dsh-codex-connect 0.1.0-alpha.4.35 → 0.1.0-alpha.4.36

package/INSTALL.md

@@ -1,9 +1,11 @@
 # Installation Runbook for CLI Agents
 
-Published Alpha 4.34 is verified with DSH `0.1.2-rc.1` and pi-ai `0.84.4` within `^0.84.2`, and with each exact DSH `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` model-runtime pairing using pi-ai `0.85.1`.
+Published Alpha 4.35 is verified with DSH `0.1.2-rc.1` and pi-ai `0.84.4` within `^0.84.2`, and with each exact DSH `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` model-runtime pairing using pi-ai `0.85.1`.
 
 Install `dsh-codex-connect` into one requested DeepSeek Harness profile without changing its current default model, search route, global configuration, or OAuth state.
 
+Channel snapshot on 2026-09-11: npm `alpha` points to `0.1.0-alpha.4.35`; `latest` intentionally remains on `0.1.0-alpha.4.34`. Use the exact-version commands below for 4.35. Publishing an Alpha and promoting the default installation channel are separate actions.
+
 ## Safety requirements
 
 - Never read, print, copy, move, or modify `~/.codex/auth.json`.
@@ -23,19 +25,19 @@ Check `dsh --version` before changing the requested profile. Use `dsh --help` to
 | `0.1.0-rc.7` | `0.1.0-alpha.4.14` |
 | `0.1.1-rc.2` | `0.1.0-alpha.4.21` |
 | `0.1.2-alpha.2` | `0.1.0-alpha.4.23` |
-| `0.1.2-rc.1` | `0.1.0-alpha.4.34` |
+| `0.1.2-rc.1` | `0.1.0-alpha.4.35` |
 | `0.1.2-alpha.5` | `0.1.0-alpha.4.25` |
-| `0.1.5-alpha.1` | `0.1.0-alpha.4.34` |
-| `0.1.5-rc.1` | `0.1.0-alpha.4.34` |
-| `0.1.5-rc.2` | `0.1.0-alpha.4.34` |
+| `0.1.5-alpha.1` | `0.1.0-alpha.4.35` |
+| `0.1.5-rc.1` | `0.1.0-alpha.4.35` |
+| `0.1.5-rc.2` | `0.1.0-alpha.4.35` |
 
 If your exact DSH version is unknown or not listed, preserve the installed host, report that the combination is unverified, and verify it before making installation changes. A missing record does not prove incompatibility, and the catalog's latest verified DSH version is not the latest upstream release. Do not recommend upgrading or downgrading DSH merely to match a row. Investigate any specific failure and seek verification of the installed combination. Do not blindly install `dsh-codex-connect@alpha`: `alpha` is a moving tag, not a compatibility guarantee. Do not infer support for newer DSH versions from these rows.
 
-Alpha 4.34 requires one consistent DSH plugin API version: `0.1.2-rc.1` with `@earendil-works/pi-ai` `^0.84.2`, or one of `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` with pi-ai `0.85.1`; Node.js remains `^22.19.0 || >=24.0.0`. Mixed host versions and other DSH/pi-ai combinations remain unverified. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 remains the verified choice for DSH `0.1.2-alpha.2`, Alpha 4.21 remains the verified choice for DSH `0.1.1-rc.2`, and staying on DSH `0.1.0-rc.7` means selecting Alpha 4.14. Changing DSH is a separate operation requiring the user's explicit request; a plugin update request does not authorize it. The repository's `pnpm --silent run check:compatibility` remains a strict development/release dependency gate, not a recommendation to change a user's host.
+Alpha 4.35 requires one consistent DSH plugin API version: `0.1.2-rc.1` with `@earendil-works/pi-ai` `^0.84.2`, or one of `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` with pi-ai `0.85.1`; Node.js remains `^22.19.0 || >=24.0.0`. Mixed host versions and other DSH/pi-ai combinations remain unverified. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 remains the verified choice for DSH `0.1.2-alpha.2`, Alpha 4.21 remains the verified choice for DSH `0.1.1-rc.2`, and staying on DSH `0.1.0-rc.7` means selecting Alpha 4.14. Changing DSH is a separate operation requiring the user's explicit request; a plugin update request does not authorize it. The repository's `pnpm --silent run check:compatibility` remains a strict development/release dependency gate, not a recommendation to change a user's host.
 
-The Alpha 4.34 rows reflect same-artifact isolated installation and model-runtime checks on both configured Node versions, browser regression, Windows canary contracts, and independent verification of the published npm artifact. All eight advertised models resolved and prepared, defaults were unchanged, and provider disposal succeeded. These are not fresh real OAuth, live model/tool/image, or full Windows application acceptance. See [.github/ALPHA_434_RELEASE_READINESS.md](https://github.com/franksong2702/dsh-codex-connect/blob/main/.github/ALPHA_434_RELEASE_READINESS.md) for release recovery, upgrade evidence, and verification limits. Historical rows remain the repository's existing verification record. This guidance does not change upstream DSH behavior or resolve [Issue #64](https://github.com/franksong2702/dsh-codex-connect/issues/64).
+The Alpha 4.35 rows reflect successful release-commit CI on Node 22.19.0 and 24.20.0 (840 tests each), 28 Chromium tests, Windows canary contracts, and the four-host installation/Reserve matrix. Independent post-publication checks installed the exact npm version on all four hosts, matched all 63 installed plugin files to the verified published archive, and exercised a 4.34-to-4.35 upgrade on rc.2. All eight advertised models resolved and prepared, defaults were unchanged, all optional capabilities remained disabled, and provider disposal and synthetic Reserve transitions passed. These checks are not fresh real OAuth, live Reserve/model/tool/image, or full Windows application acceptance. See [.github/ALPHA_435_RELEASE_READINESS.md](.github/ALPHA_435_RELEASE_READINESS.md) for publication, installation evidence, and limitations. Historical rows remain the repository's existing verification record. This guidance does not change upstream DSH behavior or resolve [Issue #64](https://github.com/franksong2702/dsh-codex-connect/issues/64).
 
