dsh-completion-guard 0.8.4 → 0.10.0

package/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 All notable changes to this project are documented here. The project is pre-1.0; release versions track the plugin lifecycle, not stabilised API promises.
 
+Each entry describes that version. Historical host ranges, defaults, plans and candidate validation results are not current setup instructions or proof that a later release passed. Use [installation and first load](docs/GETTING_STARTED.md) for the current setup and [acceptance records](docs/LOCAL_ACCEPTANCE.md) for version-specific evidence.
+
+<details>
+<summary>Version index</summary>
+
+[0.10.0](#0100) · [0.9.0](#090) · [0.8.4](#084) · [0.8.3](#083) · [0.8.2](#082) · [0.8.1](#081) · [0.8.0](#080) · [0.7.1](#071---2026-09-22) · [0.7.0](#070---2026-09-21) · [0.6.3](#063---2026-09-18) · [0.6.2](#062---2026-09-16) · [0.6.1](#061-2026-09-15) · [0.6.0](#060---2026-09-14) · [0.5.3](#053---2026-09-14) · [0.5.2](#052---2026-09-11) · [0.5.1](#051---2026-09-10) · [0.5.0](#050---2026-09-10) · [0.4.3](#043---2026-09-08) · [0.4.2](#042---2026-09-07) · [0.4.1-rc.1](#041-rc1---2026-09-04) · [0.4.0](#040---2026-09-02) · [0.3.2](#032---2026-09-01) · [0.3.1](#031---2026-08-31) · [0.3.0](#030---2026-08-31) · [0.2.1](#021---2026-08-28) · [0.2.0](#020---2026-08-28) · [0.1.2](#012---2026-08-27) · [0.1.1](#011---2026-08-27) · [0.1.0](#010---2026-08-27)
+
+</details>
+
+## 0.10.0
+
+- **Upgrade DSH before installing Guard 0.10.0.** The minimum host is `0.2.1-rc.2`, with no implied upper limit. Preserve old-session modes and configuration, upgrade the host, install Guard, then rebuild and read back each profile's host lock before re-enabling it. Old locks and completion certificates do not transfer to a changed graph. See [compatibility and upgrade boundaries](docs/COMPATIBILITY.md#0100-dsh-021-rc2) for the reviewed host identities and the separate market, load and admission checks.
+- **Job lifecycle events refine external waits without ever completing work.** A validated `job/registered`/`job/settled` pair owned by the current session can end its pending external wait; a healthy orphan settlement remains audit-only: a `completed` settlement counts as finished only when the producer itself reported fulfilment; killed and failed settlements are explicit failures, and an unreported completion stays unconfirmed. A settlement never certifies resource cleanup, file readback or a user obligation — the model still owes the verification. The recorded owner never transfers to a forked or resumed copy of the history.
+- **Working-directory changes no longer re-interpret captured evidence.** Each committed `working-directory/change` opens a new cwd epoch: targets, paths and receipts keep the meaning of the epoch they were captured in, and the session's original project directory stays immutable in the header. Shell workdir receipts bind the audited cwd provider and an epoch-bound v2 shape. A directory change while a call is in flight leaves its cwd-dependent execution unconfirmed; replay cannot reassign it to the new directory. Historical logs without cwd-change events preserve the 0.9.0 frozen projection under the same host binding, and preserve its evidence fields and digests, including explicit relative workdirs; later events cannot rewrite completed legacy facts.
+- **Experimental `plugin:` records are retained-and-skipped.** They never trigger capture, never authorize anything and never break tool pairing; Guard's own private ledger is not migrated onto them. Guard never imported the removed upstream invariant companions, and synchronous `snapshotEvents()` reads remain valid on the pinned host.
+- **Qualify retained official Desktop distribution files separately.** Exact release/header and independently reproduced source-byte pins cover eight retained invariant companions without adding them to the registry inventory. Vendor signatures, ordinary module bytes and active routes remain mandatory. Physical pnpm `11.7.0` and `11.28.5` profiles must agree with the carrier; both v2 no-op gates remain strict. Native fixtures bind newly allocated temporary roots to physical paths before deriving evidence targets, preserving exact readback assertions. See [Desktop distribution qualification](docs/COMPATIBILITY.md#official-desktop-distribution-bytes).
+- **Subagent, Team inbox and Goal-waiting semantics carry over unchanged.** A `subagent` tool result stays bounded evidence that cannot close a parent obligation; direct inbox delivery records reception, not execution; waiting for a subtask, a plan-review end turn or a paused Goal neither fabricates nor consumes a completion.
+- **Migration inventories now accept `0.9.x` as the previous package version**, so upgrading from 0.9.0 keeps the documented activation-migration path; earlier-version rules are unchanged. Development dependencies pin DSH `0.2.1-rc.2`, and the shipped floor is pinned against the official app-boot consumer's real admission decisions.
+
+## 0.9.0
+
+- **New root sessions now default to `always` when `activation` is omitted.** Explicit `opt-in` remains supported. Protection begins with the first real input; Guard adds no session events before it. Existing sessions, including empty ones, keep their verified pre-upgrade mode. Saved `off`/`on` remains effective. Explicit settings that contradict a bound mode are refused; [omit the override after migration](docs/GETTING_STARTED.md#choose-the-default-for-new-sessions) to use the new default while preserving old modes. The default policy stays `standard`: activation grants no execution or publication authority and does not automatically certify completion.
+- **Upgrade existing installations before reopening sessions.** Stop the relevant writers, preserve the old package and effective mode sources, and freeze the old-session inventory before replacement. After installation, rebuild the host lock, adopt the preserved modes and verify them before startup. Missing, conflicting or damaged bindings remain uncertified. History and valid old certificates are retained without rewriting or re-signing. See [migration and rollback](docs/ACTIVATION_MIGRATION.md).
+- **Expect a history-loading wait.** First opening or restoring a session with history loads it and rebuilds Guard state; “载入历史” may appear, and later visits can still wait. The cache reuses completed history checks only when it can verify that the history is unchanged and the results are safe to reuse; a single Desktop installation check also reuses application files already read and verified. Each operation still checks the current mode and performs the required fresh checks of Goal state, private records and the host environment. The official host's history-view lifecycle and decode cache are unchanged; this is not a promise to eliminate UI waits. A read-only measurement script separates local read, decompression, JSON parsing and pure Guard replay timings from runtime migration, IPC and rendering.
+- **Migrate an explicitly chosen readable subset when the official host refuses old formats.** `inventory` reports the full scope; `select` freezes chosen IDs. Use the same `--selection` throughout inspect/adopt/verify. Exclusions retain their original logs and mode sources and remain pending; `selected_complete` does not mean the whole inventory completed. Other errors still abort. The [guide](docs/ACTIVATION_MIGRATION.md) includes commands, recovery and copyable AI prompts.
+
 ## 0.8.4
 
 - The official Desktop app can now coexist with the official plugin market (`dshmarket`). Earlier versions refused any Desktop profile whose bundle list carried the market — the pre-install check rejected it as a bundle conflict and the installed/runtime check misreported it as an unbound plugin. The market is now treated like any other third-party profile plugin on Desktop. Official profile identity, Guard binding, the Headless bundle conflict, implementation byte and route audits, and host-lock digests are unchanged and keep failing closed.
@@ -177,8 +203,7 @@ exact-artifact native annexes attached to the versioned Release.
 
