dsh-codex-connect 0.1.0-alpha.4.35 → 0.1.0-alpha.4.37

package/INSTALL.md

@@ -1,9 +1,11 @@
 # Installation Runbook for CLI Agents
 
-Published Alpha 4.34 is verified with DSH `0.1.2-rc.1` and pi-ai `0.84.4` within `^0.84.2`, and with each exact DSH `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` model-runtime pairing using pi-ai `0.85.1`.
+Published Alpha 4.35 is verified with DSH `0.1.2-rc.1` and pi-ai `0.84.4` within `^0.84.2`, and with each exact DSH `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` model-runtime pairing using pi-ai `0.85.1`.
 
 Install `dsh-codex-connect` into one requested DeepSeek Harness profile without changing its current default model, search route, global configuration, or OAuth state.
 
+Channel snapshot on 2026-09-11: npm `alpha` points to `0.1.0-alpha.4.35`; `latest` intentionally remains on `0.1.0-alpha.4.34`. Use the exact-version commands below for 4.35. Publishing an Alpha and promoting the default installation channel are separate actions.
+
 ## Safety requirements
 
 - Never read, print, copy, move, or modify `~/.codex/auth.json`.
@@ -23,19 +25,19 @@ Check `dsh --version` before changing the requested profile. Use `dsh --help` to
 | `0.1.0-rc.7` | `0.1.0-alpha.4.14` |
 | `0.1.1-rc.2` | `0.1.0-alpha.4.21` |
 | `0.1.2-alpha.2` | `0.1.0-alpha.4.23` |
-| `0.1.2-rc.1` | `0.1.0-alpha.4.34` |
+| `0.1.2-rc.1` | `0.1.0-alpha.4.35` |
 | `0.1.2-alpha.5` | `0.1.0-alpha.4.25` |
-| `0.1.5-alpha.1` | `0.1.0-alpha.4.34` |
-| `0.1.5-rc.1` | `0.1.0-alpha.4.34` |
-| `0.1.5-rc.2` | `0.1.0-alpha.4.34` |
+| `0.1.5-alpha.1` | `0.1.0-alpha.4.35` |
+| `0.1.5-rc.1` | `0.1.0-alpha.4.35` |
+| `0.1.5-rc.2` | `0.1.0-alpha.4.35` |
 
 If your exact DSH version is unknown or not listed, preserve the installed host, report that the combination is unverified, and verify it before making installation changes. A missing record does not prove incompatibility, and the catalog's latest verified DSH version is not the latest upstream release. Do not recommend upgrading or downgrading DSH merely to match a row. Investigate any specific failure and seek verification of the installed combination. Do not blindly install `dsh-codex-connect@alpha`: `alpha` is a moving tag, not a compatibility guarantee. Do not infer support for newer DSH versions from these rows.
 
-Alpha 4.34 requires one consistent DSH plugin API version: `0.1.2-rc.1` with `@earendil-works/pi-ai` `^0.84.2`, or one of `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` with pi-ai `0.85.1`; Node.js remains `^22.19.0 || >=24.0.0`. Mixed host versions and other DSH/pi-ai combinations remain unverified. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 remains the verified choice for DSH `0.1.2-alpha.2`, Alpha 4.21 remains the verified choice for DSH `0.1.1-rc.2`, and staying on DSH `0.1.0-rc.7` means selecting Alpha 4.14. Changing DSH is a separate operation requiring the user's explicit request; a plugin update request does not authorize it. The repository's `pnpm --silent run check:compatibility` remains a strict development/release dependency gate, not a recommendation to change a user's host.
+Alpha 4.35 requires one consistent DSH plugin API version: `0.1.2-rc.1` with `@earendil-works/pi-ai` `^0.84.2`, or one of `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` with pi-ai `0.85.1`; Node.js remains `^22.19.0 || >=24.0.0`. Mixed host versions and other DSH/pi-ai combinations remain unverified. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 remains the verified choice for DSH `0.1.2-alpha.2`, Alpha 4.21 remains the verified choice for DSH `0.1.1-rc.2`, and staying on DSH `0.1.0-rc.7` means selecting Alpha 4.14. Changing DSH is a separate operation requiring the user's explicit request; a plugin update request does not authorize it. The repository's `pnpm --silent run check:compatibility` remains a strict development/release dependency gate, not a recommendation to change a user's host.
 
-The Alpha 4.34 rows reflect same-artifact isolated installation and model-runtime checks on both configured Node versions, browser regression, Windows canary contracts, and independent verification of the published npm artifact. All eight advertised models resolved and prepared, defaults were unchanged, and provider disposal succeeded. These are not fresh real OAuth, live model/tool/image, or full Windows application acceptance. See [.github/ALPHA_434_RELEASE_READINESS.md](https://github.com/franksong2702/dsh-codex-connect/blob/main/.github/ALPHA_434_RELEASE_READINESS.md) for release recovery, upgrade evidence, and verification limits. Historical rows remain the repository's existing verification record. This guidance does not change upstream DSH behavior or resolve [Issue #64](https://github.com/franksong2702/dsh-codex-connect/issues/64).
+The Alpha 4.35 rows reflect successful release-commit CI on Node 22.19.0 and 24.20.0 (840 tests each), 28 Chromium tests, Windows canary contracts, and the four-host installation/Reserve matrix. Independent post-publication checks installed the exact npm version on all four hosts, matched all 63 installed plugin files to the verified published archive, and exercised a 4.34-to-4.35 upgrade on rc.2. All eight advertised models resolved and prepared, defaults were unchanged, all optional capabilities remained disabled, and provider disposal and synthetic Reserve transitions passed. These checks are not fresh real OAuth, live Reserve/model/tool/image, or full Windows application acceptance. See [.github/ALPHA_435_RELEASE_READINESS.md](.github/ALPHA_435_RELEASE_READINESS.md) for publication, installation evidence, and limitations. Historical rows remain the repository's existing verification record. This guidance does not change upstream DSH behavior or resolve [Issue #64](https://github.com/franksong2702/dsh-codex-connect/issues/64).
 
-Alpha 4.33 omits the `modelErrors` profile field required by RC model packages, producing `Cannot read properties of undefined (reading 'get')`. Alpha 4.34 contains the fix. Reauthorization or repeated model-list retries do not add a missing profile field. Pin the corrected plugin version for a verified host combination; do not delete credentials or change DSH merely to work around this failure. DSH `0.1.5-alpha.2` remains unverified.
+Alpha 4.33 omits the `modelErrors` profile field required by RC model packages, producing `Cannot read properties of undefined (reading 'get')`. Alpha 4.34 contains the fix, retained in 4.35. Reauthorization or repeated model-list retries do not add a missing profile field. Pin the corrected plugin version for a verified host combination; do not delete credentials or change DSH merely to work around this failure. DSH `0.1.5-alpha.2` remains unverified.
 
 ### Install the selected version and validate
 
@@ -58,10 +60,10 @@ Alpha 4.33 omits the `modelErrors` profile field required by RC model packages,
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.23
    ```
 
-   For DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2`, use Alpha 4.34:
+   For DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2`, use Alpha 4.35:
 
    ```sh
-   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.34
+   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.35
    ```
 
    For DSH `0.1.2-alpha.5`, use Alpha 4.25:
@@ -70,7 +72,7 @@ Alpha 4.33 omits the `modelErrors` profile field required by RC model packages,
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.25
    ```
 
-   If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.34'` only for the DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2` combinations.
+   If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.35'` only for the DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2` combinations.
 