-Alpha 4.33 omits the `modelErrors` profile field required by RC model packages, producing `Cannot read properties of undefined (reading 'get')`. Alpha 4.34 contains the fix. Reauthorization or repeated model-list retries do not add a missing profile field. Pin the corrected plugin version for a verified host combination; do not delete credentials or change DSH merely to work around this failure. DSH `0.1.5-alpha.2` remains unverified.
+Alpha 4.33 omits the `modelErrors` profile field required by RC model packages, producing `Cannot read properties of undefined (reading 'get')`. Alpha 4.34 contains the fix, retained in 4.35. Reauthorization or repeated model-list retries do not add a missing profile field. Pin the corrected plugin version for a verified host combination; do not delete credentials or change DSH merely to work around this failure. DSH `0.1.5-alpha.2` remains unverified.
 
 ### Install the selected version and validate
 
@@ -58,10 +60,10 @@ Alpha 4.33 omits the `modelErrors` profile field required by RC model packages,
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.23
    ```
 
-   For DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2`, use Alpha 4.34:
+   For DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2`, use Alpha 4.35:
 
    ```sh
-   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.34
+   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.35
    ```
 
    For DSH `0.1.2-alpha.5`, use Alpha 4.25:
@@ -70,7 +72,7 @@ Alpha 4.33 omits the `modelErrors` profile field required by RC model packages,
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.25
    ```
 
-   If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.34'` only for the DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2` combinations.
+   If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.35'` only for the DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2` combinations.
 
 3. Run `dsh web --help` once to compose the installed profile without starting the server. DSH `0.1.2-rc.1` prepares profile plugin dependency fallback during this step.
 4. Run `dsh --profile web --dump-config` and require exactly one `llm-openai-codex` row loading `dsh-codex-connect`.
@@ -100,7 +102,7 @@ The value is a full `http://` or `https://` origin including its port, not a bar
 
 ## Optional configuration
 
-Use **Settings → Plugins → Plugin configuration → Codex Connect** for live, staged Save/Discard edits organized under Account & quota, Models, Network, and Capabilities. Switching modules preserves the draft. The same settings control `enableSearch`, `enableImageTool`, `enableImageGeneration`, and `enableAutoReview`; all four default to `false`. Enabling Auto-review permits bounded approval context, tool arguments, working directory, and the planned action to be sent to `chatgpt.com`; failures return to human approval. Enabling image generation uses the image generation capability included with the current GPT subscription and saves results as DSH attachments. Enabling search registers the provider and selects it while the capability remains enabled; disabling restores the previous provider before unregistering Codex Search. Setting `agent-default-model` to `openai-codex` remains a separate explicit change.
+Use **Settings → Plugins → Plugin configuration → Codex Connect** for live, staged Save/Discard edits organized under Account & quota, Models, Network, and Capabilities. Switching modules preserves the draft. The same settings control `enableSearch`, `enableReserveFallback`, `enableImageTool`, `enableImageGeneration`, and `enableAutoReview`; all five default to `false`. Luna Reserve is a published experiment in Alpha 4.35: enable it only when explicitly requested, never as an automatic installation step. Real-account Reserve entry and recovery remain unverified; authorization must come from the identity-matched backend response, not a generic `429` or quota percentage. Enabling Auto-review permits bounded approval context, tool arguments, working directory, and the planned action to be sent to `chatgpt.com`; failures return to human approval. Enabling image generation uses the image generation capability included with the current GPT subscription and saves results as DSH attachments. Enabling search registers the provider and selects it while the capability remains enabled; disabling restores the previous provider before unregistering Codex Search. Setting `agent-default-model` to `openai-codex` remains a separate explicit change.
 
 Apply only requested choices and preserve unrelated keys:
 
@@ -108,6 +110,7 @@ Apply only requested choices and preserve unrelated keys:
 - id: llm-openai-codex
   config:
     enableSearch: true
+    enableReserveFallback: false
     enableImageTool: false
     enableImageGeneration: false
     enableAutoReview: false

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   git hash-object README.md docs/README.zh.md
-README.md: 9016a882858e604aba551f61baadfe352e69e8e2
-docs/README.zh.md: 8d7d386608a125e6c381df3b7138fe787eba01f5
+README.md: 5c2bff3d29c1366e52035ac809f119a2fdca47fc
+docs/README.zh.md: f629b3789be4b361ffd4045dff7fa6acf92770ff

package/README.md

@@ -16,15 +16,17 @@ This guide describes the published pairings below. Check `dsh --version` first a
 
 | Requirement | Verified pairing |
 |---|---|
-| Codex Connect | `0.1.0-alpha.4.34` |
+| Codex Connect | `0.1.0-alpha.4.35` |
 | DeepSeek Harness | `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2` |
 | Node.js | `^22.19.0 \|\| >=24.0.0` |
 | Account | ChatGPT OAuth with access to the requested Codex model; availability is decided by OpenAI |
 
