dsh-codex-connect 0.1.0-alpha.4.51 → 0.1.0-alpha.4.53

package/INSTALL.md

@@ -1,10 +1,10 @@
 # Installation Runbook for CLI Agents
 
-Published Alpha 4.50 is verified with either exact DSH `0.1.7-rc.1` or `0.1.7-rc.2` and pi-ai `0.85.1`, using a consistent host package set. Earlier DSH pairings retain their separately published plugin versions below.
+Published Alpha 4.52 is verified with either exact DSH `0.1.7-rc.1` or `0.1.7-rc.2` and pi-ai `0.85.1`, using a consistent host package set. Earlier DSH pairings retain their separately published plugin versions below.
 
 Install `dsh-codex-connect` into one requested DeepSeek Harness profile without changing its current default model, search route, global configuration, or OAuth state.
 
-Channel snapshot on 2026-09-26: npm `alpha` points to `0.1.0-alpha.4.50`; `latest` remains `0.1.0-alpha.4.47`. Use the exact-version command for the installed DSH version; moving npm tags are not compatibility guarantees.
+Channel snapshot on 2026-09-28: npm `alpha` points to `0.1.0-alpha.4.52`; `latest` remains `0.1.0-alpha.4.50`. Use the exact-version command for the installed DSH version; moving npm tags are not compatibility guarantees.
 
 ## Safety requirements
 
@@ -30,12 +30,28 @@ Check `dsh --version` before changing the requested profile. Use `dsh --help` to
 | `0.1.5-alpha.1` | `0.1.0-alpha.4.41` |
 | `0.1.5-rc.1` | `0.1.0-alpha.4.41` |
 | `0.1.5-rc.2` | `0.1.0-alpha.4.41` |
-| `0.1.7-rc.1` | `0.1.0-alpha.4.50` |
-| `0.1.7-rc.2` | `0.1.0-alpha.4.50` |
+| `0.1.7-rc.1` | `0.1.0-alpha.4.52` |
+| `0.1.7-rc.2` | `0.1.0-alpha.4.52` |
 
 If your exact DSH version is unknown or not listed, preserve the installed host, report that the combination is unverified, and verify it before making installation changes. A missing record does not prove incompatibility, and the catalog's latest verified DSH version is not the latest upstream release. Do not recommend upgrading or downgrading DSH merely to match a row. Investigate any specific failure and seek verification of the installed combination. Do not blindly install `dsh-codex-connect@alpha`: `alpha` is a moving tag, not a compatibility guarantee. Do not infer support for newer DSH versions from these rows.
 
-Alpha 4.50 requires one consistent DSH `0.1.7-rc.1` or `0.1.7-rc.2` plugin API and pi-ai `0.85.1`; its direct runtime imports include `@deepseek-ai/schemastery` `3.18.4` and `@earendil-works/pi-ai` `0.85.1` so an isolated profile need not already provide them. Node.js remains `^22.19.0 || >=24.0.0`. It does not support the older DSH rows. Alpha 4.41 remains the choice for DSH `0.1.2-rc.1` with pi-ai `^0.84.2`, or `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` with pi-ai `0.85.1`. Mixed host versions and other DSH/pi-ai combinations remain unverified. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 for DSH `0.1.2-alpha.2`, Alpha 4.21 for DSH `0.1.1-rc.2`, and Alpha 4.14 for DSH `0.1.0-rc.7`. Changing DSH is a separate operation requiring the user's explicit request; a plugin update request does not authorize it. The repository's `pnpm --silent run check:compatibility` remains a strict development/release dependency gate, not a recommendation to change a user's host.
+Alpha 4.52 requires one consistent DSH `0.1.7-rc.1` or `0.1.7-rc.2` plugin API and pi-ai `0.85.1`; its direct runtime imports include `@deepseek-ai/schemastery` `3.18.4` and `@earendil-works/pi-ai` `0.85.1` so an isolated profile need not already provide them. Node.js remains `^22.19.0 || >=24.0.0`. It does not support the older DSH rows. Alpha 4.41 remains the choice for DSH `0.1.2-rc.1` with pi-ai `^0.84.2`, or `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` with pi-ai `0.85.1`. Mixed host versions and other DSH/pi-ai combinations remain unverified. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 for DSH `0.1.2-alpha.2`, Alpha 4.21 for DSH `0.1.1-rc.2`, and Alpha 4.14 for DSH `0.1.0-rc.7`. Changing DSH is a separate operation requiring the user's explicit request; a plugin update request does not authorize it. The repository's `pnpm --silent run check:compatibility` remains a strict development/release dependency gate, not a recommendation to change a user's host.
+
+### Alpha 4.52 published request-metrics delivery
+
+[PR #284](https://github.com/franksong2702/dsh-codex-connect/pull/284) adds optional local request evidence and the offline report CLI, without the internal evaluation runner or a metrics panel. Upgrading alone does not enable collection. Configure a private directory only in the intended profile and restart that profile explicitly; [English](docs/request-metrics.md) and [Chinese](docs/request-metrics.zh.md) guides cover configuration, unknown usage, retention and disabling. Task remains paused.
+
+Fresh independent static source review found no blocker. Local checks passed 132 files / 1,533 tests, Chromium 73 tests, and both stock rc.1/rc.2 same-artifact installation/runtime checks including metrics startup/CLI tests. The final PR-head checks and [exact-main CI](https://github.com/franksong2702/dsh-codex-connect/actions/runs/36366815118) passed. These are synthetic engineering checks, not new real-model/image/Reserve acceptance or evidence of savings.
+
+The original workflow uploaded npm but failed afterward. It was not rerun; recovery verified the original artifact byte-for-byte and created only missing tag/release records. [Original release run](https://github.com/franksong2702/dsh-codex-connect/actions/runs/36367211049); release commit `21504f83f0bed1d5737cb2b1972bcd3246b8d3a1`. Final independent read-only verification returned `already-complete`; the public npm archive exactly matched the original verified artifact (SHA-256 `5cab311ed632fb2156188a13633d0bf5ca4c569dad8415da4c95ad4d5063e4a4`). Version, alpha, tag and [prerelease](https://github.com/franksong2702/dsh-codex-connect/releases/tag/v0.1.0-alpha.4.52) agree. latest remains 4.50. No duplicate upload, old-tag movement or daily-service upgrade occurred. [Publication record](docs/experiments/evidence/alpha-452-publication.json).
+
+### Historical Alpha 4.51 maintenance delivery
+
+The historical Alpha 4.51 recommendation followed [PR #283](https://github.com/franksong2702/dsh-codex-connect/pull/283), successful [exact-main CI](https://github.com/franksong2702/dsh-codex-connect/actions/runs/36362680011), and independent final source review of the diagnostic type/lifecycle repair. Frozen local checks passed 127 files / 1,466 tests, Chromium 73 tests, and stock rc.1/rc.2 same-artifact installation/runtime checks. Experimental defaults and Task pause remain unchanged; no draft metrics/evaluation feature is included.
+
+The [original protected publication](https://github.com/franksong2702/dsh-codex-connect/actions/runs/36363043413) uploaded npm successfully but failed public readback. It was not rerun. Recovery-only verification matched the public package byte-for-byte to the original artifact (SHA-256 `6d8ffe3b9335e0f874592f6d5f67d2fe872e809a24a4ae4e2c1d8f14e29857e6`), then created only the missing tag and [prerelease](https://github.com/franksong2702/dsh-codex-connect/releases/tag/v0.1.0-alpha.4.51). Final independent verification returned `already-complete`: version, alpha, tag and release match commit `2ac612385ea3c3fcfc1078dc18619d7b1dc49b9a`; latest remains 4.50. See [the publication record](docs/experiments/evidence/alpha-451-publication.json). No duplicate npm upload, old-tag movement, daily-service upgrade or new real-model/image acceptance occurred.
+
+### Historical Alpha 4.50 delivery evidence
 
