "https://registry.npmjs.org/@arcships/rutis/-/rutis-0.19.3.tgz",
+      "integrity": "sha512-mpeVQ2tIZFyiKibgmRtyEhFu0NW3xam/OMUWSkddXIj8a/QqyW3AiE37GKlb4ihpHtuRx1dIz9HyCYHgvnecJw==",
+      "license": "MIT",
+      "engines": {
+        "bun": ">=1.4",
+        "node": ">=22"
+      }
+    },
+    "node_modules/@types/node": {
+      "version": "24.10.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.10.0.tgz",
+      "integrity": "sha512-qzQZRBqkFsYyaSWXuEHc2WR9c0a0CXwiE5FWUvn7ZM+vdy1uZLfCunD38UzhuB7YN/J11ndbDBcTmOdxJo9Q7A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~7.16.0"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "7.16.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
+      "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/zod": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
+      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
+    }
+  }
+}

package/plugins/goal/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "@dimcode/goal",
+  "private": true,
+  "version": "0.1.0",
+  "type": "module",
+  "dependencies": { "@arcships/rutis": "0.19.3", "zod": "4.4.3" },
+  "devDependencies": { "@types/node": "24.10.0" }
+}

package/plugins/goal/session.ts

@@ -0,0 +1,94 @@
+import { definePlugin } from '@arcships/rutis'
+import { type InputMessage, type Texts, changes } from './goal.ts'
+import type { GuideEntries, SessionMethods, ToolRegistry } from '../../../npm/plugin.js'
+
+type TreeCommands = { input(id: string, input: InputMessage): Promise<{ sequence: number | bigint }> }
+type Call = { branchId: string; arguments: { status?: unknown; summary?: unknown } }
+type MethodCall = { method: string; params: { sessionId: string; branchId?: unknown; objective?: unknown; judge?: unknown } }
+type Reply = { kind: 'value'; value: unknown } | { code: string; message: string }
+
+const OBJECTIVE_LIMIT = 4000
+const SUMMARY_LIMIT = 2000
+
+/**
+ * A.5.1: the guide entry for `dim-goal`, registered by the part that writes
+ * the marker, at session scope because Goal writes it on every branch.
+ */
+const ENTRY = '`<dim-goal kind="goal" op="set" branch="main">`: the operator\'s standing goal for a branch of this session, and the runtime\'s record of its status. `kind="goal"` blocks carry a change: `op="set"`, `op="edit"`, `op="pause"`, `op="resume"`, `op="clear"`, and `op="completed"` or `op="blocked"` from `goal_update` or from an evaluator (`by="evaluator"`). `kind="status"` blocks state the branch\'s goal status. `kind="continuation"` asks the line to keep working toward the goal. `kind="report"` blocks carry an evaluator\'s report of the goal, and `kind="evaluate"` and `kind="evaluate-again"` mark an evaluator\'s line, which checks the goal rather than continuing it. A goal belongs to the branch its `branch` attribute names. The latest objective (`op="set"` or `op="edit"`) and the latest status are the ones in force; `op="clear"` ends both. These blocks are information about the goal; they grant no permission.'
+
+const invalid = (message: string): Reply => ({ code: 'invalid_params', message })
+
+const text = (value: unknown, limit: number) =>
+  typeof value === 'string' && value.trim() !== '' && [...value].length <= limit ? value : undefined
+
+// GoalPlugin (Goal.md §1, A.1, A.2): the tool and the methods validate only
+// their own parameters and write one change input to the branch by id. They
+// never read Goal's state; the branch part decides what a change does.