 ### Validation
 
-This is a source release candidate. Local checks and remaining CI,
-native T06, exact-artifact and publication gates are recorded in
+At preparation, this entry recorded a source release candidate. Its local checks and then-pending CI, native T06, exact-artifact and publication gates are recorded in
 [local acceptance](docs/LOCAL_ACCEPTANCE.md) and the
 [release plan](https://github.com/GreenLv/dsh-completion-guard/blob/784b5452b0da366a351dff6490fa46eeed2839a9/docs/RELEASE_PLAN_0_6_2.md).
 
@@ -196,7 +221,128 @@ Repairs attachment handling, conservative request interpretation, discovery pagi
 
 The new interpretation records and reasons are additive. Attachment capture text retains its 0.6.0 bytes; an old log without interpretation records keeps pending attachments. Source checks, CI, frozen-artifact acceptance and native Web/Headless acceptance are separate results recorded in [LOCAL_ACCEPTANCE](docs/LOCAL_ACCEPTANCE.md). The local test-host cleanup now disposes persistence hosts explicitly to prevent FileHandle garbage-collection errors. No platform or publication result is implied by this changelog.
 
-## 0.6.0 third repair round after targeted review (2026-09-14)
+## 0.6.0 - 2026-09-14
+
+Brings ordinary DSH tasks through entry, execution, delivery and recovery under one rule set, adding selected shared Context Guard behaviors. Cross-language parity and a formal v2 mirror were not yet established in this version. Everything before the new protocol boundary keeps its original meaning; nothing is reinterpreted or relabelled.
+
+The repair rounds below belong to this same version, not additional releases. They retain the original findings, scope decisions and test evidence; read the initial candidate behavior together with these corrections.
+
+### Added
+
+- **Answer delivery is tracked separately from execution certification.** A
+  question or explanation is closed only by the host's own evidence: an
+  `assistant/message` in the turn's final step, with no interrupted marker,
+  followed by `turn/end` with `reason.kind: "completed"`. A status summary, a
+  draft, an intermediate reply, another turn's answer, a subagent's answer, or
+  an aborted turn never closes anything. `answered` means "the answer was
+  handed over" — never that it was right, complete, or executed.
+- **Work units with a required-descendant closure.** Tasks are grouped into
+  derived units. A delegation-marked instruction opens a child unit whose open
+  work is required by the parent's closure, so delegating a sub-task can never
+  drop the parent's own work; an ordinary task switch opens a sibling that does
+  not block the newer task. A subagent's result is bounded evidence: it is
+  recorded and visible, and it never closes a parent obligation.
+- **Ancestor constraints stay in force.** A prohibition or an unsatisfied
+  condition the root declared in an earlier unit continues to govern the same
+  action and target in a later one, and the certifier refuses those bindings
+  before examining evidence.
+- **Proof v2 with a real capability matrix.** Five new proof kinds — input
+  asset check, output visual readback, object/URL readback, execution fact, and
+  external fact — each bind a current subject, a declared source, and a real
+  operation. A successful tool call is only ever an execution fact: a browser
+  call that merely returned cannot prove an image was looked at, an input asset
+  check must be a prior-state fact, and a delegated subagent result is never a
+  proof source. When the installed host exposes no producer, the result is
+  `unavailable`, never a silent pass. The old three-kind manifest and its digest
+  domain are unchanged and remain readable.
+- **Explicit release tickets.** A release contract is adopted only by an
+  explicit root command. Once adopted, each operation spends one reservation,
+  written before the effect and settled afterwards from a trusted readback.
+  Wrong candidate SHA, ref, artifact digest or version, an expired or
+  unevaluable ticket, a consumed ticket, a replay, an operation that is already
+  in flight, an unresolved target, and an opaque runner are all refused before
+  any effect. A "release" keyword, a loaded Skill, or an installation never
+  adopts a contract.
+- **A strict proof tier.** On top of the default `standard` tier, a visual or
+  complete-scope verification the user explicitly asked for must be discharged
+  by a real readback fact. Strict adds no approval step to ordinary actions, and
+  installing never enters the `release` tier.
+- **One diagnosis language.** Every incomplete item now reports one of seven
+  classes — parameter missing, source insufficient, condition unmet, producer
+  capability unavailable, historical gap, integrity failure, policy boundary —
+  next to its exact reason code. `/context-guard migration` reports which rule
+  set is in force, which obligations keep their pre-0.6.0 rules, and what a
+  rollback requires.
+- **A host-neutral v2 conformance fixture** covering S01–S12 through the real
+  derive/delivery/closure/Goal chains. Every expectation is compared against a
+  value computed from the events and the production projection alone; the runner
+  never reads an expectation to decide an actual result.
+
+### Changed
+
+- A document "update" or "modify" is decided by the object, not by the verb:
+  a recognized document noun becomes a bounded `modify` the assistant may
+  resolve to an exact file inside the captured scope and type, while an
+  unrecognized object keeps its honest unresolved reading instead of being
+  forced into an action.
+- A trusted answer from the host's own question tool now narrows where a
+  bounded file choice may land, and is recorded separately from sandbox
+  approvals. Pasted or restated answer text forms nothing.
+- A later root instruction that contains a pending generic obligation verbatim
+  supersedes it atomically, keeping both revisions. Explanations, prohibitions
+  and waits never delete an obligation by similar wording.
+- `/context-guard status` reports the active policy tier, the reason-class
+  histogram, the migration facts, and the release state.
+
+### Fixed
+
+- The first step of a session now sees the input persisted in that same step,
+  and a failed durability flush reports an explicit unavailability instead of
+  serving a stale projection.
+- The v2 conformance runner computes `interpreted`, `closure`, `delivery`,
+  `turn_bound` and the correction decision from production state instead of from
+  the fixture's own expectations.
+- A malformed release record is reported as a bounded diagnostic and never
+  marks the whole session corrupt, so damaged release state cannot block
+  unrelated ordinary work.
+
+### Migration and rollback
+
+- The 0.6.0 semantics start at the new `Context Guard protocol boundary:
+  v5.0.0` notice, written at the first real root-input step of a new session.
+  An older binary ignores that notice, so a rollback fails closed instead of
+  misreading new records.
+- A session that never wrote the boundary keeps the previous whole-session
+  contract, version-1 certificates, and its old digest domains.
+- A session that wrote it keeps pre-boundary obligations under their birth
+  rules while new work uses units, delivery and version-2 certificates.
+- Rolling back to 0.5.x requires restoring a 0.5.x state snapshot. Replaying a
+  0.6.0 log with 0.5.x fails closed with `certificate_replay_mismatch`; never
+  migrate new-schema data down by hand.
+
+### Not yet established
+
+- **Cross-language parity and the canonical mirror are not done.** The
+  upstream `codex-context-guard` repository has not landed a frozen v2 fixture,
+  so the v2 file here is explicitly a DSH-authored *candidate*
+  (`2.0.0-candidate.1`, `status: "dsh-candidate"`). `UPSTREAM_PIN.json` still
+  pins the unchanged v1 mirrors and is not refreshed by this release.
+- The `release` tier protects only surfaces Guard itself routes. Publishing an
+  npm artifact through the Guard-owned action tool is protected; `git tag`, the
+  GitHub Release operations, and any composite runner have no interception
+  point in this host and are refused before effect rather than pretended to be
+  covered. A trusted in-process caller that bypasses Guard entirely is a host
+  trust boundary, documented rather than denied.
+- After a publish, the settlement stays `unconfirmed` unless the registry
+  readback producer answers; an unconfirmed operation is never re-sent.
+- Deterministic tests, CI, native macOS/Windows acceptance, publication and
+  installation are separate evidence scopes. This release records source and
+  deterministic evidence; native acceptance and publication follow separately.
+
+<details>
+<summary>Pre-release review and repair details for 0.6.0</summary>
+
+### 0.6.0 third repair round after targeted review (2026-09-14)
 
