dsh-completion-guard 0.8.3 → 0.9.0

package/docs/ACTIVATION_MIGRATION.md

@@ -0,0 +1,167 @@
+# Session activation migration / 会话启用模式迁移
+
+0.9.0 makes `always` the default for **new unseeded root sessions**. It preserves each old session's pre-upgrade effective mode using a write-once private binding. Mode is independent of `standard` policy, execution/publication authority and completion certificates. Empty old sessions belong in the inventory too. Recorded off/on continues to control enablement; neither configuration nor adoption re-signs history.
+
+0.9.0 将**新建无继承根会话**的默认模式改为 `always`，旧会话通过不可覆盖私有绑定保留升级前有效模式。模式独立于 `standard` 策略、执行与发布权限及完成证书。旧空会话也必须清点，已记录的 off/on 继续控制启用状态；配置及 adoption 都不重签历史。
+
+## Prepare before changing the installed version / 升级前准备
+
+Stop the relevant Web, Headless and Desktop session writers. Preserve their installed old package and effective configuration readback before upgrade. The new toolkit may run from an independently prepared candidate directory while the old Guard remains installed. Do not read the upgraded default and label it an old mode. Do not include credential values or session bodies in the readback.
+
+先停止相关 Web、Headless、Desktop 会话写者，在升级前保留旧安装包身份及有效配置回读。可从独立准备的候选工具目录运行新工具，此时旧 Guard 仍安装在原位。不能把升级后的新缺省当作旧模式，不得在回读中包含凭据或会话正文。
+
+Prepare an operator-owned JSON file in the following format. `previousPackage.sha256` identifies the preserved old package bytes; `sourceSha256` hashes the relevant sanitized, pre-upgrade source readback. Cohort names describe that verified source. If all relevant cohorts have one known mode, that uniform mode can cover the inventory. If modes differ, each session needs an explicit `sessionIds` mapping based on verified old provenance; absent or contradictory mappings stay `pending`. Profile paths, dates, event counts and `on` markers cannot supply that mapping. A checksum checks integrity; it is not an issuer signature or proof that an operator's asserted mapping is correct.
+
+准备以下格式的操作者 JSON 文件。包摘要指向保留的旧包字节，来源摘要指向相关的脱敏升级前回读。来源组名描述已核验来源。所有相关来源模式一致时可覆盖库存；模式不同则必须提供基于已核验旧来源的 `sessionIds` 映射，缺失或冲突保持 `pending`。不能用 profile 路径、日期、事件数量或 on 标记替代来源映射。摘要核验完整性，不是发行签名，也不能证明操作者的映射断言正确。
+
+```json
+{
+  "schema": "dsh-activation-prior-modes/v1",
+  "previousPackage": {
+    "name": "dsh-completion-guard",
+    "version": "0.8.4",
+    "sha256": "<64 lowercase hex characters>"
+  },
+  "sourceSha256": "<64 lowercase hex characters>",
+  "cohorts": [{ "name": "verified-old-web", "mode": "opt-in" }]
+}
+```
+
+## Official old-format refusals and an explicit readable subset / 官方旧格式拒绝与显式可读子集
+
+The official persistence reader may reject an older session with `SessionFormatUnsupportedError`. This names a host format-support boundary; it does not by itself prove corruption or a Guard regression. Do not delete, rewrite, rename or repair the raw log to force acceptance. Preserve it, the old package and its verified effective-mode source. `inventory` can record this **specific official open refusal** as pending. Other failures (corruption, permissions, missing files, unknown errors, list/stat failure or drift) abort; they are not automatically skipped. Default `inspect/adopt/verify` still requires the whole inventory to be readable.
+
+官方 persistence 可能以 `SessionFormatUnsupportedError` 拒绝旧格式会话。这说明宿主格式支持的边界，本身不证明日志损坏或 Guard 回归。不要删除、重写、改名或“修复”原日志来绕过拒绝；保留原日志、旧包和已核验的旧有效模式来源。inventory 只将这类**官方 open 拒绝**记为 pending；损坏、权限、丢失、未知异常、list/stat 失败或库存变化均中止，不会被自动跳过。默认 inspect/adopt/verify 仍要求整库可读。
+
+Suppose an inventory contains N sessions, of which M are readable. First freeze the full report, then review the local `rows` and write a JSON array containing only the readable IDs you explicitly choose, for example `["chosen-a", "chosen-b"]`. The example IDs are placeholders; use exact report IDs. No automatic “all readable” selection is made. The report and manifests contain private IDs and metadata hashes, but no event bodies or credentials; keep them local and owner-only. Run this phase before replacing either the host or Guard, with writers stopped. You can copy the preserved logs into a separate, access-controlled workspace for later host-format diagnosis; never change the authoritative originals or share their contents.
+
+假设库存共 N 个会话，其中 M 个可读。先冻结全库报告，查看本地 rows，再将明确选中的可读 ID 写入 JSON 数组，如 `["chosen-a", "chosen-b"]`。示例 ID 是占位符，必须换成报告中的精确 ID；工具不会自动选择“所有可读”。报告与清单含私有 ID 和元数据摘要，不含正文或凭据，应仅在本地以所有者权限保存。替换宿主或 Guard 前、写者停止时完成这一阶段。后续宿主格式诊断可使用另行受控保管的日志副本，不能改动权威原件或外传正文。
+
+```sh
+# POSIX shell; use distinct unused output paths. Match compression to the real config.
+node /absolute/prepared-package/bin/dsh-completion-guard-activation.mjs inventory \
+  --runtime-anchor /path/to/runtime/package.json \
+  --persistence-root /path/to/active-session-storage \
+  --output /path/to/inventory.json
+
+# chosen-ids.json is an operator-reviewed JSON array of exact readable IDs.
+node /absolute/prepared-package/bin/dsh-completion-guard-activation.mjs select \
+  --inventory /path/to/inventory.json \
+  --include-file /path/to/chosen-ids.json \
+  --output /path/to/selection.json
+
+node /absolute/prepared-package/bin/dsh-completion-guard-activation.mjs inspect \
+  --runtime-anchor /path/to/runtime/package.json \
+  --persistence-root /path/to/active-session-storage \
+  --selection /path/to/selection.json \
+  --prior-modes /path/to/old-mode-source.json \
+  --output /path/to/selected-receipt.json
+
+# After replacement, before upgraded host startup:
+node /absolute/prepared-package/bin/dsh-completion-guard-activation.mjs adopt \
+  --runtime-anchor /path/to/runtime/package.json \
+  --persistence-root /path/to/active-session-storage \
+  --selection /path/to/selection.json \
+  --receipt /path/to/selected-receipt.json \
+  --dsh-home /path/to/actual-dsh-home
+
+node /absolute/prepared-package/bin/dsh-completion-guard-activation.mjs verify \
+  --runtime-anchor /path/to/runtime/package.json \
+  --persistence-root /path/to/active-session-storage \
+  --selection /path/to/selection.json \
+  --receipt /path/to/selected-receipt.json \
+  --dsh-home /path/to/actual-dsh-home
+```
+
+`inventory_scanned` reports total/readable/unsupported counts and creates the frozen report. `selection_ready` creates the explicit scope manifest; empty, duplicate, unknown or unsupported IDs refuse. Selected `inspect` reports `ready` only when all included identities have verified old sources, then writes a receipt. Mixed-mode sources need exact per-session mappings. Source mappings may cover excluded IDs too, but exclusions never acquire a mode binding. Never infer a mode from format, date, path, event count or a new default.
+
+inventory_scanned 表示已生成全库报告及总数/可读/拒绝数量；selection_ready 表示已冻结显式范围，空选、重复、未知或被拒绝 ID 都会拒绝。子集 inspect 仅在所有包含会话的旧来源均可核验时返回 ready 并创建收据。混合模式需逐会话映射；旧来源映射可以包含排除项，但排除项不会被写入模式绑定。不得按格式、日期、路径、事件数或新默认值猜模式。
+
+Every selected `inspect/adopt/verify` rescans the **whole** inventory and checks all listed header/revision hashes, readable birth identities and refusal statuses against the selection. Added, removed, replaced or changed rows—including excluded ones—or changed readability invalidate the scope before adoption. Supplying the same manifest is mandatory on all three commands; full and selected receipts cannot be substituted. An integrity digest binds the asserted inputs; it is not authority or proof that an old-source assertion is true. A host upgrade that changes the scan requires a fresh report and reviewed scope before proceeding.