 3. Run `dsh web --help` once to compose the installed profile without starting the server. DSH `0.1.2-rc.1` prepares profile plugin dependency fallback during this step.
 4. Run `dsh --profile web --dump-config` and require exactly one `llm-openai-codex` row loading `dsh-codex-connect`.
@@ -100,7 +102,7 @@ The value is a full `http://` or `https://` origin including its port, not a bar
 
 ## Optional configuration
 
-Use **Settings → Plugins → Plugin configuration → Codex Connect** for live, staged Save/Discard edits organized under Account & quota, Models, Network, and Capabilities. Switching modules preserves the draft. The same settings control `enableSearch`, `enableImageTool`, `enableImageGeneration`, and `enableAutoReview`; all four default to `false`. Enabling Auto-review permits bounded approval context, tool arguments, working directory, and the planned action to be sent to `chatgpt.com`; failures return to human approval. Enabling image generation uses the image generation capability included with the current GPT subscription and saves results as DSH attachments. Enabling search registers the provider and selects it while the capability remains enabled; disabling restores the previous provider before unregistering Codex Search. Setting `agent-default-model` to `openai-codex` remains a separate explicit change.
+Use **Settings → Plugins → Plugin configuration → Codex Connect** for live, staged Save/Discard edits organized under Account & quota, Models, Network, and Capabilities. Switching modules preserves the draft. The same settings control `enableSearch`, `enableReserveFallback`, `enableImageTool`, `enableImageGeneration`, and `enableAutoReview`; all five default to `false`. Luna Reserve is a published experiment in Alpha 4.35: enable it only when explicitly requested, never as an automatic installation step. Real-account Reserve entry and recovery remain unverified; authorization must come from the identity-matched backend response, not a generic `429` or quota percentage. Enabling Auto-review permits bounded approval context, tool arguments, working directory, and the planned action to be sent to `chatgpt.com`; failures return to human approval. Enabling image generation uses the image generation capability included with the current GPT subscription and saves results as DSH attachments. Enabling search registers the provider and selects it while the capability remains enabled; disabling restores the previous provider before unregistering Codex Search. Setting `agent-default-model` to `openai-codex` remains a separate explicit change.
 
 Apply only requested choices and preserve unrelated keys:
 
@@ -108,6 +110,7 @@ Apply only requested choices and preserve unrelated keys:
 - id: llm-openai-codex
   config:
     enableSearch: true
+    enableReserveFallback: false
     enableImageTool: false
     enableImageGeneration: false
     enableAutoReview: false

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   git hash-object README.md docs/README.zh.md
-README.md: 9016a882858e604aba551f61baadfe352e69e8e2
-docs/README.zh.md: 8d7d386608a125e6c381df3b7138fe787eba01f5
+README.md: 5c2bff3d29c1366e52035ac809f119a2fdca47fc
+docs/README.zh.md: f629b3789be4b361ffd4045dff7fa6acf92770ff

package/README.md

@@ -16,15 +16,17 @@ This guide describes the published pairings below. Check `dsh --version` first a
 
 | Requirement | Verified pairing |
 |---|---|
-| Codex Connect | `0.1.0-alpha.4.34` |
+| Codex Connect | `0.1.0-alpha.4.35` |
 | DeepSeek Harness | `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2` |
 | Node.js | `^22.19.0 \|\| >=24.0.0` |
 | Account | ChatGPT OAuth with access to the requested Codex model; availability is decided by OpenAI |
 
+As of 2026-09-11, npm `alpha` points to 4.35 while `latest` intentionally remains on 4.34. Use the exact version below for 4.35; this recommendation does not promote the default installation channel.
+
 ### 1. Install
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.34
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.35
 dsh web
 ```
 
@@ -74,7 +76,7 @@ All options below are off on a fresh installation. Edit them in **Settings → P
 | GPT Image generation | `enableImageGeneration` | Prompt-only generation; availability, dimensions, and quota remain account- and service-controlled. |
 | Auto-review | `enableAutoReview` | Sends bounded approval context, tool arguments, working directory, and the planned action to `chatgpt.com`, with confirmation on first enablement. Failures return to human approval. |
 
-**Unreleased experiment:** Luna Reserve fallback is not included in published Alpha 4.34. It remains disabled by default in this development build; real-account Reserve entry and recovery have not been verified.
+**Published experiment:** Alpha 4.35 includes Luna Reserve fallback, disabled by default. Real-account Reserve entry and recovery remain unverified; Alpha 4.34 does not include this feature.
 
 With `enableReserveFallback: true`, the account UI and agent routing share one identity-bound quota state. Background refresh follows the returned quota windows; fresh state is reused across agent steps. The plugin enters `gpt-reserve` only with complete, non-FedRAMP account/user identity and backend Luna Reserve authorization, then restores the session's previous model and reasoning effort after confirmed ordinary-usage recovery. Reserve has its own allowance, is hidden from the model picker, and is not unlimited. The backend decides eligibility; reset times alone do not authorize a switch. This version supports known `gpt-5.6-luna` metadata only. See [Luna Reserve fallback](docs/reference.md#luna-reserve-fallback) for refresh, identity, and verification limits.
 

package/cordis.patch.yml

@@ -7,6 +7,7 @@
         enableProxy: false
         enableSearch: false
         enableReserveFallback: false
+        enableNativeCompaction: false
         enableImageTool: false
         enableImageGeneration: false
         enableAutoReview: false

package/docs/README.zh.md

@@ -16,15 +16,17 @@ Codex Connect 为标准 Harness agent loop 添加 `openai-codex` 模型提供方
 
 | 要求 | 已验证组合 |
 |---|---|
-| Codex Connect | `0.1.0-alpha.4.34` |
+| Codex Connect | `0.1.0-alpha.4.35` |
 | DeepSeek Harness | `0.1.2-rc.1`、`0.1.5-alpha.1`、`0.1.5-rc.1` 或 `0.1.5-rc.2` |
 | Node.js | `^22.19.0 \|\| >=24.0.0` |
 | 账户 | 通过 ChatGPT OAuth 使用所请求的 Codex 模型；可用性由 OpenAI 决定 |
 
+截至 2026-09-11，npm `alpha` 指向 4.35，`latest` 则有意保留在 4.34。安装 4.35 请使用下方精确版本命令；文档推荐更新不代表默认安装渠道已提升。
+
 ### 1. 安装
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.34
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.35
 dsh web
 ```
 
@@ -74,9 +76,9 @@ dsh plugin --profile web exec dsh-codex-connect doctor --json
 | GPT Image 图片生成 | `enableImageGeneration` | 只接受提示词；可用性、尺寸和额度仍由账户及服务端控制。 |
 | 自动审查 | `enableAutoReview` | 将有界的审批上下文、工具参数、工作目录和待执行动作发送到 `chatgpt.com`，首次启用需要确认。失败时交还人工审批。 |
 
-**尚未发布的实验功能：** 已发布的 Alpha 4.34 不包含 Luna Reserve 回退。此开发版本仍默认关闭该功能，尚未完成真实账户进入 Reserve 及恢复普通模型的验证。
+**已发布的实验功能：** Alpha 4.35 包含 Luna Reserve 回退，仍默认关闭。真实账户进入 Reserve 及恢复普通模型的过程仍未验证；Alpha 4.34 不包含该功能。
 
