dsh-codex-connect 0.1.0-alpha.4.36 → 0.1.0-alpha.4.38

package/INSTALL.md

@@ -1,10 +1,10 @@
 # Installation Runbook for CLI Agents
 
-Published Alpha 4.35 is verified with DSH `0.1.2-rc.1` and pi-ai `0.84.4` within `^0.84.2`, and with each exact DSH `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` model-runtime pairing using pi-ai `0.85.1`.
+Published Alpha 4.37 is verified with DSH `0.1.2-rc.1` and pi-ai `0.84.4` within `^0.84.2`, and with each exact DSH `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` model-runtime pairing using pi-ai `0.85.1`.
 
 Install `dsh-codex-connect` into one requested DeepSeek Harness profile without changing its current default model, search route, global configuration, or OAuth state.
 
-Channel snapshot on 2026-09-11: npm `alpha` points to `0.1.0-alpha.4.35`; `latest` intentionally remains on `0.1.0-alpha.4.34`. Use the exact-version commands below for 4.35. Publishing an Alpha and promoting the default installation channel are separate actions.
+Channel snapshot on 2026-09-19: npm `alpha` points to `0.1.0-alpha.4.37`; `latest` intentionally remains on `0.1.0-alpha.4.34`. Use the exact-version commands below for 4.37. Publishing an Alpha and promoting the default installation channel are separate actions.
 
 ## Safety requirements
 
@@ -25,15 +25,19 @@ Check `dsh --version` before changing the requested profile. Use `dsh --help` to
 | `0.1.0-rc.7` | `0.1.0-alpha.4.14` |
 | `0.1.1-rc.2` | `0.1.0-alpha.4.21` |
 | `0.1.2-alpha.2` | `0.1.0-alpha.4.23` |
-| `0.1.2-rc.1` | `0.1.0-alpha.4.35` |
+| `0.1.2-rc.1` | `0.1.0-alpha.4.37` |
 | `0.1.2-alpha.5` | `0.1.0-alpha.4.25` |
-| `0.1.5-alpha.1` | `0.1.0-alpha.4.35` |
-| `0.1.5-rc.1` | `0.1.0-alpha.4.35` |
-| `0.1.5-rc.2` | `0.1.0-alpha.4.35` |
+| `0.1.5-alpha.1` | `0.1.0-alpha.4.37` |
+| `0.1.5-rc.1` | `0.1.0-alpha.4.37` |
+| `0.1.5-rc.2` | `0.1.0-alpha.4.37` |
 
 If your exact DSH version is unknown or not listed, preserve the installed host, report that the combination is unverified, and verify it before making installation changes. A missing record does not prove incompatibility, and the catalog's latest verified DSH version is not the latest upstream release. Do not recommend upgrading or downgrading DSH merely to match a row. Investigate any specific failure and seek verification of the installed combination. Do not blindly install `dsh-codex-connect@alpha`: `alpha` is a moving tag, not a compatibility guarantee. Do not infer support for newer DSH versions from these rows.
 
-Alpha 4.35 requires one consistent DSH plugin API version: `0.1.2-rc.1` with `@earendil-works/pi-ai` `^0.84.2`, or one of `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` with pi-ai `0.85.1`; Node.js remains `^22.19.0 || >=24.0.0`. Mixed host versions and other DSH/pi-ai combinations remain unverified. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 remains the verified choice for DSH `0.1.2-alpha.2`, Alpha 4.21 remains the verified choice for DSH `0.1.1-rc.2`, and staying on DSH `0.1.0-rc.7` means selecting Alpha 4.14. Changing DSH is a separate operation requiring the user's explicit request; a plugin update request does not authorize it. The repository's `pnpm --silent run check:compatibility` remains a strict development/release dependency gate, not a recommendation to change a user's host.
+Alpha 4.37 requires one consistent DSH plugin API version: `0.1.2-rc.1` with `@earendil-works/pi-ai` `^0.84.2`, or one of `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` with pi-ai `0.85.1`; Node.js remains `^22.19.0 || >=24.0.0`. Mixed host versions and other DSH/pi-ai combinations remain unverified. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 remains the verified choice for DSH `0.1.2-alpha.2`, Alpha 4.21 remains the verified choice for DSH `0.1.1-rc.2`, and staying on DSH `0.1.0-rc.7` means selecting Alpha 4.14. Changing DSH is a separate operation requiring the user's explicit request; a plugin update request does not authorize it. The repository's `pnpm --silent run check:compatibility` remains a strict development/release dependency gate, not a recommendation to change a user's host.
+
+The Alpha 4.37 recommendation follows successful exact-release main CI, 975 local tests, 32 Chromium tests, and a four-host same-artifact installation matrix with 40 fresh native-compaction lifecycle processes. Independent post-publication download verified that npm's archive is byte-identical to the tested artifact and the release workflow's verified package; the Git tag resolves to the exact release commit. These are synthetic-provider installation/lifecycle checks, not new real-account acceptance or a newly exercised published-package upgrade. See [.github/ALPHA_437_PUBLICATION.md](.github/ALPHA_437_PUBLICATION.md). Native context management remains opt-in. The preview-only DSH checkpoint-retry patch is not installed by this plugin, and stock DSH 0.1.6-alpha.2 remains undeclared.
+
+Historical Alpha 4.35 evidence (not relabeled as 4.37):
 
 The Alpha 4.35 rows reflect successful release-commit CI on Node 22.19.0 and 24.20.0 (840 tests each), 28 Chromium tests, Windows canary contracts, and the four-host installation/Reserve matrix. Independent post-publication checks installed the exact npm version on all four hosts, matched all 63 installed plugin files to the verified published archive, and exercised a 4.34-to-4.35 upgrade on rc.2. All eight advertised models resolved and prepared, defaults were unchanged, all optional capabilities remained disabled, and provider disposal and synthetic Reserve transitions passed. These checks are not fresh real OAuth, live Reserve/model/tool/image, or full Windows application acceptance. See [.github/ALPHA_435_RELEASE_READINESS.md](.github/ALPHA_435_RELEASE_READINESS.md) for publication, installation evidence, and limitations. Historical rows remain the repository's existing verification record. This guidance does not change upstream DSH behavior or resolve [Issue #64](https://github.com/franksong2702/dsh-codex-connect/issues/64).
 
@@ -60,10 +64,10 @@ Alpha 4.33 omits the `modelErrors` profile field required by RC model packages,
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.23
    ```
 
-   For DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2`, use Alpha 4.35:
+   For DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2`, use Alpha 4.37:
 
    ```sh
-   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.35
+   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.37
    ```
 
    For DSH `0.1.2-alpha.5`, use Alpha 4.25:
@@ -72,7 +76,7 @@ Alpha 4.33 omits the `modelErrors` profile field required by RC model packages,
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.25
    ```
 
-   If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.35'` only for the DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2` combinations.
+   If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.37'` only for the DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2` combinations.
 
 3. Run `dsh web --help` once to compose the installed profile without starting the server. DSH `0.1.2-rc.1` prepares profile plugin dependency fallback during this step.
 4. Run `dsh --profile web --dump-config` and require exactly one `llm-openai-codex` row loading `dsh-codex-connect`.