 The Alpha 4.50 recommendation follows [PR #275](https://github.com/franksong2702/dsh-codex-connect/pull/275), [exact-release main CI](https://github.com/franksong2702/dsh-codex-connect/actions/runs/36222707376) and a successful [protected publication run](https://github.com/franksong2702/dsh-codex-connect/actions/runs/36222974006) at `6baa422b7b9cd513340948f659b51b0b9d76a724`. The same candidate passed unmodified rc.1 and rc.2 isolated installations without exemptions; Chromium passed 73 tests on each host. The rc.1 frozen full check passed 1,452 tests; rc.2 source types and focused image/auth/transport/compaction suites passed. An independent source reviewer found a mandatory UI-peer consistency gap; five red/green controls covered the correction before the final source review passed. See [the exact scope and evidence](docs/experiments/dsh-017rc2-compatibility.md).
 
@@ -92,10 +108,10 @@ Alpha 4.33 omits the `modelErrors` profile field required by RC model packages,
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.41
    ```
 
-   For either exact DSH `0.1.7-rc.1` or `0.1.7-rc.2` pairing, use Alpha 4.50:
+   For either exact DSH `0.1.7-rc.1` or `0.1.7-rc.2` pairing, use Alpha 4.52:
 
    ```sh
-   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.50
+   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.52
    ```
 
    For DSH `0.1.2-alpha.5`, use Alpha 4.25:
@@ -106,7 +122,7 @@ Alpha 4.33 omits the `modelErrors` profile field required by RC model packages,
 
    If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.41'` only for the DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` combinations, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.46'` only for DSH `0.1.7-rc.1`.
 
-   For the current DSH `0.1.7-rc.1` or `0.1.7-rc.2` pairing, if npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.50'`.
+   For the current DSH `0.1.7-rc.1` or `0.1.7-rc.2` pairing, if npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.52'`.
 
 3. Run `dsh web --help` once to compose the installed profile without starting the server. DSH `0.1.2-rc.1` prepares profile plugin dependency fallback during this step.
 4. Run `dsh --profile web --dump-config` and require exactly one `llm-openai-codex` row loading `dsh-codex-connect`.

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   git hash-object README.md docs/README.zh.md
-README.md: 042cbc25138136fb6086b74b9174e560c7dcdd26
-docs/README.zh.md: 394fa85a66eccbdee1adbfe2b859dd51b73ab785
+README.md: 87eabfbc600ce72bdca87d60e2f42ce9e419e944
+docs/README.zh.md: db1557081905aee13d0060c4097cf94d519da43f

package/README.md

@@ -16,19 +16,21 @@ This guide describes the published pairing below. Check `dsh --version` first an
 
 | Requirement | Verified pairing |
 |---|---|
-| Codex Connect | `0.1.0-alpha.4.50` |
+| Codex Connect | `0.1.0-alpha.4.52` |
 | DeepSeek Harness | `0.1.7-rc.1` or `0.1.7-rc.2` (consistent package set) |
 | Node.js | `^22.19.0 \|\| >=24.0.0` |
 | Account | ChatGPT OAuth with access to the requested Codex model; availability is decided by OpenAI |
 
-As of 2026-09-26, npm `alpha` points to 4.50 while `latest` remains 4.47; publishing this release did not promote `latest`. Use the exact version below for this DSH pairing; a moving npm tag is not a compatibility guarantee for other hosts.
+As of 2026-09-28, npm `alpha` points to 4.52 while `latest` remains 4.50; this product publication did not promote `latest`. Use the exact version below for this DSH pairing; a moving npm tag is not a compatibility guarantee for other hosts.
+
+Alpha 4.52 retains the 4.51 diagnostic fixes and adds [opt-in local request metrics](docs/request-metrics.md): observed requests, usage and latency with offline reporting. Collection stays off until a private directory is configured; unknown usage is not zero. No telemetry upload, internal evaluation runner, statistics panel or Task reopening is included.
 
 On stock DSH `0.1.7-rc.1` and `0.1.7-rc.2`, the package is installation/runtime-regression verified; Task controls remain paused: activation is rejected and fresh Sessions do not show them. Migration of earlier Task grants across a Harness upgrade is not verified. Older supported pairings and their task behavior are documented in [Installation and upgrades](INSTALL.md).
 