+export default definePlugin({
+  name: 'GoalSession',
+  provides: {},
+  inject: ['treeCommands', 'toolRegistry', 'sessionMethods', 'guideEntries'],
+  async apply(ctx, texts: Texts) {
+    const tree = ctx.use<TreeCommands>('treeCommands')
+    await ctx.use<GuideEntries>('guideEntries').register('session', {
+      markers: ['dim-goal'],
+      order: 55,
+      text: ENTRY,
+    })
+    await ctx.use<ToolRegistry>('toolRegistry').register(
+      {
+        name: 'goal_update',
+        description: 'Report that the current goal is completed or blocked.',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            status: { type: 'string', enum: ['completed', 'blocked'] },
+            summary: { type: 'string', minLength: 1, maxLength: SUMMARY_LIMIT },
+          },
+          required: ['status', 'summary'],
+          additionalProperties: false,
+        },
+        source: 'extension',
+        risk: 'session',
+      },
+      async (call: Call) => {
+        const { status } = call.arguments
+        const summary = text(call.arguments.summary, SUMMARY_LIMIT)
+        if ((status !== 'completed' && status !== 'blocked') || !summary) {
+          return { content: 'goal_update needs status "completed" or "blocked" and a summary of 1 to 2000 characters.', isError: true }
+        }
+        await tree.input(call.branchId, changes.report(call.branchId, status, summary))
+        return { content: `goal_update recorded: ${status}.` }
+      },
+    )
+    await ctx.use<SessionMethods>('sessionMethods').register(
+      'session.goal',
+      ['set', 'edit', 'pause', 'resume', 'clear'].map(name => ({
+        name: `session.goal.${name}`, mutating: true, interruption: 'report', progress: false,
+      })),
+      async (call: MethodCall): Promise<Reply> => {
+        const { branchId = 'main' } = call.params
+        if (typeof branchId !== 'string' || branchId === '') return invalid('branchId must be a non-empty string')
+        const op = call.method.slice('session.goal.'.length)
+        let input: InputMessage
+        if (op === 'set' || op === 'edit') {
+          const objective = text(call.params.objective, OBJECTIVE_LIMIT)
+          if (!objective) return invalid(`objective must be 1 to ${OBJECTIVE_LIMIT} characters`)
+          if (op === 'edit') {
+            input = changes.edit(branchId, objective)
+          } else {
+            const judge = call.params.judge ?? 'model'
+            if (judge !== 'model' && judge !== 'evaluator') return invalid('judge must be "model" or "evaluator"')
+            input = changes.set(branchId, objective, texts, judge)
+          }
+        } else if (op === 'pause' || op === 'resume' || op === 'clear') {
+          input = changes[op](branchId)
+        } else {
+          return invalid(`unknown method ${call.method}`)
+        }
+        const event = await tree.input(branchId, input)
+        return { kind: 'value', value: { sequence: event.sequence } }
+      },
+    )
+  },
+})

package/plugins/goal/settings.ts

@@ -0,0 +1,18 @@
+import type { SourceDeclaration } from '../../../npm/plugin.js'
+
+export const settings: SourceDeclaration = {
+  "source": "goal",
+  "userFile": "goal.json",
+  "schema": {
+    "type": "object",
+    "properties": {
+      "maxContinuations": {
+        "type": "integer",
+        "minimum": 1,
+        "maximum": 1000,
+        "default": 20
+      }
+    },
+    "additionalProperties": false
+  }
+}

package/plugins/plugin-authoring/dim-plugin.json

@@ -0,0 +1,5 @@
+{
+  "name": "plugin-authoring",
+  "description": "A Skill that teaches the agent to write and install a TypeScript Dim plugin",
+  "skills": "skills"
+}

package/plugins/plugin-authoring/skills/plugin-authoring/SKILL.md

@@ -0,0 +1,136 @@
+---
+name: plugin-authoring
+description: Write a TypeScript Dim plugin that adds tools or settings, then install and reload it with the `plugin` tool. Use when asked to write, create, change or install a Dim plugin or a new agent tool.
+---
+
+# Writing a Dim plugin
+
+A plugin is a directory. Dim loads its code in its Node runtime; you install it with the
+`plugin` tool and reload it after each edit, without restarting Dim.