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   git hash-object README.md docs/README.zh.md
-README.md: 5c2bff3d29c1366e52035ac809f119a2fdca47fc
-docs/README.zh.md: f629b3789be4b361ffd4045dff7fa6acf92770ff
+README.md: 59ddc56fb06a92c01d60d3d516095cc8cad5cd68
+docs/README.zh.md: c4784c0b2aece6af6f81f7944e12ec89f1631b46

package/README.md

@@ -16,17 +16,17 @@ This guide describes the published pairings below. Check `dsh --version` first a
 
 | Requirement | Verified pairing |
 |---|---|
-| Codex Connect | `0.1.0-alpha.4.35` |
+| Codex Connect | `0.1.0-alpha.4.37` |
 | DeepSeek Harness | `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2` |
 | Node.js | `^22.19.0 \|\| >=24.0.0` |
 | Account | ChatGPT OAuth with access to the requested Codex model; availability is decided by OpenAI |
 
-As of 2026-09-11, npm `alpha` points to 4.35 while `latest` intentionally remains on 4.34. Use the exact version below for 4.35; this recommendation does not promote the default installation channel.
+As of 2026-09-19, npm `alpha` points to 4.37 while `latest` intentionally remains on 4.34. Use the exact version below for 4.37; this recommendation does not promote the default installation channel.
 
 ### 1. Install
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.35
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.37
 dsh web
 ```
 
@@ -56,7 +56,7 @@ dsh plugin --profile web exec dsh-codex-connect doctor --json
 - **Accounts:** save up to 16 accounts on the DSH host and manually select the active account for subsequent requests. Account selection is not a per-session binding. Requests keep their captured account; the plugin does not rotate accounts or silently fail over.
 - **Models and Astra support:** the currently verified DSH and plugin combination supports `gpt-6-astra`. The plugin supplies its missing model definition with Low, Medium, High, Xhigh, and Max reasoning levels; Default preserves the provider default. Saved Off/Minimal selections require an [explicit update](MIGRATION.md#astra-reasoning-selections). When the installed dependency catalog includes Astra, the plugin preserves its native metadata while retaining these five calibrated reasoning choices. A model appearing in the list does not mean the current account has permission to use it; overall compatibility with new dependency versions still requires separate verification.
 - **Fast Mode:** request priority service for one conversation, off by default. Actual speed and quota consumption depend on the service; no fixed speed multiplier is guaranteed.
-- **Quota:** show the server-returned `5h` and `7d` windows and reset times, normally refreshed every 60 seconds while signed in. Missing windows are not invented; Spark uses its separate quota bucket.
+- **Quota:** show the server-returned `5h` and `7d` windows and reset times, normally refreshed every 60 seconds while signed in and the tab is visible; failures back off. Missing windows are not invented; Spark uses its separate quota bucket.
 - **Plugin updates:** check for newer Codex Connect releases without installing anything or recommending changes to DSH. Host compatibility is available through explicit local diagnostics.
 
 <p align="center">
@@ -78,7 +78,7 @@ All options below are off on a fresh installation. Edit them in **Settings → P
 
 **Published experiment:** Alpha 4.35 includes Luna Reserve fallback, disabled by default. Real-account Reserve entry and recovery remain unverified; Alpha 4.34 does not include this feature.
 
-With `enableReserveFallback: true`, the account UI and agent routing share one identity-bound quota state. Background refresh follows the returned quota windows; fresh state is reused across agent steps. The plugin enters `gpt-reserve` only with complete, non-FedRAMP account/user identity and backend Luna Reserve authorization, then restores the session's previous model and reasoning effort after confirmed ordinary-usage recovery. Reserve has its own allowance, is hidden from the model picker, and is not unlimited. The backend decides eligibility; reset times alone do not authorize a switch. This version supports known `gpt-5.6-luna` metadata only. See [Luna Reserve fallback](docs/reference.md#luna-reserve-fallback) for refresh, identity, and verification limits.
+With `enableReserveFallback: true`, the account UI and agent routing share one identity-bound quota state. Background refresh follows the returned quota windows while recently in use; fresh state is reused across agent steps. Ordinary quota reads also share the cache, even with Reserve disabled. The plugin enters `gpt-reserve` only with complete, non-FedRAMP account/user identity and backend Luna Reserve authorization, then restores the session's previous model and reasoning effort after confirmed ordinary-usage recovery. Reserve has its own allowance, is hidden from the model picker, and is not unlimited. The backend decides eligibility; reset times alone do not authorize a switch. This version supports known `gpt-5.6-luna` metadata only. See [Luna Reserve fallback](docs/reference.md#luna-reserve-fallback) for refresh, identity, and verification limits.
 
 Use the image generation capability included with your current GPT subscription. Generated originals are stored separately from attachment previews; disabling the capability or uninstalling the plugin does not delete them. See [Configuration and recovery](docs/reference.md#search-and-image-tools) for storage and access rules.
 
@@ -100,8 +100,14 @@ Subsequent Codex requests use the selected active account; conversations do not
 
 ### Why does a listed model fail?
 
+Model HTTP/SSE failures include bounded, request-local diagnostic metadata after the existing error message. An `overloaded` message alone does not establish an account block. See [persistent-error diagnostics](docs/experiments/issue-219-diagnostics.md) for scope and reproduction.
+
 Account permissions, plugin/host compatibility, and network conditions all affect availability. Access on another client does not guarantee this integration will work. OpenAI controls model access, quota, context capacity, and service behavior; catalog entries are not proof of entitlement.
 
+### Does changing client headers prevent persistent authorization failures?
+
+No such guarantee is established. Codex Connect is a third-party integration; it does not impersonate Codex Desktop or fabricate installation/attestation headers. The pi-ai model/OAuth route and auxiliary routes currently identify themselves differently. OpenAI's [App Server documentation](https://developers.openai.com/codex/app-server/) asks integrations to identify their own client with `clientInfo`; it does not establish acceptance rules for this plugin's direct backend calls. An `overloaded` message is not proof of a block. Capture the bounded error metadata and compare successful and failed windows before attributing the cause; share request IDs privately, never tokens or full session archives.
+
 ### Can I keep the original `dsh-codex` plugin installed?
 
 Not in the same effective configuration: both register `openai-codex`. Follow [MIGRATION.md](MIGRATION.md); remove only the confirmed conflicting entry, not credentials or unrelated providers.

package/docs/README.zh.md

@@ -16,17 +16,17 @@ Codex Connect 为标准 Harness agent loop 添加 `openai-codex` 模型提供方
 
 | 要求 | 已验证组合 |
 |---|---|
-| Codex Connect | `0.1.0-alpha.4.35` |
+| Codex Connect | `0.1.0-alpha.4.37` |
 | DeepSeek Harness | `0.1.2-rc.1`、`0.1.5-alpha.1`、`0.1.5-rc.1` 或 `0.1.5-rc.2` |
 | Node.js | `^22.19.0 \|\| >=24.0.0` |
 | 账户 | 通过 ChatGPT OAuth 使用所请求的 Codex 模型；可用性由 OpenAI 决定 |
 
-截至 2026-09-11，npm `alpha` 指向 4.35，`latest` 则有意保留在 4.34。安装 4.35 请使用下方精确版本命令；文档推荐更新不代表默认安装渠道已提升。
+截至 2026-09-19，npm `alpha` 指向 4.37，`latest` 则有意保留在 4.34。安装 4.37 请使用下方精确版本命令；文档推荐更新不代表默认安装渠道已提升。
 
 ### 1. 安装
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.35
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.37
 dsh web
 ```
 