+
+每次子集 inspect/adopt/verify 都重扫**全库**，核对全部 list header/revision 摘要、可读出生身份及拒绝状态。新增、删除、替换、变化（包括排除项）或可读性变化，会在 adoption 前使范围失效。三条命令均须携带同一 selection，不能混用全库与子集收据。摘要只绑定断言输入，不提供权限，也不能证明旧来源断言正确。宿主升级若改变清点结果，必须重新生成报告并审核范围后再继续。
+
+`selected_complete` means that **only the receipt-selected rows** completed or verified. `selected_partial` means one or more of those rows refused. Both report `scope: receipt_selected`, `wholeInventoryStatus: not_claimed`, and a pending list for all exclusions (`session_format_unsupported` or `not_selected`). Pending remains visible even if the command exits zero. Repeat adoption for the same unchanged scope: completed rows are byte-identical no-ops; missing rows can continue, conflicts remain refused and intact. `verify` never writes. Preserve all existing reports and receipts; `activation_output_exists` requires a new output name, not deleting the old evidence. Drift requires new inventory/selection/inspect, not editing a digest or reusing a stale scope. The older full-inventory path below remains available without `--selection`.
+
+selected_complete **仅表示收据选中行**完成或核验通过；selected_partial 表示其中至少一行拒绝。两者均输出 scope: receipt_selected、wholeInventoryStatus: not_claimed，以及所有排除项的 pending 清单（session_format_unsupported 或 not_selected）。命令即使零退出，也不能隐藏 pending 或称为整库完成。相同且未变的范围可重复 adopt：完成行字节不变，缺失行可继续，冲突拒绝且原状保留；verify 从不写入。保留旧报告和收据；activation_output_exists 应换一个输出文件名，而不是删除证据。库存变化后重新 inventory/selection/inspect，不能改摘要或复用过期范围。下方不带 --selection 的原整库路径仍可用。
+
+When a later official host supports the pending format, use its **read-only** persistence reader on the preserved log, generate a fresh inventory, compare actual birth identity and re-establish the preserved old-mode source. Confirm that the existing user authorization covers the newly included scope; ask only if it does not. Create a new selection and receipt, then adopt and verify. A previous migration receipt or certificate grants no new migration/publication authority. If the reader still refuses or the source cannot be recovered, retain pending and continue new work in a fresh qualified root session; do not fabricate origin, inherited cut, old mode or receipt. The original history remains available for later support.
+
+以后官方宿主支持这些格式时，用该宿主的**只读** persistence 读取保留日志，生成新库存，核对实际出生身份并重新核验保留的旧模式来源；核对已有用户授权是否覆盖新增范围，仅在未覆盖时补充确认；随后生成新 selection/收据，再 adopt 和 verify。旧收据或证书不授予新迁移或发布权限。仍拒绝或无可恢复来源时保持 pending，可在新的合格根会话继续工作；不能伪造 origin、继承 cut、旧模式或收据。原历史保留以等待后续支持。
+
+### Copyable migration prompts / 可复制迁移提示词
+
+> Help me migrate session activation to DSH Completion Guard 0.9.0. Lifecycle constraint: [fill in which writers may be stopped and whether restart is allowed]. Reuse scope, write and lifecycle authorization already supplied in this conversation; ask only for missing or materially changed decisions. First report the current host/persistence/compression settings, preserved 0.8.x package identity and sanitized pre-upgrade effective-mode sources. If they cannot be verified, keep affected sessions pending. Do not replace packages, stop/restart processes or write bindings before that lifecycle and mutation authority is established. Run the packaged read-only inventory command; show total/readable/official-format-refused counts and a local pending report. Use my existing explicit selection, or ask me to choose the included scope if none was supplied; do not silently expand it or treat readability alone as authorization. Bind that explicit selection through inspect/adopt/verify, detect all inventory changes, preserve raw logs and old sources, and never infer modes/origin/cuts from paths, dates or event counts. No log bodies, credentials or private IDs leave my machine. Once the scope and writes are covered by my authorization, adopt, repeat to check no-op, and verify; report selected completion and remaining pending separately. For unsupported rows, give the future official-reader/re-inventory/source-validation route; without a recoverable source, keep pending or use a new session. Do not treat old certificates as new authority.
+
+> 帮我迁移到 DSH Completion Guard 0.9.0 的会话启用模式。生命周期约束：[填写允许停止的写者及是否允许重启]。沿用本会话已给出的范围、写入及生命周期授权，仅询问缺失或实质变化的决定。先报告现有宿主、持久化目录/压缩配置、保留的 0.8.x 包身份及脱敏的升级前有效模式来源；不能核验就将受影响会话保持 pending。取得明确生命周期和写入权限前，不替换包、不停/重启进程、不写绑定。运行打包工具的只读 inventory，报告总数/可读/官方格式拒绝数量并保存本地 pending 报告；沿用我已明确选择的范围，尚未选择时再请我决定；不静默扩大范围，也不把可读性本身当作授权。让显式 selection 贯穿 inspect/adopt/verify，检测全部库存变化，保留原日志和旧来源，不按路径、日期、事件数猜模式/origin/cut。正文、凭据、私有 ID 不离开本机。范围和写入已有授权覆盖后 adopt、重复检查 no-op，再 verify，分别报告选中行完成及剩余 pending。被拒绝项给出未来官方读取器支持后重盘点、核验身份/旧来源的方案；没有可恢复来源就保留 pending 或改用新会话。旧证书不当作新权限。
+
+
+## Full-inventory inspect, adopt, verify / 整库清点、采纳、核验
+
+The entry `node /absolute/prepared-package/bin/dsh-completion-guard-activation.mjs` below uses the independently prepared 0.9.0 toolkit; it does not assume a new command is installed on PATH while the old Guard remains installed. The tool mounts only the official JSONL persistence service, without starting the agent loop, UI or model. `--runtime-anchor` is a file in the physical official runtime; the tool resolves its real path before loading dependencies. `--persistence-root` and optional `--compression none|zstd` must match the active persistence configuration. No storage path or encoding is guessed. Inspection uses public `list`, read-only `open`, exact header/inherited-cut metadata and revision readback; it outputs no event bodies. Keep writers stopped through the sequence.
+
+下方使用独立准备的 0.9.0 工具入口 `node /absolute/prepared-package/bin/dsh-completion-guard-activation.mjs`，不假定旧 Guard 仍安装时新命令已在 PATH。工具只挂载官方 JSONL persistence 服务，不启动 agent loop、界面或模型。runtime anchor 必须是官方 runtime 中的文件，加载依赖前先解析物理路径。持久目录及可选压缩格式必须匹配实际配置，不推测目录或编码。清点使用公开 list、只读 open、精确 header/cut 元数据及 revision 回读，不输出事件正文。整个操作期间保持写者停止。
+
+The following example is for a POSIX shell. Run `inspect` before replacement; run `adopt` and `verify` before starting the upgraded host. Keep the prepared toolkit path explicit throughout.
+
+以下示例使用 POSIX shell：替换前执行 inspect，升级后的宿主启动前执行 adopt 和 verify，全程使用明确的候选工具路径。
+
+```sh
+node /absolute/prepared-package/bin/dsh-completion-guard-activation.mjs inspect \
+  --runtime-anchor /path/to/runtime/package.json \
+  --persistence-root /path/to/active-session-storage \
+  --prior-modes /path/to/old-mode-source.json \
+  --output /path/to/frozen-migration.json
+
+node /absolute/prepared-package/bin/dsh-completion-guard-activation.mjs adopt \
+  --runtime-anchor /path/to/runtime/package.json \
+  --persistence-root /path/to/active-session-storage \
+  --receipt /path/to/frozen-migration.json \
+  --dsh-home /path/to/actual-dsh-home
+
+node /absolute/prepared-package/bin/dsh-completion-guard-activation.mjs verify \
+  --runtime-anchor /path/to/runtime/package.json \
+  --persistence-root /path/to/active-session-storage \
+  --receipt /path/to/frozen-migration.json \
+  --dsh-home /path/to/actual-dsh-home
+```
+