 ### 1. Install
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.50
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.52
 dsh web
 ```
 
@@ -67,6 +69,8 @@ dsh plugin --profile web exec dsh-codex-connect doctor --json
 
 ## Optional capabilities
 
+Development now follows the [core maintenance scope](docs/maintenance-scope.md): maintain connection, compatibility, diagnostics and recovery; freeze Task orchestration and unproven optimization work. Existing published options are not removed or remotely disabled by this decision.
+
 **Earlier Alpha 4.40/4.41 pairings:** task-level model control is off by default. After explicit task authorization, GPT-5.6 Sol/Medium starts the task, and the active model may continue, change effort, or hand off the main task within the granted scope. The task shares one request ledger and budget; stopping, manual takeover, and restart recovery retain the grant boundary. Phase 2 read-only delegation requires separate consent and does not grant workers write access. Stock DSH `0.1.7-rc.1` with Alpha 4.43 keeps these Task controls paused; do not infer they are available from an older pairing. See [Phase 1](docs/experiments/adaptive-task-phase1.md) and [Phase 2 consent](docs/experiments/adaptive-task-phase2-consent.md).
 
 Alpha 4.40 also supplies `gpt-6-sol` and `gpt-6-luna` when older provider catalogs omit them, retaining native metadata when present. Both expose Low through Max (including Xhigh); Default omits an explicit effort. Codex Sol's Ultra orchestration mode is not implemented. New task grants can explicitly include these models, but existing grants, GPT-5.6 Sol/Medium startup and Luna Reserve remain unchanged. A catalog entry is not proof of account access. See [compatibility scope and validation](docs/experiments/gpt6-sol-luna-compatibility.md).
@@ -130,6 +134,7 @@ A missing entry in [verified-compatibility.json](verified-compatibility.json) me
 
 - [Installation and upgrades](INSTALL.md)
 - [Configuration, diagnostics, and recovery](docs/reference.md)
+- [Local request metrics: enable, report, and disable](docs/request-metrics.md)
 - [Migration from `dsh-codex`](MIGRATION.md)
 - [Architecture and security details](docs/design.md)
 - [Auto-review behavior](docs/auto-review.md)

package/docs/README.zh.md

@@ -1,5 +1,7 @@
 # Codex Connect
 
+当前开发遵循[核心维护范围](maintenance-scope.md)：保留接入、兼容、诊断与恢复，冻结 Task 自动编排及未证明收益的优化。此决定不会删除已发布选项，也不会远程停用已有安装。
+
 [![npm version](https://img.shields.io/npm/v/dsh-codex-connect/alpha?label=npm%20alpha&color=cb3837)](https://www.npmjs.com/package/dsh-codex-connect)
 
 [English](../README.md) | 中文
@@ -16,19 +18,21 @@ Codex Connect 为标准 Harness agent loop 添加 `openai-codex` 模型提供方
 
 | 要求 | 已验证组合 |
 |---|---|
-| Codex Connect | `0.1.0-alpha.4.50` |
+| Codex Connect | `0.1.0-alpha.4.52` |
 | DeepSeek Harness | `0.1.7-rc.1` 或 `0.1.7-rc.2`（包版本必须一致） |
 | Node.js | `^22.19.0 \|\| >=24.0.0` |
 | 账户 | 通过 ChatGPT OAuth 使用所请求的 Codex 模型；可用性由 OpenAI 决定 |
 
-截至 2026-09-26，npm `alpha` 指向 4.50，`latest` 仍为 4.47；本次发布没有提升 `latest`。安装此 DSH 组合请使用下方精确版本命令；会移动的 npm tag 不保证其他宿主版本的兼容性。
+截至 2026-09-28，npm `alpha` 指向 4.52，`latest` 仍为 4.50；本次产品发布没有提升 `latest`。安装此 DSH 组合请使用下方精确版本命令；会移动的 npm tag 不保证其他宿主版本的兼容性。
+
+Alpha 4.52 保留 4.51 的诊断修复，并加入[可选本地请求计量](request-metrics.zh.md)：记录实际观察到的请求、用量和耗时，支持离线报告。配置私有目录后才采集；未知用量不当作零。不上传遥测，不包含内部评测运行器或统计面板，也不恢复 Task。
 
 该安装包已通过原版 DSH `0.1.7-rc.1` 和 `0.1.7-rc.2` 的安装及运行回归验证；Task 控件仍暂停：激活请求会被拒绝，新 Session 不显示这些控件。跨 Harness 升级迁移旧任务授权尚未验证。较旧组合及其任务行为见[安装与升级](../INSTALL.md)。
 
 ### 1. 安装
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.50
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.52
 dsh web
 ```
 
@@ -130,6 +134,7 @@ OAuth 凭据保存在运行 DSH 的主机上，由该主机用于向 OpenAI 认
 
 - [安装与升级](../INSTALL.md)
 - [配置、诊断与恢复](reference.zh.md)
+- [本地请求计量：启用、报告与停用](request-metrics.zh.md)
 - [从 `dsh-codex` 迁移](../MIGRATION.md)
 - [架构与安全细节](design.zh.md)
 - [自动审查行为](auto-review.zh.md)

package/docs/agent-notes/adaptive-runtime-status.md

@@ -1,3 +1,7 @@
+# Current planning decision — 2026-09-29
+
+The [core maintenance scope](../maintenance-scope.md) supersedes every proposed next step below. Task and automatic delegation are frozen; internal evaluation is archival work, not a prerequisite to reopening. Preserve historical evidence and shared safety/recovery obligations. The dated checkpoints below are not a live dashboard or authorization to resume.
+
 # Phase 1 merged / Phase 2 main-based review — 2026-09-23
 
 Phase 1 #236 was reviewed and squash-merged as `3c3d1762536efafaecefb36146e062dad5edd4f8`; its tree exactly equals reviewed `76c3c0c`. Main's active ruleset permits squash only. The Phase 2 branch retains its source history and connects that identical Phase 1 main tree without changing product bytes; #239 now proceeds through a main-based exact-head CI/CodeQL gate. Source branches remain intact. This supersedes the historical no-push/no-merge status below, not their evidence limitations.

package/docs/agent-notes/canary-maintenance-loop.md

@@ -0,0 +1,7 @@
+# Canary maintenance loop
+
+The daily canary now distinguishes skipped channels from executed checks in JSON and Actions summaries. Existing version trackers refresh their latest bounded evidence and respect explicit not-planned closure decisions. The run-health observer covers daily and weekly failures that have no complete set of version trackers, including failures before reports exist. It uses GitHub run/job metadata only and never executes a triggering revision or downloads its artifacts.
+
+The focused regression gate executes the observer's actual embedded script against a fake GitHub API. Scenarios include setup-like failures, cancellation, timeout, partial channel tracking, tracker-write failure, late completion, foreign branches/repositories, successful recovery and explicit maintainer closure decisions. Existing child-process fixtures verify that skipped versions do not launch checks and declared versions remain actively tested. These tests do not establish live GitHub delivery or full user acceptance.
+
+The periodic Codex Sweep owns investigation and local repair, with repository writes, pull requests, merging and publishing subject to the user's action-specific authorization. It also detects absent runs and observer failures; the observer cannot monitor its own outage. See the canonical procedure in `.github/UPSTREAM_DSH_CANARY.md`.