@@ -56,7 +56,7 @@ dsh plugin --profile web exec dsh-codex-connect doctor --json
 - **账户：**在 DSH 主机上保存最多 16 个账户，手动选择后续请求使用的活动账户，不按会话绑定。请求保持已固定的账户，插件不会自动轮换或静默故障切换。
 - **模型与 Astra 支持：**当前已验证的 DSH 与插件组合已支持 `gpt-6-astra`。插件补充缺失的模型定义，提供 Low、Medium、High、Xhigh 和 Max 五档推理强度；Default 保持提供方默认值。已保存的 Off/Minimal 选择需要[明确更新](../MIGRATION.md#astra-reasoning-selections)。安装的依赖目录包含 Astra 时，插件保留其原生元数据，同时维持这五档已校准的推理选择。模型出现在列表中，不代表当前账户具有调用权限；新依赖版本的整体兼容性仍需单独验证。
 - **Fast Mode：**为单个对话请求优先服务，默认关闭。实际速度和额度消耗取决于服务端，不保证固定提速倍数。
-- **额度：**显示服务端返回的 `5h`、`7d` 窗口及重置时间，已登录时通常每 60 秒刷新一次。不虚构缺失窗口；Spark 使用独立额度桶。
+- **额度：**显示服务端返回的 `5h`、`7d` 窗口及重置时间，已登录且标签页可见时通常每 60 秒刷新一次；失败后延长重试间隔。不虚构缺失窗口；Spark 使用独立额度桶。
 - **插件更新：**检查 Codex Connect 新版本，不自动安装，也不建议更改 DSH。宿主兼容性信息通过主动运行的本地诊断查看。
 
 <p align="center">
@@ -78,7 +78,7 @@ dsh plugin --profile web exec dsh-codex-connect doctor --json
 
 **已发布的实验功能：** Alpha 4.35 包含 Luna Reserve 回退，仍默认关闭。真实账户进入 Reserve 及恢复普通模型的过程仍未验证；Alpha 4.34 不包含该功能。
 
-启用 `enableReserveFallback: true` 后，账户 UI 和 agent 路由共用一份绑定身份的额度状态，按服务端返回的额度窗口后台刷新；有效状态可跨 agent step 复用。只有身份完整、非 FedRAMP 且服务端授权时，插件才进入 `gpt-reserve`；普通额度确认恢复后，切回该会话先前的模型和推理强度。Reserve 有自己的额度，不出现在模型选择器中，也不是无限额度。资格由服务端决定，重置时间本身不授权切换。当前版本只支持已知的 `gpt-5.6-luna` 元数据。刷新、身份和验证限制见 [Luna Reserve 回退](reference.zh.md#luna-reserve-回退)。
+启用 `enableReserveFallback: true` 后，账户 UI 和 agent 路由共用一份绑定身份的额度状态，最近有使用需求时按服务端返回的额度窗口后台刷新；有效状态可跨 agent step 复用。普通额度读取也共用缓存，即使 Reserve 已关闭。只有身份完整、非 FedRAMP 且服务端授权时，插件才进入 `gpt-reserve`；普通额度确认恢复后，切回该会话先前的模型和推理强度。Reserve 有自己的额度，不出现在模型选择器中，也不是无限额度。资格由服务端决定，重置时间本身不授权切换。当前版本只支持已知的 `gpt-5.6-luna` 元数据。刷新、身份和验证限制见 [Luna Reserve 回退](reference.zh.md#luna-reserve-回退)。
 
 使用你当前 GPT 订阅计划提供的图片生成能力。生成原文件与附件预览分开保存；关闭能力或卸载插件不会删除这些文件。存储和访问规则见[配置与恢复](reference.zh.md#搜索与图片工具)。
 
@@ -100,8 +100,14 @@ OAuth 凭据保存在运行 DSH 的主机上，由该主机用于向 OpenAI 认
 
 ### 为什么列表中的模型调用失败？
 
+模型 HTTP/SSE 请求失败时，会在原错误消息后附加有界、仅属于该请求的诊断信息。单凭 `overloaded` 消息不能认定账户被封锁。范围与复现方式见[持续错误诊断](experiments/issue-219-diagnostics.md)。
+
 账户权限、插件与宿主兼容性、网络条件都会影响可用性。其他客户端可以使用，不代表此集成一定可用。OpenAI 控制模型权限、额度、上下文容量和服务行为；目录条目不是账户权限证明。
 
+### 修改客户端请求头就能避免持续授权失败吗？
+
+目前没有这样的保证。Codex Connect 是第三方集成，不冒充 Codex Desktop，也不伪造安装标识或 attestation 请求头。pi-ai 模型/OAuth 路由与辅助路由目前采用不同的客户端身份。OpenAI 的 [App Server 文档](https://developers.openai.com/codex/app-server/)要求集成通过 `clientInfo` 标识自己的客户端，但这不能证明本插件直接调用后端接口的接受规则。`overloaded` 本身不是封锁证据。应保留有界诊断信息，对照成功和失败时段后再判断原因；请求 ID 仅私下提供，不公开 token 或完整会话归档。
+
 ### 可以保留原来的 `dsh-codex` 插件吗？
 
 不能在同一份有效配置中并存：两者都会注册 `openai-codex`。请遵循 [MIGRATION.md](../MIGRATION.md)，只移除已经确认冲突的条目，不删除凭据或无关提供方。