+As of 2026-09-11, npm `alpha` points to 4.35 while `latest` intentionally remains on 4.34. Use the exact version below for 4.35; this recommendation does not promote the default installation channel.
+
 ### 1. Install
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.34
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.35
 dsh web
 ```
 
@@ -74,7 +76,7 @@ All options below are off on a fresh installation. Edit them in **Settings → P
 | GPT Image generation | `enableImageGeneration` | Prompt-only generation; availability, dimensions, and quota remain account- and service-controlled. |
 | Auto-review | `enableAutoReview` | Sends bounded approval context, tool arguments, working directory, and the planned action to `chatgpt.com`, with confirmation on first enablement. Failures return to human approval. |
 
-**Unreleased experiment:** Luna Reserve fallback is not included in published Alpha 4.34. It remains disabled by default in this development build; real-account Reserve entry and recovery have not been verified.
+**Published experiment:** Alpha 4.35 includes Luna Reserve fallback, disabled by default. Real-account Reserve entry and recovery remain unverified; Alpha 4.34 does not include this feature.
 
 With `enableReserveFallback: true`, the account UI and agent routing share one identity-bound quota state. Background refresh follows the returned quota windows; fresh state is reused across agent steps. The plugin enters `gpt-reserve` only with complete, non-FedRAMP account/user identity and backend Luna Reserve authorization, then restores the session's previous model and reasoning effort after confirmed ordinary-usage recovery. Reserve has its own allowance, is hidden from the model picker, and is not unlimited. The backend decides eligibility; reset times alone do not authorize a switch. This version supports known `gpt-5.6-luna` metadata only. See [Luna Reserve fallback](docs/reference.md#luna-reserve-fallback) for refresh, identity, and verification limits.
 

package/cordis.patch.yml

@@ -7,6 +7,7 @@
         enableProxy: false
         enableSearch: false
         enableReserveFallback: false
+        enableNativeCompaction: false
         enableImageTool: false
         enableImageGeneration: false
         enableAutoReview: false

package/docs/README.zh.md

@@ -16,15 +16,17 @@ Codex Connect 为标准 Harness agent loop 添加 `openai-codex` 模型提供方
 
 | 要求 | 已验证组合 |
 |---|---|
-| Codex Connect | `0.1.0-alpha.4.34` |
+| Codex Connect | `0.1.0-alpha.4.35` |
 | DeepSeek Harness | `0.1.2-rc.1`、`0.1.5-alpha.1`、`0.1.5-rc.1` 或 `0.1.5-rc.2` |
 | Node.js | `^22.19.0 \|\| >=24.0.0` |
 | 账户 | 通过 ChatGPT OAuth 使用所请求的 Codex 模型；可用性由 OpenAI 决定 |
 
+截至 2026-09-11，npm `alpha` 指向 4.35，`latest` 则有意保留在 4.34。安装 4.35 请使用下方精确版本命令；文档推荐更新不代表默认安装渠道已提升。
+
 ### 1. 安装
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.34
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.35
 dsh web
 ```
 
@@ -74,9 +76,9 @@ dsh plugin --profile web exec dsh-codex-connect doctor --json
 | GPT Image 图片生成 | `enableImageGeneration` | 只接受提示词；可用性、尺寸和额度仍由账户及服务端控制。 |
 | 自动审查 | `enableAutoReview` | 将有界的审批上下文、工具参数、工作目录和待执行动作发送到 `chatgpt.com`，首次启用需要确认。失败时交还人工审批。 |
 
-**尚未发布的实验功能：** 已发布的 Alpha 4.34 不包含 Luna Reserve 回退。此开发版本仍默认关闭该功能，尚未完成真实账户进入 Reserve 及恢复普通模型的验证。
+**已发布的实验功能：** Alpha 4.35 包含 Luna Reserve 回退，仍默认关闭。真实账户进入 Reserve 及恢复普通模型的过程仍未验证；Alpha 4.34 不包含该功能。
 
-启用 `enableReserveFallback: true` 后，账户 UI 和 agent 路由共用一份绑定身份的额度状态，按服务端返回的额度窗口后台刷新；有效状态可跨 agent step 复用。只有身份完整、非 FedRAMP 且服务端授权时，插件才进入 `gpt-reserve`；普通额度确认恢复后，切回该会话先前的模型和推理强度。Reserve 有自己的额度，不出现在模型选择器中，也不是无限额度。资格由服务端决定，重置时间本身不授权切换。当前版本只支持已知的 `gpt-5.6-luna` 元数据。刷新、身份和验证限制见 [Luna Reserve fallback](reference.md#luna-reserve-fallback)。
+启用 `enableReserveFallback: true` 后，账户 UI 和 agent 路由共用一份绑定身份的额度状态，按服务端返回的额度窗口后台刷新；有效状态可跨 agent step 复用。只有身份完整、非 FedRAMP 且服务端授权时，插件才进入 `gpt-reserve`；普通额度确认恢复后，切回该会话先前的模型和推理强度。Reserve 有自己的额度，不出现在模型选择器中，也不是无限额度。资格由服务端决定，重置时间本身不授权切换。当前版本只支持已知的 `gpt-5.6-luna` 元数据。刷新、身份和验证限制见 [Luna Reserve 回退](reference.zh.md#luna-reserve-回退)。
 
 使用你当前 GPT 订阅计划提供的图片生成能力。生成原文件与附件预览分开保存；关闭能力或卸载插件不会删除这些文件。存储和访问规则见[配置与恢复](reference.zh.md#搜索与图片工具)。
 

