dsh-codex-connect 0.1.0-alpha.4.39 → 0.1.0-alpha.4.40

package/INSTALL.md

@@ -1,10 +1,10 @@
 # Installation Runbook for CLI Agents
 
-Published Alpha 4.38 is verified with DSH `0.1.2-rc.1` and pi-ai `0.84.4` within `^0.84.2`, and with each exact DSH `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` model-runtime pairing using pi-ai `0.85.1`.
+Published Alpha 4.39 is verified with DSH `0.1.2-rc.1` and pi-ai `0.84.4` within `^0.84.2`, and with each exact DSH `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` model-runtime pairing using pi-ai `0.85.1`.
 
 Install `dsh-codex-connect` into one requested DeepSeek Harness profile without changing its current default model, search route, global configuration, or OAuth state.
 
-Channel snapshot on 2026-09-20: npm `alpha` points to `0.1.0-alpha.4.38`; `latest` intentionally remains on `0.1.0-alpha.4.34`. Use the exact-version commands below for 4.38. Publishing an Alpha and promoting the default installation channel are separate actions.
+Channel snapshot on 2026-09-21: npm `alpha` points to `0.1.0-alpha.4.39`; `latest` intentionally remains on `0.1.0-alpha.4.34`. Use the exact-version commands below for 4.39. Publishing an Alpha and promoting the default installation channel are separate actions.
 
 ## Safety requirements
 
@@ -25,17 +25,17 @@ Check `dsh --version` before changing the requested profile. Use `dsh --help` to
 | `0.1.0-rc.7` | `0.1.0-alpha.4.14` |
 | `0.1.1-rc.2` | `0.1.0-alpha.4.21` |
 | `0.1.2-alpha.2` | `0.1.0-alpha.4.23` |
-| `0.1.2-rc.1` | `0.1.0-alpha.4.38` |
+| `0.1.2-rc.1` | `0.1.0-alpha.4.39` |
 | `0.1.2-alpha.5` | `0.1.0-alpha.4.25` |
-| `0.1.5-alpha.1` | `0.1.0-alpha.4.38` |
-| `0.1.5-rc.1` | `0.1.0-alpha.4.38` |
-| `0.1.5-rc.2` | `0.1.0-alpha.4.38` |
+| `0.1.5-alpha.1` | `0.1.0-alpha.4.39` |
+| `0.1.5-rc.1` | `0.1.0-alpha.4.39` |
+| `0.1.5-rc.2` | `0.1.0-alpha.4.39` |
 
 If your exact DSH version is unknown or not listed, preserve the installed host, report that the combination is unverified, and verify it before making installation changes. A missing record does not prove incompatibility, and the catalog's latest verified DSH version is not the latest upstream release. Do not recommend upgrading or downgrading DSH merely to match a row. Investigate any specific failure and seek verification of the installed combination. Do not blindly install `dsh-codex-connect@alpha`: `alpha` is a moving tag, not a compatibility guarantee. Do not infer support for newer DSH versions from these rows.
 
-Alpha 4.38 requires one consistent DSH plugin API version: `0.1.2-rc.1` with `@earendil-works/pi-ai` `^0.84.2`, or one of `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` with pi-ai `0.85.1`; Node.js remains `^22.19.0 || >=24.0.0`. Mixed host versions and other DSH/pi-ai combinations remain unverified. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 remains the verified choice for DSH `0.1.2-alpha.2`, Alpha 4.21 remains the verified choice for DSH `0.1.1-rc.2`, and staying on DSH `0.1.0-rc.7` means selecting Alpha 4.14. Changing DSH is a separate operation requiring the user's explicit request; a plugin update request does not authorize it. The repository's `pnpm --silent run check:compatibility` remains a strict development/release dependency gate, not a recommendation to change a user's host.
+Alpha 4.39 requires one consistent DSH plugin API version: `0.1.2-rc.1` with `@earendil-works/pi-ai` `^0.84.2`, or one of `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` with pi-ai `0.85.1`; Node.js remains `^22.19.0 || >=24.0.0`. Mixed host versions and other DSH/pi-ai combinations remain unverified. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 remains the verified choice for DSH `0.1.2-alpha.2`, Alpha 4.21 remains the verified choice for DSH `0.1.1-rc.2`, and staying on DSH `0.1.0-rc.7` means selecting Alpha 4.14. Changing DSH is a separate operation requiring the user's explicit request; a plugin update request does not authorize it. The repository's `pnpm --silent run check:compatibility` remains a strict development/release dependency gate, not a recommendation to change a user's host.
 
-The Alpha 4.38 recommendation follows successful exact-release main CI, 1012 local tests, 32 Chromium tests, and a four-host same-artifact installation matrix with 40 fresh native-compaction lifecycle processes. Independent post-publication download verified that npm's archive is byte-identical to the tested artifact and the release workflow's verified package; the Git tag resolves to the exact release commit. These are synthetic-provider installation/lifecycle checks, not new real-account acceptance or a newly exercised published-package upgrade. See [.github/ALPHA_438_PUBLICATION.md](.github/ALPHA_438_PUBLICATION.md). Native context management remains opt-in. The preview-only DSH checkpoint-retry patch is not installed by this plugin, and stock DSH 0.1.6-alpha.2 remains undeclared. A separate DSH 0.1.6-alpha.1 canary also passed with this artifact on macOS/Node 22.22.3; it does not broaden declared support or prove Windows/live-account recovery for #219.
+The Alpha 4.39 recommendation follows successful exact-release main CI, 1,037 local tests, 32 Chromium tests, and a four-host same-artifact installation matrix with 40 fresh native-compaction lifecycle processes. Independent post-publication download verified that npm's archive is byte-identical to the tested artifact; the Git tag and GitHub prerelease resolve to the exact release commit. These are synthetic-provider installation/lifecycle checks, not new real-account acceptance or a newly exercised published-package upgrade. See [.github/ALPHA_439_PUBLICATION.md](.github/ALPHA_439_PUBLICATION.md). Native context management remains opt-in. Stock DSH 0.1.6-alpha.1 and alpha.2 remain undeclared; their separate compatibility trackers are not broadened by this release.
 
 Historical Alpha 4.35 evidence (not relabeled as 4.37):
 
@@ -64,10 +64,10 @@ Alpha 4.33 omits the `modelErrors` profile field required by RC model packages,
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.23
    ```
 
-   For DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2`, use Alpha 4.38:
+   For DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2`, use Alpha 4.39:
 
    ```sh
-   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.38
+   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.39
    ```
 
    For DSH `0.1.2-alpha.5`, use Alpha 4.25:
@@ -76,7 +76,7 @@ Alpha 4.33 omits the `modelErrors` profile field required by RC model packages,
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.25
    ```
 
-   If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.38'` only for the DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2` combinations.
+   If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.39'` only for the DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2` combinations.
 
 3. Run `dsh web --help` once to compose the installed profile without starting the server. DSH `0.1.2-rc.1` prepares profile plugin dependency fallback during this step.
 4. Run `dsh --profile web --dump-config` and require exactly one `llm-openai-codex` row loading `dsh-codex-connect`.

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   git hash-object README.md docs/README.zh.md
-README.md: 1b0dd174f9f6cd5cde9034ce0931cdd7b2fda5b8
-docs/README.zh.md: 302b9f4e768307b51ab1a6740ba95ee87599c7e4
+README.md: dd62e2e61bb8541efc785538d1510afb37c4e221
+docs/README.zh.md: 4bf1f92786f86c484343b57a8259dd5a769a2a26

package/README.md

@@ -16,17 +16,17 @@ This guide describes the published pairings below. Check `dsh --version` first a
 
 | Requirement | Verified pairing |
 |---|---|
-| Codex Connect | `0.1.0-alpha.4.38` |
+| Codex Connect | `0.1.0-alpha.4.39` |
 | DeepSeek Harness | `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2` |
 | Node.js | `^22.19.0 \|\| >=24.0.0` |
 | Account | ChatGPT OAuth with access to the requested Codex model; availability is decided by OpenAI |
 
-As of 2026-09-20, npm `alpha` points to 4.38 while `latest` intentionally remains on 4.34. Use the exact version below for 4.38; this recommendation does not promote the default installation channel.
+As of 2026-09-21, npm `alpha` points to 4.39 while `latest` intentionally remains on 4.34. Use the exact version below for 4.39; this recommendation does not promote the default installation channel.
 