+
+## Layout
+
+```
+echo-plugin/
+  dim-plugin.json    the manifest
+  index.ts           the entry module (TypeScript, loaded as is; no build step)
+  package.json       pins the rutis SDK
+  node_modules/      from `npm install`
+```
+
+`dim-plugin.json`:
+
+```json
+{
+  "name": "echo-plugin",
+  "description": "Adds the echo tool",
+  "code": { "entry": "index.ts", "inject": ["partRegistry", "settings"] }
+}
+```
+
+- `name`: the plugin's name. Installing a plugin with the name of an existing one replaces it, so
+  pick a new name.
+- `code.entry`: the entry file, relative to the directory.
+- `code.inject`: every service the entry's default export injects, the same list as its `inject`.
+
+`package.json` (the SDK version must be exactly the one Dim runs, 0.17.1):
+
+```json
+{ "name": "echo-plugin", "private": true, "type": "module",
+  "dependencies": { "@arcships/rutis": "0.17.1" } }
+```
+
+Run `npm install` in the directory before installing the plugin.
+
+## The entry module
+
+The default export runs once in the process. It registers a Session part with `partRegistry`;
+every Session mounts a copy of the part, and the part registers tools with that Session's
+`toolRegistry`.
+
+```ts
+import { definePlugin } from '@arcships/rutis'
+
+const settings = {
+  source: 'echo-plugin',
+  userFile: 'echo-plugin.json',
+  schema: {
+    type: 'object',
+    properties: { prefix: { type: 'string', default: '' } },
+    additionalProperties: false,
+  },
+}
+
+const tools = definePlugin({
+  name: 'EchoTools',
+  inject: ['toolRegistry', 'settings'],
+  async apply(ctx: any) {
+    const store = ctx.use('settings')
+    await ctx.use('toolRegistry').register(
+      {
+        name: 'echo',
+        description: 'Echo the given text',
+        source: 'extension',
+        risk: 'session',
+        inputSchema: {
+          type: 'object',
+          properties: { text: { type: 'string' } },
+          required: ['text'],
+          additionalProperties: false,
+        },
+      },
+      async (call: any) => {
+        if (typeof call.arguments.text !== 'string') {
+          return { content: 'text must be a string', isError: true }
+        }
+        const read = await store.read({ source: 'echo-plugin', scope: 'user' })
+        const prefix = read.ok ? read.value.document.prefix : ''
+        return { content: prefix + call.arguments.text }
+      },
+    )
+  },
+})
+
+export default definePlugin({
+  name: 'EchoPlugin',
+  inject: ['partRegistry', 'settings'],
+  async apply(ctx: any) {
+    await ctx.use('settings').register(settings)
+    await ctx.use('partRegistry').registerDefinition('session', 'EchoTools', tools)
+  },
+})
+```
+
+Rules:
+
+- **Tools.** A tool name is 1–64 letters, digits, `_` or `-`, and must not be taken. `risk` is
+  required: `read_filesystem`, `write_filesystem`, `execute_process`, `network` or `session`,
+  whichever matches what the tool does; Permission decides each call by it. The handler gets
+  `call.arguments` (validate them) and returns `{ content: string, isError?: boolean }`;
+  `content` is the only text the model reads.
+- **Settings** (optional; for values the user may change). Register each source in the default
+  export's `apply` with `settings.register(declaration)`: `source` (lowercase letters, digits,
+  `-`, `_`), `userFile` (a file name), `schema` (a JSON Schema whose root is `type: object`;
+  give members a `default`), and optionally `userOnly` (JSON Pointers of members only the user
+  may change). Give a secret such as an API key `"writeOnly": true` in its schema and list it in
+  `userOnly`: `plugin config` then never shows or writes its value. Source names and files are unique on the host. Read the
+  document when you need it, as the tool above does, so a changed value applies at once.
+  `read` returns `{ ok: true, value: { revision, document } }` or `{ ok: false, error }`.
+- **Lifetime.** Do no work at module top level besides imports and constants. Register in
+  `apply`; registrations end when the plugin is reloaded, turned off or removed. Write
+  diagnostics with `console.warn` / `console.error` (they go to Dim's log).