 Two findings from the targeted review of `fcc3813`, both fixed.
 
@@ -224,13 +370,15 @@ projection still valid), a certificate that existed at adoption is frozen by
 identity and survives a later obligation,
 and invalid/mistyped adopt input leaves a valid contract usable.
 
-## 0.6.0 second repair round after follow-up review (2026-09-14)
+### 0.6.0 second repair round after follow-up review (2026-09-14)
 
 A follow-up review of the repair commit found five remaining defects in the new
 wiring. All five reproduced and are fixed. The reviewer's counterexamples are
 kept as permanent regression cases in the suites they belong to.
 
-### Fixed
+The changes below also include a new recovery entrypoint supporting those fixes; the list is not a one-to-one count of the five findings.
+
+#### Fixed
 
 - **Adding the v5 boundary no longer answers a pre-v5 question.** Deliveries were
   only gated by the watermark of their own turn; appending the boundary at the
@@ -275,7 +423,7 @@ kept as permanent regression cases in the suites they belong to.
   valid certificate. Signing, persistence and replay use the same call argument,
   and the Goal gate consumes only a certificate whose proof still binds.
 
-### Verification
+#### Verification
 
 - The reviewer's five follow-up counterexamples pass and remain as regression
   cases: pre-v5 delivery, read-only status, the frozen candidate closure, the
@@ -293,7 +441,7 @@ kept as permanent regression cases in the suites they belong to.
 - The proof suite gained the missing-proof, Goal-consumption and
   accurate-evidence-boundary cases.
 
-### Evidence boundary
+#### Evidence boundary
 
 The release chain test pins the audited host cohort through an explicit
 `RuntimeExecutorSeams.hostLock` acceptance seam, because the host-lock
@@ -302,13 +450,13 @@ host-lock evaluation; the release gate, the reservation and settlement records,
 the evidence producers and the replay are the production ones, and the host lock
 keeps its own suites and native acceptance.
 
-## 0.6.0 repairs after concentrated review (2026-09-14)
+### 0.6.0 repairs after concentrated review (2026-09-14)
 
 A concentrated review of the `0dce898` candidate produced fifteen targeted
 counterexamples; all fifteen reproduced a real defect. This section records the
 repair. The stable finding numbers (`F01`–`F08`, `R1`–`R15`) are the reviewer's.
 
-### Fixed
+#### Fixed
 
 - **F01 certificate replay was timing-dependent.** Deliveries were applied after
   the whole log was replayed, so a checkpoint recorded in a later turn was
@@ -364,7 +512,7 @@ repair. The stable finding numbers (`F01`–`F08`, `R1`–`R15`) are the reviewe
   production-chain suite drives producer → persisted log → derive → checkpoint →
   replay.
 
-### Scope rulings (coordinator, 2026-09-14)
+#### Scope rulings (coordinator, 2026-09-14)
 
 Two scope facts were decided once, and both are recorded as fact rather than as
 a general parity claim:
@@ -384,7 +532,7 @@ a general parity claim:
 The plugin therefore does not claim "C01–C12 core alignment" with Codex Context
 Guard, and it does not claim a complete release coverage surface.
 
-### Verification
+#### Verification
 
 The reviewer's fifteen counterexamples are kept as
 `tests/domain/review-counterexamples.test.ts` and now pass; the expectations
@@ -395,124 +543,7 @@ cases, including a real certified closure and every identity refusal), and the
 extended v2 fixture (S09 proof binding, per-timeline release probes, and the
 scope-attribution table).
 