 ### 1. Install
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.38
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.39
 dsh web
 ```
 
@@ -65,6 +65,8 @@ dsh plugin --profile web exec dsh-codex-connect doctor --json
 
 ## Optional capabilities
 
+**Unreleased model compatibility:** the development branch also supplies `gpt-6-sol` and `gpt-6-luna` when older provider catalogs omit them, retaining native metadata when present. Both expose Low through Max (including Xhigh); Default omits an explicit effort. Codex Sol's Ultra orchestration mode is not implemented. New task grants can explicitly include these models, but existing grants, GPT-5.6 Sol/Medium startup and Luna Reserve remain unchanged. This is not included in the published 4.39 package or proof of account access. See [compatibility scope and validation](docs/experiments/gpt6-sol-luna-compatibility.md).
+
 All options below are off on a fresh installation. Edit them in **Settings → Plugins → Plugin configuration → Codex Connect** or **Settings → Models → Openai-Codex → More settings**, then select **Save changes**. A conflict or failed save preserves your draft.
 
 | Capability | Enable with | Important behavior |

package/docs/README.zh.md

@@ -16,17 +16,17 @@ Codex Connect 为标准 Harness agent loop 添加 `openai-codex` 模型提供方
 
 | 要求 | 已验证组合 |
 |---|---|
-| Codex Connect | `0.1.0-alpha.4.38` |
+| Codex Connect | `0.1.0-alpha.4.39` |
 | DeepSeek Harness | `0.1.2-rc.1`、`0.1.5-alpha.1`、`0.1.5-rc.1` 或 `0.1.5-rc.2` |
 | Node.js | `^22.19.0 \|\| >=24.0.0` |
 | 账户 | 通过 ChatGPT OAuth 使用所请求的 Codex 模型；可用性由 OpenAI 决定 |
 
-截至 2026-09-20，npm `alpha` 指向 4.38，`latest` 则有意保留在 4.34。安装 4.38 请使用下方精确版本命令；文档推荐更新不代表默认安装渠道已提升。
+截至 2026-09-21，npm `alpha` 指向 4.39，`latest` 则有意保留在 4.34。安装 4.39 请使用下方精确版本命令；文档推荐更新不代表默认安装渠道已提升。
 
 ### 1. 安装
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.38
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.39
 dsh web
 ```
 
@@ -65,6 +65,8 @@ dsh plugin --profile web exec dsh-codex-connect doctor --json
 
 ## 可选能力
 
+**尚未发布的模型兼容：**开发分支会在旧提供方目录缺失时补充 `gpt-6-sol` 和 `gpt-6-luna`，已有原生定义时保留其元数据。两者提供 Low 到 Max（含 Xhigh），Default 不指定推理档位；尚未实现 Codex Sol 的 Ultra 编排模式。新任务可明确授权使用它们，但已有授权、GPT-5.6 Sol/Medium 起步与 Luna Reserve 不变。这些改动不包含在已发布的 4.39 包中，也不代表账户调用资格已验证。参见[兼容范围与验证](experiments/gpt6-sol-luna-compatibility.md)。
+
 以下选项在新安装时全部关闭。请在 **设置 → 插件 → 插件配置 → Codex Connect** 或 **设置 → 模型 → Openai-Codex → 更多设置** 中编辑，再点击 **保存更改**。发生冲突或保存失败时会保留草稿。
 
 | 能力 | 启用字段 | 重要行为 |

package/docs/agent-notes/adaptive-runtime-status.md

@@ -1,6 +1,48 @@
-# Alpha 4.39 preparation checkpoint — 2026-09-21
+# Phase 1 merged / Phase 2 main-based review — 2026-09-23
 