package/docs/agent-notes/adaptive-runtime-status.md

@@ -0,0 +1,61 @@
+# Alpha 4.37 published checkpoint — 2026-09-19
+
+Alpha `0.1.0-alpha.4.37` was published from `5cbd0d330d12c81f0bf37515b65bc799e480aa78` through successful workflow `35439115133`. The npm archive equals the final tested artifact; the Git tag and published GitHub prerelease match the release commit. `alpha` is 4.37; `latest` remains 4.34. See [publication verification](../../.github/ALPHA_437_PUBLICATION.md). No service or default changed, and no new live-model request was made. The local DSH repair, Think and Split are not included.
+
+## Historical preparation checkpoint — 2026-09-19
+
+#216 was normally squash-merged at `525e01b6e1c2b7d23ba70e29510ef1fd31fb0168`; the merge tree equals the reviewed `1e05677` tree. Main CI `35436177342` passed. This branch prepares 0.1.0-alpha.4.37. The maintainer subsequently authorized publication through the normal candidate-review/main-CI/OIDC workflow on 2026-09-19; a prepared branch is not publication evidence. `latest`, running services and live model calls remain outside scope. See [release readiness](../../.github/ALPHA_437_RELEASE_READINESS.md) and [draft release notes](../release-notes/alpha-4.37.md).
+
+Remember's bounded real A/B restart controls are on main. The user preview on DSH 0.1.5-rc.1 also produced a real automatic native checkpoint and completed subsequent tool-assisted work. Its checkpoint survived a normal preview restart; the deployment check sent no post-restart model continuation. Broader #196/#65 acceptance remains open.
+
+The checkpoint-only retry repair at local source `2e5469e` was applied only to the preview host. It is NOT installed by this plugin candidate. Stock alpha.2 support remains undeclared (#211).
+
+Split #199 (`b0bbbbb`) and #200 (`8883bc5`) remain unmerged drafts; #200's seven checks passed, including supplemental CodeQL and separate Split host matrices. Think #167 remains unmerged. None is included in this release. #215 remains open for reporter recovery. The maintainer-supplied excerpt and an offline control identify a missing local archive in the web-profile dependency set, not a declared plugin dependency; this is not currently a confirmed 4.37 regression blocker. UND_ERR_DESTROYED causality and the reporter's environment remain unverified. See [the bounded triage](issue-215-install-triage-2026-09-19.md). #182 was closed as superseded/not planned, not verified support. #208 remains an enhancement; #194, #183 and #207 retain separate acceptance scopes.
+
+The dated checkpoints below are historical and retain their original scope.
+
+---
+
+# Remember delivery checkpoint — 2026-09-19
+
+Remote main was rechecked at `574d55f2f990053c64fabd3fb8867318875183a4`: #212 and #213 are merged. This Remember test/evidence delivery is based on that main and does not change product `src/`, built `lib/`, dependencies, supported-host metadata or experimental defaults. The September 18 checkpoint below is historical, including its then-open PR and unaccepted-live statements.
+
+At test source `ad7c93481096b4750ede77dc93a19b241b7f11e0`, the separately authorized [real A/B controls](../experiments/remember-controlled-live-m15-2026-09-18-9n7e.md) both passed on plain Luna / DSH `0.1.2-rc.1`. A verified retained-user persistence; B verified assistant-origin recall with no target in non-compaction replay input. Each used four requests and distinct writer/resume processes. The [acceptance entry](../experiments/remember-acceptance.md) is the current scope reference.
+
+The [earlier oversized-user failure](../experiments/native-compaction-durable-m15-2026-09-18-1317.md) remains failed and unexplained. Astra, actual UI/fork behavior, repeated/automatic live compaction, tools/images, fault recovery, accounting and long-task quality are not accepted by these controls. #196, #65 and #195 remain open; Think/Split are not incorporated. The [limited user experience plan](../experiments/remember-user-acceptance-plan.md) has no provisioned service or further model budget.
+
+Current delivery authorization covers review, local commit, branch push, one PR and status synchronization only. No merge, package release, deployment, daily upgrade, new credential access or additional real model call is authorized. Exact-head PR checks remain separate from the historical live evidence. The #211 host-side repair evidence was delivered through #212; this PR does not certify stock alpha.2 or close #211.
+
+---
+
+# Adaptive runtime checkpoint — 2026-09-18
+
+Repository: `franksong2702/dsh-codex-connect`. This is a dated checkpoint, not a live dashboard.
+Source baseline: `eae9430f16f1707d8cefb76dec6e8344871d7684` (main, #210).
+GitHub prerelease: `v0.1.0-alpha.4.36`, published 2026-09-17T14:15:19Z at that SHA.
+The Astra/Remember delivery branch `franksong2702/astra-remember-delivery` is independently based on that main commit and is not part of that release. No current npm readback or deployment is implied. The original combined work remains preserved at `3de1b69`; compatibility tooling is delivered separately in [PR #212](https://github.com/franksong2702/dsh-codex-connect/pull/212).
+
+## Current tracks
+
+| Track | Implemented / merged / release state | Remaining gate |
+| --- | --- | --- |
+| Remember #65 / #196 | #197 merged as `78c8f71`; included in the 4.36 release record; native creation remains default-off | Real provider plus JSONL/process restart in one run remains unaccepted. See [the bounded acceptance contract](../experiments/remember-acceptance.md). |
+| Think #167 | Open, head `7315795`; conflicts with main. September 17 history-format repairs are present. | Separate mechanism from proposal policy; refresh complete current-head validation. CodeQL success alone is not full CI. Compaction/multi-agent composition is not supported by this prototype. |
+| Split #199 | Draft design, head `8b52da6`; mergeable but behind main at review time | Review the narrow contract against the current baseline. |
+| Split #200 | Draft implementation, head `694b58e`; targets #199's design branch, not main | Current checks do not include CodeQL. Synthetic Gateway/Chat approval flows exist; human acceptance, persistence and real task-value comparisons remain open. |
+
+The umbrella is #195. These are separate experiments, not three composable switches. No Think/Split source was incorporated in this follow-up.
+
+## Compatibility
+
+Declared hosts remain exactly `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, `0.1.5-rc.2`.
+
+[#211](https://github.com/franksong2702/dsh-codex-connect/issues/211) stays open: alpha.2 changed ordinary startup from disk links to a process-local resolver without preparing peers for the separate `plugin exec` process. A local host-side repair passed a fresh isolated installation and was submitted in [upstream Discussion #5537](https://github.com/deepseek-ai/deepseek-harness/discussions/5537#discussioncomment-18498638). This is not an official alpha.2 fix. The diagnostic changes, upstream patch and pre-split evidence belong to PR #212, not this branch; neither PR depends on the other to run its tests.
+
+Original CI run `35322318396` retained only the JSON-framing symptom. Concrete missing-package evidence came from later local reproductions; it was not recovered from the original CI streams. #207 and #183 keep their separate full-acceptance scope. #182 is an older undeclared candidate, not an implicit supported-version range.
+
+## Authorized follow-up and boundaries
+
+This delivery covers the [Astra context audit](astra-context-audit.md), scoped denial guidance and bounded Remember acceptance preparation. Preparing and pushing the two delivery PRs is authorized; merge, release, deployment, enabled experimental defaults, live credentials and new model requests are outside this task. The previously blocked real durable probe is not retried or routed elsewhere.
+
+Capture fresh local validation separately from historical PR checks. A successful synthetic fixture does not establish user value, token savings or live provider acceptance. The [pre-split record](adaptive-runtime-validation-2026-09-18.md) preserves historical scope; use the delivery PR's exact head and Checks for its current remote CI.

package/docs/agent-notes/adaptive-runtime-validation-2026-09-18.md

@@ -0,0 +1,45 @@
+# September 18 pre-split delivery evidence
+
+## Historical record, not current-head CI
+
+This document preserves the earlier combined local investigation, before the compatibility and Astra/Remember deliveries were split into independent PRs. Statements below about unknown causes, blocked investigation and unpushed code describe that original checkpoint, not the latest project state. Later #211 cause, repair and upstream-submission evidence is tracked in [PR #212](https://github.com/franksong2702/dsh-codex-connect/pull/212). Use [the current checkpoint](adaptive-runtime-status.md) for scope and each PR's exact-head Checks for fresh CI. The real Remember restart probe remains unaccepted and is not retried by this delivery.
+
+## Identity
+
+Repository baseline: `eae9430f16f1707d8cefb76dec6e8344871d7684`.
+Local branch: `franksong2702/astra-goals-1-3-20260918`.
+WebCodex project: `agent:mac-webcodex-trial:dsh-codex-connect-f53ce775-42955146`.
+Workflow session: `wc_sess_cGTpW5Z54AMlbcBs`.
+Runtime: Node `v22.22.3`, pnpm `10.30.3`; frozen-lockfile installation reused the existing package cache.
+
+## Delivered scope
+
+1. Doctor JSON framing diagnostics now distinguish empty, multiline and invalid JSON with byte/line counts, without raw-output/parser excerpts. Strict parsing, candidate classification, support metadata and privacy checks are retained. This improves investigation evidence; #211's upstream root cause is not fixed or claimed verified.
+2. A short contributor router and explicit development/product context audit were added. The only shipped-source change scopes denial guidance to the denied action/dependents while retaining no-bypass, exact-action approval, higher-priority restrictions and the existing breaker.
+3. The bounded durable probe checks actual direct package versions in parent and children before credentials/dispatch, reports those versions, and rejects unverified combinations. Current-state and finite Remember acceptance documentation replace stale entry-point descriptions without deleting historical evidence.
+
+## Executed validation
+
+| Check | Actual result |
+| --- | --- |
+| New denial/durable evidence regression, before implementation | Two expected failures; nine existing tests passed. |
+| Doctor contract, before implementation | Three new content-free diagnostic assertions failed out of 67. |
+| Focused denial/durable/runtime validation after implementation | Three files, 19 tests passed. |
+| Doctor contract after implementation | 67/67 assertions passed, plus the existing 11 synthetic child-routing scenarios. These are checker fixtures, not upstream host installations. |
+| First full check | Failed at TypeScript because the new `.mjs` helper lacked a declaration. A `.d.mts` declaration was added; no test was disabled. |
+| Final runtime-source `pnpm run check` | Exit 0, **94 test files / 897 tests**; workflow contracts, metadata/source lint, host/client typecheck, build, import/CLI checks, declared development-host compatibility and package checks passed. Job `wc_job_RcZsJFijHuBe9Tjl`. |
+| Generated runtime inspection | All nine generated files matched the baseline exactly after substituting only the reviewed notice and shared-chunk filename references. No unrelated runtime/client changes. |
+
+The full check includes real DSH JSONL write and distinct-process restore with synthetic provider responses, native-rejection/fallback blocking, automatic and in-process fork/tool regressions. Only the dedicated subprocess fixture is a process-restart proof. The full check's package validation covered 70 files before this documentation-only evidence file was added; final package/link/whitespace checks are performed at closeout. No claim is made of a fresh four-host/Node matrix, Chromium run or remote CI for this local source.
+
+## GitHub synchronization actually completed
+
+Current dated checkpoints were prepended to #195, #167, #199, #200, #196 and #65; each API response was read back and matched the intended body. Original bodies were preserved, all issues/PRs stayed open, and draft states/base branches were not changed. #211 received [the diagnostic follow-up](https://github.com/franksong2702/dsh-codex-connect/issues/211#issuecomment-5727447681); it remains unresolved.
+
+A transient GitHub read failed with a connection reset; the subsequent read succeeded before updates. No uncertain mutation was blindly repeated.
+
+## Unfinished and excluded
+
+#211 still lacks actual alpha.2 doctor-output framing evidence. Inspection of the upstream DSH release package was blocked by the platform, stopped, and not retried through another execution route. The prior real Remember durable probe also remains blocked/unaccepted and was not retried. These are different blocked operations; neither establishes an account problem or a confirmed core runtime defect.
+
+New real provider dispatches: **0**. No real credentials were accessed or changed. No user service, default capability, supported-version declaration, main branch, release or installed plugin was changed. Code remains on the local branch, not pushed or deployed by this follow-up. Live restart acceptance and measurable Astra/long-task benefits remain unproven.