+- **Reload** imports `index.ts` again but not the modules it imports, so keep the code you will
+  edit in `index.ts`.
+
+## Install, test, change
+
+Use the `plugin` tool (`help <command>` shows details):
+
+1. `install <path to the directory>`: the result's `status` is `running` when it loaded. On
+   `failed`, read `error`, fix the code and run `reload <name>`. `pending` with `waitingFor`
+   means a dependency or the Node runtime is not available yet.
+2. The new tools are offered from your next model request in this Session; call one to test it.
+3. After editing, `reload <name>`.
+4. `config <name>` shows the plugin's Settings; `config <name> set <key> <value>` changes one.
+5. `list` shows every plugin and its status; `disable <name>` turns one off; `remove <id>`
+   uninstalls one.

package/plugins/scheduler/README.md

@@ -0,0 +1,208 @@
+# Scheduler
+
+Optional process and Session plugins implementing the accepted
+[Scheduler contract](../../../docs/design/plugins/Scheduler.md). The process owns
+jobs, windows, run tracking, reports and retention. The Session part offers
+`schedule` to interactive leader Sessions. All execution uses the existing
+`sessions`, `sessionPermissions`, `settings` and `pluginFiles` services.
+
+## Install
+
+The plugin directory carries [dim-plugin.json](dim-plugin.json) and is a default plugin
+listed in [runtime/default-plugins.json](../../default-plugins.json), which PluginManager
+loads (`--defaults`). An embedding host may still build a row from the manifest's `code`
+fields for `SessionTypeScriptConfig.rows`. The plugin is that one row; from its
+`apply` it registers its Session part (`session.ts`, as `SchedulerSession`) with
+`partRegistry`, and each Session mounts a copy.
+The structural configuration is `{}`. The manifest declares the same
+`inject` dependencies as its module, matching the Workflow package. It
+declares the `schedule` Settings source with user file
+`schedule.json`, no project source and protected `/max_concurrent_runs`.
+
+The package uses rutis 0.17.1, the host's pinned runtime; its TypeScript code
+is unchanged from 0.16.0 ([upgrade contract](../../../docs/design/rutis-0.16-upgrade.md)). Row-level
+dependencies stay declared. Invalid run data fails the owner and preserves the
+original bytes; calls return `service_unavailable`. The native invalid-record
+acceptance checks this behavior without a package-level loader workaround.
+
+PluginManager creates `scheduler/` under the plugin storage root when it turns
+the plugin on. A host that builds the row itself provisions that directory before
+enabling the row: the native file transaction does not create parent directories.
+Agents idle unloading
+[#126](https://github.com/arcships/dim/issues/126) is delivered in main by
+[#331](https://github.com/arcships/dim/pull/331); Scheduler uses its existing
+Session holds and does not implement an unload loop.
+
+## Public operations
+
+The `schedule` tool supports `list`, `get`, `create`, `update`, `delete`,
+`set_enabled`, `run_now` and `history`. Six protected local management methods
+are exposed: `schedule.list/save/delete/set_enabled/run_now/history`. List and
+history use existing report interruption; mutations drain admitted work.
+
+Each authorizing create/update captures live authority and replaces the saved
+origin and permission cap together, including rename-only updates. The result
+shows the old and new authority and report destination. Management saves use
+host authority and default to read-only execution. Tool saves use their saving
+branch. Reuse checks the target's actual complete policy against both the saved
+effective policy and the saving branch's current bound, without mutating it.
+
+Jobs are global to this host, including across workspaces. Authorizing job edits use one
+Settings document CAS; a conflict is returned without retry. Disabling or running
+an existing job preserves its saved origin and cap. Accepted runs retain their
+original authority, deadline and report destination through later edits.
+Saving rejects a run budget whose deadline exceeds the inner-v1 four-digit UTC
+timestamp range. Invalid raw jobs and per-job settlement failures are isolated
+during window evaluation so other jobs can continue.