-Remote main is `6ce8a37ca7c28640a43b9189b767e4f6212cea7e`, the normal merge of #227. Published Alpha `0.1.0-alpha.4.38` remains the current public recommendation while 4.39 is prepared; `latest` remains separately managed at 4.34. #227 centralizes authenticated `chatgpt.com/backend-api` request governance across Model/pi-ai, Search, quota, image generation, Auto-review and native compaction. It preserves pi-ai's model identity, uses honest plugin identity on plugin-owned direct routes, adds per-attempt correlation, bounded admission, cancellation/deadline composition, proxy lifetime and server-directed lane cooldown. It does not establish the unverified risk-control hypothesis from #219.
+Phase 1 #236 was reviewed and squash-merged as `3c3d1762536efafaecefb36146e062dad5edd4f8`; its tree exactly equals reviewed `76c3c0c`. Main's active ruleset permits squash only. The Phase 2 branch retains its source history and connects that identical Phase 1 main tree without changing product bytes; #239 now proceeds through a main-based exact-head CI/CodeQL gate. Source branches remain intact. This supersedes the historical no-push/no-merge status below, not their evidence limitations.
+
+Fresh independent review found no remaining confirmed blocker in Phase 2 `76c3c0c..4b5d485` and the supplemental Phase 1 authority/stop/recovery pass. A suggested cancellation window was withdrawn after verifying the code executes synchronously with no reentrant revoke path. Focused Phase 2 checks passed 3 files / 40 tests. The exact installed `4b5d485` also passed all eight native Session groups on DSH `0.1.5-rc.1` / Node `26.5.0`, matching the actual 3081 version combination, with npm 10.9.3 peer checks and selected vendor floors. All nine installed library hashes were verified; cleanup and fixture removal passed; real provider requests were zero.
+
+This is still isolated synthetic acceptance, not acceptance of existing 3081 sessions/host patches or real model quality. Actual 3081 installation/restart awaits its explicit scoped approval; 3080, npm release/publish and real model requests remain untouched. See the [updated acceptance gate](../experiments/adaptive-task-phase2-acceptance.md#main-based-integration-gate).
+
+# Phase 2 E exact-host and installed Session local candidate — 2026-09-23
+
+Continued from local `dcd5cab`, without changing Phase 1 #236 or main. [E acceptance and evidence](../experiments/adaptive-task-phase2-acceptance.md) records the pre-integration gate, single default-off product composition, per-root artifacts, optional-service compatibility and child prompt isolation. Product bytes are `20e6ecf`; the final test/checker/docs changes do not alter them. Legacy grants gain no delegation permission; explicit v2 upgrade and separate source/model/effort consent remain mandatory.
+
+Node 22.19.0 and 24.13.0 each passed 115 files / 1,234 tests in the complete check. Final four-host matrices on both Nodes passed the same 130 checks plus 18 crash cases / 36 fresh processes per combination, at bundle `6cc3da121ef360bc5193e7eef986623310d4491204d9fc7f80b0b93b0c86e7fd`. The committed installed baseline candidate passed eight native Session groups, including real parent/child loop, shared title accounting, restart without replay, native Stop, manual Terra/Default and safe downgrade/re-upgrade. Owned browser/host cleanup was verified; all model responses and credentials were synthetic. Independent review found no remaining confirmed runtime issue.
+
+Material qualification: the installed full page used baseline DSH's published Cordis dependency floors and npm 10.9.3 with peer checks. A newer stock loader combination failed even without this plugin; npm 11 also rejected the exact peer closure. Neither is certified by the passing fixture. No daily profiles/3080/3081, real-provider requests, push, GitHub mutation, merge, release or deployment occurred. Next is a separately reviewable Phase 2 PR and exact-head remote CI after explicit authorization, not an automatic release. Historical A–D checkpoints below describe their earlier integration state.
+
+# Phase 2 D consent and safe-transition local candidate — 2026-09-22
+
+Continued from local `fae0a2d` in the isolated ledger branch, leaving Phase 1 #236 unchanged. [Consent and transition contract](../experiments/adaptive-task-phase2-consent.md) records explicit v1/v2 composition, authenticated optional file/model/effort consent, existing-dialog status, archive-verified downgrade and counter/provenance-preserving re-upgrade. Product `src/index.ts` still constructs Phase 1; the v2 composition is only assembled in disposable tests. Shared decoder/hooks and built client/runtime bytes changed, not dependencies/defaults.
+
+Final local `pnpm run check` passed 114 files / 1,221 tests on Node 24.13.0 and baseline DSH 0.1.2-rc.1; browser regression passed 50 tests. Authenticated Phase 2 checker passed all 13 cases (including a four-request parent/child browser journey); old Phase 1 checker passed six. Current crash matrix passed 18 cases / 36 fresh processes. Independent review confirmed the full-receipt safety-exit fix and the corrected contention-test accounting; prior lock-timeout failures are retained in the local delivery evidence. No real credentials/provider, push, GitHub mutation, merge, release or deployment. E remains four-host/two-Node runtime identity plus installed full Session acceptance, followed by reviewed default-off product integration.
+
+# Phase 2 C recovery and root-integration local candidate — 2026-09-22
+
+Continued from local `a26a6d6`, without changing Phase 1 #236. [Recovery contract and evidence](../experiments/adaptive-task-phase2-recovery.md) records v2 main-model changes, root auxiliary accounting, original-history portability, manual takeover and same-owner idle resume. Real-loop SIGKILL recovery passed 18 cases across 36 fresh processes with two host encodings; no replay, counter rollback or fabricated delivery. Final local check passed 112 files / 1,200 tests. The executor remains internal: product entry point, v1 behavior and built runtime are unchanged. Next gates are migration/downgrade, authenticated optional UI/default-off integration, and full host/Node/installed-session acceptance. No push or GitHub/production changes in this slice.
+
+# Phase 2 restricted execution local candidate — 2026-09-22
+
+Continued from local A commit `6d21243` in the same isolated branch. [Execution contract and evidence](../experiments/adaptive-task-phase2-execution.md) records the new evidence/artifact store, real owned-host bridge and internal executor. The synthetic real-host path now goes parent → bounded child read/submit → cleanup → durable original tool-result reconciliation → parent continuation. No product entry point or built runtime is changed; C crash matrix, D/E UI/compatibility and migration gates remain open. No push or GitHub changes in this slice.
+
+# Phase 2 A isolated ledger development — 2026-09-22
+
+This local branch starts at #236's tested `76c3c0c`, without changing that PR or main. The user approved root-owned plugin persistence after a required custom Session event could be written/flushed but not cold-loaded on baseline DSH. [Slice A](../experiments/adaptive-task-phase2-ledger.md) adds dormant strict v2 ledger primitives; no migration, child tools, transport, UI or real-profile change is enabled. The same atomic task file owns authorization, request counters and retained replay records. Evidence and remaining gates are in that contract. No push, merge, publish or deployment is included.
+
+# Consolidated Phase 1 candidate — 2026-09-22
+
+This branch starts directly from main `1748bec`. Its current product contract is [task-level model selection](../experiments/adaptive-task-phase1.md): default-off, Sol/Medium, one task grant, bounded main-model/effort changes and handoffs, shared request accounting, safe stop/manual takeover and interrupted restore. Candidate #236 at `0a09e04` passed all eight remote checks. Main remains `1748bec`; the candidate is unmerged. No Think/Split product setting or M2/M3 runtime is included.
+
+The maintainer subsequently authorized closing eleven legacy PRs: #167/#199/#200/#220/#221/#222/#224/#232/#233/#234/#235. They are now closed, not merged; source branches and evidence remain intact. #195 is the unified roadmap, and #198 owns dynamic Phase 2 delegation. Do not follow historical instructions below to revive/rebase the old Think/Split stacks.
+
+Follow-up implementation `2b1bd5d` includes the installed full-Session synthetic harness, the cold-restore UI readiness/unknown-state fix and the manual Default display correction. [Phase 1 installed acceptance](../experiments/adaptive-task-phase1-acceptance.md) passed 9 journeys on baseline DSH, with 1,094 core and 43 browser tests passing locally; an initial host-start timeout remains recorded separately. Backend bytes/defaults/dependencies are unchanged. The maintainer authorized updating #236 with these fixes and records on 2026-09-22; consult the PR's exact head for subsequent CI, since `0a09e04` checks do not certify the fixes. The [Phase 2 design](../experiments/adaptive-task-phase2-design.md) is a separate proposal, not runtime behavior. No merge, release, deployment or live-account acceptance is implied. The dated checkpoints below are historical.
+
+# Alpha 4.39 published checkpoint — 2026-09-21
+
+Alpha `0.1.0-alpha.4.39` was published from `e78f934b77685fd653a91d0109a043b489d52116` through successful workflow `35552461838`; exact-main CI `35552132368` passed first. npm `alpha` now points to 4.39 while `latest` remains separately managed at 4.34. The public npm archive, tag and GitHub prerelease were independently read back and match the release commit and tested artifact. See [publication verification](../../.github/ALPHA_439_PUBLICATION.md). #227 centralizes authenticated `chatgpt.com/backend-api` request governance across Model/pi-ai, Search, quota, image generation, Auto-review and native compaction. It preserves pi-ai's model identity, uses honest plugin identity on plugin-owned direct routes, adds per-attempt correlation, bounded admission, cancellation/deadline composition, proxy lifetime and server-directed lane cooldown. It does not establish the unverified risk-control hypothesis from #219.
 
 The second review of #227 found and fixed response-lifetime/cancellation leaks, cooldown admission races, queued deadline gaps, Request-signal propagation and authenticated redirect risks before merge. All eight exact-head GitHub checks passed on the corrected head. The overlapping #226 is now closed as superseded and must not be revived independently.
 
@@ -20,7 +62,7 @@ Declared DSH hosts remain exactly `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, a
 
 #219 remains open for the external reporter to confirm whether the original persistent overloaded condition recurs under comparable normal use. #215 remains primarily blocked on the reporter's missing local profile archive evidence. #194 waits for natural Luna Reserve eligibility rather than manufactured exhaustion. #208 remains an independent opt-in “new session Fast Mode default” enhancement.
 
-Alpha 4.39 preparation is authorized through normal review/merge/OIDC publication. It must not change daily services, use live credentials/models, promote `latest`, or silently enable experimental defaults. Candidate verification and publication evidence belong in [.github/ALPHA_439_RELEASE_READINESS.md](../../.github/ALPHA_439_RELEASE_READINESS.md) and the eventual publication record.
+Alpha 4.39 is released; the post-publication documentation update changes repository guidance only and does not republish npm. No daily service, live credential/model, `latest` promotion, or experimental default changed. Candidate evidence remains in [.github/ALPHA_439_RELEASE_READINESS.md](../../.github/ALPHA_439_RELEASE_READINESS.md); immutable publication identity is in [.github/ALPHA_439_PUBLICATION.md](../../.github/ALPHA_439_PUBLICATION.md).
 