package/docs/agent-notes/astra-context-audit.md

@@ -0,0 +1,27 @@
+# Astra prompt and context audit — 2026-09-18
+
+Baseline: main `eae9430f16f1707d8cefb76dec6e8344871d7684`. Scope: repository development guidance and plugin-owned model-visible text; not a DSH core prompt rewrite, model benchmark or port of #167/#200.
+
+## Reference and decision
+
+The [OpenAI guidance published September 11](https://developers.openai.com/blog/rethinking-skills-and-prompts-for-gpt-6-astra) recommends precise skill triggers, progressive disclosure and revisiting excessive procedural instructions. Applied here, that means a short task-oriented router and explicit completion boundaries, not a new global Astra persona. Safety and lifecycle constraints remain in code and in the host's authority model.
+
+## Two different context layers
+
+| Surface actually inspected | Finding | Action |
+| --- | --- | --- |
+| Repository `AGENTS.md` / `SKILL.md` discovery | The baseline has neither tracked file. `.agents/notes` contains historical feature notes, not registered skills. | Add a short `AGENTS.md` router. Do not require reading the whole documentation tree or invent a skill installation. |
+| `src/adapter.ts` | The normal adapter preserves the host/pi-ai message pipeline; Astra specialization is catalog/effort metadata, not an injected global procedure. | Keep host-owned system instructions and message conversion. |
+| `src/native-compaction.ts` | Native compaction forwards `context.systemPrompt` and tool definitions; it removes the host's extra summarization instruction for the native operation. | Keep the lifecycle/protocol implementation unchanged. No duplicate repository documentation is injected. |
+| `src/image-tool.ts` | The optional tool already describes one prompt, exact original preservation, conversation preview and service-default size/style. | Keep the concise description and programmatic argument/size guards. |
+| `src/search.ts` | Standalone search submits the query through its provider contract, not a plugin-wide Astra system prompt. | Keep routing, configured model, limits and authentication unchanged. |
+| `src/auto-review-backend.ts` / `src/auto-review-probe.ts` | Risk/authorization instructions belong to the dedicated reviewer or diagnostic request, not every main-agent turn. | Do not shorten safety policy or change the reviewer route to claim Astra optimization. |
+| `src/auto-review.ts` denial notice | The previous wording said to stop/request input without explicitly separating a rejected dependency from independent authorized work. | Scope the stop to the action and its dependents; retain the no-workaround rule and require exact-action approval subject to higher-priority restrictions. |
+
+## Product change and regression boundary
+
+Only the denial notice changes in the shipped-source layer. It still returns `rejected`; it does not create an approval, enqueue a retry, change the three-denial circuit breaker, or replace platform/host policy. Tests retain the existing one-shot approval and breaker behavior and add a single-denial assertion covering independent work, no implicit follow-up, and no new authority.
+
+The guidance is shared by Codex models rather than Astra-only. This is a clearer boundary, not a measured latency/cost reduction. No claim is made that the model will consistently interpret the new wording better until a separately authorized behavioral comparison exists. Repository-agent ergonomics and user-facing product outcomes must not be reported as the same metric.
+
+Think's proposed reasoning changes and Split's synthetic consent UI remain in their own unmerged PRs. This audit does not validate their prompts as deployed behavior or resolve their composition with Remember.