-启用 `enableReserveFallback: true` 后，账户 UI 和 agent 路由共用一份绑定身份的额度状态，按服务端返回的额度窗口后台刷新；有效状态可跨 agent step 复用。只有身份完整、非 FedRAMP 且服务端授权时，插件才进入 `gpt-reserve`；普通额度确认恢复后，切回该会话先前的模型和推理强度。Reserve 有自己的额度，不出现在模型选择器中，也不是无限额度。资格由服务端决定，重置时间本身不授权切换。当前版本只支持已知的 `gpt-5.6-luna` 元数据。刷新、身份和验证限制见 [Luna Reserve fallback](reference.md#luna-reserve-fallback)。
+启用 `enableReserveFallback: true` 后，账户 UI 和 agent 路由共用一份绑定身份的额度状态，按服务端返回的额度窗口后台刷新；有效状态可跨 agent step 复用。只有身份完整、非 FedRAMP 且服务端授权时，插件才进入 `gpt-reserve`；普通额度确认恢复后，切回该会话先前的模型和推理强度。Reserve 有自己的额度，不出现在模型选择器中，也不是无限额度。资格由服务端决定，重置时间本身不授权切换。当前版本只支持已知的 `gpt-5.6-luna` 元数据。刷新、身份和验证限制见 [Luna Reserve 回退](reference.zh.md#luna-reserve-回退)。
 
 使用你当前 GPT 订阅计划提供的图片生成能力。生成原文件与附件预览分开保存；关闭能力或卸载插件不会删除这些文件。存储和访问规则见[配置与恢复](reference.zh.md#搜索与图片工具)。
 

package/docs/agent-notes/adaptive-runtime-status.md

@@ -0,0 +1,57 @@
+# Alpha 4.37 preparation checkpoint — 2026-09-19
+
+#216 was normally squash-merged at `525e01b6e1c2b7d23ba70e29510ef1fd31fb0168`; the merge tree equals the reviewed `1e05677` tree. Main CI `35436177342` passed. This branch prepares 0.1.0-alpha.4.37. The maintainer subsequently authorized publication through the normal candidate-review/main-CI/OIDC workflow on 2026-09-19; a prepared branch is not publication evidence. `latest`, running services and live model calls remain outside scope. See [release readiness](../../.github/ALPHA_437_RELEASE_READINESS.md) and [draft release notes](../release-notes/alpha-4.37.md).
+
+Remember's bounded real A/B restart controls are on main. The user preview on DSH 0.1.5-rc.1 also produced a real automatic native checkpoint and completed subsequent tool-assisted work. Its checkpoint survived a normal preview restart; the deployment check sent no post-restart model continuation. Broader #196/#65 acceptance remains open.
+
+The checkpoint-only retry repair at local source `2e5469e` was applied only to the preview host. It is NOT installed by this plugin candidate. Stock alpha.2 support remains undeclared (#211).
+
+Split #199 (`b0bbbbb`) and #200 (`8883bc5`) remain unmerged drafts; #200's seven checks passed, including supplemental CodeQL and separate Split host matrices. Think #167 remains unmerged. None is included in this release. #215 remains open for reporter recovery. The maintainer-supplied excerpt and an offline control identify a missing local archive in the web-profile dependency set, not a declared plugin dependency; this is not currently a confirmed 4.37 regression blocker. UND_ERR_DESTROYED causality and the reporter's environment remain unverified. See [the bounded triage](issue-215-install-triage-2026-09-19.md). #182 was closed as superseded/not planned, not verified support. #208 remains an enhancement; #194, #183 and #207 retain separate acceptance scopes.
+
+The dated checkpoints below are historical and retain their original scope.
+
+---
+
+# Remember delivery checkpoint — 2026-09-19
+
+Remote main was rechecked at `574d55f2f990053c64fabd3fb8867318875183a4`: #212 and #213 are merged. This Remember test/evidence delivery is based on that main and does not change product `src/`, built `lib/`, dependencies, supported-host metadata or experimental defaults. The September 18 checkpoint below is historical, including its then-open PR and unaccepted-live statements.
+
+At test source `ad7c93481096b4750ede77dc93a19b241b7f11e0`, the separately authorized [real A/B controls](../experiments/remember-controlled-live-m15-2026-09-18-9n7e.md) both passed on plain Luna / DSH `0.1.2-rc.1`. A verified retained-user persistence; B verified assistant-origin recall with no target in non-compaction replay input. Each used four requests and distinct writer/resume processes. The [acceptance entry](../experiments/remember-acceptance.md) is the current scope reference.
+
+The [earlier oversized-user failure](../experiments/native-compaction-durable-m15-2026-09-18-1317.md) remains failed and unexplained. Astra, actual UI/fork behavior, repeated/automatic live compaction, tools/images, fault recovery, accounting and long-task quality are not accepted by these controls. #196, #65 and #195 remain open; Think/Split are not incorporated. The [limited user experience plan](../experiments/remember-user-acceptance-plan.md) has no provisioned service or further model budget.
+
+Current delivery authorization covers review, local commit, branch push, one PR and status synchronization only. No merge, package release, deployment, daily upgrade, new credential access or additional real model call is authorized. Exact-head PR checks remain separate from the historical live evidence. The #211 host-side repair evidence was delivered through #212; this PR does not certify stock alpha.2 or close #211.
+
+---
+
+# Adaptive runtime checkpoint — 2026-09-18
+
+Repository: `franksong2702/dsh-codex-connect`. This is a dated checkpoint, not a live dashboard.
+Source baseline: `eae9430f16f1707d8cefb76dec6e8344871d7684` (main, #210).
+GitHub prerelease: `v0.1.0-alpha.4.36`, published 2026-09-17T14:15:19Z at that SHA.
+The Astra/Remember delivery branch `franksong2702/astra-remember-delivery` is independently based on that main commit and is not part of that release. No current npm readback or deployment is implied. The original combined work remains preserved at `3de1b69`; compatibility tooling is delivered separately in [PR #212](https://github.com/franksong2702/dsh-codex-connect/pull/212).
+
+## Current tracks
+
+| Track | Implemented / merged / release state | Remaining gate |
+| --- | --- | --- |
+| Remember #65 / #196 | #197 merged as `78c8f71`; included in the 4.36 release record; native creation remains default-off | Real provider plus JSONL/process restart in one run remains unaccepted. See [the bounded acceptance contract](../experiments/remember-acceptance.md). |
+| Think #167 | Open, head `7315795`; conflicts with main. September 17 history-format repairs are present. | Separate mechanism from proposal policy; refresh complete current-head validation. CodeQL success alone is not full CI. Compaction/multi-agent composition is not supported by this prototype. |
+| Split #199 | Draft design, head `8b52da6`; mergeable but behind main at review time | Review the narrow contract against the current baseline. |
+| Split #200 | Draft implementation, head `694b58e`; targets #199's design branch, not main | Current checks do not include CodeQL. Synthetic Gateway/Chat approval flows exist; human acceptance, persistence and real task-value comparisons remain open. |
+
+The umbrella is #195. These are separate experiments, not three composable switches. No Think/Split source was incorporated in this follow-up.
+
+## Compatibility
+
+Declared hosts remain exactly `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, `0.1.5-rc.2`.
+
+[#211](https://github.com/franksong2702/dsh-codex-connect/issues/211) stays open: alpha.2 changed ordinary startup from disk links to a process-local resolver without preparing peers for the separate `plugin exec` process. A local host-side repair passed a fresh isolated installation and was submitted in [upstream Discussion #5537](https://github.com/deepseek-ai/deepseek-harness/discussions/5537#discussioncomment-18498638). This is not an official alpha.2 fix. The diagnostic changes, upstream patch and pre-split evidence belong to PR #212, not this branch; neither PR depends on the other to run its tests.
+
+Original CI run `35322318396` retained only the JSON-framing symptom. Concrete missing-package evidence came from later local reproductions; it was not recovered from the original CI streams. #207 and #183 keep their separate full-acceptance scope. #182 is an older undeclared candidate, not an implicit supported-version range.
+
+## Authorized follow-up and boundaries
+
+This delivery covers the [Astra context audit](astra-context-audit.md), scoped denial guidance and bounded Remember acceptance preparation. Preparing and pushing the two delivery PRs is authorized; merge, release, deployment, enabled experimental defaults, live credentials and new model requests are outside this task. The previously blocked real durable probe is not retried or routed elsewhere.
+
+Capture fresh local validation separately from historical PR checks. A successful synthetic fixture does not establish user value, token savings or live provider acceptance. The [pre-split record](adaptive-runtime-validation-2026-09-18.md) preserves historical scope; use the delivery PR's exact head and Checks for its current remote CI.