+`inspect` creates a new owner-only receipt with exclusive creation, or reports exact unresolved session IDs and exits nonzero without creating an adoptable receipt. `adopt` first checks receipt identities against the current public inventory, then writes each binding separately; `verify` never writes. A conflict leaves the other completed rows intact and reports `partial`. Repeating adoption is a byte-identical no-op for completed rows and continues missing rows. Claim completion only after all receipt rows verify. A newly appearing session is not silently included in an old receipt.
+
+inspect 排他创建仅所有者可访问的新收据，或报告未解决会话 ID 并非零退出，不生成可采纳收据。adopt 先用当前公开库存核对身份，再逐会话写绑定；verify 不写入。冲突保留其他已完成行并报告 partial，重复采纳对已完成行字节不变，继续缺失行。所有收据行核验通过后才可报告该收据迁移完成；新出现的会话不会被静默加入旧收据。
+
+## Restore, diagnosis and rollback / 恢复、诊断与回退
+
+Bindings live under `DSH_HOME/completion-guard/activation-bindings-v1` (`~/.dsh` when unset), with one hashed slot per SessionId. Birth identity includes createdAt, parent, seeded flag, exact inherited cut, origin and delegation depth; preset, cwd, profile and host lock do not change it. Existing mode overrides defaults. A contradictory explicit configuration refuses `activation_mode_conflict`; removing that contradictory override restores the original binding semantics. To choose another initial mode, create a new root session. Restore/clear/compact/late attach never create a missing binding.
+
+绑定位于上述私有目录，一个 SessionId 对应一个摘要槽。出生身份包含 createdAt、父会话、seed 标记、精确继承 cut、来源及委派深度；preset、cwd、profile、宿主锁不改变模式身份。已有模式覆盖缺省，显式矛盾报具名拒绝；移除矛盾覆盖可恢复原绑定语义，选择另一初始模式请新建根会话。恢复、清空、压缩、迟挂载不补建缺失记录。
+
+Missing/corrupt/changed records invalidate cached projections and certification. Inspect the named reason, then use the preserved verified receipt to adopt the same missing old identity/mode. Corrupt or conflicting final slots refuse automatic repair; preserve them for diagnosis. If no trusted old source remains, keep the session unknown and establish new work in a fresh qualified session. This does not delete history or trigger an endless correction loop. Forks require a parent binding and inherit its mode; the exact cut is supplied and validated by the official Session/persistence contract, without mode inference from prefix length.
+
+缺失、损坏或变化的记录使缓存投影和认证失效。根据具名原因诊断，再使用保留且已核验的收据采纳同一缺失旧身份与模式。损坏或冲突的 final 拒绝自动修复，请保留诊断；无可信旧来源时保持 unknown，在新合格会话中建立新工作。不删除历史，也不触发无穷纠正。fork 需核验父绑定并继承父模式；精确 cut 由官方 Session/persistence 合同提供及验证，不由前缀长度推断模式。
+
+A fresh 0.9.0 creation that leaves `.pending` has no general recovery command in this toolkit. `inspect` accepts preserved pre-0.9.0 sources, and `adopt` requires a verified legacy migration receipt; neither permits inventing such a receipt for a fresh creation. Without an existing trusted legacy receipt, keep the mode unknown, diagnose the retained state, or continue new work in another qualified fresh session. The exported same-value writer is a programmatic controlled recovery primitive, not an operator CLI. Do not delete `.pending` merely to make the final readable.
+
+新的 0.9.0 会话创建留下 .pending 时，本工具没有通用恢复命令。inspect 只接受已保留的 0.9.0 前来源，adopt 需要核验过的旧迁移收据，不能为新建会话编造旧收据。没有既有可信旧收据时，保持模式 unknown、诊断保留状态，或在另一合格新会话中继续新工作。导出的同值 writer 是程序受控恢复原语，不是操作者 CLI；不能为了让 final 可读而删除 .pending。
+
+For rollback, stop writers, retain the receipt and bindings, and select the previous mode explicitly in each old profile before reinstalling the old Guard. A pre-0.9.0 Guard does not read these bindings; mixed-mode inventories need separate correctly mapped profiles or remain unsuitable for rollback. Keep host-lock and certificate identities separate: re-inspect the actual installed host as required, and never re-sign old certificates merely to change mode. Cross-machine transfer includes only verified bindings/receipts, with owner permissions restored; it transfers no host lock, credentials or native authority.
+
+回退先停写者，保留收据与绑定，为旧 profile 显式选择原模式再恢复旧 Guard。0.9.0 之前的 Guard 不读取绑定，混合模式库存需正确映射的独立 profile，否则不适合回退。宿主锁及证书身份另行核验，不为改变模式重签旧证书；跨机仅迁移核验过的绑定与收据并恢复所有者权限，不转移宿主锁、凭据或原生权限。
+
+## Storage capability limits / 存储能力边界
+
+POSIX writes reuse the private writer lock, exclusive temporary creation, full write/file fsync, non-overwriting hard-link publication, directory fsync and final readback. Same identity/mode is a strict no-op preserving provenance. Readers reject malformed/duplicate-key JSON, bad digest/schema, unsafe owner/access modes, leaf links and user-owned ancestor links. Root-owned macOS `/var` and `/tmp` system aliases are the only permitted ancestor link exceptions; writable non-sticky ancestry refuses. These checks do not claim resistance to hostile same-owner processes racing the filesystem.
+
+POSIX 复用私有 writer 锁、排他临时文件、完整写入及文件 fsync、不可覆盖 hard-link 发布、目录 fsync 与 final 回读。同身份同模式严格不改写来源。读取拒绝坏 JSON、重复键、摘要/schema 错误、错误所有者/权限、叶链接及用户祖先链接；仅允许 root 所有的 macOS 系统别名 /var、/tmp，非 sticky 可写祖先拒绝。它不是防御同 owner 恶意并发文件系统操作的绝对保证。
+
+Windows uses the adopted **published-file flush barrier** on qualified local storage supporting same-volume hard links: flush the complete exclusive temporary, publish the non-overwriting link, open the existing final with read/write permissions without create/truncate, verify regular-file identity and exact bytes, fsync that final handle, close it and independently read back. No final bytes or permissions are normalized. Directory fsync remains an observed EPERM capability gap. Microsoft documents file data/metadata flush; applying that file flush to the newly published link is an explicitly bounded engineering inference, not POSIX-directory equivalence, power-loss proof, hardware-cache guarantees or durability of the whole ancestor namespace. Native candidate acceptance must record filesystem/runtime identity, this barrier and the directory gap separately.
+
+Windows 在合格且支持同卷 hard-link 的本地存储上采用**发布后文件 flush 屏障**：完整排他临时文件 flush，不可覆盖 link 发布，以不创建/不截断的可写句柄打开现有 final，核对 regular-file 身份及精确字节，fsync 该句柄，关闭后独立回读。不规范化 final 字节或权限。目录 fsync 的 EPERM 能力缺口保留。Microsoft 说明文件数据/metadata flush；将其应用于刚发布的 link 是具名、有界工程推论，不是 POSIX 目录等价、断电、硬件缓存或整个祖先 namespace 持久性证明。候选原生验收须分别记录文件系统/runtime、文件屏障及目录缺口。
+
+A post-publication failure retains the exclusive `.pending` temporary hard link; readers refuse `activation_publication_incomplete` even when final is visible. Controlled same-value writing reopens and successfully flushes retained temporary bytes, then can verify the exact pending/final identity, complete the barrier and remove the temporary. Recovery does not rewrite bytes or provenance. Temporary cleanup occurs after the required barrier/readback and its crash durability is a separate limit, not covered by that earlier flush. A malformed retained temporary or identity/mode conflict refuses automatic recovery. This is one per-session temporary publication, with no global transaction or birth WAL.
+
+发布后失败保留排他的 .pending 临时 hard-link；即使 final 可见，读者仍拒绝未完成发布。受控同值写入须重新打开并成功 flush 保留临时字节，再核对 pending/final 精确身份、补完屏障并移除临时项，不改字节或来源。临时清理在必需屏障与回读之后，它的 crash 持久性独立，不能借用此前 flush。坏临时项或身份/模式冲突拒绝自动恢复；这是逐会话临时发布，无全局事务或 birth WAL。
+
+The official file-tool guard denies explicit private-storage targets (including resolved path aliases), and shell-tool calls naming the private roots or mode entrypoint. Operator migration runs independently. This is bounded tool-surface protection, not arbitrary command interpretation, a general subprocess sandbox or protection against hostile in-process plugins/encoded shell commands. No broader host interception is claimed.
+
+官方文件工具 guard 拒绝明确的私有目标（含解析后的路径别名），shell 工具拒绝指向私有根或模式入口的调用；操作者迁移独立执行。这是有界工具表面保护，不是任意命令解释、通用子进程 sandbox，也不防御同进程恶意插件或编码 shell 绕过，不声称更广的宿主拦截。