 The dated checkpoints below are historical and retain their original scope.
 

package/docs/design.md

@@ -8,6 +8,12 @@ The bundle patch inserts only `llm-openai-codex`. It never writes `agent-default
 
 The Host registers `llm-openai-codex` as the plugin-owned capability settings namespace. DSH's `llm-pi-ai` catalog owns the `openai-codex` configurable-provider directory entry, while Codex Connect registers the active adapter without redeclaring that entry. The browser binds the plugin namespace through Harness's settings-scope transport and renders account, quota, Save/Discard capability controls in the existing Plugin configuration card. Revision-fenced field writes preserve unrelated settings. Committed changes reconcile search and image registrations live. Default-model settings are never written.
 
+## Task-level model selection (unreleased Phase 1 candidate)
+
+The optional conversation control grants a bounded main-model/effort scope to one task, initially Sol/Medium. The task runtime, adapter dispatch wrapper and existing backend governor share durable request accounting. There is no separate Think, Split or Remember product selector. Host-owned permissions, session history and compaction remain their existing owners; model choice grants no new tool authority. See [the consolidated contract and migration](experiments/adaptive-task-phase1.md) for source selection from #232–#235, cancellation, recovery and acceptance limits.
+
+The local unreleased Phase 2 candidate implements [task-scoped read-only delegation](experiments/adaptive-task-phase2-design.md), tracked in #198. A single composition preserves v1 grants until an explicit idle upgrade; child model/effort and evidence-file consent are separate from the main-task grant. Every root has an owner/session-bound private artifact namespace. Ordinary standalone adapters still need only `llm`; task controls require live agent and session services. New sessions remain off. See [Phase 2 exact-host and installed acceptance](experiments/adaptive-task-phase2-acceptance.md) for current verification, failures and remaining gates. [Phase 1 acceptance](experiments/adaptive-task-phase1-acceptance.md), local implementation, remote CI and release authority remain separate.
+
 ## OAuth persistence
 
 The plugin uses `$DSH_HOME/.openai-codex-auth.json`, separate from Codex CLI/Desktop state. Format version 2 stores at most 16 OAuth accounts and names exactly one active account. Existing version-1 documents remain readable and migrate on the first credential mutation; that migration first creates the owner-only `.openai-codex-auth.json.v1-backup` rollback copy. A pre-existing rollback copy must be owner-only and match the current version-1 document or migration stops before replacing the main document. Removing any account or signing out deletes the rollback copy so removed credentials do not persist there. Documents are limited to 512 KiB. POSIX reads reject group/world-accessible files, non-regular files are rejected, writes are atomic, and mutations use the Harness cross-process file lock. Callers receive cloned credentials.

package/docs/experiments/adaptive-task-evaluation.md

@@ -0,0 +1,34 @@
+# Phase 1 comparison plan — no live model runs performed
+
+This is the agreed first evaluation corpus specification, not benchmark evidence. Before running, select a non-secret repository snapshot, record its exact revision, provide the same original task and permitted tools to every arm, and write executable acceptance checks. Use isolated worktrees and fresh sessions. Do not use this plan to start a real account/model test without explicit task and usage authorization.
+
+## Twelve tasks
+
+| Id | Task | Acceptance established before execution |
+| --- | --- | --- |
+| S1 | Add a documented optional boolean setting to a small fixture | Off default; save/reload; malformed values rejected; no unrelated behavior changes |
+| S2 | Fix an off-by-one pagination bug | First/last/empty pages; stable cursor; regression that failed before the fix |
+| S3 | Add one English/Chinese label | Both locales; narrow-screen accessible label; no routing or authority change |
+| R1 | Repair stale UI state after switching sessions | Delayed old response cannot overwrite new session; requests cancelled; no mutation retry |
+| R2 | Add a bounded parser for a documented event | Valid/rejected schemas; chunking/oversize cases; safe failure without raw credential output |
+| R3 | Refactor duplicated deterministic request metadata | Both callers preserved; no new external calls; exact headers and errors checked |
+| H1 | Diagnose cancellation versus queued network work | Deterministic reproduction; correct cleanup; no leaked slot and no false success |
+| H2 | Repair a race in persisted request reservations | Concurrent and separate-process attempts cannot exceed the shared cap or reset counters |
+| H3 | Review a cross-session authorization boundary | Seeded flaws independently identified with source evidence; false positives recorded; scope unchanged |
+| L1 | Preserve an explicit requirement across two compactions | Exact requirement survives in effective context; no fabricated history or repeat work |
+| L2 | Continue a partial implementation after process replacement | Original task and changes retained; correct interrupted state; no repeated authority/action |
+| L3 | Finish a staged change, then a user-requested manual exit | Successful phase acceptance plus normal manual continuation and no implicit auto-resume |
+
+The existing synthetic host/UI/persistence tests provide mechanical examples of several criteria, not measured model performance on these twelve tasks. Do not grade “used Astra” or “handed off” as success. A correct no-handoff solution can be best.
+
+## Arms and recording
+
+Compare fixed Sol/Medium with Phase 1 starting Sol/Medium under the same allowed model pool and task request ceiling. On representative tasks include direct Luna/Max, Terra/Medium and Astra/Low controls so an unnecessary Sol prelude cannot masquerade as a gain. Use identical cleaned task state, environment, permissions, requirements and acceptance tests. Record the exact model/catalog/effort versions and any nondeterministic setting. Repeat each screened task at least three times in randomized arm order before drawing a tentative conclusion; this is a pilot, not a population-wide savings claim.
+
+For each run retain independent acceptance outcomes, final diff and failed checks, whole-task elapsed time, every managed model/compaction/auxiliary request reservation, available provider token counters with absent values explicitly unknown, retry/failure/interruptions, and user interventions. Do not add reasoning tokens a second time to inclusive output fields. Keep provider pricing separate from subscription usage. Store artifacts privately with redaction and explicit retention; do not upload prompts or project sources as telemetry.
+
+Freeze the rubric before opening outputs; review without route labels when practicable. Report all failures and timeouts, not only completed runs. A framework stop is not a correct solution. Compare quality first, then the time/resource/interruption tradeoff at comparable quality. Count the cost of context expansion, lost caching and handoff verification. Model self-confidence and the number of models used are not grading criteria.
+
+## Go/no-go
+
+Security/lifecycle failures block promotion regardless of average results. A candidate must not materially degrade simple-task correctness or add needless user interruptions. An observed benefit must recur on more than one task/repetition and survive comparison with a suitable fixed-model control. Publish uncertainty and per-task exceptions rather than one unsupported global percentage. Remove or narrow consistently unhelpful choices. Full live protocol acceptance and human comprehension remain distinct gates from this pilot's measurements.