package/docs/agent-notes/dsh-016-candidate-validation.md

@@ -0,0 +1,27 @@
+# DSH 0.1.6 candidate validation
+
+DSH `0.1.6-alpha.1` is a candidate, not a declared supported host. This change does not widen peer dependencies, change `compatibility.json` or `verified-compatibility.json`, publish a release, or upgrade a user profile. Track full acceptance in #207.
+
+## Automated scope
+
+The installation checker now exercises the packed plugin with image generation enabled in addition to its existing provider, Reserve and durable native-compaction checks. It runs the exact host's tool registry and PTC dispatch bridge, validates the rendered image-reference envelope against its typed preview, downloads the original bytes through the registered route, and verifies that a fork inheriting the PTC event can download the original while an earlier fork and an unrelated Session cannot.
+
+The image provider, preview store and code-execution backend are synthetic. The fixture invokes the host-supplied PTC binding; it does not execute arbitrary source, test the real Node PTC process, make provider requests, authenticate a browser, or claim browser rendering. Original storage and the plugin download handler are real. The candidate uses `ptcRuntime`; the existing declared hosts use `codeRuntime`. Both dispatch event names are checked through the actual host, not fabricated session events.
+
+The same-artifact matrix refuses missing image evidence, failed fork authorization checks and nonzero real-provider request counts. Existing browser component regression remains a separate baseline-host check, not proof of the candidate Web composition.
+
+## API assessment
+
+The main plugin does not subscribe to the removed `agent/session-start` event. Its existing image-download and Auto-review readers use `snapshotEvents()`, which the candidate still implements but marks deprecated; deprecation alone does not prove a runtime break. The unmerged Split experiment has separate lifecycle dependencies and is not covered by this assessment. Upstream PTC package/service renaming and the new process backend require explicit coverage before expanding support.
+
+## User acceptance before support expansion
+
+Use a separate disposable DSH home and workspace. Do not upgrade or restart an existing service, copy real account files, or import private session history as part of an automated check. A user must authorize live requests and sign in to the test profile.
+
+- Open the candidate Web UI and confirm plugin settings, model selection, reasoning controls and Fast controls render and retain explicit choices.
+- Sign in and complete one ordinary text/tool round trip; verify cancellation and reload/reconnect behavior.
+- With image generation explicitly enabled, generate one image through PTC, inspect the actual card, download original and preview, and check reload and fork access. Synthetic provider results do not replace this check.
+- Exercise only the optional search, proxy, quota, Auto-review or native-compaction features included in the intended deployment. Record untested features rather than treating default-off loading as their acceptance.
+- Record the exact host version, plugin commit/artifact, Node version and observed results without credentials or private transcript content.
+
+After acceptance, update the supported-host metadata together in a separate release change. Publishing and deployment remain separately authorized actions.

package/docs/agent-notes/ptc-image-presentation.md

@@ -0,0 +1,18 @@
+# Image presentation through PTC
+
+Fixes the presentation failure reported in issue #205.
+
+DSH 0.1.5-rc.2 intentionally invokes `output.presentationMeta` only for top-level tools. Its `tool/ptc-dispatch` event preserves rendered content, not that metadata. Therefore image generation can succeed while the nested tool view cannot decode a result.
+
+The plugin now renders a bounded, versioned text envelope containing original/preview references alongside its typed image attachments. The tool view validates the envelope and requires an exact match to those image attachments. It does not parse arbitrary prose, accept raw paths, or infer an original from a preview hash. Existing direct-tool metadata remains authoritative; malformed metadata is not silently bypassed.
+
+Old PTC sessions without the envelope recover their typed previews and preview downloads. Their original IDs were not preserved in nested result content, so this fallback deliberately does not advertise an original download. New results support both representations. Fork authorization also recognizes successful inherited PTC events, preserving the immutable inherited-prefix and stored-original checks. Both the legacy `tool/code-dispatch` and current `tool/ptc-dispatch` event names are supported.
+
+## Verification
+
+- Decoder tests: legacy previews, full envelopes, missing/mismatched attachments, duplicate/oversized/malformed envelopes, invalid references.
+- Component tests: nested PTC cards recover galleries and download controls with and without original references.
+- Route tests: inherited PTC originals work; failed/wrong-tool/non-inherited events remain denied.
+- Existing direct calls, original integrity and nested/restored session tests remain applicable.
+
+This change does not change image-provider selection, copy files into a workspace, expose the plugin storage directory, or add a filesystem sidebar integration. A successful generator result proves storage, not that the browser rendered it; operational acceptance must inspect the actual card.