package/docs/ARCHITECTURE.md

@@ -40,9 +40,9 @@ without such a notice cannot be upgraded by reading today's Host config.
 
 ## Durable state model
 
-The effective plugin configuration and the DSH Session append-only log are the ordinary inputs to the rebuildable Guard projection. Context Guard **appends no custom session event types**: the persisted event vocabulary is harness-owned and the current persistence layer refuses unknown event types. The explicit release and restart paths additionally use the provider-invisible private ledger described below. The `activation` configuration supplies the initial enablement state, while ordinary session state is derived from the natively persisted events DSH already writes:
+The resolved session mode binding, effective policy configuration and DSH Session append-only log are the ordinary inputs to the rebuildable Guard projection. Context Guard **appends no custom session event types**: the persisted event vocabulary is harness-owned and the current persistence layer refuses unknown event types. The explicit release and restart paths additionally use the provider-invisible private ledger described below. The `activation` configuration selects only a fresh unseeded root binding; the resolved immutable binding supplies initial enablement, while ordinary session state is derived from the natively persisted events DSH already writes:
 
-- effective plugin configuration — initial enablement (`opt-in` starts disabled; `always` starts enabled before log replay);
+- immutable session mode binding — initial enablement (`always` is the new-root default; adopted old modes persist; `opt-in` starts disabled and `always` starts enabled before replay);
 - `command/run` — later enablement (`/context-guard on|off|clear`) and epoch transitions;
 - `user/message` — captured contract clauses;
 - `tool/call` + `tool/result` — bounded evidence and completion-certificate attempts;
@@ -52,7 +52,7 @@ The effective plugin configuration and the DSH Session append-only log are the o
 
 Everything else in the DSH log is deliberately ignored. In particular a V3 `system/message` is a plugin-sourced surface node rather than root authority, a compaction checkpoint `user/message` stays plugin context, and `request/header`, `request/context`, `assistant/attempt`, `session/end-seed` and raw `assistant` streams carry no contract state.
 
-The in-memory `GuardProjection` is a rebuildable cache: `deriveProjection` applies the effective activation configuration, replays the native log deterministically, recomputes every contract, evidence, and certificate, and flags `corrupt` when a recorded certificate no longer re-derives from the evidence in the log. The projection and its evidence are session-scoped: a new DSH session starts a new projection and cannot import, look up, or certify evidence IDs from another session. A completed workflow that needs a certificate must therefore produce its evidence and call `context_guard_checkpoint` in the same session. Under `always`, replay begins enabled; changing an existing profile from `opt-in` to `always` can therefore bring earlier persisted user messages into the derived contract. A recorded `/context-guard off` disables capture from that point until a later `on`. A recorded `/context-guard clear` supersedes every pending requirement and acceptance under a `CLEAR:<revision>` sentinel (prohibitions are retained) and bumps the contract revision, so a fresh empty-binding checkpoint can certify while the guard stays enabled. Captured contracts always carry a concrete subject/surface, so no unrelated evidence can close a requirement.
+The in-memory `GuardProjection` is a rebuildable cache: `deriveProjection` applies the resolved session activation mode, replays the native log deterministically, recomputes every contract, evidence, and certificate, and flags `corrupt` when a recorded certificate no longer re-derives from the evidence in the log. The projection and its evidence are session-scoped: a new DSH session starts a new projection and cannot import, look up, or certify evidence IDs from another session. A completed workflow that needs a certificate must therefore produce its evidence and call `context_guard_checkpoint` in the same session. Under a bound `always` mode, replay begins enabled. Changing a profile default does not change old bindings; a contradictory explicit setting refuses rather than replaying that session under another mode. A recorded `/context-guard off` disables capture from that point until a later `on`. A recorded `/context-guard clear` supersedes every pending requirement and acceptance under a `CLEAR:<revision>` sentinel (prohibitions are retained) and bumps the contract revision, so a fresh empty-binding checkpoint can certify while the guard stays enabled. Captured contracts always carry a concrete subject/surface, so no unrelated evidence can close a requirement.
 