package/docs/experiments/adaptive-task-phase1-acceptance.md

@@ -0,0 +1,106 @@
+# Phase 1 installed Session-page acceptance — 2026-09-22
+
+The full installed Session-page **synthetic** gate passes on local commit `2b1bd5d5de9952b4dd9f83434afd9d16af0dafa6`, Node 24.13.0 and exact baseline DSH `0.1.2-rc.1`. This is not daily-profile, real-account, model-quality or economic-benefit acceptance.
+
+At completion of the local run, draft #236 still pointed to `0a09e04d09de60930e85f9e87b9a6c97b43f1647`; its eight green checks belonged to that old head. Main was `1748bec2d7cfd6ec72ef64ed6bf341bb47be0424`. The maintainer subsequently authorized pushing these fixes and acceptance records to #236 and checking new-head CI. This document records local acceptance, not a prediction of that CI result. No merge, release, publish or deployment occurred; Phase 2 remains a design proposal.
+
+## Actual installed surface and identity
+
+`scripts/check-adaptive-task-session.mjs` installs an immutable `git archive HEAD` package with the exact host dependency closure in a new disposable DSH home. It launches stock `dsh web` on a random loopback port and drives the real shell/client registration, native workspace/Session creation, Composer, model picker and Stop. No replacement page or fixture message API is involved. All installed `lib/` filenames/hashes are compared with the archived source; installed host package paths/versions are recorded.
+
+Artifact SHA-256: `40284d656cc32834eab1515cbba6859769440ea6d8125809c58a401a9ba1cb9b`. The successful run recorded two distinct host PIDs, seven synthetic wire requests and zero real provider calls. The preloader provides synthetic OAuth/SSE; runtime and browser networking reject unexpected destinations. Public npm downloads are allowed during preparation: this is not an air-gapped installation claim. Daily 3080/3081, existing profiles and real credentials were not used.
+
+## Nine passing journeys
+
+1. Real empty Session: control present, default off, no request before consent.
+2. Narrow Sol/Medium and Luna/Max consent, limit 6; drop committed start response, show uncertainty, reconcile by reading, never duplicate the command.
+3. Native Composer → Sol/Medium → routing tool → Luna/Max; original requirement retained; one ledger at 2/6.
+4. New Session remains off/0; switching back and reloading preserve the grant/count without dispatch.
+5. Same browser/authority, fresh host process: interrupted at 2/6, no unsolicited work; explicit resume and a new message reach 3/6.
+6. Native Stop generating aborts the held request, leaves stopped/4 and no queued continuation.
+7. Manual takeover, native Terra/High then Terra/Default: actual wire honors both, routing tool absent, retired automatic counter stays 4/6.
+8. Separate one-request task attempts handoff; second dispatch is denied, mode limit/reserved 1. Handoff does not grant another budget.
+9. No uncaught browser errors/unexpected network attempts; browser/hosts close, listener refuses connections, successful disposable fixture removed.
+
+## Defects found and corrected
+
+The shell can render the plugin slot before restoration publishes the live root. Old-head cold reads returned HTTP 409 `TASK_LIVE_ROOT_REQUIRED`; the panel remained unavailable and misleadingly labelled unknown state as automation off. Waiting merely for an editable Composer did not reliably remove the race.
+
+The fix retries **only this read-only 409**, at most three attempts with 250/500ms delays under the existing deadline. Other errors fail closed. Commands and model requests never retry automatically. Unknown state has an explicit English/Chinese label. Panel ownership is bound to Session ID; closing/switching cancels reads and delays. The final installed report records the cold-restore 409 followed by 200 and the expected interrupted state.
+
+Screenshot review also found that a manual request with Default effort has no explicit model/effort pair, but the panel incorrectly called this “No model request yet.” The fallback now distinguishes absence of an explicit pair from an untouched task; counters and execution were already correct. A focused browser regression and the installed-page assertion cover this case.
+
+Independent read-only review covered the actual UI/transport boundary, authority/cancellation semantics and final fallback copy. No blocking finding remained; its suggested Close-specific cancellation regression was added and passed.
+
+## Verification
+
+| Actually executed check | Result |
+| --- | --- |
+| `PATH=/usr/local/bin:$PATH pnpm run check` | Exit 0; 108 files / 1,094 tests plus lint/type/build and existing contract/pack checks. |
+| `PATH=/usr/local/bin:$PATH pnpm run test:browser` | Final exit 0; 9 files / 43 tests, five new restoration/cancellation/Default cases. |
+| `pnpm run lint:source`, `pnpm run typecheck`, `pnpm run build` under Node 24 PATH | Final rerun exit 0 after the UI changes. Backend built bytes unchanged; client rebuilt. |
+| `PATH=/usr/local/bin:$PATH pnpm run pack:check` (also included in final `check`) | Final exit 0; 95 files, 1,306,216 packed / 2,298,760 unpacked bytes. Initial restricted attempt could not write npm cache; approved same-command rerun passed. |
+| `/usr/local/bin/node scripts/check-adaptive-task-session.mjs /var/folders/ny/p6hzzr7178j3xwj5lzyr03x00000gn/T/codex-task-session-fZRa9w/fixture.json` | Exit 0; 9 journeys, seven synthetic requests, zero real provider calls, cleanup/fixtureRemoved true, checked 2026-09-22T10:49:34.500Z. |
+| `node --check` on the three scripts; `git diff --check` | Exit 0. |
+
+Earlier attempts remain failures, not credited as passing: harness fixes addressed model-list order, native Session-transition timing, unbounded CDP body reads and cleanup after early browser exit. The new regression caught hidden reads on Session change, fixed by Session-bound panel state. The old candidate's cold-restore defect passed only after the product fix was installed.
+
+The final-head preparation/run initially exited 1 at the 15-second host readiness deadline, before browser scenarios or provider calls; cleanup was reported false and its recorded process was subsequently verified absent. The unchanged, still-unused installation then passed all nine journeys using its manifest. The startup cause is unresolved, not attributed to a product defect or claimed fixed. Its failed report/events were retained separately before the successful rerun overwrote the fixture output; the successful report's events also retain the first preload marker.
+
+Run `node scripts/check-adaptive-task-session.mjs` with Node 24, compatible npm, project dependencies and Playwright Chromium. It needs registry access for setup and local listen/browser permissions. It tests **committed HEAD**, not unstaged product changes. `prepare-adaptive-task-session.mjs` can prepare a separate unused fixture whose manifest is passed to the checker; used workspaces are rejected.