package/docs/experiments/native-compaction-lifecycle.md

@@ -0,0 +1,85 @@
+# Native compaction: durable lifecycle gate
+
+Tracking: [PR #197](https://github.com/franksong2702/dsh-codex-connect/pull/197), [mechanism #196](https://github.com/franksong2702/dsh-codex-connect/issues/196), [context experiment #65](https://github.com/franksong2702/dsh-codex-connect/issues/65), [roadmap #195](https://github.com/franksong2702/dsh-codex-connect/issues/195).
+
+Status: **unreleased prototype**, creation disabled by default. The published npm `0.1.0-alpha.4.35` does not contain this experiment even though the development branch has not bumped the package version.
+
+## What this gate actually exercises
+
+The fixture uses real, unmodified DSH AgentRegistry, AgentLoop, BasicCompactionEngine, SessionStore, token meter and JSONL persistence. Only provider responses and credentials are synthetic. It does not manually manufacture a checkpoint or substitute a mock session store for the lifecycle proof.
+
+For each physical JSONL encoding (`none` and `zstd`, using each host's normal writer format), independent Node processes run these phases:
+
+1. **Write:** run two real agent turns, invoke `ctx.compaction.compactNow`, require a useful replacement, check correlated compaction events and source references, and read the actual persisted artifact. Store a digest of the identified checkpoint and its visible surface for the next process.
+2. **Resume and fork:** start with no live sessions and native checkpoint creation disabled. Resume the parent through `ctx.agents.resume`, check the restored checkpoint and surface, and complete a tool-call/result round trip. Verify the next provider payload includes the unchanged opaque item and encrypted reasoning replay, not a textual marker. Create a factory-owned fork through `ctx.agents.create` using a verified completed parent prefix, explicit inherited-event count and parent lineage. Persist the child and verify later parent work leaves the child's stored bytes unchanged.
+3. **Resume child:** open the child in another fresh process, check exact inherited-prefix ownership, then run a new tool call with a different correlation id. The child's request uses its own session/cache identity; the parent's stored artifact remains unchanged.
+4. **Failure paths:** run the real transaction with HTTP rejection, a truncated response, empty encrypted content, incomplete terminal status, an oversized checkpoint, an oversized stream, and explicit caller cancellation. Failed native attempts may commit only the ordinary summary. Cancellation preserves the original surface and emits no fallback request. Every scenario is disposed, resumed and continued.
+
+5. **Automatic triggers:** run nine isolated scenarios through actual AgentLoop `agent/pre-step` and `agent/request-error` hooks: pressure, below threshold, auto disabled, overflow recovery, unrelated errors, bounded repeated overflow, failed recovery without progress, repeated pressure compaction, and an unshrinkable newest-message tail. The fixture verifies a new completed or failed turn, correlated compaction events, checkpoint replacement/replay, and preservation of the original surface when no replacement commits.
+
+The installed checker launches ten separate processes per exact host (five phases per encoding). The four-host installation matrix therefore exercises 40 processes, including eight automatic-phase processes that each run all nine scenarios, in addition to its ordinary install, model, settings and Reserve checks. It imports the plugin from the installed profile and DSH modules from the exact isolated host, rather than substituting the source tree's DSH dependencies.
+
+Source tests reuse the same assertions with recreated Cordis contexts. They are useful regressions, but **context recreation is not the process-restart proof**; the installed checker supplies that proof separately.
+
+The supported host generations do not share one storage-service API: `0.1.2-rc.1` exposes `readRaw`, while `0.1.5-alpha.1` uses read/write handles instead. Physical verification deliberately reads the disposable fixture's JSONL files directly, matches the header's exact session identity, and compares stored-byte digests. Actual write, restore and fork operations still go through the respective host's real APIs. This is not a private adapter or storage shim added to the shipped plugin. In handle-based hosts a bare `ctx.sessions.fork` does not acquire a persistence writer; the fixture therefore creates the seeded child through the Agent factory, which owns persistence admission and teardown.
+
+## Failure-driven corrections
+
+The initial prototype validated the number and position of compaction items but not whether `encrypted_content` was usable. The empty-content lifecycle fixture exposed that a useless native checkpoint could be committed. Encoding and decoding now require nonempty encrypted content and a valid optional identity, and restrict retained items to the deliberately supported user-message projection.
+
+Checkpoint encoding can fail even after a provider stream completes (for example, the local checkpoint size limit). Encoding must remain inside the pre-emission fallback boundary; otherwise an exception in a detached success callback can leave a consumer waiting without a terminal event. The bridge now contains those failures and also terminates synchronous fallback setup/iterator errors. Error response bodies and parser readers are released, and native stream bytes and terminal status are checked before accepting output.
+
+Two additional boundary regressions cover the full retained JSON array (brackets, commas and multibyte UTF-8) and composition with pi-ai payload observers. The 64,000-byte ceiling includes all array syntax. If an external `onPayload` observer returns `undefined`, the wrapper preserves its transformed payload instead of causing pi-ai to reuse the original, unexpanded input. Sync, async, mutating-observer and explicit-replacement callbacks are exercised through the installed provider implementation.
+
+## Automatic-trigger scope and retention boundary
+
+Pressure scenarios use an isolated 8,192-token model-capacity override and DSH's actual token meter; overflow scenarios remain below their configured pressure threshold and rely on the adapter classifying a synthetic context-window error. No DSH method is overridden to fabricate triggering. Provider errors, usage and encrypted items remain synthetic. This demonstrates host control flow, not a real model hitting its context limit.
+
+DSH's existing range selector retains the newest message even with `retainTokens: 0`. When that newest reply dominates the context, the selected older prefix may be too small to replace usefully. The `unshrinkable-tail` scenario checks that DSH rejects the non-shrinking summary, preserves history and completes the ordinary continuation. The bridge does not alter this host policy or promise that every high-pressure context can be reduced. Repeated compaction is covered synthetically, not by a live long-task benchmark.
+
+## Reproduction
+
+```sh
+pnpm exec vitest run tests/native-compaction.spec.ts tests/native-compaction-lifecycle.spec.ts tests/native-compaction-automatic.spec.ts tests/native-compaction-probes.spec.ts
+pnpm run check
+pnpm run test:browser
+pnpm run check:dsh-matrix
+```
+
+For an already isolated installation:
+
+```sh
+node scripts/check-installed-native-compaction.mjs /absolute/profile/package.json /absolute/host/package.json
+```
+
+The checker never calls the real model backend. Credentials are fixture-only, session directories are disposable, and the fetch stub rejects unrelated endpoints. Nothing here requires changing an active DSH service.
+
+## Separate bounded live provider acceptance — 2026-09-12
+
+Using the user's explicitly authorized existing M15 Codex login, the bridge/codec probe completed exactly three real requests: ordinary `gpt-5.6-luna`, native `compaction_trigger`, and continuation with the returned opaque item. Every returned server model was also `gpt-5.6-luna`; all responses were HTTP 200 with completed terminal status. The native response contained exactly one valid compaction item. The continuation correctly recalled a label generated in the baseline assistant reply, absent from retained user text and from the replay's non-compaction input. Native creation was disabled for replay.
+
+There were zero retries, fallback attempts or fallback dispatches; no Reserve/Sol/Astra calls. The read-only credential file remained byte-identical, and no real opaque state was written to disk. Sanitized [request metrics and outcome](native-compaction-luna-smoke-m15-2026-09-12.json) record the exact source digest, three dispatches and 552 backend-reported total tokens. All reported cached-token counts were zero.
+
+This is **one short same-account/same-model provider acceptance test**, separate from the synthetic durable lifecycle above. It does not combine a real backend with AgentLoop/JSONL/restart/fork, establish encrypted-token pricing, or demonstrate savings, cache benefit or long-task quality. Those three dispatches are historical evidence, not a reusable execution budget.
+
+## Separate real-provider persistence probe — not yet accepted
+
+`scripts/native-compaction-durable-smoke.mjs` has an offline rehearsal that uses the real adapter, AgentLoop, manual compaction transaction, JSONL persistence and two separate Node processes. It removes the original test label from visible replay input, restores an identical checkpoint with creation disabled, and tests native-rejection termination without a fallback dispatch. Its explicit live mode is Luna-only and bounded to three dispatches; the ordinary test suite exercises synthetic mode and argument rejection only.
+
+The user authorized expanded acceptance, but the subsequent live invocation was reported blocked and no verifiable live result for this durable probe has been recovered. The exact blocker remains undetermined. Delivery continues without retrying that operation or changing execution channels. Do not count offline success or the earlier bridge-only live smoke as real-provider JSONL/restart acceptance. Ports 3080/3081 and production-like DSH remain outside scope.
+
+## Interpretation and remaining work
+
+- The verified fork path is the public **Agent factory** seeded-creation boundary (`ctx.agents.create`), not the Web UI's completed-turn selector/controller. The fixture verifies a completed source prefix rather than reimplementing the UI's anchor-selection policy. Web end-to-end fork behavior is a separate acceptance item.
+- Manual `compactNow`, automatic pressure/overflow triggering (`compactIfNeeded`) and repeated pressure compaction now have synthetic control-flow coverage. Real-provider automatic triggering and repeated compaction, sudden process termination during writes, deliberate disk failures, images and cross-provider/account changes remain separate cases.
+- Model and effort are checked on resumed requests, and tool schemas on the native request. This does not establish compatibility with the adaptive `configuration_update` policy in PR #167.
+- Reported checkpoint/shadowed token counts are DSH heuristics over synthetic text. Provider usage is fabricated by the offline fixture. Neither proves real token savings, correct pricing of encrypted compaction content, cache benefits or long-task quality.
+- The conservative retained projection is capped at **64,000 serialized UTF-8 bytes**, not 64 KiB and not a claim of exact Codex token-policy equivalence.
+- A synthetic encrypted string proves transport/storage preservation, not real provider interpretation. The separate bounded Luna test above now supplies minimal live acceptance evidence; full live lifecycle and long-task comparison remain under #65.
+- Passing this gate permits a focused review of the mechanism; it does not authorize merging, releasing, promoting `latest`, or enabling the feature for users.
+
+## 中文说明
+
+这一关验证的是“存档后能继续”，而不是“压缩请求返回成功”：使用 DSH 的真实压缩事务和文件存储，随后在独立进程里恢复父会话、创建分支、恢复子会话，并继续调用工具。测试还检查取消和异常不会把无效原生 checkpoint 写入历史。
+
+持久化 lifecycle 与自动触发测试的模型响应、账户仍均为合成数据。自动压力、溢出恢复、重复压缩和无收益时保留历史已纳入离线验收；安装矩阵要求每宿主 10 个独立进程。另一次经用户授权的 M15 普通 Luna 三请求测试，已验证真实服务端接受原生压缩并能在后续请求中使用 opaque state。真实 provider 与 JSONL／进程重启结合的验收仍未完成，不能用上述两组独立证据代替；网页分支、故障注入与长任务效果也尚未验收。现有发布版与正在运行的环境不受影响。