package/docs/agent-notes/adaptive-runtime-validation-2026-09-18.md

@@ -0,0 +1,45 @@
+# September 18 pre-split delivery evidence
+
+## Historical record, not current-head CI
+
+This document preserves the earlier combined local investigation, before the compatibility and Astra/Remember deliveries were split into independent PRs. Statements below about unknown causes, blocked investigation and unpushed code describe that original checkpoint, not the latest project state. Later #211 cause, repair and upstream-submission evidence is tracked in [PR #212](https://github.com/franksong2702/dsh-codex-connect/pull/212). Use [the current checkpoint](adaptive-runtime-status.md) for scope and each PR's exact-head Checks for fresh CI. The real Remember restart probe remains unaccepted and is not retried by this delivery.
+
+## Identity
+
+Repository baseline: `eae9430f16f1707d8cefb76dec6e8344871d7684`.
+Local branch: `franksong2702/astra-goals-1-3-20260918`.
+WebCodex project: `agent:mac-webcodex-trial:dsh-codex-connect-f53ce775-42955146`.
+Workflow session: `wc_sess_cGTpW5Z54AMlbcBs`.
+Runtime: Node `v22.22.3`, pnpm `10.30.3`; frozen-lockfile installation reused the existing package cache.
+
+## Delivered scope
+
+1. Doctor JSON framing diagnostics now distinguish empty, multiline and invalid JSON with byte/line counts, without raw-output/parser excerpts. Strict parsing, candidate classification, support metadata and privacy checks are retained. This improves investigation evidence; #211's upstream root cause is not fixed or claimed verified.
+2. A short contributor router and explicit development/product context audit were added. The only shipped-source change scopes denial guidance to the denied action/dependents while retaining no-bypass, exact-action approval, higher-priority restrictions and the existing breaker.
+3. The bounded durable probe checks actual direct package versions in parent and children before credentials/dispatch, reports those versions, and rejects unverified combinations. Current-state and finite Remember acceptance documentation replace stale entry-point descriptions without deleting historical evidence.
+
+## Executed validation
+
+| Check | Actual result |
+| --- | --- |
+| New denial/durable evidence regression, before implementation | Two expected failures; nine existing tests passed. |
+| Doctor contract, before implementation | Three new content-free diagnostic assertions failed out of 67. |
+| Focused denial/durable/runtime validation after implementation | Three files, 19 tests passed. |
+| Doctor contract after implementation | 67/67 assertions passed, plus the existing 11 synthetic child-routing scenarios. These are checker fixtures, not upstream host installations. |
+| First full check | Failed at TypeScript because the new `.mjs` helper lacked a declaration. A `.d.mts` declaration was added; no test was disabled. |
+| Final runtime-source `pnpm run check` | Exit 0, **94 test files / 897 tests**; workflow contracts, metadata/source lint, host/client typecheck, build, import/CLI checks, declared development-host compatibility and package checks passed. Job `wc_job_RcZsJFijHuBe9Tjl`. |
+| Generated runtime inspection | All nine generated files matched the baseline exactly after substituting only the reviewed notice and shared-chunk filename references. No unrelated runtime/client changes. |
+
+The full check includes real DSH JSONL write and distinct-process restore with synthetic provider responses, native-rejection/fallback blocking, automatic and in-process fork/tool regressions. Only the dedicated subprocess fixture is a process-restart proof. The full check's package validation covered 70 files before this documentation-only evidence file was added; final package/link/whitespace checks are performed at closeout. No claim is made of a fresh four-host/Node matrix, Chromium run or remote CI for this local source.
+
+## GitHub synchronization actually completed
+
+Current dated checkpoints were prepended to #195, #167, #199, #200, #196 and #65; each API response was read back and matched the intended body. Original bodies were preserved, all issues/PRs stayed open, and draft states/base branches were not changed. #211 received [the diagnostic follow-up](https://github.com/franksong2702/dsh-codex-connect/issues/211#issuecomment-5727447681); it remains unresolved.
+
+A transient GitHub read failed with a connection reset; the subsequent read succeeded before updates. No uncertain mutation was blindly repeated.
+
+## Unfinished and excluded
+
+#211 still lacks actual alpha.2 doctor-output framing evidence. Inspection of the upstream DSH release package was blocked by the platform, stopped, and not retried through another execution route. The prior real Remember durable probe also remains blocked/unaccepted and was not retried. These are different blocked operations; neither establishes an account problem or a confirmed core runtime defect.
+
+New real provider dispatches: **0**. No real credentials were accessed or changed. No user service, default capability, supported-version declaration, main branch, release or installed plugin was changed. Code remains on the local branch, not pushed or deployed by this follow-up. Live restart acceptance and measurable Astra/long-task benefits remain unproven.

package/docs/agent-notes/astra-context-audit.md

@@ -0,0 +1,27 @@
+# Astra prompt and context audit — 2026-09-18
+
+Baseline: main `eae9430f16f1707d8cefb76dec6e8344871d7684`. Scope: repository development guidance and plugin-owned model-visible text; not a DSH core prompt rewrite, model benchmark or port of #167/#200.
+
+## Reference and decision
+
+The [OpenAI guidance published September 11](https://developers.openai.com/blog/rethinking-skills-and-prompts-for-gpt-6-astra) recommends precise skill triggers, progressive disclosure and revisiting excessive procedural instructions. Applied here, that means a short task-oriented router and explicit completion boundaries, not a new global Astra persona. Safety and lifecycle constraints remain in code and in the host's authority model.
+
+## Two different context layers
+
+| Surface actually inspected | Finding | Action |
+| --- | --- | --- |
+| Repository `AGENTS.md` / `SKILL.md` discovery | The baseline has neither tracked file. `.agents/notes` contains historical feature notes, not registered skills. | Add a short `AGENTS.md` router. Do not require reading the whole documentation tree or invent a skill installation. |
+| `src/adapter.ts` | The normal adapter preserves the host/pi-ai message pipeline; Astra specialization is catalog/effort metadata, not an injected global procedure. | Keep host-owned system instructions and message conversion. |
+| `src/native-compaction.ts` | Native compaction forwards `context.systemPrompt` and tool definitions; it removes the host's extra summarization instruction for the native operation. | Keep the lifecycle/protocol implementation unchanged. No duplicate repository documentation is injected. |
+| `src/image-tool.ts` | The optional tool already describes one prompt, exact original preservation, conversation preview and service-default size/style. | Keep the concise description and programmatic argument/size guards. |
+| `src/search.ts` | Standalone search submits the query through its provider contract, not a plugin-wide Astra system prompt. | Keep routing, configured model, limits and authentication unchanged. |
+| `src/auto-review-backend.ts` / `src/auto-review-probe.ts` | Risk/authorization instructions belong to the dedicated reviewer or diagnostic request, not every main-agent turn. | Do not shorten safety policy or change the reviewer route to claim Astra optimization. |
+| `src/auto-review.ts` denial notice | The previous wording said to stop/request input without explicitly separating a rejected dependency from independent authorized work. | Scope the stop to the action and its dependents; retain the no-workaround rule and require exact-action approval subject to higher-priority restrictions. |
+
+## Product change and regression boundary
+
+Only the denial notice changes in the shipped-source layer. It still returns `rejected`; it does not create an approval, enqueue a retry, change the three-denial circuit breaker, or replace platform/host policy. Tests retain the existing one-shot approval and breaker behavior and add a single-denial assertion covering independent work, no implicit follow-up, and no new authority.
+
+The guidance is shared by Codex models rather than Astra-only. This is a clearer boundary, not a measured latency/cost reduction. No claim is made that the model will consistently interpret the new wording better until a separately authorized behavioral comparison exists. Repository-agent ergonomics and user-facing product outcomes must not be reported as the same metric.
+
+Think's proposed reasoning changes and Split's synthetic consent UI remain in their own unmerged PRs. This audit does not validate their prompts as deployed behavior or resolve their composition with Remember.