package/docs/agent-notes/issue-211-root-cause.md

@@ -0,0 +1,70 @@
+# Issue 211: missing profile-visible host peers
+
+## Downstream delivery checkpoint — 2026-09-18
+
+The complete upstream patch and generic regression are posted in [Discussion #5537](https://github.com/deepseek-ai/deepseek-harness/discussions/5537#discussioncomment-18498638). This downstream PR contains diagnostic improvements, explicit candidate-verification tooling and historical evidence only. It does not apply the upstream patch to normal installations, expand supported versions or close #211. Astra/Remember changes are delivered separately.
+
+All test counts, source/archive hashes and execution-boundary notes below describe their original pre-split runs. They are not current-head PR CI evidence; later investigation superseded the earlier unknown-cause statements. The PR Checks identify fresh delivery validation. Original investigation history is preserved.
+
+## Repair follow-up — 2026-09-18
+
+The upstream cause is now confirmed and a local repair has passed fresh installation. Alpha.1's ordinary launcher default was `link`; alpha.2 changed it to `runtime`. The separate `dsh plugin ... exec` process did not inherit that process-local resolver. The source repair calls DSH's public profile-local materializer only for explicit CLI `exec`, inside the existing profile write lock, preserving native package identity and cancellation. It does not hand-link named peers or change Codex Connect's business code.
+
+The portable upstream source patch, builder, candidate hashes and detailed results are recorded in repository path `patches/README.md`. A packed repaired `@deepseek-ai/dsh-plugin-manager` was installed into a fresh alpha.2 host before testing; no acceptance-installation file was patched afterward. The original failure was reproduced separately, eight repaired-command regressions passed, and the new installation passed doctor, models, disposal, Reserve, ten process-restart compaction phases and synthetic images. All four unmodified declared hosts also passed with the same Codex Connect archive. The local complete check passed 95 files / 905 tests.
+
+This is a local upstream repair, not an update to the official alpha.2 registry package. No push, publication or daily-service replacement was performed. Issue 211 remains open for upstream delivery and later verification of an unmodified official release. The diagnostic-only findings below are preserved as historical evidence.
+
+## Finding — 2026-09-18
+
+The local exact-DSH `0.1.6-alpha.2` reproduction fails during ESM module linking, before the doctor can produce a report. Its first actual exception is `ERR_MODULE_NOT_FOUND` for `@deepseek-ai/schemastery`. This is an installation/profile dependency-resolution failure, not malformed JSON, extra logging, lost CLI arguments or a model/account failure.
+
+The plugin already declares `@deepseek-ai/schemastery` in `peerDependencies` and deliberately leaves it external in `tsdown.config.ts`. It is present in the isolated DSH installation at version `3.18.2`, but initially invisible from the installed plugin's package directory. Reclassifying it as an omitted declaration or blindly bundling host peers would not describe the observed problem.
+
+The checker obscured this failure: candidate exit 1 is provisionally allowed so a valid `unverified` doctor report can continue, but the startup exception also exits 1. Parsing its empty stdout then replaced the useful stderr exception with the generic one-JSON-line error.
+
+## Evidence and causal control
+
+Original GitHub run `35322318396`, alpha job `105527422364`, used main `eae9430f16f1707d8cefb76dec6e8344871d7684` and Node `24.15.0`. Its complete job log contains 431 lines, but neither doctor stream was retained separately; the artifacts API returned zero artifacts. The exact historical stderr cannot be recovered from that run.
+
+New local observations use Node `22.22.3`, pnpm `10.30.3`, exact DSH `0.1.6-alpha.2`, and the plugin runtime from local commit `5128b7868f53b1a583553aee3125fdf755b8c16a`. This is a concrete reproduction, not a claim to have recovered the original Linux/Node 24 process. Within each comparison the installed plugin CLI bytes were checked against the built source; neither plugin nor host code changed between the control conditions.
+
+| Observation | Result |
+| --- | --- |
+| Ordinary isolated checker, job `wc_job_ktzmpbSbAmf6gytH` | Exit 1; stdout is empty, zero bytes. |
+| DSH `plugin exec` versus direct installed plugin CLI | Both exit 1 with the same missing `@deepseek-ai/schemastery` exception. |
+| Read-only own-entry observer and explicit `--` separator | DSH forwards `doctor --json` correctly; the realpath main-entry comparison matches; the separator does not change the failure. |
+| ESM resolution from the plugin package directory | All 22 declared peers are initially unresolved. Twenty-one exist in the exact host; `react` is not a direct host-root package. |
+| Expose only host `schemastery` inside the disposable profile | The next missing peer becomes `@deepseek-ai/dsh-util-values`; this is broader than one missing library. |
+| Expose the 21 existing host peers inside that same disposable profile | Doctor emits one 1,294-byte JSON report, credential state `missing`, compatibility `unverified`. Exit 1 remains expected for an undeclared host. |
+| Existing installed-runtime check in the dependency-exposure control | Exit 0: eight models prepared, disposal and Reserve transitions verified, ten fresh native-compaction processes across none/zstd encodings, and synthetic direct/PTC image checks passed. |
+
+The final experiment deliberately validates the **original failed doctor result**, even after the control succeeds. Its overall exit stays 1. The manual dependency-exposure control is not normal installation success and does not promote candidate support.
+
+Sanitized machine-readable records:
+
+- [Doctor/entry comparison](../experiments/issue-211-doctor-diagnostic-2026-09-18.json), job `wc_job_YySfh5MGD8JOWuAG`, SHA-256 `4a6ad4cd7876a1c4e3af1a6a470a419d063515c199f9881ee1cdd680da678c80`.
+- [Peer-resolution counterfactual](../experiments/issue-211-peer-resolution-2026-09-18.json), job `wc_job_dsJNi-kcYVSc0i8Y`, SHA-256 `0de54233d7bab215aad9c8c3dd8189aa3c74a718fb7af9a9fcb9ef0603b7a951`.
+
+The last comparison's packed-artifact SHA-256 is `08c8e37e31072fc9f9c94ecead174ff05eb392ae34cc721616a0c784b5a28841`. Different experiment runs can have different archive hashes because evidence documentation is included in the package; no runtime change was used to obtain the counterfactual recovery. Both recorded temporary installations were confirmed absent after completion. No live credentials or provider requests were used. Runtime responses and images remain synthetic, not live acceptance.
+
+## Delivered diagnostic correction
+
+`validateDoctorResult` now recognizes a single `ERR_MODULE_NOT_FOUND` startup exception naming one of this project's declared runtime packages when an undeclared candidate returns exit 1 and empty stdout. It reports only the error code and allowlisted package name, never the raw stderr, importer path or private text. Unknown/ambiguous errors keep the content-free framing diagnostic. Nonempty stdout still goes through strict JSON and schema validation, and infrastructure failures retain their classification.
+
+The regression first failed one of 75 checker assertions, then passed all 75 after the correction. The existing 11 synthetic child-routing scenarios also passed. The temporary observation callback and experimental link/trace helper were removed after recording the evidence; no dependency linking is inserted into the normal checker or product.
+
+Final `pnpm run check` passed on the completed checker/source changes: 94 files / 897 tests, typecheck, lint, build and package gates; job `wc_job_mvDMGKy8frhHrAxO`. The package check included 74 files. Replaying the saved actual process error through the final validator produced the expected safe missing-package diagnostic. Six local documentation links and the whitespace check passed. Generated `lib/` and runtime `src/` are unchanged from this task's starting commit. The GitHub cause report was posted and read back as issue-comment `5727830405`; #211 remained open. This paragraph is a documentation-only addition after that full check.
+
+Ordinary fresh-install reproduction of the unresolved candidate is still:
+
+```sh
+DSH_VERSION=0.1.6-alpha.2 DSH_UNDECLARED_CANARY_VERSION=1 node scripts/check-dsh-install.mjs
+```
+
+This uses a disposable keyless installation. The new error is expected to identify the missing declared package rather than merely empty JSON; the final diagnostic change is separately validated against the saved actual process output without repeating an installation.
+
+## Remaining repair boundary
+
+The observed break is between the isolated host's installed peer packages and the profile/plugin's module-resolution context. The exact upstream source change that stopped exposing those peers has not been inspected or established. The earlier denied upstream-source inspection was not retried. This follow-up used the ordinary permitted installer and black-box process observations instead.
+
+A production repair must restore the supported host/profile peer-resolution contract, preserving shared package identity, then pass a **fresh unmodified installation** and the current host matrix. Manual symlinks in an experiment are not that repair; copying peer packages or silently accepting arbitrary JSON is not an adequate substitute. Keep #211 open with cause localized and repair pending. No new supported version, release, merge, push, deployment or daily-service change is made here.