package/docs/experiments/native-compaction-luna-smoke-m15-2026-09-12.json

@@ -0,0 +1,89 @@
+{
+  "schema_version": 1,
+  "status": "invocation_completed",
+  "started_at": "2026-09-12T00:24:27.850Z",
+  "finished_at": "2026-09-12T00:24:35.570Z",
+  "runner": "M15",
+  "command_exit_code": 0,
+  "command_signal": null,
+  "credential_file_unchanged": true,
+  "stderr_bytes": 0,
+  "result": {
+    "schema_version": 1,
+    "mode": "live",
+    "request_model": "gpt-5.6-luna",
+    "node": "v22.22.3",
+    "source_sha256": "f4909020c17a1ecb3003d349bc9009a555903146c7a1b6d51d53e12943edc392",
+    "transport": "sse",
+    "max_retries": 0,
+    "maximum_dispatches": 3,
+    "credential_refresh": false,
+    "credential_source": "codex-login",
+    "full_dsh_lifecycle": false,
+    "bridge_and_codec": true,
+    "persistent_session_write": false,
+    "scenario": "live",
+    "metrics": [
+      {
+        "stage": "baseline",
+        "dispatch": 1,
+        "request_model": "gpt-5.6-luna",
+        "server_model": "gpt-5.6-luna",
+        "http_status": 200,
+        "reasoning_effort": "low",
+        "terminal_status": "completed",
+        "input_tokens": 57,
+        "output_tokens": 87,
+        "total_tokens": 144,
+        "cached_tokens": 0,
+        "reasoning_tokens": 70,
+        "compaction_items": 0,
+        "latency_ms": 3655,
+        "error_code": null
+      },
+      {
+        "stage": "native",
+        "dispatch": 2,
+        "request_model": "gpt-5.6-luna",
+        "server_model": "gpt-5.6-luna",
+        "http_status": 200,
+        "reasoning_effort": "low",
+        "terminal_status": "completed",
+        "input_tokens": 164,
+        "output_tokens": 72,
+        "total_tokens": 236,
+        "cached_tokens": 0,
+        "reasoning_tokens": 0,
+        "compaction_items": 1,
+        "latency_ms": 2489,
+        "error_code": null
+      },
+      {
+        "stage": "replay",
+        "dispatch": 3,
+        "request_model": "gpt-5.6-luna",
+        "server_model": "gpt-5.6-luna",
+        "http_status": 200,
+        "reasoning_effort": "low",
+        "terminal_status": "completed",
+        "input_tokens": 157,
+        "output_tokens": 15,
+        "total_tokens": 172,
+        "cached_tokens": 0,
+        "reasoning_tokens": 0,
+        "compaction_items": 0,
+        "latency_ms": 1324,
+        "error_code": null
+      }
+    ],
+    "native_checkpoint_accepted": true,
+    "replay_accepted": true,
+    "label_recalled": true,
+    "stop_reason": "COMPLETED",
+    "dispatch_count": 3,
+    "real_provider_dispatches": 3,
+    "blocked_dispatch_attempts": 0,
+    "fallback_attempted": false,
+    "fallback_dispatched": false
+  }
+}

package/docs/reference.i18n.yaml

@@ -1,4 +1,4 @@
 # Bilingual-pair consistency record for the operational reference. Re-record with:
 #   git hash-object docs/reference.md docs/reference.zh.md
-docs/reference.md: 114ff306f7edffbec3f7faf97da0a4dbb9793c7e
-docs/reference.zh.md: 875352186b206b4f0fe29e5671972e781986a713
+docs/reference.md: b4a7480a0bd95cc5cfee5f713a10a7820ee61342
+docs/reference.zh.md: cffb2fd685a2f0189d75c4ae3cbf6716697e063c

package/docs/reference.md

@@ -10,7 +10,7 @@ OAuth credentials are stored on the DSH host and used there to authenticate and
 
 Choose an `openai-codex` model in the normal Harness model picker. Model names remain canonical in every UI language. **More settings → Models** controls which models appear in discovery; hiding a model does not disable routing by its exact id.
 