+
+Generated evidence: `output/playwright/task-session/<fixture-id>/report.json`, redacted `events.json`, handoff/manual screenshots and failure artifacts. Success removes disposable home/browser/dependencies after evidence export. Failures retain fixtures for diagnosis; remove only exact owned directories after checking recorded processes have exited. This turn removed six prior diagnostic fixtures after saving redacted events; no user data was removed.
+
+Portable checked-in evidence: [successful report](../../.github/phase1-session/report.json), [synthetic transport events](../../.github/phase1-session/events.json), and [initial startup failure](../../.github/phase1-session/startup-failure.json). Local fixture paths are replaced with a placeholder; they are historical identity records, not locations of a running service.
+
+Remaining: synchronize the local fix to #236 and run exact-head remote CI; other supported hosts do not yet have this full-page evidence; real-account/usefulness/human acceptance and cross-device/new-cookie takeover remain separate. Live testing needs an explicitly chosen profile/account and request budget. No Phase 2 runtime is included.
+
+<details>
+<summary>Historical acceptance preparation, before the installed-page run</summary>
+
+Candidate: #236 `0a09e04d09de60930e85f9e87b9a6c97b43f1647`; runtime `7bb8e28`. Main `1748bec` is unchanged. This working slice modifies documentation only; existing candidate runtime/build/dependencies remain intact.
+
+## Evidence boundary
+
+Remote status was freshly checked: all eight checks pass on the exact candidate. Earlier CI logs recorded 108 files / 1,094 tests on each Node target, 38 browser regressions, authenticated isolated controls, four fresh persistence processes and same-artifact four-host installation/task matrices. Those facts are not full installed Session-page or real-account acceptance.
+
+This turn reran:
+
+| Check | Result |
+| --- | --- |
+| `PATH=/usr/local/bin:$PATH pnpm exec vitest run tests/adaptive-task-host.spec.ts tests/adaptive-task-store.spec.ts tests/adaptive-task-matrix-contract.spec.ts` | Exit 0; 3 files / 52 tests. |
+| `PATH=/usr/local/bin:$PATH node scripts/check-adaptive-task-persistence.mjs` | Exit 0; four distinct processes, plain/zstd, original requirement retained, reservations 2 -> 3, zero real provider calls. Bundle SHA-256 `bcea5079ab2f046792efa0a687031bc72687d32121b06cc8b68c71b445a659aa`. |
+| `PATH=/usr/local/bin:$PATH node scripts/check-adaptive-task-ui.mjs` | Initial sandbox attempt failed before HTTP scenarios: localhost `listen EPERM`. Authorized localhost rerun exited 0; all 6 cases passed, real host auth/product endpoint/control, synthetic responses, zero real provider requests. `fullDailyProfileAcceptance: false` remains explicit. |
+
+Node used: 24.13.0. The diagnostic verbose rerun identified the permission failure (five cases failed to bind, one canonical-authority case passed). Do not label this a product regression or omit the failed attempt. No test expectation or product code was changed to work around it.
+
+## Why the full-page gate remains open
+
+`tests/adaptive-task-http.spec.ts` really registers the product, host WebServer/Connection, signed-cookie authorization and actual adapter. However, `scripts/adaptive-task-browser-entry.tsx` directly mounts `AdaptiveTaskControl` on a synthetic page and posts messages through `/fixture/task`. This bypasses real shell slot composition, Session-controller transport and the normal Composer send/model-picker flow. Repeating that test cannot close the full-page gap.
+
+The actual product control is registered in `src/client/index.tsx` under `conversation.input.right`, using host session identity. The next full-page fixture must load the unmodified installed shell/client entry and drive those real controls; it may substitute provider responses/credentials, not the application route or Composer transport.
+
+## Next isolated full-page acceptance unit
+
+This is a test-harness implementation task, not a production deployment or a finished check. Use an independently identified throwaway DSH home and ephemeral localhost port, never 3080/3081 or an existing user profile. Install the exact candidate package and exact host runtime closure, verify hashes and actual module identities, and instrument a synthetic provider with a deny-by-default external-network tripwire. Block automatic quota/update/OAuth outbound calls as well; no copying of real credentials or conversation data.
+
+Required journeys:
+
+1. Load the actual signed-in shell with synthetic host authentication; confirm model-choice control appears in the normal empty Session Composer and remains off.
+2. Explicitly grant selected models/efforts; submit through the real Composer, observe Sol/Medium then permitted handoff; keep the original requirement visible.
+3. Switch conversations and reload; neither grants nor status may leak to another Session.
+4. Use the ordinary Session Stop button during a pending synthetic response; no queued continuation may dispatch.
+5. Take manual control, choose a different model and Default through the real picker, then continue normally without an automatic override.
+6. Restart only the owned temporary host, reload the saved Session, see interrupted state and retained count; only explicit same-owner resume may dispatch.
+7. Drop a mutation response, reconnect and reconcile state without re-sending the command.
+8. End the fixture: stop only its processes, prove no live listeners/children remain and retain non-sensitive reports. Credential/login links must not appear in logs.
+
+Evidence must record installed plugin/host identity, exercised actual routes/components, wire selections/counts, persistence identities, errors and cleanup result. A screenshot or HTTP 200 alone is insufficient. First validate the baseline host; only then expand relevant cross-host UI checks. Existing four-host server tests are not four-host full-page evidence.
+
+## Real-account / human acceptance
+
+Not authorized or executed by this design slice. Once isolated full-page behavior passes, request a specific test-account/profile choice and a bounded request budget before any live inference. Include a model-led task where handoff is useful and a trivial task where continuing without delegation/routing is correct. The user assesses understandable consent, stop and manual takeover on the real UI. Never claim saved cost, better quality or account eligibility from simulated responses.
+
+Cross-device/new-cookie recovery is a separate design decision, not a hidden prerequisite fulfilled by refreshing this browser. Merge/release/deployment require separate approval. Phase 2 design can proceed in parallel; Phase 2 runtime must not be used to mask an unaccepted Phase 1 lifecycle.
+
+</details>