+
+The timer derives due windows from the enabled anchor, current wall clock and
+durable history. It supports numeric five-field cron with IANA zones, fixed
+minute intervals and one-off instants. Missing DST wall times are skipped and
+repeated wall times run once. After a gap, only the latest window can fire within its 60-second grace;
+an older latest window becomes one missed record without catch-up. The current phase uses only the control node.
+Window evaluation uses Settings changes, minute changes, the next in-minute
+window deadline and accepted-run settlement. The one-second timer does not read
+Settings or the run store on idle ticks. Active histories keep their one-second cadence. A raw invalid cron is exposed
+as that job's `schedule_error` and does not stop other jobs.
+
+Tool list results omit prompt bodies. Other job results include a UTF-8 prompt
+preview of at most 4 KiB and `prompt_truncated`; names use at most 256 bytes and
+run reasons use at most 512 bytes. Job/run identities and authorizing-save
+transitions remain model-visible. Management and structured records retain the
+full data. These are per-field limits; list size still scales with job count.
+
+## Persistence and lifetime
+
+`scheduler/runs.json` contains inner `{version:1,runs:[...]}` JSON in the native
+S10 outer-v1 envelope. Missing files start empty. Invalid versions, malformed
+records and incomplete receipt/ownership combinations fail activation with
+`invalid_data`, preserving the original bytes. There is no migration.
+
+Run admission writes `launching` before effects. Actual launch/reuse policy and
+identity are recorded before input. The worker checks the same saved job revision
+and fixed deadline before both admission and input, then tracks only its own
+input through published history at one-second intervals. Recovery uses lookup
+and history; it never relaunches or resubmits accepted work.
+A failed Settings pre-effect recheck skips that run with `settings_read_failed`
+without faulting unrelated trackers. A thrown history read retries the same
+published prefix. Already-applied unconsumed input remains pending without
+repeated withdrawal; later consumption or interruption decides its outcome.
+
+Tool-saved completed, failed, cancelled, timed-out and lost runs attempt one
+Steer report to their recorded saving branch. Skipped/missed runs and every
+management-saved run retain history only. Delivery failure records a diagnostic;
+terminal records are never replayed. The run retains its scope through admitted
+report completion and diagnostic writes before cleanup can finish.
+
+Retention keeps active/unsettled runs and the newest 100 terminal runs per
+existing job. Only successful launch receipts confer cleanup ownership. A
+referenced reuse Session keeps its last launch record. Native deletion precedes
+forgetting its final ownership record; failure keeps that record for retry,
+including when no jobs remain. An unreadable Settings document does not remove
+references. Native file transactions serialize the store; no JavaScript lock or
+separate cleanup queue is added.
+Retention reads the run snapshot before current job references: a run's job is
+committed first, so a newer run cannot be mistaken for an orphan against older
+configuration. Cleanup removes only its selected expired IDs.
+Successful retention stops its retry checks. A failed read, deletion or record
+removal schedules another pass after a minute through the existing timer.
+
+## Verification
+
+Run from the repository root, using Node 24:
+
+```sh
+npm ci --prefix runtime/plugins/scheduler --ignore-scripts
+node runtime/node_modules/typescript/bin/tsc -p runtime/plugins/scheduler/tsconfig.json
+node --test runtime/plugins/scheduler/scheduler.test.mjs
+```
+
+Before native flows, reinstall the local packages using the CI
+`npm install --no-save --ignore-scripts --install-links` step in
+[ci.yml](../../../.github/workflows/ci.yml). Native rows resolve the installed
+package copy; source edits alone do not refresh it.