package/docs/agent-notes/dsh-016-candidate-validation.md

@@ -0,0 +1,27 @@
+# DSH 0.1.6 candidate validation
+
+DSH `0.1.6-alpha.1` is a candidate, not a declared supported host. This change does not widen peer dependencies, change `compatibility.json` or `verified-compatibility.json`, publish a release, or upgrade a user profile. Track full acceptance in #207.
+
+## Automated scope
+
+The installation checker now exercises the packed plugin with image generation enabled in addition to its existing provider, Reserve and durable native-compaction checks. It runs the exact host's tool registry and PTC dispatch bridge, validates the rendered image-reference envelope against its typed preview, downloads the original bytes through the registered route, and verifies that a fork inheriting the PTC event can download the original while an earlier fork and an unrelated Session cannot.
+
+The image provider, preview store and code-execution backend are synthetic. The fixture invokes the host-supplied PTC binding; it does not execute arbitrary source, test the real Node PTC process, make provider requests, authenticate a browser, or claim browser rendering. Original storage and the plugin download handler are real. The candidate uses `ptcRuntime`; the existing declared hosts use `codeRuntime`. Both dispatch event names are checked through the actual host, not fabricated session events.
+
+The same-artifact matrix refuses missing image evidence, failed fork authorization checks and nonzero real-provider request counts. Existing browser component regression remains a separate baseline-host check, not proof of the candidate Web composition.
+
+## API assessment
+
+The main plugin does not subscribe to the removed `agent/session-start` event. Its existing image-download and Auto-review readers use `snapshotEvents()`, which the candidate still implements but marks deprecated; deprecation alone does not prove a runtime break. The unmerged Split experiment has separate lifecycle dependencies and is not covered by this assessment. Upstream PTC package/service renaming and the new process backend require explicit coverage before expanding support.
+
+## User acceptance before support expansion
+
+Use a separate disposable DSH home and workspace. Do not upgrade or restart an existing service, copy real account files, or import private session history as part of an automated check. A user must authorize live requests and sign in to the test profile.
+
+- Open the candidate Web UI and confirm plugin settings, model selection, reasoning controls and Fast controls render and retain explicit choices.
+- Sign in and complete one ordinary text/tool round trip; verify cancellation and reload/reconnect behavior.
+- With image generation explicitly enabled, generate one image through PTC, inspect the actual card, download original and preview, and check reload and fork access. Synthetic provider results do not replace this check.
+- Exercise only the optional search, proxy, quota, Auto-review or native-compaction features included in the intended deployment. Record untested features rather than treating default-off loading as their acceptance.
+- Record the exact host version, plugin commit/artifact, Node version and observed results without credentials or private transcript content.
+
+After acceptance, update the supported-host metadata together in a separate release change. Publishing and deployment remain separately authorized actions.

package/docs/agent-notes/issue-211-root-cause.md

@@ -0,0 +1,70 @@
+# Issue 211: missing profile-visible host peers
+
+## Downstream delivery checkpoint — 2026-09-18
+
+The complete upstream patch and generic regression are posted in [Discussion #5537](https://github.com/deepseek-ai/deepseek-harness/discussions/5537#discussioncomment-18498638). This downstream PR contains diagnostic improvements, explicit candidate-verification tooling and historical evidence only. It does not apply the upstream patch to normal installations, expand supported versions or close #211. Astra/Remember changes are delivered separately.
+
+All test counts, source/archive hashes and execution-boundary notes below describe their original pre-split runs. They are not current-head PR CI evidence; later investigation superseded the earlier unknown-cause statements. The PR Checks identify fresh delivery validation. Original investigation history is preserved.
+
+## Repair follow-up — 2026-09-18
+
+The upstream cause is now confirmed and a local repair has passed fresh installation. Alpha.1's ordinary launcher default was `link`; alpha.2 changed it to `runtime`. The separate `dsh plugin ... exec` process did not inherit that process-local resolver. The source repair calls DSH's public profile-local materializer only for explicit CLI `exec`, inside the existing profile write lock, preserving native package identity and cancellation. It does not hand-link named peers or change Codex Connect's business code.
+
+The portable upstream source patch, builder, candidate hashes and detailed results are recorded in repository path `patches/README.md`. A packed repaired `@deepseek-ai/dsh-plugin-manager` was installed into a fresh alpha.2 host before testing; no acceptance-installation file was patched afterward. The original failure was reproduced separately, eight repaired-command regressions passed, and the new installation passed doctor, models, disposal, Reserve, ten process-restart compaction phases and synthetic images. All four unmodified declared hosts also passed with the same Codex Connect archive. The local complete check passed 95 files / 905 tests.
+
+This is a local upstream repair, not an update to the official alpha.2 registry package. No push, publication or daily-service replacement was performed. Issue 211 remains open for upstream delivery and later verification of an unmodified official release. The diagnostic-only findings below are preserved as historical evidence.
+
+## Finding — 2026-09-18
+
+The local exact-DSH `0.1.6-alpha.2` reproduction fails during ESM module linking, before the doctor can produce a report. Its first actual exception is `ERR_MODULE_NOT_FOUND` for `@deepseek-ai/schemastery`. This is an installation/profile dependency-resolution failure, not malformed JSON, extra logging, lost CLI arguments or a model/account failure.
+
+The plugin already declares `@deepseek-ai/schemastery` in `peerDependencies` and deliberately leaves it external in `tsdown.config.ts`. It is present in the isolated DSH installation at version `3.18.2`, but initially invisible from the installed plugin's package directory. Reclassifying it as an omitted declaration or blindly bundling host peers would not describe the observed problem.
+
+The checker obscured this failure: candidate exit 1 is provisionally allowed so a valid `unverified` doctor report can continue, but the startup exception also exits 1. Parsing its empty stdout then replaced the useful stderr exception with the generic one-JSON-line error.
+
+## Evidence and causal control
+
+Original GitHub run `35322318396`, alpha job `105527422364`, used main `eae9430f16f1707d8cefb76dec6e8344871d7684` and Node `24.15.0`. Its complete job log contains 431 lines, but neither doctor stream was retained separately; the artifacts API returned zero artifacts. The exact historical stderr cannot be recovered from that run.
+
+New local observations use Node `22.22.3`, pnpm `10.30.3`, exact DSH `0.1.6-alpha.2`, and the plugin runtime from local commit `5128b7868f53b1a583553aee3125fdf755b8c16a`. This is a concrete reproduction, not a claim to have recovered the original Linux/Node 24 process. Within each comparison the installed plugin CLI bytes were checked against the built source; neither plugin nor host code changed between the control conditions.
+
+| Observation | Result |
+| --- | --- |
+| Ordinary isolated checker, job `wc_job_ktzmpbSbAmf6gytH` | Exit 1; stdout is empty, zero bytes. |
+| DSH `plugin exec` versus direct installed plugin CLI | Both exit 1 with the same missing `@deepseek-ai/schemastery` exception. |
+| Read-only own-entry observer and explicit `--` separator | DSH forwards `doctor --json` correctly; the realpath main-entry comparison matches; the separator does not change the failure. |
+| ESM resolution from the plugin package directory | All 22 declared peers are initially unresolved. Twenty-one exist in the exact host; `react` is not a direct host-root package. |
+| Expose only host `schemastery` inside the disposable profile | The next missing peer becomes `@deepseek-ai/dsh-util-values`; this is broader than one missing library. |
+| Expose the 21 existing host peers inside that same disposable profile | Doctor emits one 1,294-byte JSON report, credential state `missing`, compatibility `unverified`. Exit 1 remains expected for an undeclared host. |
+| Existing installed-runtime check in the dependency-exposure control | Exit 0: eight models prepared, disposal and Reserve transitions verified, ten fresh native-compaction processes across none/zstd encodings, and synthetic direct/PTC image checks passed. |
+
+The final experiment deliberately validates the **original failed doctor result**, even after the control succeeds. Its overall exit stays 1. The manual dependency-exposure control is not normal installation success and does not promote candidate support.
+
+Sanitized machine-readable records:
+
+- [Doctor/entry comparison](../experiments/issue-211-doctor-diagnostic-2026-09-18.json), job `wc_job_YySfh5MGD8JOWuAG`, SHA-256 `4a6ad4cd7876a1c4e3af1a6a470a419d063515c199f9881ee1cdd680da678c80`.
+- [Peer-resolution counterfactual](../experiments/issue-211-peer-resolution-2026-09-18.json), job `wc_job_dsJNi-kcYVSc0i8Y`, SHA-256 `0de54233d7bab215aad9c8c3dd8189aa3c74a718fb7af9a9fcb9ef0603b7a951`.
+
+The last comparison's packed-artifact SHA-256 is `08c8e37e31072fc9f9c94ecead174ff05eb392ae34cc721616a0c784b5a28841`. Different experiment runs can have different archive hashes because evidence documentation is included in the package; no runtime change was used to obtain the counterfactual recovery. Both recorded temporary installations were confirmed absent after completion. No live credentials or provider requests were used. Runtime responses and images remain synthetic, not live acceptance.
+
+## Delivered diagnostic correction
+
+`validateDoctorResult` now recognizes a single `ERR_MODULE_NOT_FOUND` startup exception naming one of this project's declared runtime packages when an undeclared candidate returns exit 1 and empty stdout. It reports only the error code and allowlisted package name, never the raw stderr, importer path or private text. Unknown/ambiguous errors keep the content-free framing diagnostic. Nonempty stdout still goes through strict JSON and schema validation, and infrastructure failures retain their classification.
+
+The regression first failed one of 75 checker assertions, then passed all 75 after the correction. The existing 11 synthetic child-routing scenarios also passed. The temporary observation callback and experimental link/trace helper were removed after recording the evidence; no dependency linking is inserted into the normal checker or product.
+
+Final `pnpm run check` passed on the completed checker/source changes: 94 files / 897 tests, typecheck, lint, build and package gates; job `wc_job_mvDMGKy8frhHrAxO`. The package check included 74 files. Replaying the saved actual process error through the final validator produced the expected safe missing-package diagnostic. Six local documentation links and the whitespace check passed. Generated `lib/` and runtime `src/` are unchanged from this task's starting commit. The GitHub cause report was posted and read back as issue-comment `5727830405`; #211 remained open. This paragraph is a documentation-only addition after that full check.
+
+Ordinary fresh-install reproduction of the unresolved candidate is still:
+
+```sh
+DSH_VERSION=0.1.6-alpha.2 DSH_UNDECLARED_CANARY_VERSION=1 node scripts/check-dsh-install.mjs
+```
+
+This uses a disposable keyless installation. The new error is expected to identify the missing declared package rather than merely empty JSON; the final diagnostic change is separately validated against the saved actual process output without repeating an installation.
+
+## Remaining repair boundary
+
+The observed break is between the isolated host's installed peer packages and the profile/plugin's module-resolution context. The exact upstream source change that stopped exposing those peers has not been inspected or established. The earlier denied upstream-source inspection was not retried. This follow-up used the ordinary permitted installer and black-box process observations instead.
+
+A production repair must restore the supported host/profile peer-resolution contract, preserving shared package identity, then pass a **fresh unmodified installation** and the current host matrix. Manual symlinks in an experiment are not that repair; copying peer packages or silently accepting arbitrary JSON is not an adequate substitute. Keep #211 open with cause localized and repair pending. No new supported version, release, merge, push, deployment or daily-service change is made here.