-## 0.6.0 - 2026-09-14
-
-This release makes ordinary DSH work enter, execute, deliver, and resume under
-one set of rules. It also closes the substantive gaps against the shared
-Context Guard semantics. Everything before the new protocol boundary keeps its
-old meaning; nothing is re-read or re-labelled.
-
-### Added
-
-- **Answer delivery is tracked separately from execution certification.** A
-  question or explanation is closed only by the host's own evidence: an
-  `assistant/message` in the turn's final step, with no interrupted marker,
-  followed by `turn/end` with `reason.kind: "completed"`. A status summary, a
-  draft, an intermediate reply, another turn's answer, a subagent's answer, or
-  an aborted turn never closes anything. `answered` means "the answer was
-  handed over" — never that it was right, complete, or executed.
-- **Work units with a required-descendant closure.** Tasks are grouped into
-  derived units. A delegation-marked instruction opens a child unit whose open
-  work is required by the parent's closure, so delegating a sub-task can never
-  drop the parent's own work; an ordinary task switch opens a sibling that does
-  not block the newer task. A subagent's result is bounded evidence: it is
-  recorded and visible, and it never closes a parent obligation.
-- **Ancestor constraints stay in force.** A prohibition or an unsatisfied
-  condition the root declared in an earlier unit continues to govern the same
-  action and target in a later one, and the certifier refuses those bindings
-  before examining evidence.
-- **Proof v2 with a real capability matrix.** Five new proof kinds — input
-  asset check, output visual readback, object/URL readback, execution fact, and
-  external fact — each bind a current subject, a declared source, and a real
-  operation. A successful tool call is only ever an execution fact: a browser
-  call that merely returned cannot prove an image was looked at, an input asset
-  check must be a prior-state fact, and a delegated subagent result is never a
-  proof source. When the installed host exposes no producer, the result is
-  `unavailable`, never a silent pass. The old three-kind manifest and its digest
-  domain are unchanged and remain readable.
-- **Explicit release tickets.** A release contract is adopted only by an
-  explicit root command. Once adopted, each operation spends one reservation,
-  written before the effect and settled afterwards from a trusted readback.
-  Wrong candidate SHA, ref, artifact digest or version, an expired or
-  unevaluable ticket, a consumed ticket, a replay, an operation that is already
-  in flight, an unresolved target, and an opaque runner are all refused before
-  any effect. A "release" keyword, a loaded Skill, or an installation never
-  adopts a contract.
-- **A strict proof tier.** On top of the default `standard` tier, a visual or
-  complete-scope verification the user explicitly asked for must be discharged
-  by a real readback fact. Strict adds no approval step to ordinary actions, and
-  installing never enters the `release` tier.
-- **One diagnosis language.** Every incomplete item now reports one of seven
-  classes — parameter missing, source insufficient, condition unmet, producer
-  capability unavailable, historical gap, integrity failure, policy boundary —
-  next to its exact reason code. `/context-guard migration` reports which rule
-  set is in force, which obligations keep their pre-0.6.0 rules, and what a
-  rollback requires.
-- **A host-neutral v2 conformance fixture** covering S01–S12 through the real
-  derive/delivery/closure/Goal chains. Every expectation is compared against a
-  value computed from the events and the production projection alone; the runner
-  never reads an expectation to decide an actual result.
-
-### Changed
-
-- A document "update" or "modify" is decided by the object, not by the verb:
-  a recognized document noun becomes a bounded `modify` the assistant may
-  resolve to an exact file inside the captured scope and type, while an
-  unrecognized object keeps its honest unresolved reading instead of being
-  forced into an action.
-- A trusted answer from the host's own question tool now narrows where a
-  bounded file choice may land, and is recorded separately from sandbox
-  approvals. Pasted or restated answer text forms nothing.
-- A later root instruction that contains a pending generic obligation verbatim
-  supersedes it atomically, keeping both revisions. Explanations, prohibitions
-  and waits never delete an obligation by similar wording.
-- `/context-guard status` reports the active policy tier, the reason-class
-  histogram, the migration facts, and the release state.
-
-### Fixed
-
-- The first step of a session now sees the input persisted in that same step,
-  and a failed durability flush reports an explicit unavailability instead of
-  serving a stale projection.
-- The v2 conformance runner computes `interpreted`, `closure`, `delivery`,
-  `turn_bound` and the correction decision from production state instead of from
-  the fixture's own expectations.
-- A malformed release record is reported as a bounded diagnostic and never
-  marks the whole session corrupt, so damaged release state cannot block
-  unrelated ordinary work.
-
-### Migration and rollback
-
-- The 0.6.0 semantics start at the new `Context Guard protocol boundary:
-  v5.0.0` notice, written at the first real root-input step of a new session.
-  An older binary ignores that notice, so a rollback fails closed instead of
-  misreading new records.
-- A session that never wrote the boundary keeps the previous whole-session
-  contract, version-1 certificates, and its old digest domains.
-- A session that wrote it keeps pre-boundary obligations under their birth
-  rules while new work uses units, delivery and version-2 certificates.
-- Rolling back to 0.5.x requires restoring a 0.5.x state snapshot. Replaying a
-  0.6.0 log with 0.5.x fails closed with `certificate_replay_mismatch`; never
-  migrate new-schema data down by hand.
-
-### Not yet established
-
-- **Cross-language parity and the canonical mirror are not done.** The
-  upstream `codex-context-guard` repository has not landed a frozen v2 fixture,
-  so the v2 file here is explicitly a DSH-authored *candidate*
-  (`2.0.0-candidate.1`, `status: "dsh-candidate"`). `UPSTREAM_PIN.json` still
-  pins the unchanged v1 mirrors and is not refreshed by this release.
-- The `release` tier protects only surfaces Guard itself routes. Publishing an
-  npm artifact through the Guard-owned action tool is protected; `git tag`, the
-  GitHub Release operations, and any composite runner have no interception
-  point in this host and are refused before effect rather than pretended to be
-  covered. A trusted in-process caller that bypasses Guard entirely is a host
-  trust boundary, documented rather than denied.
-- After a publish, the settlement stays `unconfirmed` unless the registry
-  readback producer answers; an unconfirmed operation is never re-sent.
-- Deterministic tests, CI, native macOS/Windows acceptance, publication and
-  installation are separate evidence scopes. This release records source and
-  deterministic evidence; native acceptance and publication follow separately.
+</details>
 