package/docs/experiments/adaptive-task-phase1.md

@@ -0,0 +1,52 @@
+# Task-level model selection: consolidated Phase 1
+
+Unreleased candidate built directly from main `1748bec2d7cfd6ec72ef64ed6bf341bb47be0424`. The delivery boundary is a reviewable PR; merging, publishing, deployment, live models and closing previous PRs are outside this change.
+
+## Product and ownership
+
+An empty ordinary conversation offers **Model choice / 模型选择**. Nothing activates until its user explicitly accepts a per-conversation grant. The first main request uses **Sol / Medium**. The user selects allowed main models and individual effort levels plus a shared request limit (default 40, maximum 200). The exact displayed effort subset is persisted; catalog changes cannot expand it. Another conversation and the profile defaults are unaffected.
+
+The current model may continue directly, change effort, or hand subsequent main requests to an allowed model through `codex_connect_change_work_model`. Each successor has the same optional tool. There is no mandatory planning call, permanent Sol coordinator, reasoning-first decision pipeline or fixed worker strategy. Phase 1 does not introduce subagents. Host-owned tool, filesystem, command and publishing permissions are unchanged.
+
+The runtime owns one task grant, route, operation receipts and durable request counter. The host owns the actual main Agent, session journal, model selection, cancellation, compaction and tool permissions. The adapter supplies a request-local dispatch wrapper. Each managed backend attempt reserves through the existing backend governor immediately before transport; failed or uncertain dispatches are not refunded. Main requests, compaction and attributable auxiliary Codex requests share the limit. Queued/cooldown work remains cancellable before reservation.
+
+The selected model/effort scope governs the **main task route**. Existing search, image and review tools retain their separately configured specialized models and permissions; this feature neither enables them nor expands their authority. Their attributable managed Codex attempts count against the same task. Unattributed background operations and arbitrary third-party traffic are not guessed into the ledger. Reservations are not tokens, money, subscription quota or proof of saved cost. Account eligibility is not inferred from the installed catalog.
+
+## Source consolidation and supersede mapping
+
+The following immutable revisions were compared, including their incremental source, adapter, registration, settings, tests and CI changes:
+
+| Source PR | Inspected head / base | Result in this candidate |
+| --- | --- | --- |
+| #232 M1 | `2f135e7` / main `1748bec` | Extract model-independent journal checks (host surface folding, start/summary/end correlation, exact replaced source range and checkpoint content) into `adaptive-task-checkpoint.ts`. Do not import Astra reasoning state, `configuration_update`, native per-change questions or the Think setting. |
+| #233 M2 | `725cd93` / `2f135e7` | No runtime code imported. `Observe → Recommend → Admit → Apply`, Astra effort assumptions and its separate telemetry remain experiment references. Task requests use the task grant directly. |
+| #234 M3 | `535b8f5` / `725cd93` | No Split runtime, source snapshot worker, fixed Luna/Low provider bounds or shared Think action lease imported. Phase 2 must design delegation against task-owned authorization and accounting. |
+| #235 Phase 1 | `3da8ce2` / `535b8f5` | Retain task contract/store/runtime/HTTP/context, minimal conversation control and relevant tests. Rebuild the adapter and plugin registration directly on main, remove legacy Think gating, add explicit effort subsets and strengthen lifecycle/provenance tests. |
+
+The backend governor, native compaction codec and host persistence already on main remain the reliability foundation. No additional runtime dependency or old Think question/CSS dependency is needed. The new CI matrix exercises only Phase 1 cases plus exact host identity; it cannot obtain credit from old Think/M2/M3 tests. Previous validation counts and artifacts are historical evidence, not this candidate's acceptance.
+
+This PR supersedes #232–#235 as the proposed Phase 1 integration route. On 2026-09-22 the maintainer separately authorized closing those PRs, the historical Think chain (#167/#220/#221/#222/#224), and Split #199/#200. All eleven source branches and commits were retained. Closure retires the old integration paths; it does not claim that their remaining acceptance passed. This is a source consolidation, not a merge of their stacked commits. #195 remains the umbrella roadmap; #198 now tracks dynamic Phase 2 delegation.
+
+## Context and lifecycle
+
+Handoff uses ordinary model/effort selection on the same main Agent. Visible requirements, conclusions, tool calls/results and supported images come from the original host journal. Private assistant reasoning and model-specific replay metadata are omitted. Foreign or pre-handoff compacted spans expand from the exact host-validated source range; new target-model checkpoints remain useful until another handoff. Summary text never grants authority. Missing/corrupt correlation, unknown replacement history and transfers above 512,000 bytes fail rather than silently truncating requirements.
+
+Task documents live in the private `codex-connect-tasks` directory beside the plugin's configured credential store. They contain hashes, grants, counters and bounded operation receipts, not prompts, OAuth tokens or model rationale. Updates use the host file lock, atomic replacement and sync before dispatch; reads reject unsafe links, permissions, size and schema. A journal marker proves that a grant existed but is never itself a grant.
+
+Activation stays interrupted until the marker is flushed successfully. Start/resume reserves the host's idle maintenance boundary; interruption or a failed flush cannot expose a new executable grant. A new runtime epoch requires explicit same-browser resume and retains counts. An ordinary Session stop or the task Stop action revokes automatic work. Manual takeover cancels active work, withdraws the model-change tool and permits normal later model/Default selection; the prior task counter remains historical and is not a lifetime cap on manual use. Manual takeover cannot be reversed by a model.
+
+Controls use actual DSH Connection Host/Origin and signed-cookie validation. Cookie audience canonicalization matches the host. A principal is the hash of the exact signed browser credential and canonical authority, not a named-person ACL. New cookies/devices cannot take over someone else's existing grant. Cross-device recovery remains a separate product decision. Missing Connection service supplies no unauthenticated endpoint.
+
+## Migration
+
+Published Alpha 4.39 users retain all existing defaults. No task grant is created by upgrade, page load, old prose, or enabling native compaction. Begin a new conversation and explicitly start Model choice to use the candidate.
+
+Do not migrate old Astra-only Think histories or carry an old experimental profile's `enableReasoningUpdates` into this candidate. That setting and its product control are absent. Preserve those experimental sessions and branches for reference; use a clean conversation for Phase 1. The existing native-compaction setting remains a technical compatibility opt-in and is not presented as a peer Think/Split/Remember product mode. Phase 1 can operate with ordinary host compaction when native creation is disabled.
+
+The task POST contract now requires the exact `efforts` map for selected `models`; an old #235 browser bundle cannot silently grant every newly available effort. Reload the candidate's matching client bundle. No automatic budget reset, old-state deletion or browser-owner migration is performed.
+
+## Verification boundary
+
+Run `pnpm run check`, `pnpm run test:browser`, `node scripts/check-adaptive-task-ui.mjs`, `node scripts/check-adaptive-task-persistence.mjs`, `node scripts/check-adaptive-task-matrix.mjs`, and `pnpm run check:dsh-matrix` on the candidate.
+
+Tests use actual host AgentLoop, persistence, authentication, plugin endpoint and adapter with synthetic responses/credentials. The local `2b1bd5d` follow-up additionally passes the stock installed Session shell, native Composer/model picker/Stop and cold restart on baseline DSH `0.1.2-rc.1`; see [the acceptance record](adaptive-task-phase1-acceptance.md). This is still an isolated synthetic profile, not the daily profile or a real account. Earlier four-host backend checks are not four-host full-page evidence; none establishes live account eligibility, model quality, economic benefit or human acceptance. The twelve-task evaluation plan remains unexecuted in `adaptive-task-evaluation.md`.