package/docs/agent-notes/core-transport-decoupling.md

@@ -0,0 +1,11 @@
+# Core transport separation — 2026-09-29
+
+Scope: remove implicit Task policy imports from the ordinary model adapter and backend governor. The product assembly explicitly supplies legacy provider policy and per-attempt accounting, preserving old grants, budget checks, cancellation and recovery. No default, saved state, authorization rule, supported version or public Task gate changes.
+
+The adapter's optional dispatch object supplies `wrapProvider`; ordinary profiles retain provider retry/session behavior. The governor accepts optional owner accounting before the existing auxiliary check and before the actual fetch; rejection releases admission without dispatch. Task-specific wiring belongs to the product assembly and historical task fixtures, not core transport imports.
+
+Verification requires a test that makes importing the Task scope fail while ordinary profile/governor requests still succeed, plus explicit-policy/refused-accounting cases and the existing real-host synthetic Task suites. Full repository checks, fresh-process accounting/recovery checks and exact-head CI remain required before merge. All fixtures use fake responses; no live acceptance is claimed.
+
+This is dependency separation, not complete runtime retirement. `src/index.ts` still constructs the legacy runtime to preserve saved-task ownership, recovery and accounting. It cannot simply be omitted based on a missing directory: lost task metadata and retained session markers must still fail closed. Full orchestration deletion requires a recovery-only replacement with equivalent historical-state checks; this change does not assert that replacement is complete.
+
+Local verification on Node 24.13.0: `pnpm run check` passed, including 133 files / 1,537 tests, lint/typecheck, normal build, built import/CLI/metrics checks and package validation. `check-adaptive-task-persistence.mjs` passed four fresh processes; `check-adaptive-task-delegation-crashes.mjs` passed 18 cases / 36 fresh processes with zero real provider requests. Initial sandbox-local HTTP binding was denied; the normal host execution passed. The initial Node 26 run failed because existing probe launchers use the removed `--experimental-transform-types` flag; this change does not repair or certify those Node 26 launchers.

package/docs/agent-notes/request-metrics-runtime-candidate.md

@@ -0,0 +1,27 @@
+# Request metrics: standalone runtime candidate history
+
+## Scope
+
+This candidate is based on maintenance main `2ac612385ea3c3fcfc1078dc18619d7b1dc49b9a`. It extracts only the opt-in metrics collector, offline reporting CLI, minimal adapter/backend integration and tests. It excludes the internal evaluation runner, task catalog, local project documents, private journals and machine paths. The unchanged package version identifies the base release, not publication of these new features.
+
+Collection is disabled when no metrics directory is configured. It records bounded local operational metadata, preserves missing usage as unknown, and never calculates subscription cost or uploads telemetry. No UI, Task activation, account changes, real experiment or deployment is included. See [the measurement contract](../request-metrics.md).
+
+## Review
+
+An independent ephemeral GPT-6 Astra process reviewed the complete selected metrics/diagnostic/backend sources and integrations. Final static verdict: PASS, no findings. The exact reviewed file bytes match this extraction; see [the original report and fingerprints](../experiments/evidence/request-metrics-runtime-review-20260928.json). This does not certify unprovided dependencies or replace candidate installation tests.
+
+Earlier review findings were reproduced and repaired: untrusted SSE type coercion, enum coercion, invalid journal lifecycle/pairing, diagnostic unread-reader error forwarding, and pending-read cancellation misclassification. The first diagnostic repairs are already isolated in the maintenance base. The candidate retains the original governor policy of prompt logical cancellation, not a new physical socket cleanup guarantee; that scope and the review disposition remain explicit.
+
+## Remaining gate
+
+Frozen install, full check, Chromium and the exact rc.1/rc.2 same-artifact installation matrix are required on this standalone tree. A draft PR makes this scope reviewable; it does not authorize merging the entire internal research archive or publishing metrics under the existing version. No efficiency, token-saving or autonomous-delegation benefit is claimed.
+
+## Standalone verification completed
+
+On the extracted candidate, frozen install and full check passed (131 files / 1,529 tests); Chromium passed (13 files / 73 tests). Both stock DSH rc.1 and rc.2 passed the same-artifact installed runtime checks with defaults unchanged. The tested archive SHA-256 is `43d87c178d16792d674ce3878dc8ab3b9f98541145a91aaae6e16fe61d6f1a9d`; it predates only the final evidence-note update and is not the published 4.51 archive. Existing image/compaction paths and the installed metrics checker were exercised with synthetic responses. No real experiment or account acceptance was run.
+
+At that historical checkpoint the product remained a draft, with no new release number or daily service installation. The promotion section below and current PR record supersede that release status; the recorded test/archive identity remains historical.
+
+## Product promotion — 2026-09-28
+
+The maintainer approved advancing this isolated product scope. Alpha 4.52 is now prepared from the reviewed runtime and current main documentation, with a new independent static source review (no blocker), public English/Chinese operational guides, and no internal evaluation runner. Historical candidate evidence above remains unchanged. Current exact-version checks and release outcome are recorded in the PR and release-readiness record; preparation is not publication. No automatic collection, Task activation or daily-service change is included.

package/docs/agent-notes/task-activation-ui-retirement.md

@@ -0,0 +1,11 @@
+# Retire experimental activation UI — 2026-09-29
+
+The public contribution is now structurally recovery-only, rather than choosing between recovery and the full experimental form. Remove `AdaptiveTaskControl.tsx`, `TaskDelegationConsent.tsx` and the two browser suites whose sole subject was that retired form. Their last retained source is available in the parent Git history and the maintainer's local research archive; historical evidence hashes are not rewritten.
+
+Dependency inspection found only the published conditional branch and those two test suites importing the removed form. No package dependency is exclusive to these React components; React and the host client packages remain required elsewhere. The recovery component, its bilingual/phone-width/late-response/no-replay tests, HTTP activation rejection, owner validation, existing task counters, backend runtime and all task lifecycle tests remain.
+
+The displayed explanation now says frozen, not awaiting acceptance. Old tasks keep authorized Stop/manual takeover and readback. Ordinary conversations remain entry-free. No configuration, saved grant, archive, checkpoint or session data is deleted. Restoring the obsolete form from Git does not authorize enabling it.
+
+Required checks are browser recovery regression, full repository check/build and packaged artifact validation, followed by normal exact-head CI. Removing this UI is not full server orchestration removal; the legacy server implementation still supports historical-state safety until a separately verified recovery-only replacement exists.
+
+Local Node 24.13.0 verification passed: `pnpm run check` (133 files / 1,537 tests, lint/typecheck/build, import/CLI/metrics and packaging) and `pnpm run test:browser` (11 files / 53 tests). The reduction from 73 browser tests is the deliberate retirement of 20 tests for the removed activation/consent forms, not weakened recovery assertions. The preserved recovery suite additionally verifies the frozen wording in both languages. No actual account/model requests or daily services were used.

package/docs/design.md

@@ -10,7 +10,9 @@ The Host registers `llm-openai-codex` as the plugin-owned capability settings na
 
 Fast Mode remains per-session process-local state. Separate default-off profile settings seed newly started top-level and subagent sessions through `agent/created`; resume, setting edits, and repeated startup notifications do not change an existing session's Composer choice. The adapter adds `service_tier: 'priority'` only on Codex requests for an enabled session.
 