 ## 0.5.3 - 2026-09-14
 

package/CHANGELOG.zh-CN.md

@@ -2,6 +2,32 @@
 
 本项目的重要变化记录在这里。项目仍处于 1.0 之前；版本号跟踪插件生命周期，不代表 API 已稳定。
 
+各条目描述对应版本。历史宿主范围、默认值、后续计划和候选验证结果，不是当前安装指引，也不能证明后续版本已通过验收。当前配置请看[安装与首次载入](docs/GETTING_STARTED.md)，各版本证据请看[验收记录](docs/LOCAL_ACCEPTANCE.md)。
+
+<details>
+<summary>版本索引</summary>
+
+[0.10.0](#0100) · [0.9.0](#090) · [0.8.4](#084) · [0.8.3](#083) · [0.8.2](#082) · [0.8.1](#081) · [0.8.0](#080) · [0.7.1](#0712026-09-22) · [0.7.0](#0702026-09-21) · [0.6.3](#0632026-09-18) · [0.6.2](#0622026-09-16) · [0.6.1](#0612026-09-15) · [0.6.0](#060---2026-09-14) · [0.5.3](#053---2026-09-14) · [0.5.2](#052---2026-09-11) · [0.5.1](#051---2026-09-10) · [0.5.0](#050---2026-09-10) · [0.4.3](#043---2026-09-08) · [0.4.2](#042---2026-09-07) · [0.4.1-rc.1](#041-rc1---2026-09-04) · [0.4.0](#040---2026-09-02) · [0.3.2](#032---2026-09-01) · [0.3.1](#031---2026-08-31) · [0.3.0](#030---2026-08-31) · [0.2.1](#021---2026-08-28) · [0.2.0](#020---2026-08-28) · [0.1.2](#012---2026-08-27) · [0.1.1](#011---2026-08-27) · [0.1.0](#010---2026-08-27)
+
+</details>
+
+## 0.10.0
+
+- **安装 Guard 0.10.0 前先升级 DSH。** 最低宿主为 `0.2.1-rc.2`，没有隐式上限。保留旧会话模式和配置，升级宿主、安装 Guard，再为各 profile 重建并回读宿主锁，核验后恢复启用。旧锁和完成证书不能转移到变化后的包图。[兼容性说明](docs/COMPATIBILITY.md#0100-dsh-021-rc2)保留已审查宿主身份，以及市场卡片、插件加载和 Guard 准入各自的边界。
+- **job 生命周期事件细化外部等待，但永不代替完成。** 本会话所有、身份核验一致的持久化 `job/registered`/`job/settled` 配对记录可结束对应等待，合法孤立结算仅保留为审计事实：`completed` 结算只有在 producer 自己报告完成时才算完成；killed 与 failed 是显式失败，未报告的 completed 保持未确认。结算不证明资源清理、文件读回或用户义务完成——验证仍需照做。记录的 owner 不转移到 fork 或恢复的历史副本。
+- **工作目录切换不再重新解释已捕获的证据。** 每条已提交的 `working-directory/change` 开启新的 cwd 纪元：目标、路径与回执保留捕获当时的含义，会话原始项目目录在 header 中保持不变。shell 工作目录回执核验 cwd 服务身份，并新增绑定纪元的 v2 形态。调用未返回时若目录变化，依赖该目录的执行保持未确认，不能在重放时转归新目录。没有目录变更事件的日志在同一宿主绑定下保留 0.9.0 冻结投影，并保留其证据字段与摘要，包括显式相对 workdir；后来事件不能改写已完成的旧证据。
+- **实验性 `plugin:` 记录一律保留并跳过。** 它们不触发捕获、不授予任何权限、不破坏工具配对；Guard 自有私有账本不迁移到该机制。Guard 从未引用上游已移除的 invariant 伴随插件；同步 `snapshotEvents()` 读取在锁定宿主上继续有效。
+- **单独核验官方 Desktop 分发中保留的文件。** 固定发行包/header 和独立源码编译字节 pin 覆盖八个保留的 invariant 伴随文件，不将它们混入 registry 清单；官方签名、原模块字节及实际路由核验仍为必需。平铺 pnpm `11.7.0`、`11.28.5` profile 必须与 carrier 版本一致，v2 两步 no-op 合同不变。native fixture 在创建临时目录时即绑定物理路径，再派生证据目标，保留严格 readback 断言。见[Desktop 分发资格说明](docs/COMPATIBILITY.md#official-desktop-distribution-bytes)。
+- **子代理、Team Inbox 与 Goal 等待语义保持不变。** `subagent` 工具结果仍是有界证据，不能关闭父义务；直接 Inbox 投递记录的是接收成功而非执行完成；等待子任务、计划审阅结束或暂停的 Goal 都不会伪造或消耗完成。
+- **迁移库存现在接受 `0.9.x` 作为旧包版本**，从 0.9.0 升级沿用既有启用模式迁移路径；更早版本的规则不变。开发依赖固定 DSH `0.2.1-rc.2`，发布 floor 以官方 app-boot 消费者的真实准入决策核对。
+
+## 0.9.0
+
+- **未填写 `activation` 时，新建根会话默认采用 `always`。** 显式 `opt-in` 仍受支持。Guard 从首条真实输入开始保护，此前不追加会话事件。旧会话（包括旧空会话）保留已核验的升级前模式，已保存的 `off`、`on` 继续有效。显式配置与绑定模式矛盾时会被拒绝；要采用新默认值并保留旧模式，请[在迁移后省略覆盖字段](docs/GETTING_STARTED.md#新会话默认模式)。默认策略仍为 `standard`，自动启用不授予执行、发布权限，也不会自动认证完成。
+- **已有安装升级后，先核验再打开会话。** 替换包前停止相关写者，保留旧包及有效模式来源，冻结旧会话库存。安装后重建宿主锁，完成旧模式 adoption 和 verify，再启动宿主。绑定缺失、冲突或损坏时不能认证；原历史和有效旧证书保留，不重写、不重签。步骤及回退见[迁移指南](docs/ACTIVATION_MIGRATION.md)。
+- **历史载入仍需要等待。** 首次打开或恢复已有历史的会话时，宿主载入历史，Guard 重建状态，界面可能显示“载入历史”；再次打开也可能等待。本版只在确认历史未变、检查结果可安全复用时，复用已经通过的历史检查；同一次 Desktop 安装检查中也会复用已读取并核验的应用文件。每次操作仍核对当前模式，并按需要重新核验 Goal 状态、私有记录和宿主环境。官方宿主的历史视图生命周期及解码缓存未变，不能保证消除界面等待。新增只读测量脚本，分别报告本地读取、解压、JSON 解析和纯 Guard 重放耗时，不包含运行时迁移、IPC 和渲染。
+- **官方宿主拒绝旧格式时，可明确迁移选中的可读会话。** `inventory` 清点全库，`select` 冻结选中 ID，inspect/adopt/verify 全程使用同一 `--selection`。排除项保留原日志和旧模式来源，继续待处理；`selected_complete` 不代表整库完成。其他异常仍会中止。[指南](docs/ACTIVATION_MIGRATION.md)包含命令、恢复方案和可复制 AI 提示词。
+
 ## 0.8.4
 