 ## Session lifecycle: silent start, first-message activation
 
@@ -219,3 +219,9 @@ Checkpoint certification runs over the complete contract before display filterin
 The serializer reserves metadata space before selecting rows and returns at most 12 KiB of valid UTF-8 JSON. Oversized rows identify omitted detail; `detail_id` retrieves bounded JSON-text chunks. Later chunks require the initial `snapshot` as `detail_snapshot`. A long ID may use a SHA-256 lookup token in the summary; its original ID remains unchanged in the detail. Explicit `item_ids` can inspect passed and superseded provenance as well as current work. None of these views changes the certificate's scope.
 
 Recovery reserves its rules, query pointer and folding totals before filling item summaries. Separate category slots retain a key prohibition and the newest pending requirement before optional rejection details or evidence; many constraints cannot hide the current work. Long IDs are summarized independently of the reason and next step. Small packets distinguish capability restoration from requirement rebinding. Its default budget is 4,000 characters; values below 512 or non-integers are rejected. The 512-character form keeps a constraint, the current limitation, and a query pointer. Full constraint enforcement remains in the ledger and execution checks. The runtime re-derives binding refusals from persisted calls and deduplicates guidance against the current contract and relevant evidence. A real compact/resume boundary always resets that context-local deduplication.
+
+### Session initial activation (0.9.0)
+
+The real Cordis schema preserves omitted activation; qualified public startup binds only fresh unseeded roots. Existing sessions read their write-once birth binding, and pre-upgrade sessions need independent inventory/adoption. Resume, compact, clear and late attach cannot guess a mode. Every sync freshly calls `readActivationBinding`; missing/changed/conflicting files invalidate fast paths and certification. This store is independent of the certificate identity and private release ledger, with no global birth WAL or mode transaction. Exact parent cut comes from the host contract; no factory issuer token is assumed. See [storage, migration and Windows capability limits](ACTIVATION_MIGRATION.md).
+
+真实 Cordis schema 保留省略来源，合格 startup 只绑定新建无继承根。旧会话读取不可覆盖出生绑定，升级前库存需独立 adoption；恢复等入口不猜模式。每次 sync 新鲜读取绑定，缺失、变化、冲突使缓存及认证失效。存储独立于证书身份和私有发布账本，无全局 birth WAL 或模式事务。父 cut 来自宿主合同，不假设 issuer token；平台能力边界见迁移说明。

package/docs/COMPATIBILITY.md

@@ -2,9 +2,9 @@
 
 Guard binds each accepted installation to its exact package identities, implementation bytes and dependency routes. Version admission and implementation qualification are separate checks; a matching version alone does not establish compatibility.
 
-## 0.8.2–0.8.3: DSH >=0.2.0-rc.2 and official Desktop
+## 0.8.2–0.9.0: DSH >=0.2.0-rc.2 and official Desktop
 
-0.8.3 retains the host admission and Desktop support introduced in 0.8.2. Each release still requires its own artifact acceptance.
+0.9.0 retains the host admission and Desktop support introduced in 0.8.2. Each release still requires its own artifact acceptance.
 
 Version admission uses strict SemVer precedence, including later-tuple RCs and ignoring build metadata. The floor is `0.2.0-rc.2`, with no upper limit. `0.2.0-rc.1` keeps its recorded-evidence row but is refused as below the floor. Below-floor and malformed versions are refused. Cordis has a separate `>=4.0.4` peer range and qualification; a DSH version does not establish arbitrary Cordis compatibility.
 
@@ -18,15 +18,17 @@ Guard identifies the profile by its manifest name. A Desktop profile contains th
 
 Desktop's bundled pnpm 11.7 produces a physical hoisted plugin tree with a JSON `.modules.yaml` index and no package map. Guard verifies the index against the actual tree, then applies the same published-byte and dependency-route checks to local critical peers. Missing, unlisted, duplicate, escaped or changed critical packages are refused. A supported package-map layout remains accepted when present; malformed maps never fall back to the physical-tree path.
 
+The official market (`dshmarket`) is an ordinary third-party profile plugin on a Desktop profile: its bundle presence neither conflicts with the official bundle tuple nor identifies the surface as Web, and its package name grants no trust. Installing or removing the market changes the profile's importer, so the previous Desktop lock stops matching and must be rebuilt through the formal flow. Real-market coexistence acceptance (`desktop-market-coexistence/v1`) is recorded separately from the layered no-op gate in the matching Release annex; graphical-shell and real-model observations remain separate gates.
+
 The archive is read in place. The registry baseline closes the executable/JSON inventory of each critical package, including scripts outside `lib`. Its bytes must match the acquired official tarball digests. The signed archive metadata authenticates the packager's rewritten manifests; executable files have no rewrite exception. Nested critical packages, unlisted code and changed dependency routes are refused. The same fresh route and byte audit also checks critical peers selected from the physical profile.
 
 The lock binds the canonical archive, signed header, runtime manifest and metadata, carrier bytes, installed Guard manifest, profile manifest, map and lockfile. Inject and runtime revalidation use one evaluation path, including foreground renderers and default-workdir providers. Changed inputs refuse the injected lock. Receipts stay under physical, contained profile directories; directory links cannot redirect them elsewhere.
 
 `hostLockProfile: "desktop"` is preserved through composition and readback. Guard refuses Desktop restart with `host_capability_request_unsupported`; the graphical app owns its lifecycle. Exact-artifact backend acceptance, graphical-shell acceptance and real-model behavior are separate gates. Their results belong to the matching Release annexes.
 
-### 0.8.2–0.8.3 中文说明
+### 0.8.2–0.9.0 中文说明
 
-0.8.3 保留 0.8.2 的宿主准入范围与 Desktop 支持；各版本仍须独立核对制品验收结果。
+0.9.0 保留 0.8.2 的宿主准入范围与 Desktop 支持；各版本仍须独立核对制品验收结果。
 
 0.8.2 延续 0.8.x 的任务、证书与数据协议，主要适配 DSH RC.2、增加 Desktop 宿主锁并修复退出证据判定。最低 DSH 版本升至 `0.2.0-rc.2`；请先升级宿主，再安装 Guard、重新注入锁并回读。版本准入没有上限，但版本号相符仍不足以证明实现兼容。Cordis 的独立要求为 `>=4.0.4`。
 
@@ -34,6 +36,8 @@ Desktop 按应用自有的 `dsh-profile-desktop` 名称识别。安装须使用
 
 Desktop 自带 pnpm 11.7 生成平铺插件目录，安装索引为 JSON 格式的 `.modules.yaml`，不含 package-map。Guard 核对索引与实际目录，再对本地关键 peer 执行相同的官方字节与依赖路由认证。关键包缺失、未登记、重复、越界或发生改写时均拒绝准入；若存在受支持的 package-map，则使用该布局，损坏的 map 不会回退到平铺目录路径。
 