package/docs/agent-notes/issue-215-install-triage-2026-09-19.md

@@ -0,0 +1,43 @@
+# Issue #215 installation triage — 2026-09-19
+
+## Evidence and limits
+
+The maintainer supplied the report excerpt directly after the earlier detailed issue-body read was blocked. This triage uses that supplied text, repository manifests, official documentation and a separate offline pnpm control. It does not recover or retry the denied issue-body read. The reporter's full hub.log, profile manifests, exact pnpm version and exact Git-install commit remain unavailable.
+
+Reported environment: Windows x64, Node 24.16.0, DSH 0.1.6-alpha.2, Plugin Hub 1.4.2. The summary names a Git-based plugin add, whereas its attempted-channels section lists removal. The complete command/rollback order cannot be inferred from this summary.
+
+## Findings
+
+The first concrete blocking error in the supplied excerpt is ENOENT while opening the local archive `dsh-computer-use-0.2.0-win1.tgz`. The package manager calls this a direct dependency of the web profile, not a Codex Connect dependency. A referenced path component or file was unavailable. How the reference entered that profile and whether the archive was moved/deleted or its path supplied incorrectly remain unconfirmed. Private absolute paths are intentionally omitted here.
+
+Neither current HEAD `525e01b6e1c2b7d23ba70e29510ef1fd31fb0168`, the local 4.37 candidate, nor published 4.36 source `eae9430f16f1707d8cefb76dec6e8344871d7684` declares `dsh-computer-use`, `dsh-plugin` or `dsh-skill-manager` in dependency sections. The current lockfile and plugin patch contain no `dsh-computer-use` reference. Runtime dependencies are unchanged. This is not verification of the reporter's unrecorded exact Git revision.
+
+UND_ERR_DESTROYED means an operation used an already destroyed Undici client; it does not identify who destroyed it or why. The registry warnings could be cleanup/cancellation consequences or a separate transport problem. The excerpt and the control below do not prove that causal link. Sharing an Undici dependency does not attribute this failure to Codex Connect. The auto-generated labels `plugin-side install failure` and `Key error: ERR_DESTROYED` are not established root-cause findings.
+
+Stock DSH 0.1.6-alpha.2 remains undeclared and tracked separately by #211. The missing archive is not established as a duplicate of #211's plugin-exec peer-resolution problem. Repairing an archive reference does not certify alpha.2 compatibility.
+
+## Offline control
+
+Executed on M15 / macOS / Node 22.22.3 / pnpm 10.30.3 at 2026-09-19T10:25:14Z. Only two metadata-only synthetic tarballs were used; no Codex Connect, DSH or Hub runtime was loaded. Every add used `--offline --ignore-scripts --ignore-workspace`, an isolated temporary home/store and empty npm configuration.
+
+| Scenario | Exit | Result |
+| --- | --- | --- |
+| Add the new fixture to a clean project | 0 | Success. |
+| Add the same fixture while another direct dependency references a missing local archive | 254 | ENOENT names the missing existing archive; direct-dependency diagnostic present. |
+| Restore only that archive and repeat the same add in the same project | 0 | Success. |
+
+None of these runs emitted UND_ERR_DESTROYED. This reproduces a package-manager mechanism, not the reporter's Windows/Hub stack or full warning sequence. No live model requests or reporter configuration changes occurred. Temporary files were removed. A sanitized receipt is in ignored `node_modules/.cache/issue215-local-tarball-repro.json`.
+
+## Maintainer response and release disposition
+
+Keep #215 open pending reporter confirmation. Ask the reporter to check the archive using PowerShell `Test-Path -LiteralPath`, inspect the relevant dsh-computer-use entry in the profile package.json/pnpm-lock.yaml, and preserve backups before restoring the trusted archive or intentionally correcting/removing its stale reference through the supported plugin-manager workflow. Do not delete the whole .dsh home, blindly remove lockfiles or use an arbitrary substitute archive.
+
+If installation still fails, request the exact package-manager version and the command-boundary/error section of hub.log, with credentials, auth URLs and unnecessary private paths redacted. Clarify add versus remove. Persistent registry warnings should be investigated separately after the local source blocker is addressed.
+
+For 4.37 on the unchanged declared-supported host set, this is **not currently a confirmed release-blocking plugin regression**. Preparation may proceed with this evidence-backed disposition. Keep the issue open and reassess if a clean supported-host reproduction identifies a plugin defect. Do not claim that 4.37 fixes the archive, the network warnings or alpha.2 compatibility. Candidate review, artifact/compatibility records, remote CI, merge and publication authorization remain separate gates.
+
+## Primary references
+
+- Node.js ENOENT definition: https://nodejs.org/api/errors.html#common-system-errors
+- pnpm 10 install / removed file-dependency targets: https://pnpm.io/10.x/cli/install
+- Undici ClientDestroyedError: https://undici.nodejs.org/api/Errors#clientdestroyederror

package/docs/agent-notes/remember-controlled-probes-delivery.md

@@ -0,0 +1,41 @@
+# Remember controlled probes: local implementation and offline evidence
+
+## Status
+
+Implemented after `263bfcd866fc028798e39d588939ca899d564ba1`, whose parent is merged-main reference `574d55f2f990053c64fabd3fb8867318875183a4`. This delivery is local engineering preparation, not provider acceptance. The [original September 18 live failure](../experiments/native-compaction-durable-m15-2026-09-18-1317.md) remains failed; its three-request grant is exhausted. No new live requests or credential reads were performed.
+
+The native execution channel recovered and actually returned Node `22.22.3`. This does not explain the earlier missing tunnel or the earlier live recall mismatch.
+
+## Implementation
+
+The [controlled acceptance specification](../experiments/remember-controlled-acceptance-plan.md) is now implemented in the existing `scripts/native-compaction-durable-smoke.mjs`, with a shared helper `scripts/native-compaction-controlled-cases.mjs`. There is one credential/transport/persistence implementation, not a second copied runner.
+
+- `--case=retained-user`: a short user message carries the target. The normal retained-user projection survives the real checkpoint and JSONL restore. The synthetic continuation reads the target from the actual retained request item; this is a persistence control, not opaque-state recall.
+- `--case=assistant-origin`: the target is extracted from the actual baseline assistant answer. A real anchor turn moves it into the older prefix. The native request must contain it only in an assistant item; the restored request must contain no plaintext target. The synthetic native response derives a clearly marked fixture envelope from that assistant input, and the fresh-process responder reads the answer only from the replayed envelope. No comparator/expected-target parameter is supplied to this responder. This is not real encryption or evidence of provider semantics.
+- Default/`--case=oversized-user`: the old 65,000-space user-message boundary, prompt, three-dispatch ceiling and strict recall criterion remain separate and tested. Its earlier failure is not erased or explained retrospectively.
+
+A/B each follow baseline, anchor, native compaction, process exit/restore, continuation: four dispatches maximum, with no retry or fallback dispatch. The real DSH range selector is configured with `retainTokens: 0` only inside this isolated fixture. It still retains the newest item and rejects non-shrinking replacements. No host method or production retention code is overridden. The first prompt requests 600-750 words of neutral library prose; accepted material is bounded to 400-1100 words / 12,000 UTF-8 bytes, with Agent maxTokens 2048 and compaction maxTokens 1024. These settings are not a claim about actual live token usage.
+
+The actual JSONL is parsed to locate a checkpoint structurally identical to the committed in-memory checkpoint; merely finding a marker string no longer proves A/B persistence. New-process restore checks the full checkpoint digest. Before dispatch, the retained prefix and opaque item must match their persisted identities. The target must not survive in another active message or request metadata. New assistant events are required after the continuation start; historical correct answers do not satisfy the gate. Recall still requires `reply.trim() === target`, with no case folding or substring acceptance.
+
+Controlled live invocations require an explicit case, Codex-login selection, and run id. An owner-only exclusive claim survives temporary cleanup in ignored `.remember-acceptance-runs/`; a reused id, including reuse for another case, is refused before credentials. This is same-id duplicate prevention, not permission to mint another id after failure. Fault-injection flags are offline-only. Neither the wrapper nor this document authorizes live execution. The historical oversized live path is unchanged and still needs separate authorization before any invocation.
+
+## Validation obtained
+
+The first focused run passed 59 tests over three files, including 31 new controlled-case tests. On the final code, `pnpm run check` completed with **98 test files / 965 passing tests**, plus metadata/source lint, host/client typechecking, build, CLI checks, compatibility check and package check. Original WebCodex job: `wc_job_z9tnGGA5qqaK_EVS`, exit 0. Node: `22.22.3`. This note is a later documentation addition; package/link checks are repeated at closeout. No new Node 24, browser, installed-host matrix or remote CI result is claimed.
+
+[New machine-readable offline observations](../experiments/remember-controlled-offline-evidence.json) summarize 11 actual fixture runs on the final probe/helper hashes:
+
+- Two positive controls finish four simulated dispatches and two distinct successful processes, with exact recall and physical checkpoint equality.
+- Five negative wire fixtures omit the selected target, leak it in plaintext, lose retained-user input, alter the replayed opaque item, or remove it. They stop before the affected synthetic transport, after only two or three simulated dispatches. `guard_failure` records the precise cause even when the host wraps it as an agent/compaction failure.
+- Four case-only/wrapped/wrong/empty answers still fail after four simulated dispatches with `RECALL_MISMATCH_NO_RETRY`. Restore success remains independently recorded.
+
+Additional unit tests reject ambiguous assistant-generated labels, a correct historical answer without a new turn, marker-only physical-file checks, invalid/duplicate flags, unsafe run-ledger symlinks and reused run ids. These unit checks are not mislabeled as actual crash/disk-fault injections.
+
+Original live JSON evidence remains SHA-256 `c8884b6b7fbeedb44f67615b0bfca9c96d4600203929da6627755e27d448aa91`. New offline evidence is SHA-256 `e5af6ff65cf3df5e3121c2e6533caec95be1321a5315a05e9c16ead36522a40f`. Public observations contain classifications, booleans, counts and source identities, not targets, answers, opaque contents or credential paths.
+
+## Next gate and limits
+
+A proposed new live sequence is A first, then B only if A passes, using the previously designated M15 Codex login, plain Luna/low, at most four requests per case (eight total), stopping on any failure or platform denial. It requires fresh user authorization and the platform's normal approval; no unused budget from an old attempt is carried forward. There is no automatic multi-case runner. No manual user product acceptance is required at this engineering stage.
+
+A/B live success would establish bounded same-account/same-model text behavior, not Astra, tools, images, UI forks, crash recovery, repeated compaction, savings or long-task quality. C remains a separately authorized retention-boundary test. This delivery does not push, open a PR, merge, publish, deploy or upgrade daily services, and does not enable experimental defaults.