 - 官方 Desktop 应用现在可以与官方插件市场（`dshmarket`）共存。更早的版本会拒绝 bundles 中带有市场的任何 Desktop profile——预安装检查将其报为 bundle 冲突，已安装/运行时检查则误报为插件未绑定。现在市场在 Desktop 上与其他普通第三方 profile 插件同等对待。官方 profile 身份、Guard 绑定、Headless bundle 冲突、实现字节与路由审计以及宿主锁摘要全部保持不变并继续 fail closed。
@@ -119,7 +145,7 @@
 
 ### 验证范围
 
-当前为源码发布候选。本地结果与尚缺的 CI、T06 原生、精确制品和发布门槛见[验收记录](docs/LOCAL_ACCEPTANCE.md)及[发版计划](https://github.com/GreenLv/dsh-completion-guard/blob/784b5452b0da366a351dff6490fa46eeed2839a9/docs/RELEASE_PLAN_0_6_2.md)。
+准备时，本条目记录的是源码发布候选。本地结果与当时尚缺的 CI、T06 原生、精确制品和发布门槛见[验收记录](docs/LOCAL_ACCEPTANCE.md)及[发版计划](https://github.com/GreenLv/dsh-completion-guard/blob/784b5452b0da366a351dff6490fa46eeed2839a9/docs/RELEASE_PLAN_0_6_2.md)。
 
 ## 0.6.1（2026-09-15）
 
@@ -135,7 +161,54 @@
 
 解释记录和原因码为增量。附件捕获文本保持 0.6.0 字节；旧日志没有解释记录时，附件继续 pending。源码检查、CI、冻结制品和原生 Web/Headless 验收分别记录在[验收记录](docs/LOCAL_ACCEPTANCE.md)。测试宿主清理现在显式释放持久化宿主，避免 FileHandle 被垃圾回收时报错。本节不代表任何平台验收或发布已经完成。
 
-## 0.6.0 定向复核后的第三轮修复（2026-09-14）
+## 0.6.0 - 2026-09-14
+
+本版统一普通 DSH 任务在进入、执行、交付与恢复时的规则，并新增部分共享 Context Guard 行为。本版本尚未建立跨语言 parity 或正式 v2 镜像。新协议边界之前的一切保持原有含义，既不重解释也不重新贴标签。
+
+下方各轮修复都属于同一个 0.6.0，不是额外版本。原始缺陷、范围裁定和测试证据保留在折叠记录中；初始候选的行为说明应与这些修正一同阅读。
+
+### 新增
+
+- **回答交付与执行认证分开记录。** 问答或讲解只由宿主的自身事实关闭：同一 turn 最大 step 的 `assistant/message`、无 interrupted 标记，且其后存在 `reason.kind: "completed"` 的 `turn/end`。状态汇报、草稿、中间回复、其它 turn 的回答、子代理回答和中止的 turn 都不会关闭任何条目。`answered` 只表示"回答已交付"，不表示正确、完整或已执行。
+- **工作单元与必需后代闭包。** 任务被归入派生的单元。带委派标记的指令会开启一个子单元，其未完成义务进入父单元闭包，因此委派子任务绝不会丢掉父任务自身的工作；普通任务切换开启的是同级单元，不阻塞更新的任务。子代理结果是**有界证据**：记录并可见，但永远不能关闭父项。
+- **祖先约束持续生效。** 根用户在前一单元声明的禁止项或未满足条件，对后续单元中同一动作与目标的义务继续生效；认证器在检查证据之前就拒绝这类绑定。
+- **证明 v2 与真实能力矩阵。** 新增输入资产检查、生成结果视觉回读、对象/URL 回读、执行事实、外部事实五类证明，每类都绑定当前主体、声明的来源和真实操作。工具调用成功只构成执行事实：一次仅仅返回的浏览器调用不能证明看过图，输入资产检查必须是前置状态事实，子代理结果不能作为证明来源。已安装宿主没有对应生产者时结论是 `unavailable`，绝不静默通过。原有三类 manifest 及其摘要域不变，仍可读取。
+- **显式发布票据。** 发布契约只能由用户显式根命令采用。采用后每个操作消耗一次预约记录：效果前写入，效果后依据可信回读结算。错候选 SHA、错 ref、错制品摘要或版本、过期或无法评估的有效期、已消费票据、重放、已在执行中的操作、未解析目标和不透明 runner 都在任何副作用之前被拒绝。"release" 关键词、加载 Skill 或安装不会采用契约。
+- **strict 证明档位。** 在默认 `standard` 之上，用户明确要求的视觉或完整范围验证必须由真实回读事实兑现。strict 不为普通动作新增审批，安装也绝不隐式进入 `release` 档。
+- **统一诊断语言。** 每个未完成条目在精确原因码之外，还会给出七类标签之一：参数缺失、来源不足、条件未满足、生产者能力缺失、历史缺口、完整性失败、策略边界。`/context-guard migration` 报告当前生效的规则集、仍按 0.6.0 之前规则保留的义务，以及回滚所需的动作。
+- **宿主中立的 v2 一致性 fixture**，覆盖 S01–S12，且全部经过真实 derive/交付/闭包/Goal 链路。每条期望都只与"由事件和生产投影独立算出"的实际值比较；runner 绝不读取期望来决定实际值。
+
+### 变化
+
+- 文档"更新/修改"由对象决定，而不由动词决定：可识别的文档名词变成 `modify`，助手可在捕获的范围与类型内解析到具体文件；无法识别的对象保持诚实的未决读法，而不是被强行归为某个动作。
+- 宿主自身问答工具返回的可信答案现在会收窄有界文件选择的落点，并与沙箱审批分开记录。转贴或复述的回答文本不构成任何东西。
+- 后续根指令逐字包含某条未决通用义务时，会原子替换它并保留新旧 revision；解释、禁止和等待绝不因相似措辞删除义务。
+- `/context-guard status` 报告当前策略档、原因类直方图、迁移事实与发布状态。
+
+### 修复
+
+- 会话首步现在能看到同步持久化的输入；flush 失败会明确报告不可用，而不是返回陈旧投影。
+- v2 一致性 runner 的 `interpreted`、`closure`、`delivery`、`turn_bound` 与纠正判断改为从生产状态计算，不再取自 fixture 自身的期望。
+- 损坏的发布记录只产生一条有界诊断，不再把整个会话标为 corrupt，因此损坏的发布状态不会阻塞无关的普通工作。
+
+### 迁移与回滚
+
+- 0.6.0 语义从新的 `Context Guard protocol boundary: v5.0.0` notice 开始，写在新会话首个真实根输入步之前。旧二进制会忽略该 notice，因此回滚方向是 fail-closed，而不是误读新记录。
+- 从未写过该边界的会话继续沿用整会话契约、版本 1 证书与旧摘要域。
+- 写过该边界的会话中，边界之前的义务保留出生规则，新工作使用工作单元、交付与版本 2 证书。
+- 回滚到 0.5.x 必须恢复 0.5.x 的状态快照。用 0.5.x 重放 0.6.0 日志会以 `certificate_replay_mismatch` fail-closed；切勿手工把新 schema 数据降级。
+
+### 尚未成立
+
+- **跨语言 parity 与正式镜像尚未完成。** 上游 `codex-context-guard` 尚未落地冻结的 v2 fixture，因此本仓库的 v2 文件明确是 DSH 产出的**候选**（`2.0.0-candidate.1`、`status: "dsh-candidate"`）。`UPSTREAM_PIN.json` 仍绑定未变的 v1 镜像，本次发布不刷新它。
+- `release` 档只保护 Guard 自身路由的表面：经 Guard 自有动作工具发布 npm 制品受保护；`git tag`、GitHub Release 各操作和复合 runner 在本宿主没有拦截点，会在效果前拒绝，而不是假装已覆盖。完全绕过 Guard 的可信进程内调用属于宿主信任边界，只能披露，不能否认。
+- 发布后若 registry 回读生产者没有回应，结算保持 `unconfirmed`；未确认的操作绝不重发。
+- 确定性测试、CI、macOS/Windows 原生验收、发布与安装是相互独立的证据范围。本次记录源码与确定性证据；原生验收与发布另行进行。
+
+<details>
+<summary>0.6.0 发布前的复核与修复细节</summary>
+
+### 0.6.0 定向复核后的第三轮修复（2026-09-14）
 