+官方插件市场（`dshmarket`）在 Desktop profile 上是普通第三方 profile 插件：它的 bundle 既不与官方 bundle 元组冲突，也不能把运行面识别成 Web，其包名本身不授予任何信任。安装或移除市场会改变 profile 的 importer，旧 Desktop 锁因此不再匹配，必须按正式流程重建。真实市场共存验收（`desktop-market-coexistence/v1`）在对应 Release annex 中与分层 no-op 门槛分开记录；图形界面与真实模型观察仍是独立门槛。
+
 Guard 先核验 macOS 的 DeepSeek Developer ID 签名或 Windows 的 DeepSeek Authenticode 发布者，再将 ASAR 头与签名载体内的摘要比对。随后原位读取归档，按独立获取的官方 tarball 清单核验关键包内全部可执行/JSON 文件，包括 `lib` 外的脚本。签名归档的元数据只用于认证打包器改写的 manifest；新增代码、嵌套关键包、错误依赖路由及本地被改动的关键 peer 均拒绝。宿主锁同时绑定应用、载体、profile、安装映射与锁文件；注入和运行时复验采用同一链路，并核验 shell 渲染器及默认工作目录提供者。
 
 Desktop 应用重启仍由应用自行管理，Guard 不提供该能力。最终制品的后端生命周期、图形界面和真实模型验收分别记录在对应 Release annex 中。定时提醒及超时问题的晚到答案仍不授予根指令权限；退出标记被后续 prose 遮挡时，结果保持 `unknown`，不再误判成功。
@@ -147,7 +151,11 @@ Market versions do not select a core cohort. Market restart has its own protocol
 
 The package exposes a named `apply(ctx)` function and a named `inject` array (`['sessions', 'commands', 'fs']`) with no default export. Its `dsh.bundle.patch` points at `cordis.patch.yml`, which inserts the `context-guard` bundle row.
 
-The plugin accepts an `activation` configuration value of `opt-in` or `always`. The default is `opt-in`; `always` means every session is protected automatically from its first real user message. Since 0.5.0, session start writes nothing into the session log: the versioned protocol boundary and first-step guidance are delivered inside the same step batch as — and ahead of — the first real user message, so a new session stays blank (`seq === 0`) and a DSH preset can be selected before anything is sent. An explicit `off` suppresses `always` in that session until the next `on`. Invalid values fail during plugin configuration instead of silently falling back. A DSH profile can select `always` with an ID-targeted `config` override in its `cordis.patch.yml`; see the README quick start for the complete example.
+The plugin accepts explicit `opt-in` or `always`, preserving omitted configuration through the real Cordis schema. Since 0.9.0 only newly created, unseeded root sessions default to `always`. Old sessions retain the pre-upgrade effective mode through [verified migration bindings](ACTIVATION_MIGRATION.md), including empty sessions. Existing bindings override a profile default; contradictory explicit configuration refuses with `activation_mode_conflict`. Persisted off/on controls replay enablement. Mode selection does not grant authority, certify work or change the default `standard` policy. Invalid values refuse configuration.
+
+A qualified official `agent/created` startup path may bind fresh roots. Resume, clear, compact and late attach only read existing bindings; missing or corrupt records refuse certification. Qualification checks public live Agent/Session identity and the supported host composition. This trusts the audited host call chain; the public API provides no factory issuer token and does not defend against arbitrary hostile in-process plugins. Fork/seed mode comes from a verified parent binding; exact inherited-cut validation belongs to the official Session/persistence contract, not a guessed event count. At T0 the Guard may write its private sidecar but writes no Session log messages, preserving the blank preset picker. First real input receives the boundary and guidance in the same entered step. Blank input does not activate; attachments do.
+
+旧会话通过升级前模式清点及核验收据保留有效模式和重放 epoch，不重新解释旧证书。缺省变化只影响新建无继承根会话。恢复、清空、压缩及迟挂载不补建缺失记录；显式模式冲突拒绝认证。官方宿主公开身份与调用链是来源边界，不声称有逐调用 issuer token 或防御任意同进程伪造。父模式绑定和官方 persistence 的精确 cut 分别核验；未知来源保持诊断，不清历史、不重签。见[迁移说明](ACTIVATION_MIGRATION.md)。
 
 ### Host-lock setup
 
@@ -192,7 +200,7 @@ managers therefore see the same two exact host releases as the host-lock
 registry; neither an unregistered stable release nor a future version is
 implicitly admitted.
 
-That historical artifact retained exact `0.1.5-rc.1` development pins. The current 0.8.3 build pins DSH `0.2.0-rc.2` while public DSH peers declare the floor range. Historical peer declarations belong to their own release sections
+That historical artifact retained exact `0.1.5-rc.1` development pins. The current 0.9.0 build pins DSH `0.2.0-rc.2` while public DSH peers declare the floor range. Historical peer declarations belong to their own release sections
 above and are not part of the 0.5.2 contract.
 
 ## Terminal outcome contract

package/docs/HISTORICAL_INCIDENT_COVERAGE.md

@@ -36,10 +36,18 @@ verdict is never inherited from a file-level or family-level green run.
   regression set, kept outside this repository; raw records, private session
   material and machine-local mappings are never copied into public files.
   The per-record table below is a historical producer statement for a former
-  28-record subset and is superseded for acceptance purposes by the current
-  full-library adjudication (56 cases / 45 active — 29 Codex, 16 DSH — plus a
-  frozen 16-record legacy lineage), whose per-case verdicts, execution lanes
-  and candidate binding are tracked in that sanitized set.
+  28-record subset. An earlier full-library snapshot recorded 56 cases / 45
+  active (29 Codex, 16 DSH), plus a separate frozen 16-record legacy lineage;
+  those counts are historical and are not the current acceptance denominator.
+- The 2026-10-08 inventory review covered 70 case records / 53 active, plus
+  the separately counted frozen legacy lineage of 16 records / 8 active.
+  Every record was reviewed for lineage, DSH applicability, named source
+  controls and remaining inputs. This is a per-record inventory review, not
+  replay of every original incident or native-platform acceptance. Source
+  analogues, original reproductions and exact-artifact native runs remain
+  separate evidence; the old execution results below keep their original
+  dates and subjects. The maintainer's sanitized per-case review retains the
+  complete verdicts and candidate bindings without publishing private mappings.
 
 ## New adaptation tests added for this adjudication
 

package/docs/HOST_LOCK_UPGRADE.md

@@ -1,11 +1,14 @@
 # Upgrading the core host lock
 
-Version 0.8.3 requires DSH `>=0.2.0-rc.2` and qualified Cordis `>=4.0.4`. Upgrade order and what each step produces:
+Version 0.9.0 requires DSH `>=0.2.0-rc.2` and qualified Cordis `>=4.0.4`. Fresh installations have no old-mode inventory to adopt; existing installations must preserve their old mode sources before any replacement. Follow this order:
 