-## Task-level model selection (unreleased Phase 1 candidate)
+## Task-level model selection: frozen
+
+Phase 1 #236 and Phase 2 #239 were merged; #248 subsequently paused public activation, which remains paused in Alpha 4.52. The [maintenance scope](maintenance-scope.md) freezes further orchestration development. Retain old-state readback and authorized safety exits. The two candidate descriptions below are historical architecture context, not current release status or instructions to finish acceptance.
 
 The optional conversation control grants a bounded main-model/effort scope to one task, initially Sol/Medium. The task runtime, adapter dispatch wrapper and existing backend governor share durable request accounting. There is no separate Think, Split or Remember product selector. Host-owned permissions, session history and compaction remain their existing owners; model choice grants no new tool authority. See [the consolidated contract and migration](experiments/adaptive-task-phase1.md) for source selection from #232–#235, cancellation, recovery and acceptance limits.
 
@@ -28,6 +30,8 @@ Browser account and update requests have a 45-second deadline covering response
 
 ## Backend request governance
 
+Ordinary adapter profiles and the backend governor do not import Task policy. The composition root explicitly supplies provider wrapping and pre-fetch accounting for retained legacy tasks; see [core transport separation](agent-notes/core-transport-decoupling.md). Removing experimental execution must preserve these historical-task safety obligations.
+
 Authenticated runtime traffic to `https://chatgpt.com/backend-api/` passes through one plugin-owned request governor before network dispatch. The governor fail-closes on any other origin/path, composes caller and route deadlines, keeps the existing Codex-only proxy scope alive for the complete logical direct request or provider stream, assigns a fresh `x-client-request-id` to every HTTP attempt, and bounds one plugin instance to eight concurrent backend requests. Concurrency is counted per HTTP attempt, not during authentication; even parallel fetches within one logical operation share that limit. Requests queued behind that limit remain cancellable and within route deadlines. Cancelling unread/paused bodies, response-hook failures and scope disposal releases resources; scope disposal runs before other plugin teardown waits. URL/header inputs are snapshotted before queue waits and authenticated requests never automatically follow redirects. HTTP `429` or `503` responses with a valid `Retry-After` create a lane-local cooldown that is rechecked on admission, never occupies a network slot while waiting, and honors longer service delays using timer slices of at most 15 minutes; the governor does not invent an account-block verdict or replay a failed model turn. Route-specific protocol retries remain with their existing owners, such as pi-ai model retry semantics and native-compaction's bounded retry loop.
 
 Direct plugin routes use the honest shared identity `originator: deepseek-harness` and `User-Agent: dsh-codex-connect`; Search, quota, image generation, Auto-review, and native compaction all use that policy. The pi-ai model route deliberately preserves pi-ai's provider identity rather than impersonating Codex CLI/Desktop, while still receiving the same attempt id, concurrency, proxy, cancellation, server-directed cooldown, and bounded HTTP diagnostic metadata. Native compaction travels through the provider fetch seam at runtime and therefore shares the model governor lane while retaining the direct-plugin identity on its own request. This split is explicit policy, not a claim about undocumented upstream risk controls.

package/docs/design.zh.md

@@ -8,6 +8,12 @@ bundle patch 只插入 `llm-openai-codex`，不会写入 `agent-default-model`
 
 Host 将 `llm-openai-codex` 注册为插件自有的能力 settings namespace。DSH 的 `llm-pi-ai` catalog 持有 `openai-codex` 可配置 provider 目录条目，Codex Connect 只注册实际 adapter，不重复声明该条目。浏览器通过 Harness settings-scope transport 绑定插件 namespace，把账户、额度以及带保存/放弃的能力配置放在现有“插件配置”卡片中。带 revision 防护的逐字段写入不会覆盖无关设置；提交后会即时协调搜索与图片能力的注册状态。插件绝不写入默认模型设置。
 
+## Task 开发冻结
+
+普通模型适配器与后端请求管理器不直接导入 Task 策略；产品组装处显式接入旧任务的 provider 包装和请求前计数。此拆分保留旧任务权限、取消与恢复，不等于已删除全部实验运行时。见[拆分记录](agent-notes/core-transport-decoupling.md)。
+
+维护范围现以[核心维护决定](maintenance-scope.md)为准：Task Phase 1/2 实现已经合并，但公开启动入口保持暂停，后续自动编排开发冻结。保留旧状态读取、经授权的停止与人工接管；历史候选验收计划不再是当前待办。
+
 ## OAuth 持久化
 
 插件使用 `$DSH_HOME/.openai-codex-auth.json`，与 Codex CLI/Desktop 状态分离。格式 version 2 最多保存 16 个 OAuth 账户，并明确指定唯一当前账户。原 version 1 文件仍可读取，第一次修改凭据时才迁移；迁移前会先生成仅所有者可读的 `.openai-codex-auth.json.v1-backup` 回退副本。若该副本已存在，它必须仅所有者可读且与当前 version 1 文件一致，否则迁移会在替换主文件前停止。移除任一账户或执行退出登录时会删除该副本，避免已移除凭据继续留存。文档大小上限为 512 KiB。POSIX 上拒绝组/其他用户可读文件，也拒绝非普通文件；写入采用原子替换，所有修改使用 Harness 跨进程文件锁，返回给调用方的是凭据副本。

package/docs/experiments/adaptive-task-phase2-design.md

@@ -23,7 +23,7 @@ The original design-only slice was followed by Phase 1 installed-page acceptance
 | `src/adaptive-task-scope.ts`, `src/backend-request.ts` | Exact scoped route, no automatic retry, existing governor | Reuse for child transport with one debit, no second request governor |
 | Host `dsh-agent` baseline types | Factory `create` with unpublished `setup`, publication `commit`, owned `AgentHandle.dispose()` | Use owned handle; creation signal is not a lifetime signal |
 | Old #200 `83f6a02`, `src/split-worker.ts` | Fixed worker, one pre-staged offer, rejects persistence-enabled hosts | Reference only; cannot become the new runtime by removing its guard |
-| `src/client/AdaptiveTaskControl.tsx` | One task model-choice surface | Optional delegation consent/status inside it, not a Split setting |
+| Retired `src/client/AdaptiveTaskControl.tsx` | Historical task model-choice surface | Removed under the maintenance freeze; current public UI is recovery-only, not delegation consent |
 