 针对 `fcc3813` 定向复核的两项发现，均已修复。
 
@@ -144,11 +217,13 @@
 
 新增回归：采用后签发 → 拒绝（投影仍 valid）；采用时已存在的证书按身份冻结，且后续新增义务不会使其失效；无效/错字段 adopt 输入不影响有效契约可用。
 
-## 0.6.0 跟进复核后的第二轮修复（2026-09-14）
+### 0.6.0 跟进复核后的第二轮修复（2026-09-14）
 
 对修复提交的跟进复核在新接线中发现 5 个残留缺陷，全部复现并已修复。复核者的反例按归属保留为常驻回归用例。
 
-### 修复
+下方变化还包括配套新增的可信恢复入口，各条目并非与五个反例一一对应。
+
+#### 修复
 
 - **追加 v5 边界不再回答 v5 之前的问题。** 交付此前只受自身 turn 水位约束；在 v4 日志末尾追加边界，会让旧 turn 的回答追溯性关闭旧规则下仍开放的义务。现在只有 turn 在边界**之后**结束的交付才算数，且只有边界之后捕获的义务才可能被交付关闭。
 - **真实发布生产者补齐合同声明的全部身份。** 可信读取器现在从规范化后的 resolution 填充 registry（此前完全缺失，凡声明 registry 的合同都无法被授权）；ref 改由运行时依据**已采用契约**用审计过的 git 可执行程序解析——这是一条闭合且可达的路径，而不是发布 manifest schema 会拒绝的 command-manifest 字段。解析出的提交与制品内嵌 `gitHead` 不一致时拒绝。
@@ -157,21 +232,21 @@
 - **新增可调用的可信恢复入口。** `context_guard_release` 读取发布状态；`reconcile` 通过与发布路径相同的审计 registry 适配器读取外部身份，并且只在回读指向合同（或预约记录中的 SRI）所冻结的字节时才结算。它绝不重发发布，且在重启后、以及对**已撤销但仍在执行中**的尝试都可用——撤销收回的是后续授权，而不是对可能已发生效果的核对义务。仅冻结字节 SHA-256 的合同仍可被核对，并且仍能**检测**回读不一致。
 - **递交的证明现在属于持久合同。** checkpoint 调用会记录其 `proof` manifest，重放在该调用自身水位处重新绑定，并要求记录中的证明状态与日志蕴含的一致。被篡改或被省略、而结果仍声称已绑定的证明，现在以 `proof_replay_mismatch` fail-closed，而不是恢复出一张有效证书。签发、落盘与重放使用同一份调用参数，Goal 门也只消费证明仍能绑定的证书。
 
-### 验证
+#### 验证
 
 - 复核者的 5 个跟进反例全部通过，并按归属保留为回归用例：pre-v5 交付、只读 status、冻结的候选闭包、观测到的 registry、持久证明篡改。
 - 新增 `tests/tools/v060-release-chain.test.ts`——复核要求的验收：同一个测试串起真实 root 发布指令、真实已认证准备闭包、真实契约采用、经注册取证工具产生的真实 tgz 与 resolution，随后由注册的动作工具调用**运行时自身的发布门**：写入预约、执行一次、保持 in-flight、经注册恢复工具结算，并把重放作为已消费票据拒绝。只替换 npm 执行器与 registry HTTP 客户端；授权门、记录、生产者与重放都是生产代码。另有两例覆盖"已撤销但在执行中"的重启恢复与回读不一致。
 - 证明套件新增遗漏证明、Goal 消费，以及准确的证据边界说明。
 
-### 证据边界
+#### 证据边界
 
 发布链路测试通过显式的 `RuntimeExecutorSeams.hostLock` 验收接缝固定审计队列，因为宿主锁迁移复核会读取真实文件系统根。该接缝**只**替换宿主锁求值；发布门、预约与结算记录、证据生产者与重放仍是生产代码，宿主锁也有自己的套件与原生验收。
 
-## 0.6.0 集中复核后的修复（2026-09-14）
+### 0.6.0 集中复核后的修复（2026-09-14）
 
 针对 `0dce898` 候选的集中复核给出 15 个定向反例，15 个全部复现出真实缺陷。本节记录修复。编号（`F01`–`F08`、`R1`–`R15`）沿用复核者原编号。
 