-The Codex catalog comes from the installed `@earendil-works/pi-ai` package, not a live query of the account's available models. DSH `0.1.2-rc.1` uses pi-ai `^0.84.2`, which lacks `gpt-6-astra`; Codex Connect supplies that definition. Alpha 4.33 is also verified with DSH `0.1.5-alpha.1` and pi-ai `0.85.1`. Mixed host package versions and other DSH/pi-ai combinations remain unverified. With a native Astra entry, the plugin preserves its metadata and retains Low, Medium, High, Xhigh, and Max reasoning choices without modifying the installed catalog. Users do not need to upgrade pi-ai separately to select Astra. The exact verified pairs and acceptance limits are recorded in the release notes; dependency declarations alone do not establish verification. Neither catalog source proves account access.
+The Codex catalog comes from the installed `@earendil-works/pi-ai` package, not a live query of the account's available models. DSH `0.1.2-rc.1` uses pi-ai `^0.84.2`, which lacks `gpt-6-astra`; Codex Connect supplies that definition. Published Alpha 4.35 is also verified with each exact DSH `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` pairing using pi-ai `0.85.1`. Mixed host package versions and other DSH/pi-ai combinations remain unverified. With a native Astra entry, the plugin preserves its metadata and retains Low, Medium, High, Xhigh, and Max reasoning choices without modifying the installed catalog. Users do not need to upgrade pi-ai separately to select Astra. The exact verified pairs and acceptance limits are recorded in the release notes; dependency declarations alone do not establish verification. Neither catalog source proves account access.
 
 - Adding an account leaves the current account usable while authorization is pending.
 - Cancelling or timing out a new authorization preserves every existing account and closes accepted callback connections, including incomplete HTTP requests. After cancellation, the browser reads account labels and quota together before updating the view. Pending authorization expires after 10 minutes by default; `oauthTimeoutMs` accepts 1,000–1,800,000 milliseconds and is applied when the plugin loads.
@@ -59,7 +59,7 @@ Direct connection is the default. An enabled credential-free HTTP(S) proxy appli
 
 ### Luna Reserve fallback
 
-This is an unreleased, default-off experiment; published Alpha 4.34 does not include it. Real-account Reserve entry and recovery remain unverified.
+Published Alpha 4.35 includes this default-off experiment; Alpha 4.34 does not include it. Real-account Reserve entry and recovery remain unverified. See the [publication and installation evidence](../.github/ALPHA_435_RELEASE_READINESS.md).
 
 `enableReserveFallback: true` opts agent requests into backend-authorized Luna Reserve fallback. The account UI and routing share an in-memory account/user-bound quota snapshot; concurrent reads coalesce and fresh reads do not issue another quota `GET`. A cold or stale read waits for refresh. After a successful fetch, background refresh runs at 60/30/15/5 seconds for usage below 75%, at least 75%, at least 90%, and at least 99%, using the highest consumption across ordinary and relevant model windows. Future reset times shorten the next refresh to reset plus one second; they never establish recovery. Cache reads do not postpone that deadline. Failed fetches discard cached decisions and retry after five seconds. Account mutations, settings changes, and plugin disposal invalidate the state; UI receives only the public quota projection.
 

package/docs/reference.zh.md

@@ -10,7 +10,7 @@ OAuth 凭据保存在运行 DSH 的主机上，由该主机用于向 OpenAI 认
 
 在 Harness 的常规模型选择器中选择一个 `openai-codex` 模型。所有界面语言均保留模型的规范名称。**更多设置 → 模型** 控制发现列表中显示哪些模型；隐藏模型不会禁用按精确 ID 路由。
 
-Codex 目录来自已安装的 `@earendil-works/pi-ai` 包，不是实时查询账户可用模型的结果。DSH `0.1.2-rc.1` 使用 pi-ai `^0.84.2`，其中尚无 `gpt-6-astra`，因此由 Codex Connect 补充定义。Alpha 4.33 也已验证 DSH `0.1.5-alpha.1` 与 pi-ai `0.85.1` 的组合；混装的宿主包以及其他 DSH/pi-ai 组合仍属未验证。遇到原生 Astra 条目时，插件保留其元数据，并维持 Low、Medium、High、Xhigh 和 Max 推理选择，不修改已安装的目录。用户无需单独升级 pi-ai 即可选择 Astra。发布说明记录了准确的已验证组合和验收限制；依赖声明本身不代表已验证。两种来源的目录条目都不能证明账户具有调用权限。
+Codex 目录来自已安装的 `@earendil-works/pi-ai` 包，不是实时查询账户可用模型的结果。DSH `0.1.2-rc.1` 使用 pi-ai `^0.84.2`，其中尚无 `gpt-6-astra`，因此由 Codex Connect 补充定义。已发布的 Alpha 4.35 也已分别验证精确版本 DSH `0.1.5-alpha.1`、`0.1.5-rc.1`、`0.1.5-rc.2` 与 pi-ai `0.85.1` 的组合；混装的宿主包以及其他 DSH/pi-ai 组合仍属未验证。遇到原生 Astra 条目时，插件保留其元数据，并维持 Low、Medium、High、Xhigh 和 Max 推理选择，不修改已安装的目录。用户无需单独升级 pi-ai 即可选择 Astra。发布说明记录了准确的已验证组合和验收限制；依赖声明本身不代表已验证。两种来源的目录条目都不能证明账户具有调用权限。
 