 Host evidence above is the installed baseline API, not a claim all four host versions have identical signatures. Exact-host create/setup/ownership and cleanup tests are implementation gates. The previous matrix already showed newer hosts need explicit parent ownership; capability adapters must preserve that distinction.
 

package/docs/experiments/evidence/alpha-451-publication.json

@@ -0,0 +1,41 @@
+{
+  "schemaVersion": 1,
+  "checkedAt": "2026-09-28",
+  "version": "0.1.0-alpha.4.51",
+  "channels": {
+    "latest": "0.1.0-alpha.4.50",
+    "alpha": "0.1.0-alpha.4.51"
+  },
+  "tagCommit": "2ac612385ea3c3fcfc1078dc18619d7b1dc49b9a",
+  "release": {
+    "isDraft": false,
+    "isPrerelease": true,
+    "publishedAt": "2026-09-28T00:46:17Z",
+    "tagName": "v0.1.0-alpha.4.51",
+    "targetCommitish": "2ac612385ea3c3fcfc1078dc18619d7b1dc49b9a",
+    "url": "https://github.com/franksong2702/dsh-codex-connect/releases/tag/v0.1.0-alpha.4.51"
+  },
+  "originalRun": "36363043413",
+  "originalRunConclusion": "failure after npm publication, at public readback",
+  "recovery": {
+    "status": "recovered",
+    "version": "0.1.0-alpha.4.51",
+    "runId": "36363043413",
+    "sha": "2ac612385ea3c3fcfc1078dc18619d7b1dc49b9a",
+    "sha256": "6d8ffe3b9335e0f874592f6d5f67d2fe872e809a24a4ae4e2c1d8f14e29857e6",
+    "npmRepublished": false,
+    "tagsPromoted": false,
+    "releaseId": 397876473
+  },
+  "finalReadOnlyVerification": {
+    "status": "already-complete",
+    "version": "0.1.0-alpha.4.51",
+    "runId": "36363043413",
+    "sha": "2ac612385ea3c3fcfc1078dc18619d7b1dc49b9a",
+    "sha256": "6d8ffe3b9335e0f874592f6d5f67d2fe872e809a24a4ae4e2c1d8f14e29857e6",
+    "npmRepublished": false,
+    "tagsPromoted": false,
+    "releaseId": 397876473
+  },
+  "dailyServicesChanged": false
+}

package/docs/experiments/evidence/alpha-452-publication.json

@@ -0,0 +1,58 @@
+{
+  "schemaVersion": 1,
+  "checkedAt": "2026-09-28",
+  "version": "0.1.0-alpha.4.52",
+  "pr": 284,
+  "prHead": "460897102971ca169bb2a856b0b3e1ebfa73a4fb",
+  "dailyServicesChanged": false,
+  "latestPromoted": false,
+  "realProductAcceptanceCalls": 0,
+  "prChecksPassed": 10,
+  "mergeCommit": "21504f83f0bed1d5737cb2b1972bcd3246b8d3a1",
+  "mainCiRun": 36366815118,
+  "releaseRun": "36367211049",
+  "originalRunConclusion": "failure",
+  "recoveryPreflight": {
+    "status": "verified-recovery-needed",
+    "version": "0.1.0-alpha.4.52",
+    "runId": "36367211049",
+    "sha": "21504f83f0bed1d5737cb2b1972bcd3246b8d3a1",
+    "sha256": "5cab311ed632fb2156188a13633d0bf5ca4c569dad8415da4c95ad4d5063e4a4",
+    "npmRepublished": false,
+    "tagsPromoted": false
+  },
+  "recovery": {
+    "status": "recovered",
+    "version": "0.1.0-alpha.4.52",
+    "runId": "36367211049",
+    "sha": "21504f83f0bed1d5737cb2b1972bcd3246b8d3a1",
+    "sha256": "5cab311ed632fb2156188a13633d0bf5ca4c569dad8415da4c95ad4d5063e4a4",
+    "npmRepublished": false,
+    "tagsPromoted": false,
+    "releaseId": 397895899
+  },
+  "finalReadOnlyVerification": {
+    "status": "already-complete",
+    "version": "0.1.0-alpha.4.52",
+    "runId": "36367211049",
+    "sha": "21504f83f0bed1d5737cb2b1972bcd3246b8d3a1",
+    "sha256": "5cab311ed632fb2156188a13633d0bf5ca4c569dad8415da4c95ad4d5063e4a4",
+    "npmRepublished": false,
+    "tagsPromoted": false,
+    "releaseId": 397895899
+  },
+  "channels": {
+    "latest": "0.1.0-alpha.4.50",
+    "alpha": "0.1.0-alpha.4.52"
+  },
+  "tagCommit": "21504f83f0bed1d5737cb2b1972bcd3246b8d3a1",
+  "release": {
+    "isDraft": false,
+    "isPrerelease": true,
+    "publishedAt": "2026-09-28T01:52:28Z",
+    "tagName": "v0.1.0-alpha.4.52",
+    "targetCommitish": "21504f83f0bed1d5737cb2b1972bcd3246b8d3a1",
+    "url": "https://github.com/franksong2702/dsh-codex-connect/releases/tag/v0.1.0-alpha.4.52"
+  },
+  "verified": true
+}