-1. Stop the host, upgrade DSH to `0.2.0-rc.2` or a later version, then install this Guard version.
-2. Rebuild the host lock for each Guard profile by running `inspect`, `inject` and `verify-dump` from an accepted package or matching source checkout:
-   `node bin/dsh-completion-guard-host-lock.mjs inject --runtime-root <DSH runtime> --profile-root <profile>` — then verify with `... verify-dump --dump-config <file>`. A successful rebuild reads back `supported` with `audit_provenance` stating how the graph was established.
-3. Start each Web/Headless profile when needed so it reads the rebuilt lock. The checks above do not require a running host.
+1. Stop the relevant host/session writers. For an **existing installation**, preserve the old installed package and sanitized effective-mode sources, then prepare the public persistence inventory and frozen receipt with the [prepared-candidate migration toolkit](ACTIVATION_MIGRATION.md), **before replacing DSH or Guard**. Unresolved old provenance stays pending. A **fresh installation with no old Guard sessions** skips this old-mode preparation.
+2. Upgrade DSH to `0.2.0-rc.2` or a later version, then install this Guard version, keeping writers stopped.
+3. Rebuild the host lock for each profile with `inspect`, `inject` and `verify-dump` from the accepted package or matching prepared source. For a POSIX shell, the entry is `node /absolute/prepared-package/bin/dsh-completion-guard-host-lock.mjs`; pass the actual runtime/profile roots. A successful rebuild reads back `supported` with `audit_provenance` stating how the graph was established.
+4. For an **existing installation**, run mode `adopt` and `verify` with its frozen old receipt while writers remain stopped, **before starting any host**. Host-lock rebuilding does not perform adoption. For a fresh installation there is no old receipt to adopt.
+5. Start each Web/Headless/Desktop profile only after the applicable mode and host-lock checks pass. These checks do not require a running host.
+
+0.9.0 的全新安装没有旧模式需要采纳；已有安装必须在替换前保留旧来源。顺序为：先停相关写者，保存旧安装包和脱敏有效模式来源，以独立准备的候选工具冻结公开库存及旧收据；再升级 DSH、安装 Guard、重建宿主锁；保持写者停止，在启动任何宿主前完成旧收据 `adopt` 和 `verify`；最后按需启动。全新安装跳过旧模式准备与 adoption，未知旧来源仍保持 pending，宿主锁不替代模式核验。
 
 Failure readbacks distinguish these cases:
 
@@ -22,7 +25,7 @@ which core packages actually resolve still invalidates the lock.
 
 Choose the published Guard package and DSH version from the
 [compatibility guide](COMPATIBILITY.md). Keep the existing profile backup and
-its disabled/activation settings. Installation does not authorize enablement.
+its disabled/activation settings. Before replacing either DSH or Guard, stop writers and preserve the old package/effective-mode sources and frozen inventory/receipt as above. After replacement, adopt and verify that receipt before startup. Installation does not authorize enablement.
 Web and Headless are separate profiles and must be checked separately.
 
 If the profile still declares `dsh-context-guard`, replace it through DSH's
@@ -81,7 +84,7 @@ certificate authority — completion certificates, mutation authorization,
 release pre-effect decisions and Goal/Stop boundaries — validates the lock
 freshly at the moment of its own decision.
 
-Version 0.8.3 registers `dsh-0.2.0-rc.2-core-v1` as the audited baseline cohort and derives graph cohorts for compatible hosts above the version floor (see the compatibility guide). Runtime checks authenticate the mapped files and verify that each critical dependency resolves to the mapped instance. Installation imports use native Node resolution; Profile imports use the host's local-first routing and installation fallback only when no local package is selected. A nearer shadow, missing edge, wrong export target or escaped path is rejected even when the recorded versions match.
+Version 0.9.0 registers `dsh-0.2.0-rc.2-core-v1` as the audited baseline cohort and derives graph cohorts for compatible hosts above the version floor (see the compatibility guide). Runtime checks authenticate the mapped files and verify that each critical dependency resolves to the mapped instance. Installation imports use native Node resolution; Profile imports use the host's local-first routing and installation fallback only when no local package is selected. A nearer shadow, missing edge, wrong export target or escaped path is rejected even when the recorded versions match.
 
 The manifest's `registry-derived-pending-native-audit` provenance and empty `auditedPlatforms` list describe its immutable source audit, which is part of the lock digest. Native acceptance belongs to each exact artifact's separate Release annexes; it does not rewrite that digest. Inspection, injection and dump verification report `audit_provenance` alongside the cohort and digest.
 
@@ -100,14 +103,14 @@ that matters for deciding whether you are migrating or just drifting:
   a DSH upgrade, and both are cured by re-running inspect, inject and verify against
   the new runtime rather than by editing the lock.
 
-Historical requirements and session records are retained; old certificates do not become certificates for the new lock. Historical host cohorts are test data only and are not accepted by 0.8.3.
+Historical requirements and session records are retained; old certificates do not become certificates for the new lock. Historical host cohorts are test data only and are not accepted by 0.9.0.
 The shared digest-v3 encoder and its upstream fixtures are unchanged.
 
 ## Official Desktop profile
 
 Stop the Desktop app before installing or rebuilding its lock. Use the CLI carrier shipped with that app: `Contents/Resources/runtime/cli/bin/dsh` on macOS, or `resources\runtime\cli\bin\dsh.cmd` in the Windows installation. A separately installed `dsh` CLI cannot manage the reserved Desktop profile.
 