package/docs/agent-notes/issue-215-install-triage-2026-09-19.md

@@ -0,0 +1,43 @@
+# Issue #215 installation triage — 2026-09-19
+
+## Evidence and limits
+
+The maintainer supplied the report excerpt directly after the earlier detailed issue-body read was blocked. This triage uses that supplied text, repository manifests, official documentation and a separate offline pnpm control. It does not recover or retry the denied issue-body read. The reporter's full hub.log, profile manifests, exact pnpm version and exact Git-install commit remain unavailable.
+
+Reported environment: Windows x64, Node 24.16.0, DSH 0.1.6-alpha.2, Plugin Hub 1.4.2. The summary names a Git-based plugin add, whereas its attempted-channels section lists removal. The complete command/rollback order cannot be inferred from this summary.
+
+## Findings
+
+The first concrete blocking error in the supplied excerpt is ENOENT while opening the local archive `dsh-computer-use-0.2.0-win1.tgz`. The package manager calls this a direct dependency of the web profile, not a Codex Connect dependency. A referenced path component or file was unavailable. How the reference entered that profile and whether the archive was moved/deleted or its path supplied incorrectly remain unconfirmed. Private absolute paths are intentionally omitted here.
+
+Neither current HEAD `525e01b6e1c2b7d23ba70e29510ef1fd31fb0168`, the local 4.37 candidate, nor published 4.36 source `eae9430f16f1707d8cefb76dec6e8344871d7684` declares `dsh-computer-use`, `dsh-plugin` or `dsh-skill-manager` in dependency sections. The current lockfile and plugin patch contain no `dsh-computer-use` reference. Runtime dependencies are unchanged. This is not verification of the reporter's unrecorded exact Git revision.
+
+UND_ERR_DESTROYED means an operation used an already destroyed Undici client; it does not identify who destroyed it or why. The registry warnings could be cleanup/cancellation consequences or a separate transport problem. The excerpt and the control below do not prove that causal link. Sharing an Undici dependency does not attribute this failure to Codex Connect. The auto-generated labels `plugin-side install failure` and `Key error: ERR_DESTROYED` are not established root-cause findings.
+
+Stock DSH 0.1.6-alpha.2 remains undeclared and tracked separately by #211. The missing archive is not established as a duplicate of #211's plugin-exec peer-resolution problem. Repairing an archive reference does not certify alpha.2 compatibility.
+
+## Offline control
+
+Executed on M15 / macOS / Node 22.22.3 / pnpm 10.30.3 at 2026-09-19T10:25:14Z. Only two metadata-only synthetic tarballs were used; no Codex Connect, DSH or Hub runtime was loaded. Every add used `--offline --ignore-scripts --ignore-workspace`, an isolated temporary home/store and empty npm configuration.
+
+| Scenario | Exit | Result |
+| --- | --- | --- |
+| Add the new fixture to a clean project | 0 | Success. |
+| Add the same fixture while another direct dependency references a missing local archive | 254 | ENOENT names the missing existing archive; direct-dependency diagnostic present. |
+| Restore only that archive and repeat the same add in the same project | 0 | Success. |
+
+None of these runs emitted UND_ERR_DESTROYED. This reproduces a package-manager mechanism, not the reporter's Windows/Hub stack or full warning sequence. No live model requests or reporter configuration changes occurred. Temporary files were removed. A sanitized receipt is in ignored `node_modules/.cache/issue215-local-tarball-repro.json`.
+
+## Maintainer response and release disposition
+
+Keep #215 open pending reporter confirmation. Ask the reporter to check the archive using PowerShell `Test-Path -LiteralPath`, inspect the relevant dsh-computer-use entry in the profile package.json/pnpm-lock.yaml, and preserve backups before restoring the trusted archive or intentionally correcting/removing its stale reference through the supported plugin-manager workflow. Do not delete the whole .dsh home, blindly remove lockfiles or use an arbitrary substitute archive.
+
+If installation still fails, request the exact package-manager version and the command-boundary/error section of hub.log, with credentials, auth URLs and unnecessary private paths redacted. Clarify add versus remove. Persistent registry warnings should be investigated separately after the local source blocker is addressed.
+
+For 4.37 on the unchanged declared-supported host set, this is **not currently a confirmed release-blocking plugin regression**. Preparation may proceed with this evidence-backed disposition. Keep the issue open and reassess if a clean supported-host reproduction identifies a plugin defect. Do not claim that 4.37 fixes the archive, the network warnings or alpha.2 compatibility. Candidate review, artifact/compatibility records, remote CI, merge and publication authorization remain separate gates.
+
+## Primary references
+
+- Node.js ENOENT definition: https://nodejs.org/api/errors.html#common-system-errors
+- pnpm 10 install / removed file-dependency targets: https://pnpm.io/10.x/cli/install
+- Undici ClientDestroyedError: https://undici.nodejs.org/api/Errors#clientdestroyederror