package/docs/experiments/adaptive-task-phase2-acceptance.md

@@ -0,0 +1,68 @@
+# Phase 2 E: exact-host and installed Session acceptance
+
+## Main-based integration gate
+
+2026-09-23: the maintainer authorized review and merge toward real 3081 experiment readiness. Phase 1 #236 is squash-merged as `3c3d176` with its exact reviewed tree preserved. Phase 2 #239 retains the original branch history, connects that identical main baseline without product changes, and must pass main-based exact-head checks including CodeQL before merge. This updates the historical authorization/status below; it does not authorize npm publication or live inference.
+
+Independent read-only pre-landing review of `76c3c0c..4b5d485` found no remaining confirmed blocker; focused checks passed 3 files / 40 tests. A suspected cancellation gap was withdrawn because the relevant entry check, guard, listener registration and followup have no asynchronous yield or actual reentrant revoke path.
+
+An additional immutable installed full-page run at `4b5d485` used DSH `0.1.5-rc.1`, Node `26.5.0`, npm `10.9.3` with peer checks and the selected host's published Cordis floors. Archive SHA-256: `b328a16446a2cb089dab4fba6ce1e90825fc7446d6a87fe42560cc1d1f01bffb`. All nine library hashes matched the candidate; all eight Phase 2 native Session groups passed, including native title accounting, lost-response reconciliation, downgrade/re-upgrade, restart, Stop, and manual Terra/Default. No uncaught browser errors, unexpected external attempts or real provider requests; cleanup and fixture removal both passed. Command: `node scripts/check-adaptive-task-session.mjs <prepared fixture>/fixture.json --phase2`, exit 0. Redacted report/events are retained in the task's `outputs/goal-rc1-node26-{report,events}.json`.
+
+This closes the isolated full-page gap for the currently installed 3081 host/Node version combination. It does not certify existing daily-profile state, local host patches, all four hosts' full pages, or real model behavior. Actual 3081 backup/install/restart remains separately approval-gated. The following sections preserve the original E-slice scope and evidence.
+
+Authority: user approved the next step on 2026-09-22 after local `dcd5cab`. Source of truth: Phase 2 design, A–D contracts, current isolated branch and declared compatibility. Existing README/design/contracts/checkpoint satisfy the documentation roles; no duplicate project skeleton.
+
+Goal: verify identical Phase 2 cases on all four declared hosts and Node 22.19.0/24.13.0, then integrate the reviewed default-off composition into the product and verify the installed authenticated full Session journey.
+
+Scope: dedicated matrix/checker contract, exact runtime identity and synthetic-network guards; installed-page synthetic provider/control harness; narrow product composition/artifact ownership; tests and evidence. Main-task selection and child consent remain separately opt-in. No model/provider permissions or defaults are broadened.
+
+Out of scope: existing daily profiles or ports 3080/3081, real credentials/provider requests, GitHub writes/push, merge, release, publish, deployment, account eligibility or cost/quality claims. Public registry/runtime downloads for disposable tests are allowed; they do not transmit project data.
+
+Plan:
+1. Verify clean D commit and relevant project/compatibility contracts.
+2. Build one Phase 2 test bundle and validate four exact isolated host closures on both Node targets, including package identity and no skipped/failed cases.
+3. After the matrix passes, wire a single default-off composition and per-root private artifacts in the product entry; rerun relevant old/new regressions and full check.
+4. Install committed candidate bytes in a fresh exact host profile; use native shell/Session/Composer/picker/Stop, with synthetic credentials/provider and denied external dispatch.
+5. Verify explicit grant, bounded parent/child workflow, shared counts, recovery without replay, stop during child, manual model choice, safe downgrade and owned-resource cleanup; independently review and write back.
+
+Verification: dedicated matrix contract tests and both runtime reports; `pnpm run check`; browser and authenticated control regression; full installed Session checker with package hashes and actual host identity; `git diff --check`. Failed runs retained, no green-count substitution for full-page evidence. Product integration must not precede a passing exact-host gate; final release readiness is not implied.
+
+Status: locally accepted on 2026-09-23, with the installed-host vendor qualification below. No unresolved product decision; cross-device ownership and real-provider usefulness remain explicitly outside this slice. Not pushed, merged, published, deployed or live-account accepted.
+
+## Findings during the gate
+
+- npm 11.6.2 rejected the exact peer closure with conflicting override sets, including with every peer-only root explicit. The same closure installs with npm 10.9.3 and full peer checks. The checker records installer identity; local Node 24 and CI use the pinned acceptance installer, not `--force` or `--legacy-peer-deps`. This is an acceptance-installation limitation, not evidence of a provider or running-host defect.
+- A transient public registry read failed after the first successful host. Exact public manifests now have a name/version-validated cache and at most two read attempts; dependency resolution still pins every DSH package.
+- The first real alpha.1 host run rejected `agentCtx.agent` during unpublished setup. Removing that unused read exposed the second compatibility difference: alpha.1 requires `options.parentAgent`, whereas baseline derives ownership from the caller context. The bridge supplies both and still rejects a returned child with mismatched live ownership before any run. Runtime `isLive` checks continue to compare agent/session instances and parent ownership. Failed runs are retained; baseline-only greens did not authorize product integration.
+- The pre-integration gate passed all eight host/Node combinations at bundle `3f26325a9b2132585f59b2032cfd6045c984817ffc5da9d3f0e7a33d0f06d136`: 128 named checks and 18 crash cases/36 fresh processes per combination. Only then was `src/index.ts` changed to construct one default-off composition, with owner/session-keyed artifacts.
+- Integration exposed an optional-service boundary that privileged root-context fixtures did not test: the product only injects `llm`. Task code now resolves agent/session capabilities through the host's optional-service API, fails closed for incomplete live-task contexts, and preserves ordinary standalone streams/auxiliary work. Consent fixtures now use an actual llm-only plugin context; two regression cases add absent/incomplete-service coverage. The final matrix therefore has 130 checks per host and is rerun against the changed bundle.
+- A fresh baseline full profile resolved Cordis 4.0.4 / loader 1.0.5 / HMR 1.0.19 / timer 1.1.6 and exited before page readiness. Removing this candidate from the temporary profile reproduced the same stock failure. Loader 1.0.5 no longer awaits the created plugin fiber in `Entry.init()`, but this DSH launcher immediately expects the HMR service. The installed-page fixture pins the Cordis versions explicitly declared at the selected DSH release's caret floors (baseline: 4.0.2 / loader 1.0.3 / include 1.0.7 / HMR 1.0.17 / timer 1.1.4), keeps HMR enabled, and records/asserts actual versions. This does not repair or certify the newer stock vendor combination.
+- The full page then exposed a real child failure before provider dispatch: the inherited deployment persona required `{{cwd}}`, while the evidence-only child intentionally has no workspace. The child now installs a complete scoped evidence-helper persona and suppresses ambient runtime context through the host's public scoped prompt API. Tools and enforcement remain host-owned. Regression verifies successful execution without cwd, absent parent ambient content, and unchanged parent prompt/context. The native title request is retained and counted, not suppressed to match the smaller fixture's request count.
+- The new isolation test initially assembled a PTC parent without a code runtime, then incorrectly substituted root/global assembly, whose persona configuration differs across host versions. The final test explicitly registers the parent-scoped persona: one case retains a PTC parent and checks the child's native restricted tools and isolated context; a separate non-PTC parent is assembled with its actual scope/agent and compared before, during and after child lifetime. A focused exact alpha.1 reproduction also exposed the test's baseline-only `options.system` assumption: alpha.1 projects rendered system prompts into message history. The corrected assertion inspects the whole model-visible request (`system` plus `messages`), requiring the bounded persona and forbidding parent persona/ambient content. Focused baseline and exact alpha.1 each passed three cases. These were fixture defects, not evidence that the product required parent PTC or global prompt mutation.
+
+## Installed candidate and review
+
+The installed immutable source is `20e6ecf40ab2e231423c702b983bfb8b4ec455e6`; packed archive SHA-256 is `373ac57093c8c2cec29e04d61fe9fd2d0bd73c2b6abf45000e22f664aeca048b`. All nine installed `lib/` file hashes match the final local product build. Later checker/test/documentation changes do not change those bytes.
+
+The Node 24.13.0 / DSH 0.1.2-rc.1 full installed native Session checker passed eight groups: default-off and explicit child consent; a deliberately lost consent response without replay; bounded source-read/findings workflow; shared accounting including the native title request; fresh-host interrupted restoration without replay; archive-verified downgrade/re-upgrade; native Stop cancellation; and native manual Terra High/Default selection. The complete run made ten synthetic wire requests: eight task debits plus two ordinary manual requests after takeover. No uncaught browser errors or unexpected external network attempts were observed. The owned browser/host were closed, port closure checked, and successful disposable fixture removed. Desktop delegation/manual screenshots were inspected; this is not human or physical-mobile acceptance.
+
+Independent read-only review covered exact host ownership, optional-service fail-closed behavior, the single default-off composition, artifact namespacing, child prompt/tool boundaries, and the final parent-scope test correction. No confirmed runtime finding remains from this review. It is a local review, not a GitHub review or remote CI result.
+
+## Reproduction and evidence boundaries
+
+- `pnpm run check`: Node 22.19.0 and Node 24.13.0, each 115 files / 1,234 tests plus lint, typecheck, build, CLI and package checks; exit 0. A default-sandbox rerun was separately rejected at loopback `listen` with `EPERM`; the authorized isolated-network run passed. The final test-only parent-scope adjustment also passed its three focused cases and final typecheck.
+- `node scripts/check-adaptive-task-delegation-ui.mjs`: 15 authenticated control cases, exit 0. Ordinary browser regression previously passed 50 cases and Phase 1 authenticated control six; neither is described as the installed full-page journey.
+- `node scripts/check-adaptive-task-session.mjs --phase2`: the reusable entry builds a committed archive. This acceptance prepared that archive first and passed its fixture manifest as the first argument, then `--phase2`; eight groups, exit 0. Host identity is baseline only, with the explicit vendor pins above and npm 10.9.3 peer checks enabled.
+- `node scripts/check-adaptive-task-delegation-matrix.mjs --report docs/experiments/phase2-matrix-node{22,24}.json`: run separately under each exact Node. Node 24 uses `MATRIX_NPM_CLI` pointing to the npm 10.9.3 CLI; both retain full peer checks. Final matrix completion is recorded below, not inferred from older passing reports.
+
+The local delivery `outputs/` contains command logs, successful installed `phase2-e-installed-report.json` and `phase2-e-installed-events.json`, desktop screenshots, and failure evidence. Failed stock-start/persona fixtures are retained for diagnosis; they are not running services. No real credentials/provider, daily 3080/3081 profile, GitHub state or published artifact was changed.
+
+This candidate does not certify the newer stock Cordis loader combination, npm 11 full-closure installation, full native pages on all four hosts, real-model usefulness/cost, cross-device ownership, or user acceptance. Those limits remain separate from synthetic runtime correctness.
+
+## Final exact-host gate
+
+Both final commands exited 0. [Node 22.19.0 report](phase2-matrix-node22.json) and [Node 24.13.0 report](phase2-matrix-node24.json) each cover `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2`. Every combination passed the same 130 named checks, with no skipped/failed/todo cases, plus 18 crash cases / 36 fresh processes. Restores made zero fetches/child creates and rejected old epochs. Actual runtime packages were resolved inside each isolated host; unexpected external attempts and real-provider dispatches were zero.
+
+All eight combinations used bundle SHA-256 `6cc3da121ef360bc5193e7eef986623310d4491204d9fc7f80b0b93b0c86e7fd`. A fresh build from the final working tree reproduced that digest, and the strict matrix-report validator accepted both reports against it. `git diff --check` passed. No product bytes changed after the installed-page candidate `20e6ecf`.
+
+Next gate: prepare a separately reviewable Phase 2 PR on the approved Phase 1 baseline, then run exact-head remote CI after explicit push/GitHub authorization. Keep the stock vendor/installer qualification visible. Real-provider usefulness and human acceptance require their own bounded authorization; no automatic merge or release follows from this local result.