package/docs/agent-notes/remember-delivery-preparation-2026-09-19.md

@@ -0,0 +1,49 @@
+# Remember delivery preparation — 2026-09-19
+
+## Resumed delivery review — 2026-09-19
+
+After the user's explicit continuation, the normal WebCodex issue-read and evidence-review operations completed. The earlier safety-blocked call remains a historical event; it is not reclassified as a successful execution. Current issue reads found #196, #65 and #195 open, and no existing PR for this delivery branch. Main was still `574d55f`.
+
+The review verified all four new JSON evidence files for raw target/answer, opaque-content, credential and private-path fields; no such payloads were found. Original A/B and failed-run digests remain unchanged. A/B report assertions, distinct process identities, usage sums and probe/helper source hashes match the historical `ad7c934` execution. Product code, built output, dependencies, compatibility metadata and workflows remain identical to the main baseline.
+
+The outstanding local notes below describe the prior interrupted preparation. The resumed task will commit the reviewed evidence and navigation updates, publish one PR and prepend bounded status notes to the three trackers without closing them. PR creation is not a release. Final remote CI must be checked against the PR's exact head; the prior local checks are not remote evidence. See the PR and its read-back status notes for actual submission/check results.
+
+## Historical observed state and publication blocker
+
+The current task is authorized to consolidate the local Remember diagnostics/controlled probes and their existing live evidence into one PR, synchronize the relevant issue status, and prepare a limited user experience plan. It does not authorize another live experiment, merge, release, deployment or daily environment upgrade.
+
+The successful initial observation found local branch `franksong2702/remember-offline-diagnostics-20260918` at `ad7c93481096b4750ede77dc93a19b241b7f11e0`, with preceding diagnostic commit `263bfcd866fc028798e39d588939ca899d564ba1`. Remote main was `574d55f2f990053c64fabd3fb8867318875183a4`. The open-PR read returned #167, #199 and #200; no duplicate Remember delivery PR was observed. Uncommitted changes included the prior live A/B reports, their acceptance entry and existing local handoff records.
+
+A subsequent combined `run_script` request to read issues #196/#65/#195, inspect the live-report structure/hash and review part of the local diff was blocked because OpenAI could not determine the request's safety. It returned no command result. Those reads were not retried, subdivided or moved to another execution route. Their dependent issue writes and public delivery confirmation remain stopped. The blocker is not evidence that GitHub denied write permissions, that the local Runner disconnected, or that the acceptance tests failed. No PR, push, remote CI run or issue update was completed by this preparation.
+
+## Fresh local validation
+
+The independent `pnpm run check` completed successfully under original job `wc_job_xfGLXCEKw2ikT4Qr`, exit 0: **98 test files / 965 tests**, plus the command's lint, typecheck, build, workflow-contract, CLI, compatibility and package checks. The reported package check at that point counted 83 files. This note is a documentation addition after that command. This is fresh local validation of the current code, not remote CI and not additional live-provider acceptance.
+
+The existing A/B evidence narrative and controlled-case tests were read directly. They distinguish normal retained-user replay from assistant-origin opaque-only recall; the oversized-user failure remains separately recorded. Live test source identity is `ad7c934`, not a future delivery commit. No current claim is made that the blocked publication/privacy audit completed.
+
+## Proposed PR text — not submitted
+
+**Title:** `test: deliver bounded Remember restart controls and live acceptance evidence`
+
+**Scope:** Consolidate the prior two local test-tool commits, the original failed oversized-user record, request-derived synthetic controls, content-free recall diagnostics, and the separately recorded successful live A/B controls. Include a clear current-state entry and the [limited user acceptance plan](../experiments/remember-user-acceptance-plan.md). Related to #196, #65 and #195; no automatic closing keywords.
+
+**What is established:** At source `ad7c934`, ordinary Luna on direct DSH `0.1.2-rc.1` / pi-ai `0.84.4` / Cordis `4.0.2` passed one retained-user persistence control and one assistant-origin opaque-only recall control. Each used four requests and distinct writer/resume processes. Physical checkpoint equality, replay identity and a newly generated exact answer were recorded. A intentionally carries the answer in retained user input; B's replay contains no plaintext target outside its opaque item. Eight requests total and 6,737 backend-reported tokens belong to that historical run, not to this PR task.
+
+**What is not established:** The oversized-user failure remains unexplained. These cases do not certify Astra, arbitrary user-message deletion, repeated/automatic compaction, tools, images, UI forks, crashes/disk failure, long-task quality, pricing or savings. The native compaction engine, model choices, credential logic, supported-host declaration and default-off behavior are not intended to change in this delivery.
+
+**Validation:** Cite the fresh local check above as local evidence only. Before publication, complete the outstanding evidence/privacy and final-diff review. After creating the PR, require its exact final commit's normal Linux Node 22/24 tests and four-host matrices, browser regression, Windows contract, dependency review and CodeQL; do not substitute historical checks. No remote checks were run by this task.
+
+**Boundaries:** No additional credential reads or live requests. Preserve one-shot run claims and old outcome records. Do not include `handoff/`, `.remember-acceptance-runs/`, local repair archives or actual session material in the public patch. Do not merge, publish, deploy, upgrade or enable experiments by virtue of opening the PR.
+
+## Proposed issue updates — not submitted
+
+For **#196**, record the bounded Luna A/B persistence and opaque-recall gate as supported by the original execution evidence after publication review, while keeping broader unchecked acceptance items explicit. Do not close the issue in this task or mark untested checklist entries complete.
+
+For **#65**, link the same bounded result as a feasibility/lifecycle data point; retain oversized-user semantics, repeated compaction, long-task quality and accounting/value questions as open research.
+
+For **#195**, advance only the Remember status to reflect its limited A/B evidence and delivery-PR stage. Do not imply Think/Split composition is supported or any new default is enabled. Read the actual current issue text before applying an update; that read is still blocked in this task.
+
+## Next user experience gate
+
+The [experience plan](../experiments/remember-user-acceptance-plan.md) is saved, but no UI entry is provisioned. The intended user task is a short disposable planning conversation with three ordinary constraints, one rejected alternative and one pending action. The engineer verifies actual compaction and shutdown/reopen; the user judges whether the assistant still respects those constraints and continues the pending work. No user installation or shell commands are part of that plan. Serving the UI and spending further model requests require separately scoped authorization.