package/docs/experiments/evidence/request-metrics-runtime-review-20260928.json

@@ -0,0 +1,62 @@
+{
+  "schemaVersion": 1,
+  "recordedAt": "2026-09-28",
+  "scope": "M1 opt-in local request metrics only",
+  "base": "2ac612385ea3c3fcfc1078dc18619d7b1dc49b9a",
+  "reviewerModel": "gpt-6-astra",
+  "ephemeralIndependentProcess": true,
+  "inputSha256": "042bc8e326ace2364ce0272ee24b9d9a7a6d17f27871f7cc23fedddd2eb31ff5",
+  "reportSha256": "ae64ddccd26a24568f79e90314311f7ef061f3ceab41e17e14e021692dfa06bc",
+  "reviewedSourceDigests": {
+    "src/request-metrics.ts": "b54d634b5a8cdd6fd563126da6bab30d66f92fa14c2dcacc62986bb871613531",
+    "src/request-metrics-report.ts": "654e16dff53e265315d63364a08276835b99a56d9a43f7452b173a24dd3b8781",
+    "src/request-metrics-cli.ts": "58f8e282a4c879da41b63b3761bf0c2a335284d1796a711d12ba266f52cb6af6",
+    "src/backend-request.ts": "ed1183c9129f17c50cac07ff3e0708441e795f40e79f9de169ca57748bf4c010",
+    "src/request-diagnostics.ts": "48d2b83f2ef0166296c3ca9d817c0f784c913579c1f872e3e4a984f10bb5f768",
+    "tests/metrics-pending-cancel.spec.ts": "c936380765d73dfb18a5d2f849e1f0081042bdfe8e687a1b0c87d59d9221e641",
+    "tests/metrics-response-lifecycle.spec.ts": "bd00752aebfd8400e843d931f165cd702aa04f59af5ab811f70e11b7c7c4b8db",
+    "tests/request-metrics-review.spec.ts": "c479d1da7cbeafe5c01c129699c61c16725c4807b456adbbf135dcb5ad916886",
+    "docs/request-metrics.md": "4ac1cae37431c67c5637d2d6acce54421511cc71ed27a931793872a021533f2b"
+  },
+  "review": {
+    "verdict": "PASS",
+    "findings": [],
+    "residual_limits": [
+      "结论仅覆盖所提供代码、集成差异、文档和基线；未调用工具、访问网络或执行测试。测试源码不构成通过证据。",
+      "所示解析与聚合逻辑检查字段类型、重复记录、同文件先 start 后 finish 配对及 collection 生命周期；允许未完成请求和明确披露的部分尾行。日志不是经过认证的完整消费凭证。",
+      "响应观察未发现新增的字节改写或取消分类回归；真实传输、宿主集成及运行时行为仍未经执行验证。",
+      "所示持久化路径未发现直接写入请求体、响应内容或凭据的代码；未提供的 backend-request-policy.ts 中 clientRequestId 的生成与保留规则不在本次核验范围内。会话哈希不是匿名化，Windows ACL 也未校验。"
+    ],
+    "prior_finding_disposition": {
+      "status": "non-blocking",
+      "description": "接受维护者的处置。信号 abort 和响应 hook 失败后请求取消、随即释放逻辑 admission 的行为已存在于所提供基线。当前 backend-request.ts:85-90、252-256 保留该政策，与 docs/request-metrics.md:54-58 明确声明的逻辑请求契约一致；未发现其新增物理连接清理保证或构成指标回归。",
+      "explicit_consumer_cancel": "backend-request.ts:102、110-115 使用 cancelling 标记抑制取消产生的 pending-read 合成 EOF，并在清理结束后记录一次 cancelled；若期间发生信号 abort，则按文档提前结束逻辑请求。此前观察到的 provider terminal 仍按 request-metrics.ts:236-239 保持优先。",
+      "validation_needed": "执行所提供的取消和生命周期测试以验证运行时行为；本次静态审查不声称这些测试已通过。"
+    }
+  },
+  "runtimeFilesMatchReviewedSources": true,
+  "candidateValidation": {
+    "fullCheck": {
+      "files": 131,
+      "tests": 1529,
+      "passed": true
+    },
+    "chromium": {
+      "files": 13,
+      "tests": 73,
+      "passed": true
+    },
+    "matrix": {
+      "sameArtifact": true,
+      "hosts": [
+        "0.1.7-rc.1",
+        "0.1.7-rc.2"
+      ],
+      "artifactSha256": "43d87c178d16792d674ce3878dc8ab3b9f98541145a91aaae6e16fe61d6f1a9d",
+      "defaultsUnchanged": true,
+      "scope": "standalone draft candidate, not the published base package; archive before final evidence-note updates"
+    }
+  },
+  "releaseStatus": "unpublished draft; package version follows base, not release identity",
+  "realAcceptanceRequests": 0
+}