package/docs/agent-notes/ptc-image-presentation.md

@@ -0,0 +1,18 @@
+# Image presentation through PTC
+
+Fixes the presentation failure reported in issue #205.
+
+DSH 0.1.5-rc.2 intentionally invokes `output.presentationMeta` only for top-level tools. Its `tool/ptc-dispatch` event preserves rendered content, not that metadata. Therefore image generation can succeed while the nested tool view cannot decode a result.
+
+The plugin now renders a bounded, versioned text envelope containing original/preview references alongside its typed image attachments. The tool view validates the envelope and requires an exact match to those image attachments. It does not parse arbitrary prose, accept raw paths, or infer an original from a preview hash. Existing direct-tool metadata remains authoritative; malformed metadata is not silently bypassed.
+
+Old PTC sessions without the envelope recover their typed previews and preview downloads. Their original IDs were not preserved in nested result content, so this fallback deliberately does not advertise an original download. New results support both representations. Fork authorization also recognizes successful inherited PTC events, preserving the immutable inherited-prefix and stored-original checks. Both the legacy `tool/code-dispatch` and current `tool/ptc-dispatch` event names are supported.
+
+## Verification
+
+- Decoder tests: legacy previews, full envelopes, missing/mismatched attachments, duplicate/oversized/malformed envelopes, invalid references.
+- Component tests: nested PTC cards recover galleries and download controls with and without original references.
+- Route tests: inherited PTC originals work; failed/wrong-tool/non-inherited events remain denied.
+- Existing direct calls, original integrity and nested/restored session tests remain applicable.
+
+This change does not change image-provider selection, copy files into a workspace, expose the plugin storage directory, or add a filesystem sidebar integration. A successful generator result proves storage, not that the browser rendered it; operational acceptance must inspect the actual card.

package/docs/agent-notes/remember-controlled-probes-delivery.md

@@ -0,0 +1,41 @@
+# Remember controlled probes: local implementation and offline evidence
+
+## Status
+
+Implemented after `263bfcd866fc028798e39d588939ca899d564ba1`, whose parent is merged-main reference `574d55f2f990053c64fabd3fb8867318875183a4`. This delivery is local engineering preparation, not provider acceptance. The [original September 18 live failure](../experiments/native-compaction-durable-m15-2026-09-18-1317.md) remains failed; its three-request grant is exhausted. No new live requests or credential reads were performed.
+
+The native execution channel recovered and actually returned Node `22.22.3`. This does not explain the earlier missing tunnel or the earlier live recall mismatch.
+
+## Implementation
+
+The [controlled acceptance specification](../experiments/remember-controlled-acceptance-plan.md) is now implemented in the existing `scripts/native-compaction-durable-smoke.mjs`, with a shared helper `scripts/native-compaction-controlled-cases.mjs`. There is one credential/transport/persistence implementation, not a second copied runner.
+
+- `--case=retained-user`: a short user message carries the target. The normal retained-user projection survives the real checkpoint and JSONL restore. The synthetic continuation reads the target from the actual retained request item; this is a persistence control, not opaque-state recall.
+- `--case=assistant-origin`: the target is extracted from the actual baseline assistant answer. A real anchor turn moves it into the older prefix. The native request must contain it only in an assistant item; the restored request must contain no plaintext target. The synthetic native response derives a clearly marked fixture envelope from that assistant input, and the fresh-process responder reads the answer only from the replayed envelope. No comparator/expected-target parameter is supplied to this responder. This is not real encryption or evidence of provider semantics.
+- Default/`--case=oversized-user`: the old 65,000-space user-message boundary, prompt, three-dispatch ceiling and strict recall criterion remain separate and tested. Its earlier failure is not erased or explained retrospectively.
+
+A/B each follow baseline, anchor, native compaction, process exit/restore, continuation: four dispatches maximum, with no retry or fallback dispatch. The real DSH range selector is configured with `retainTokens: 0` only inside this isolated fixture. It still retains the newest item and rejects non-shrinking replacements. No host method or production retention code is overridden. The first prompt requests 600-750 words of neutral library prose; accepted material is bounded to 400-1100 words / 12,000 UTF-8 bytes, with Agent maxTokens 2048 and compaction maxTokens 1024. These settings are not a claim about actual live token usage.
+
+The actual JSONL is parsed to locate a checkpoint structurally identical to the committed in-memory checkpoint; merely finding a marker string no longer proves A/B persistence. New-process restore checks the full checkpoint digest. Before dispatch, the retained prefix and opaque item must match their persisted identities. The target must not survive in another active message or request metadata. New assistant events are required after the continuation start; historical correct answers do not satisfy the gate. Recall still requires `reply.trim() === target`, with no case folding or substring acceptance.
+
+Controlled live invocations require an explicit case, Codex-login selection, and run id. An owner-only exclusive claim survives temporary cleanup in ignored `.remember-acceptance-runs/`; a reused id, including reuse for another case, is refused before credentials. This is same-id duplicate prevention, not permission to mint another id after failure. Fault-injection flags are offline-only. Neither the wrapper nor this document authorizes live execution. The historical oversized live path is unchanged and still needs separate authorization before any invocation.
+
+## Validation obtained
+
+The first focused run passed 59 tests over three files, including 31 new controlled-case tests. On the final code, `pnpm run check` completed with **98 test files / 965 passing tests**, plus metadata/source lint, host/client typechecking, build, CLI checks, compatibility check and package check. Original WebCodex job: `wc_job_z9tnGGA5qqaK_EVS`, exit 0. Node: `22.22.3`. This note is a later documentation addition; package/link checks are repeated at closeout. No new Node 24, browser, installed-host matrix or remote CI result is claimed.
+
+[New machine-readable offline observations](../experiments/remember-controlled-offline-evidence.json) summarize 11 actual fixture runs on the final probe/helper hashes:
+
+- Two positive controls finish four simulated dispatches and two distinct successful processes, with exact recall and physical checkpoint equality.
+- Five negative wire fixtures omit the selected target, leak it in plaintext, lose retained-user input, alter the replayed opaque item, or remove it. They stop before the affected synthetic transport, after only two or three simulated dispatches. `guard_failure` records the precise cause even when the host wraps it as an agent/compaction failure.
+- Four case-only/wrapped/wrong/empty answers still fail after four simulated dispatches with `RECALL_MISMATCH_NO_RETRY`. Restore success remains independently recorded.
+
+Additional unit tests reject ambiguous assistant-generated labels, a correct historical answer without a new turn, marker-only physical-file checks, invalid/duplicate flags, unsafe run-ledger symlinks and reused run ids. These unit checks are not mislabeled as actual crash/disk-fault injections.
+
+Original live JSON evidence remains SHA-256 `c8884b6b7fbeedb44f67615b0bfca9c96d4600203929da6627755e27d448aa91`. New offline evidence is SHA-256 `e5af6ff65cf3df5e3121c2e6533caec95be1321a5315a05e9c16ead36522a40f`. Public observations contain classifications, booleans, counts and source identities, not targets, answers, opaque contents or credential paths.
+
+## Next gate and limits
+
+A proposed new live sequence is A first, then B only if A passes, using the previously designated M15 Codex login, plain Luna/low, at most four requests per case (eight total), stopping on any failure or platform denial. It requires fresh user authorization and the platform's normal approval; no unused budget from an old attempt is carried forward. There is no automatic multi-case runner. No manual user product acceptance is required at this engineering stage.
+
+A/B live success would establish bounded same-account/same-model text behavior, not Astra, tools, images, UI forks, crash recovery, repeated compaction, savings or long-task quality. C remains a separately authorized retention-boundary test. This delivery does not push, open a PR, merge, publish, deploy or upgrade daily services, and does not enable experimental defaults.