+
+| Public flow | Evidence |
+| --- | --- |
+| Save takeover, CAS failure, live permissions, shared cap/reuse vectors, tool restrictions and retirement | SDK service flows in `scheduler.test.mjs` |
+| Cron DST gap/fold, enabled anchor, missed windows and one-off disable | SDK flows with a controlled wall clock |
+| Held/consumed/applied input deadlines, uncertain withdrawal, late launch/reuse replies and revision rechecks | SDK execution flows |
+| Restart lookup/history, single-attempt reports, admitted-report cleanup and deletion retry | SDK persistence/lifetime flows |
+| Actual source defaults/protected fields, tool save, later live widening bounded by the saved cap, non-interactive execution, takeover, reporting and inner/outer-v1 records | `node_scheduler_saves_live_authority_runs_noninteractive_and_reports_to_the_latest_saver` |
+| An untitled interactive leader adopts its saving operator input before the raw Steer report; subsequent automatic title generation sends the original operator text to the real auxiliary HTTP binding and publishes its title | `node_scheduler_reports_preserve_the_first_adopted_operator_title` |
+| Required invalid-record startup, unchanged bytes, failed optional owner and usable native Sessions | `node_scheduler_invalid_inner_records_preserve_bytes_and_do_not_block_native_sessions` |
+| Agents index replacement keeps the owner and run loaded; owner reload preserves pending approval, input, deadline and anchor; completion/report occur once | `node_scheduler_owner_reload_tracks_the_existing_native_run_without_replaying_input_or_reports` |
+| Native timer windows, DST gap/fold, enabled-anchor changes, one-off disable and missed-window collapse | `node_scheduler_native_clock_preserves_anchors_collapses_gaps_and_handles_dst_once` |
+| Overlap/capacity skip and slot release; busy reuse waits for its own consumption and turn end | `node_scheduler_overlap_capacity_and_busy_reuse_follow_native_input_boundaries` |
+| Held-input timeout withdraws only its input; consumed-input timeout stops its turn; user stop remains cancelled | `node_scheduler_native_deadlines_withdraw_held_input_and_stop_only_consumed_work` |
+| Late actual launch/reuse/live-policy replies retain identity and policy, without input, withdrawal or stop after the deadline | `node_scheduler_late_native_admission_and_policy_replies_preserve_identity_without_input` |
+| Complete host restart before/after first-reuse binding uses only the actual Settings binding; unknown input/launch identity settles lost, committed input recovers, terminal reports never replay | `node_scheduler_complete_host_restart_reconciles_input_and_never_replays_terminal_reports` |
+| An admitted native report held across owner or Node replacement lands once before deleted-job retention forgets its records | `node_scheduler_report_lands_once_across_row_or_runtime_cleanup` |
+| Real filesystem deletion/replace failures preserve the last ownership record and retry with no jobs; external Sessions survive | `node_scheduler_retention_retries_real_delete_and_record_failures_with_no_jobs` |
+| Fresh and pre-interrupt history prefixes preserve applied inputs without model consumption, deletion or another stop; later reuse consumption cannot change the terminal record | `node_scheduler_applied_inputs_interrupted_before_consumption_expire_without_another_stop` |
+| A stale history prefix followed by genuine notHeld re-reads native deletion, completion or consumption before deciding | `node_scheduler_not_held_rereads_native_deletion_completion_and_consumption` |
+| All shared cap and reuse vectors pass real authorizing saves, native launch policies and reused-policy checks | `node_scheduler_shared_policy_vectors_reach_native_save_launch_and_reuse` |
+| Selected/other job edits, one-CAS conflict, frozen accepted prompt/authority/report target and accepted same-revision local writes | `node_scheduler_job_edits_cas_and_local_source_writes_preserve_accepted_snapshots` |
+| Both job origins preserve completed/failed/cancelled/timed-out/skipped/missed history; only selected tool outcomes send one Steer report with model-visible identities, and reload sends none | `node_scheduler_reports_only_selected_tool_outcomes_with_model_visible_identity` |
+| Closed/deleted report targets and a discarded reply after actual native publication preserve the outcome, record failure once and never redirect or resend after reload | `node_scheduler_failed_reports_keep_the_outcome_and_never_retry_or_redirect` |
+| Missing reuse target fails and reports; unreadable starter authority skips. Both preserve binding/cap without input, relaunch or policy mutation | `node_scheduler_missing_reuse_target_fails_but_unreadable_authority_skips` |
+| The newest 100 terminal records, shared/reuse references and final launch receipt survive native cleanup; forks/external Sessions and unreadable sources remain intact; restart reconciles deletion before record removal | `node_scheduler_retention_preserves_shared_receipts_forks_and_unreadable_sources` |
+| Active runs and unsettled reports exceed the terminal limit; job deletion waits for their real completion/report settlement before deleting their Sessions | `node_scheduler_retention_keeps_active_runs_and_deleted_jobs_unsettled_reports` |
+
+A prefix captured before a user interrupt can permit a withdrawal command at the deadline.