package/docs/maintenance-scope.md

@@ -0,0 +1,59 @@
+# Core maintenance scope — 2026-09-29
+
+This maintainer-approved scope supersedes earlier roadmap directions to complete experimental acceptance or reopen Task. Historical results remain evidence, not a backlog or authorization to resume. This document changes development priorities, not installed packages or running services.
+
+## Product promise and admission
+
+Maintain authorization/accounts, ordinary manual model use, installation, exact-version compatibility, Canary alert handling, diagnostics, request cancellation/resource safety and necessary recovery. Keep DSH ownership of permissions, session persistence and lifecycle. Local request metrics remains an optional diagnostic capability, not a new evaluation platform or statistics UI.
+
+A proposal needs an identifiable user problem, repeatable supporting evidence and an acceptable maintenance/host-dependency cost before entering the next roadmap. Missing evidence is grounds to defer, not an instruction to build more experiment infrastructure. Reconsideration requires an explicit maintainer decision; green CI or a scheduled reminder cannot reopen a frozen track.
+
+## Disposition
+
+| Surface | Disposition | Retained obligations |
+| --- | --- | --- |
+| Authorization, manual models, installation, compatibility, Canary, diagnostics | Maintain | Scoped defect fixes and supported-version evidence; no automatic expansion of support |
+| Backend governor, cancellation, proxy lifetime, quota cache, request metrics | Maintain | Shared safety and diagnostics; metrics does not establish task cost or savings |
+| Adaptive Task model/effort changes and read-only delegation | Freeze | Public gate stays closed; preserve old-state readback, authorized Stop/manual takeover, accounting and ownership checks |
+| Cross-browser Task recovery and restricted research entry | Freeze development | Preserve local work; any demonstrated safety defect becomes a separate core repair, not a reason to finish orchestration |
+| Internal autonomy evaluation, container runners, grading and budget experiments | Archive research | Preserve source, unfinished changes and dated evidence outside public delivery; no new scenarios, live A/B or pilot work |
+| Retired Think/Split stacks | Historical archive | Do not rebase, reopen or restore as active roadmap work |
+| Native compaction / Remember | Freeze expansion | Preserve existing checkpoint decoding/replay, fallback and recovery; address concrete safety defects without a broad quality study |
+| Luna Reserve | Freeze expansion | Keep default-off and existing safety checks; no manufactured exhaustion or new eligibility experiment |
+| Speculative routing and unproven optimizations | Exclude from roadmap | No distinct speculative-routing implementation was located in the inspected main source/scripts/docs; no deletion target is asserted |
+| Published Search, images, Auto-review and Fast Mode | Existing maintenance only | No new features or silent disablement in this scope change |
+
+Task Phase 1/2 are merged implementations, not merely unshipped drafts. Alpha 4.52 retains the public pause. Published optional features and historical releases cannot be withdrawn by editing this document. Existing installations and saved data remain untouched.
+
+## Dependency removal inventory
+
+| Candidate for a later removal change | Connections that must be separated first | Required preservation/verification |
+| --- | --- | --- |
+| `adaptive-task-*` runtime/delegation/artifact modules | `src/index.ts` constructs the runtime, passes it to the adapter and attaches auxiliary request accounting; HTTP routes and client components consume its state | Normal model/auxiliary requests without Task; old grant readback, authorized exits, cancellation, counters and restart safety |
+| Full Task controls and research recovery UI | Published recovery-only component, authenticated HTTP commands, owner binding, existing task state | Fresh sessions remain entry-free; stale clients cannot activate; do not weaken owner checks to simplify recovery |
+| Research `evals/autonomy/`, restricted runner and research-only tests | Local package/test imports, docs, private evidence and reproduction metadata | Preserve snapshot first; remove only experiment-exclusive dependencies; retain core metrics/governor tests |
+| Native compaction creation experiments | Checkpoint representation and adapter replay also serve existing saved sessions | Keep old checkpoint readability, fallback and recovery; separate creation policy from persisted-data support |
+| Reserve routing | Shared quota cache/account identity and return-state recovery | Keep normal quota display, account isolation and safe restoration; no blanket quota-module deletion |
+
+This is a reviewed starting inventory, not proof that the dependency graph is fully detached. Completed narrow removals are recorded below; the rest remains retained. Each removal must update references/docs together and run focused regression, required build/package checks and supported-host checks appropriate to the changed surface. Do not erase unresolved defects by closing an experiment tracker.
+
+## Current iteration and acceptance
+
+- [x] Record the scope decision and retirement rules, separate from historical acceptance.
+- [x] Link contributor and product entry points to this scope.
+- [x] Identify shared dependencies that prevent bulk removal.
+- [x] Publish the documentation decision: #288 merged as `43a1c013537dd5bfc6944761018c117d197dd25b` after all ten checks passed.
+- [x] Synchronize trackers: #195 and #194 closed as not planned; #65 remains open for two historical failure observations, not a broad experiment campaign. Core-defect monitoring and Canary follow-up now respect the freeze; the original October 3 closeout deadline is unchanged.
+- [x] Separate implicit Task policy imports from core transport, with explicit legacy accounting retained (#289).
+- [x] Remove activation-only browser forms and their exclusive tests after dependency inspection; retain recovery-only UI and regression coverage.
+- [ ] Before any further server removal, replace legacy orchestration with verified recovery-only ownership, missing-state, replay, counters and child cleanup handling. Until then retain the existing server implementation; this is not a commitment to new experiments or Task reopening.
+
+Local research preservation has a separate private archive manifest; do not commit machine paths or private experiment evidence into the public repository. A local archive is not a merged product change and does not stop another running task. Existing scheduled jobs must not be assumed updated by this document.
+
+The [first code separation](agent-notes/core-transport-decoupling.md) removes implicit Task imports from ordinary transport. It retains explicit legacy-task wiring in the product and does not claim the entire runtime is retired.
+
+The [activation UI retirement](agent-notes/task-activation-ui-retirement.md) removes the full experimental form and its exclusive browser tests after dependency inspection. The public contribution retains recovery only. Historical design/evidence entries describing the deleted form are archival, not current source paths or reopening work.
+
+## Evidence baseline
+
+Inspected main: `e26165d962102ca6c6eeba5c5d9a8cfa75ffd02a`, tree `63c1842ed9b6c2527a774ec1943ad9733933231e`. The local documentation branch starts from the identical reviewed PR #287 tree. Public release scope: [Alpha 4.52](https://github.com/franksong2702/dsh-codex-connect/releases/tag/v0.1.0-alpha.4.52). Historical obligations: [#195](https://github.com/franksong2702/dsh-codex-connect/issues/195), [#65](https://github.com/franksong2702/dsh-codex-connect/issues/65), [#194](https://github.com/franksong2702/dsh-codex-connect/issues/194). Their earlier proposed next steps are superseded for local planning, but their GitHub bodies have not been edited by this change.

package/docs/reference.i18n.yaml

@@ -1,4 +1,4 @@
 # Bilingual-pair consistency record for the operational reference. Re-record with:
 #   git hash-object docs/reference.md docs/reference.zh.md
-docs/reference.md: 824fad33dad0fe6e3b1bb7ab5ec10629e5d31459
-docs/reference.zh.md: ebd88277a1177598016e51566aabbee78f7a46b0
+docs/reference.md: 0700f6001d8ffb5fbc029ff24039229c04cabe98
+docs/reference.zh.md: a4630017b51cfe8087e2f420d040c3404c8638c0

package/docs/reference.md

@@ -147,6 +147,8 @@ The main plugin options are:
 | `searchMode` | `cached` | `cached`, `indexed`, or `live` |
 | `searchContextSize` | `medium` | `low`, `medium`, or `high` |
 | `searchMaxOutputTokens` | `10000` | Positive integer output budget for search |
+| `requestMetricsDirectory` | absent / off | Startup-only private absolute directory for [local request evidence](request-metrics.md); no telemetry upload |
+| `requestMetricsMaxBytes` | `16777216` | Startup-only per-process journal cap, integer `4096`–`67108864`; no directory means no collection |
 
 `contextWindowOverrides` changes the client budget, not OpenAI's server capacity. Unknown model ids and values above the plugin's documented configuration ceiling fail explicitly. Use `null` for the whole field to mask inherited overrides, or `null` for one model to restore its catalog default while preserving other entries. Leave room for output and protocol overhead, and treat larger values as deployment-specific experiments rather than entitlement evidence. [Alpha design](design.md) documents the ownership and persistence rules.
 

package/docs/reference.zh.md

@@ -147,6 +147,8 @@ Alpha 4.49 中，完整 `attachment` 选择器匹配到实际用户上传记录
 | `searchMode` | `cached` | `cached`、`indexed` 或 `live` |
 | `searchContextSize` | `medium` | `low`、`medium` 或 `high` |
 | `searchMaxOutputTokens` | `10000` | 搜索使用的正整数输出预算 |
+| `requestMetricsDirectory` | 不设置／关闭 | 启动配置中的私有绝对路径，记录[本地请求计量](request-metrics.zh.md)，不上传遥测 |
+| `requestMetricsMaxBytes` | `16777216` | 每进程单日志上限，整数 `4096`–`67108864`；不配置目录则不采集 |
 
 `contextWindowOverrides` 修改的是客户端预算，不是 OpenAI 服务端容量。未知模型 ID 或超过插件文档配置上限的值会明确失败。将整个字段设为 `null` 可屏蔽继承的全部覆盖值；将单个模型设为 `null` 可恢复其目录默认值，同时保留其他条目。请为输出和协议开销预留空间，并把更大的数值视为特定部署的实验，不能当作账户权限证据。所有权与持久化规则见 [Alpha 设计](design.zh.md)。