 - 添加账户期间，当前账户仍可继续使用。
 - 取消新的授权或等待超时，不会删除任何已有账户，并会关闭已接受的回调连接，包括未完成的 HTTP 请求。取消后，浏览器会一起读取账户标签与额度，再更新显示。待处理授权默认 10 分钟后过期；`oauthTimeoutMs` 接受 1,000–1,800,000 毫秒，并在插件加载时应用。
@@ -59,11 +59,11 @@ GPT Codex 对话的 Composer 会显示 Fast Mode 与额度：
 
 ### Luna Reserve 回退
 
-这是尚未发布、默认关闭的实验功能；已发布的 Alpha 4.34 不包含该功能。真实账户进入 Reserve 及恢复普通模型的过程仍未完成验证。
+已发布的 Alpha 4.35 包含这项默认关闭的实验功能；Alpha 4.34 不包含该功能。真实账户进入 Reserve 及恢复普通模型的过程仍未完成验证。详见[发布与安装验证记录](../.github/ALPHA_435_RELEASE_READINESS.md)。
 
 `enableReserveFallback: true` 为 agent 请求启用由后端授权的 Luna Reserve 回退。账户 UI 和路由共用绑定账户与用户的内存额度快照；并发读取合并，有效状态不再发起额度 `GET`。首次或过期读取等待刷新。查询成功后，根据普通额度和相关模型窗口中的最高消耗，低于 75%、达到 75%、达到 90%、达到 99% 时，分别每 60/30/15/5 秒后台刷新。未来重置时间可将下次刷新提前到重置后一秒，但不证明额度恢复。缓存读取不会推迟刷新期限。查询失败会清除缓存决策，五秒后重试。账户修改、设置变更和插件卸载会使状态失效；UI 只接收公开额度投影。
 
-有效的共享决策为该会话和账户的下一次 `gpt-reserve` 调用签发私有一次性许可。这是本地调用保护，不代表服务端要求每次调用单独认证额度。取消、替换请求、agent 出错、回合停止、额度状态失效、快照刷新或缓存淘汰都会撤销未使用的许可。恢复普通模型前，返回记录的读取也会重新检查该授权是否有效。直接和辅助 Reserve 调用会在发送前失败。关闭回退时，普通 agent 步骤不查询额度，账户 UI 保持被动读取，也不创建后台额度轮询；已处于 Reserve 的会话需要显式选择普通模型.
+有效的共享决策为该会话和账户的下一次 `gpt-reserve` 调用签发私有一次性许可。这是本地调用保护，不代表服务端要求每次调用单独认证额度。取消、替换请求、agent 出错、回合停止、额度状态失效、快照刷新或缓存淘汰都会撤销未使用的许可。恢复普通模型前，返回记录的读取也会重新检查该授权是否有效。直接和辅助 Reserve 调用会在发送前失败。关闭回退时，普通 agent 步骤不查询额度，账户 UI 保持被动读取，也不创建后台额度轮询；已处于 Reserve 的会话需要显式选择普通模型。
 
 Access token 的 `https://api.openai.com/auth` 中必须包含非空的 `chatgpt_account_id` 和 `chatgpt_user_id`（或 `user_id`），且 `chatgpt_account_is_fedramp` 必须缺省或为 `false`。身份缺失、不完整、属于 FedRAMP、发生变化或与额度响应不匹配时，该步骤不会启用回退。插件不会从邮箱地址或订阅套餐推测身份。
 

package/lib/bin.d.ts

@@ -1,6 +1,5 @@
 //#region src/bin.d.ts
 /** Standalone credential CLI for the optional OpenAI Codex bundle. */
 /** Execute one boot-free credential command. */
-declare function run(argv: readonly string[]): Promise<number>;
-//#endregion
-export { run };
+export declare function run(argv: readonly string[]): Promise<number>;
+//#endregion

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { A as DSH_PLUGIN_API_PACKAGES, B as isSupportedDshPluginApiVersion, Ft as loginOpenAICodex, Gt as openAICodexAuthPath, It as logoutOpenAICodex, Lt as openAICodexAuthStatus, Pt as openAICodexModelCatalog, Rt as publicAuthError, Ut as OPENAI_CODEX_PROVIDER, V as readInstalledPackageVersion, Wt as OpenAICodexCredentialStore, c as migrateOpenAICodexSearchHistory, d as OPENAI_CODEX_BASE_URL, jt as normalizeOpenAICodexProxyUrl, l as CODEX_AUTO_REVIEW_MODEL, nt as OpenAICodexTrustedOriginsStore, rt as normalizeTrustedOrigin, u as probeCodexAutoReview, x as CODEX_CONNECT_VERSION, y as diagnoseOpenAICodex, z as evaluateCompatibility } from "./src-BTr7qkL_.js";
+import { A as DSH_PLUGIN_API_PACKAGES, B as isSupportedDshPluginApiVersion, Ft as loginOpenAICodex, Gt as openAICodexAuthPath, It as logoutOpenAICodex, Lt as openAICodexAuthStatus, Pt as openAICodexModelCatalog, Rt as publicAuthError, Ut as OPENAI_CODEX_PROVIDER, V as readInstalledPackageVersion, Wt as OpenAICodexCredentialStore, c as migrateOpenAICodexSearchHistory, d as OPENAI_CODEX_BASE_URL, jt as normalizeOpenAICodexProxyUrl, l as CODEX_AUTO_REVIEW_MODEL, nt as OpenAICodexTrustedOriginsStore, rt as normalizeTrustedOrigin, u as probeCodexAutoReview, x as CODEX_CONNECT_VERSION, y as diagnoseOpenAICodex, z as evaluateCompatibility } from "./src-HfJnOVCK.js";
 import { i as fetch, r as ProxyAgent, t as Agent } from "./undici-runtime-H2uktiw6.js";
 import { createHash } from "node:crypto";
 import { realpathSync } from "node:fs";