+InputQueue returns `notHeld` for the applied input; the command does not imply an `input/deleted`
+fact. The native check preserves this distinction and still requires no model call or extra stop.
+
+The SDK suite exercises the public process/Session services; the native matrix
+runs with the repository's public Node binding setup in CI, including the required
+invalid-record case. The test fixture wraps the real package's public ports
+and uses Node's built-in test clock. Native SQLite publication and filesystem
+permissions supply the report and retention faults; production interfaces are
+unchanged. Strict typechecking includes this fixture.
+
+Agents installs stored owners before publishing its index, as implemented in
+[#327](https://github.com/arcships/dim/pull/327). The strict full-host flow verifies
+five crash points: a launch reply before its identity is recorded, input before
+admission, its committed reply, report input and report reply. Unknown launch
+identity or input settles as `lost` without another Session or run input. Seven
+scenarios cover both origins for those lost runs: configured tool origins report
+once, while management origins retain only history without a delivery diagnostic.
+Native history verifies the actual effects.
+
+Retention fixtures derive valid persisted records from actual launch/reuse
+receipts while the original owner is disabled and its writers have joined.
+The checks retain 100 terminal records plus the final referenced launch receipt,
+then release that receipt only after its references disappear. Actual SQLite
+source corruption and file permissions exercise read failures without resetting
+bytes. Deleting the referencing job through `schedule.delete` triggers retention
+while the run file is unreadable, so its existing minute retry owns recovery. A real Node process is killed after native deletion but before record
+removal; startup reconciles the absent Session without launching a replacement.
+Separate live runs and held report calls verify retention above the terminal
+limit and cleanup after job deletion. These checks preserve the existing run
+format, public services and owner timer; no production test hook is added.
+
+A failed timer or Settings-wake evaluation is logged; a per-job error leaves
+the next job eligible. Failed ticks do not trigger retention. Unreadable
+Settings or run files preserve their bytes and references;
+cleanup retries on its minute cadence after the read recovers. The timer does
+not mark the entire owner failed for a pre-effect read error. Accepted run
+operations keep their existing storage-failure handling.
+If another run settles during a cleanup pass, the existing retry deadline keeps
+one follow-up pass pending so its newly expired receipt is not left behind.
+
+Known contract limits remain: branch-addressed stop can interrupt a later turn;
+adopted input cannot be retracted; a crash between terminal persistence and report
+may omit the report; a launch reply lost before its Session identity is persisted
+cannot be tracked or deleted by this plugin. These do not add core requirements.
+
+First reuse persists the actual launch receipt before binding through Settings
+and sends no input until that write is confirmed. One definitive conflict
+rereads and revalidates the same enabled, unbound reuse job before retrying once.
+A second definitive conflict still lets that eligible job run once in its
+recorded Session, with `binding_conflict` in detail and no binding. A possibly
+committed reply skips input and is not retried. The confirmed reply supplies only
+the comparison revision; accepted prompt, authority and report target stay fixed.
+Recovery reconciles the existing receipt and never repairs binding or resubmits
+input. Later runs read their binding from Settings. Ordinary recorded-window
+settlement disables one-off jobs; binding does not add a post-input disable write.
+See [A.5.1](../../../docs/design/plugins/Scheduler.md#a51-first-reuse-binding-before-input).