package/docs/agent-notes/remember-delivery-preparation-2026-09-19.md

@@ -0,0 +1,49 @@
+# Remember delivery preparation — 2026-09-19
+
+## Resumed delivery review — 2026-09-19
+
+After the user's explicit continuation, the normal WebCodex issue-read and evidence-review operations completed. The earlier safety-blocked call remains a historical event; it is not reclassified as a successful execution. Current issue reads found #196, #65 and #195 open, and no existing PR for this delivery branch. Main was still `574d55f`.
+
+The review verified all four new JSON evidence files for raw target/answer, opaque-content, credential and private-path fields; no such payloads were found. Original A/B and failed-run digests remain unchanged. A/B report assertions, distinct process identities, usage sums and probe/helper source hashes match the historical `ad7c934` execution. Product code, built output, dependencies, compatibility metadata and workflows remain identical to the main baseline.
+
+The outstanding local notes below describe the prior interrupted preparation. The resumed task will commit the reviewed evidence and navigation updates, publish one PR and prepend bounded status notes to the three trackers without closing them. PR creation is not a release. Final remote CI must be checked against the PR's exact head; the prior local checks are not remote evidence. See the PR and its read-back status notes for actual submission/check results.
+
+## Historical observed state and publication blocker
+
+The current task is authorized to consolidate the local Remember diagnostics/controlled probes and their existing live evidence into one PR, synchronize the relevant issue status, and prepare a limited user experience plan. It does not authorize another live experiment, merge, release, deployment or daily environment upgrade.
+
+The successful initial observation found local branch `franksong2702/remember-offline-diagnostics-20260918` at `ad7c93481096b4750ede77dc93a19b241b7f11e0`, with preceding diagnostic commit `263bfcd866fc028798e39d588939ca899d564ba1`. Remote main was `574d55f2f990053c64fabd3fb8867318875183a4`. The open-PR read returned #167, #199 and #200; no duplicate Remember delivery PR was observed. Uncommitted changes included the prior live A/B reports, their acceptance entry and existing local handoff records.
+
+A subsequent combined `run_script` request to read issues #196/#65/#195, inspect the live-report structure/hash and review part of the local diff was blocked because OpenAI could not determine the request's safety. It returned no command result. Those reads were not retried, subdivided or moved to another execution route. Their dependent issue writes and public delivery confirmation remain stopped. The blocker is not evidence that GitHub denied write permissions, that the local Runner disconnected, or that the acceptance tests failed. No PR, push, remote CI run or issue update was completed by this preparation.
+
+## Fresh local validation
+
+The independent `pnpm run check` completed successfully under original job `wc_job_xfGLXCEKw2ikT4Qr`, exit 0: **98 test files / 965 tests**, plus the command's lint, typecheck, build, workflow-contract, CLI, compatibility and package checks. The reported package check at that point counted 83 files. This note is a documentation addition after that command. This is fresh local validation of the current code, not remote CI and not additional live-provider acceptance.
+
+The existing A/B evidence narrative and controlled-case tests were read directly. They distinguish normal retained-user replay from assistant-origin opaque-only recall; the oversized-user failure remains separately recorded. Live test source identity is `ad7c934`, not a future delivery commit. No current claim is made that the blocked publication/privacy audit completed.
+
+## Proposed PR text — not submitted
+
+**Title:** `test: deliver bounded Remember restart controls and live acceptance evidence`
+
+**Scope:** Consolidate the prior two local test-tool commits, the original failed oversized-user record, request-derived synthetic controls, content-free recall diagnostics, and the separately recorded successful live A/B controls. Include a clear current-state entry and the [limited user acceptance plan](../experiments/remember-user-acceptance-plan.md). Related to #196, #65 and #195; no automatic closing keywords.
+
+**What is established:** At source `ad7c934`, ordinary Luna on direct DSH `0.1.2-rc.1` / pi-ai `0.84.4` / Cordis `4.0.2` passed one retained-user persistence control and one assistant-origin opaque-only recall control. Each used four requests and distinct writer/resume processes. Physical checkpoint equality, replay identity and a newly generated exact answer were recorded. A intentionally carries the answer in retained user input; B's replay contains no plaintext target outside its opaque item. Eight requests total and 6,737 backend-reported tokens belong to that historical run, not to this PR task.
+
+**What is not established:** The oversized-user failure remains unexplained. These cases do not certify Astra, arbitrary user-message deletion, repeated/automatic compaction, tools, images, UI forks, crashes/disk failure, long-task quality, pricing or savings. The native compaction engine, model choices, credential logic, supported-host declaration and default-off behavior are not intended to change in this delivery.
+
+**Validation:** Cite the fresh local check above as local evidence only. Before publication, complete the outstanding evidence/privacy and final-diff review. After creating the PR, require its exact final commit's normal Linux Node 22/24 tests and four-host matrices, browser regression, Windows contract, dependency review and CodeQL; do not substitute historical checks. No remote checks were run by this task.
+
+**Boundaries:** No additional credential reads or live requests. Preserve one-shot run claims and old outcome records. Do not include `handoff/`, `.remember-acceptance-runs/`, local repair archives or actual session material in the public patch. Do not merge, publish, deploy, upgrade or enable experiments by virtue of opening the PR.
+
+## Proposed issue updates — not submitted
+
+For **#196**, record the bounded Luna A/B persistence and opaque-recall gate as supported by the original execution evidence after publication review, while keeping broader unchecked acceptance items explicit. Do not close the issue in this task or mark untested checklist entries complete.
+
+For **#65**, link the same bounded result as a feasibility/lifecycle data point; retain oversized-user semantics, repeated compaction, long-task quality and accounting/value questions as open research.
+
+For **#195**, advance only the Remember status to reflect its limited A/B evidence and delivery-PR stage. Do not imply Think/Split composition is supported or any new default is enabled. Read the actual current issue text before applying an update; that read is still blocked in this task.
+
+## Next user experience gate
+
+The [experience plan](../experiments/remember-user-acceptance-plan.md) is saved, but no UI entry is provisioned. The intended user task is a short disposable planning conversation with three ordinary constraints, one rejected alternative and one pending action. The engineer verifies actual compaction and shutdown/reopen; the user judges whether the assistant still respects those constraints and continues the pending work. No user installation or shell commands are part of that plan. Serving the UI and spending further model requests require separately scoped authorization.