-Install Guard through that carrier with `plugin --profile desktop add dsh-completion-guard@0.8.3`. Use the profile's own host-lock tool and the app's physical `app.asar` as `--runtime-root`. The default profile is `$DSH_HOME/profiles/desktop`, or `.dsh/profiles/desktop` under the user's home when `DSH_HOME` is unset. This POSIX example starts after installation:
+For an existing installation, first preserve the old package/effective modes and freeze the inventory/receipt before replacing the carrier or Guard; after replacement, complete adoption/verification before Desktop startup. For a fresh installation there is no old-mode adoption. Install Guard through that carrier with `plugin --profile desktop add dsh-completion-guard@0.9.0`. Use the profile's own host-lock tool and the app's physical `app.asar` as `--runtime-root`. The default profile is `$DSH_HOME/profiles/desktop`, or `.dsh/profiles/desktop` under the user's home when `DSH_HOME` is unset. This POSIX example starts after installation:
 
 ```sh
 DSH_DESKTOP_ASAR=/absolute/path/to/DeepSeek-Harness.app/Contents/Resources/app.asar
@@ -123,7 +126,9 @@ On Windows use the `.cmd` host-lock launcher and the installation's `resources\a
 
 Check `supported` on inspect, inject and verify-dump. Keep Desktop stopped until all checks pass, then open the app when needed. Guard never edits the app archive or restarts the graphical app.
 
-Desktop 升级顺序相同：先停止应用并升级宿主，再用应用附带的 CLI 安装 Guard。普通外部 CLI 无法管理保留的 Desktop profile。以应用的 `app.asar` 和实际 Desktop profile 路径执行 `inspect`、`inject`、`dump-desktop`、`verify-dump`，确认三项 JSON 回读均为 `supported` 后再打开应用。`dump-desktop` 不启动宿主；配置输出可能包含私人信息，请留在本机。Guard 不修改应用归档，也不负责应用重启。
+The official plugin market (`dshmarket`) can be installed into the same Desktop profile through the official management entry; its package name neither conflicts with the Desktop bundle tuple nor grants any trust. Installing or removing the market changes the profile's importer, so the previous Desktop lock stops matching (`host_lock_installed_graph_drift`) and must be rebuilt with the full four-step flow: `inspect`, then `inject`, then generate a NEW composed dump with `dump-desktop`, then verify that new dump with `verify-dump --dump-config <new file>`. `dump-desktop` only composes a configuration for readback; it never substitutes for `verify-dump`. Verify the dump generated after this rebuild — a dump captured before the market change no longer matches and must be discarded. Rebuild the lock on this machine; a lock or digest copied from another profile or machine is not valid evidence. Desktop restart stays unsupported regardless of coexistence.
+
+Desktop 升级顺序相同：先停止应用并升级宿主，再用应用附带的 CLI 安装 Guard。普通外部 CLI 无法管理保留的 Desktop profile。以应用的 `app.asar` 和实际 Desktop profile 路径执行 `inspect`、`inject`、`dump-desktop`、`verify-dump`，确认三项 JSON 回读均为 `supported` 后再打开应用。`dump-desktop` 不启动宿主；配置输出可能包含私人信息，请留在本机。Guard 不修改应用归档，也不负责应用重启。官方插件市场（`dshmarket`）可以通过官方管理入口安装到同一 Desktop profile；其包名既不与 Desktop bundle 元组冲突，也不授予任何信任。安装或移除市场会改变 profile 的 importer，旧 Desktop 锁因此不再匹配（`host_lock_installed_graph_drift`），需要用完整四步流程重建：先 `inspect`，再 `inject`，然后用 `dump-desktop` 生成新的组合配置，最后用 `verify-dump --dump-config <新文件>` 校验这份新配置。`dump-desktop` 只负责生成配置供回读，不能替代 `verify-dump`。请校验本次重建后新生成的 dump——市场变化前捕获的旧 dump 已不匹配，应当丢弃。请在本机重建锁；从其他 profile 或其他机器复制的锁或摘要不构成有效证据。无论是否共存，Desktop 重启仍不受支持。
 
 ## Market and restart
 
@@ -154,7 +159,7 @@ exact artifact and platform; publication is recorded on its GitHub Release.
 
 ## Historical 0.5.1 evidence
 
-Version 0.5.1 registered DSH `0.1.5-rc.1` and `0.1.5-rc.2` with 33 critical packages. Its macOS and Windows results belong only to that artifact and those hosts; see the [0.5.1 release annexes](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.5.1). These are historical records, not installation targets for 0.8.3.
+Version 0.5.1 registered DSH `0.1.5-rc.1` and `0.1.5-rc.2` with 33 critical packages. Its macOS and Windows results belong only to that artifact and those hosts; see the [0.5.1 release annexes](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.5.1). These are historical records, not installation targets for 0.9.0.
 
 ## Rebinding compatible package versions
 
@@ -171,3 +176,15 @@ The version floor admits later releases and RCs by SemVer precedence. A new vers
 - A changed graph or trust description creates a new lock identity. Existing completion certificates and private authority records retain their old digest and cannot transfer. Reinject the lock, restart the profile under the user's control, and obtain new evidence.
 
 Rebinding writes only its qualification receipt and, for `inject`, the managed lock configuration. It does not start DSH, install packages, publish, or mutate session history. Foreground/default-workdir interpretations retain their narrower reviewed-byte qualification. Native acceptance of a later DSH version remains separate from this source-level compatibility rule.
+
+## 0.9.0 session modes / 会话模式
+
+This is a major default-mode change for new root sessions only. Preserve old effective modes before replacing Guard, then use [activation inspect/adopt/verify](ACTIVATION_MIGRATION.md). Host-lock rebinding does not migrate modes or re-sign certificates. Existing bindings override defaults; explicit conflicts refuse. `standard` and persisted off/on retain their contracts. Missing modes remain unknown. Rollback and the current Windows storage capability gap are described in that guide.
+
+本次只改变新建根会话的默认模式。更换 Guard 前保存旧有效模式，再按迁移说明清点、采纳及核验。重绑宿主锁不迁移模式、不重签证书；已有绑定覆盖缺省，显式冲突拒绝。standard 及持久化 off/on 合同不变，缺失模式保持 unknown，回退及 Windows 存储能力缺口见该说明。
+
+## Old-format migration refusals / 旧格式迁移拒绝
+
+Before replacing the host or Guard, preserve old sources and use the [activation migration guide](ACTIVATION_MIGRATION.md). An official format refusal is a pending host-support boundary. `inventory` plus user-reviewed `select` permits readable rows to proceed while binding full coverage and excluded metadata; pass the same `--selection` to inspect/adopt/verify and distinguish `selected_complete` from whole inventory completion. Keep original logs and old-mode sources for pending rows; future host support requires a fresh scan and source/scope verification.
+
+替换宿主或 Guard 前保留旧来源并按上述迁移说明清点。官方格式拒绝是 pending 的宿主支持边界；inventory 加用户审核的 select 可让可读项先行，同时绑定全库存与排除项元数据。inspect/adopt/verify 全程携带同一 --selection，selected_complete 不当作整库完成。pending 保留原日志及旧模式来源，等待官方支持后重新清点、核验来源和范围。

package/docs/PRIVACY.md

@@ -32,3 +32,7 @@ Context Guard stores only bounded, deterministic facts. It does not persist prom
   a conflicting contract/target binding, or an uncertain writer lock refuses
   release/restart reuse. Historical plugin notices are never promoted into the
   stronger private-ledger channel.
+
+Session activation bindings store only immutable birth identity, mode and provenance digests in the private `activation-bindings-v1` directory. Migration receipts contain per-session identity/mode/cohort and relevant non-secret input digests, never raw prompt bodies or credential values. They are operator-owned integrity records, not signatures. Model file/shell protection has the bounded scope and platform gaps described in [activation migration](ACTIVATION_MIGRATION.md); arbitrary same-owner or in-process attackers are not excluded by checksums.
+
+会话模式绑定只保存不可变出生身份、模式与来源摘要。迁移收据只含逐会话身份、模式、来源组及相关非秘密输入摘要，不含原始提示正文或凭据值。它们是操作者完整性记录，不是签名；工具保护及平台缺口见迁移说明，摘要不排除任意同 owner 或同进程攻击。

package/docs/WRITER_LOCK_PROTOCOL.md

@@ -1,6 +1,6 @@
 # Private-ledger writer lock
 
-This document describes the current 0.8.3 protocol (Revision 3.2). It replaces the generation, slot/intent and earlier arbitration designs recorded in Git history. Those earlier designs are not operational instructions.
+This document describes the current 0.8.4 protocol (Revision 3.2). It replaces the generation, slot/intent and earlier arbitration designs recorded in Git history. Those earlier designs are not operational instructions.
 
 ## Purpose and limits
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-completion-guard",
-  "version": "0.8.3",
+  "version": "0.9.0",
   "description": "A task-contract and completion-certification layer for DeepSeek Harness.",
   "repository": {
     "type": "git",
@@ -20,7 +20,8 @@
     }
   },
   "bin": {
-    "dsh-completion-guard-host-lock": "./bin/dsh-completion-guard-host-lock.mjs"
+    "dsh-completion-guard-host-lock": "./bin/dsh-completion-guard-host-lock.mjs",
+    "dsh-completion-guard-activation": "./bin/dsh-completion-guard-activation.mjs"
   },
   "files": [
     "bin",
@@ -118,5 +119,5 @@
     "hooks",
     "typescript"
   ],
-  "gitHead": "146bc1d1c5ad6e273305e50b53d9f1750bcc7a87"
+  "gitHead": "72e3dce43b15867a6c41d0f9f2b4f73f0abf3b78"
 }