-### 修复
+#### 修复
 
 - **F01 证书重放依赖时间点。** 交付原本在整个日志重放后统一应用，因此后续 turn 记录下来的证书在重放时，已交付的回答仍显示为未决；v5 规则也按整段日志生效，而不是从边界开始。现在交付在其所属 turn 的结束水位处应用，规则档在边界事件处切换，投影因此等于自身前缀的投影。证书比较改为按字段语义：字段顺序不同的同一证书重放结果一致，而多字段、少字段或被篡改仍然失败。
 - **F02 交付接纳迟到与中间回答。** 最终回答必须出现在该 turn 自己的 `turn/end` 之前、位于宿主实际进入的最高 step，且该 turn 只能有一个 completed 结束并有 start 记录。迟到文本、中间 step、重复或异常结束、被中止的 turn 都不产生交付。
@@ -182,7 +257,7 @@
 - **F07 证明可能被错误主体满足。** 绑定改为完整链路：条目自身冻结的主体与范围、事实按普通证据资格规则校验、声明的来源、每一类声明的操作、输入检查相对效果的先后、以及范围摘要背后真实的覆盖集合。manifest 与事实互相自洽但与用户义务不符时一律拒绝。
 - **F08 证明入口未接入生产。** v2 绑定器已接入 `context_guard_checkpoint`（可选 `proof` manifest 在签发任何证书之前绑定并报告状态）；v2 fixture 在每个 release 探针自己的时间点求值、铸造真实闭包证书、为 S09 携带真实读事实；并新增专职生产链路测试：producer → 持久日志 → derive → checkpoint → 重放。
 
-### 范围裁定（协调者，2026-09-14）
+#### 范围裁定（协调者，2026-09-14）
 
 两项范围事实一次裁定，均按事实记录，而不是作为整体 parity 声明：
 
@@ -191,51 +266,11 @@
 
 因此本插件不宣称与 Codex Context Guard "C01–C12 核心对齐"，也不宣称完整的发布覆盖面。
 
-### 验证
+#### 验证
 
 复核者的 15 个反例保留为 `tests/domain/review-counterexamples.test.ts`，现已全部通过；本次修复刻意改动的期望在原位标注了原因。新增覆盖：`tests/domain/v060-proof-production-chain.test.ts`（经真实工具注册的证明入口）、重写的发布/迁移套件（26 例，含真实已认证闭包与逐项身份拒绝）、以及扩展后的 v2 fixture（S09 证明绑定、逐时间点 release 探针、范围归因表）。
 
-## 0.6.0 - 2026-09-14
-
-本版让普通 DSH 任务在进入、执行、交付与恢复时遵循同一套规则，并补齐与共享 Context Guard 语义之间的实质差距。新协议边界之前的一切保持原有含义，既不重解释也不重新贴标签。
-
-### 新增
-
-- **回答交付与执行认证分开记录。** 问答或讲解只由宿主的自身事实关闭：同一 turn 最大 step 的 `assistant/message`、无 interrupted 标记，且其后存在 `reason.kind: "completed"` 的 `turn/end`。状态汇报、草稿、中间回复、其它 turn 的回答、子代理回答和中止的 turn 都不会关闭任何条目。`answered` 只表示"回答已交付"，不表示正确、完整或已执行。
-- **工作单元与必需后代闭包。** 任务被归入派生的单元。带委派标记的指令会开启一个子单元，其未完成义务进入父单元闭包，因此委派子任务绝不会丢掉父任务自身的工作；普通任务切换开启的是同级单元，不阻塞更新的任务。子代理结果是**有界证据**：记录并可见，但永远不能关闭父项。
-- **祖先约束持续生效。** 根用户在前一单元声明的禁止项或未满足条件，对后续单元中同一动作与目标的义务继续生效；认证器在检查证据之前就拒绝这类绑定。
-- **证明 v2 与真实能力矩阵。** 新增输入资产检查、生成结果视觉回读、对象/URL 回读、执行事实、外部事实五类证明，每类都绑定当前主体、声明的来源和真实操作。工具调用成功只构成执行事实：一次仅仅返回的浏览器调用不能证明看过图，输入资产检查必须是前置状态事实，子代理结果不能作为证明来源。已安装宿主没有对应生产者时结论是 `unavailable`，绝不静默通过。原有三类 manifest 及其摘要域不变，仍可读取。
-- **显式发布票据。** 发布契约只能由用户显式根命令采用。采用后每个操作消耗一次预约记录：效果前写入，效果后依据可信回读结算。错候选 SHA、错 ref、错制品摘要或版本、过期或无法评估的有效期、已消费票据、重放、已在执行中的操作、未解析目标和不透明 runner 都在任何副作用之前被拒绝。"release" 关键词、加载 Skill 或安装不会采用契约。
-- **strict 证明档位。** 在默认 `standard` 之上，用户明确要求的视觉或完整范围验证必须由真实回读事实兑现。strict 不为普通动作新增审批，安装也绝不隐式进入 `release` 档。
-- **统一诊断语言。** 每个未完成条目在精确原因码之外，还会给出七类标签之一：参数缺失、来源不足、条件未满足、生产者能力缺失、历史缺口、完整性失败、策略边界。`/context-guard migration` 报告当前生效的规则集、仍按 0.6.0 之前规则保留的义务，以及回滚所需的动作。
-- **宿主中立的 v2 一致性 fixture**，覆盖 S01–S12，且全部经过真实 derive/交付/闭包/Goal 链路。每条期望都只与"由事件和生产投影独立算出"的实际值比较；runner 绝不读取期望来决定实际值。
-
-### 变化
-
-- 文档"更新/修改"由对象决定，而不由动词决定：可识别的文档名词变成 `modify`，助手可在捕获的范围与类型内解析到具体文件；无法识别的对象保持诚实的未决读法，而不是被强行归为某个动作。
-- 宿主自身问答工具返回的可信答案现在会收窄有界文件选择的落点，并与沙箱审批分开记录。转贴或复述的回答文本不构成任何东西。
-- 后续根指令逐字包含某条未决通用义务时，会原子替换它并保留新旧 revision；解释、禁止和等待绝不因相似措辞删除义务。
-- `/context-guard status` 报告当前策略档、原因类直方图、迁移事实与发布状态。
-
-### 修复
-
-- 会话首步现在能看到同步持久化的输入；flush 失败会明确报告不可用，而不是返回陈旧投影。
-- v2 一致性 runner 的 `interpreted`、`closure`、`delivery`、`turn_bound` 与纠正判断改为从生产状态计算，不再取自 fixture 自身的期望。
-- 损坏的发布记录只产生一条有界诊断，不再把整个会话标为 corrupt，因此损坏的发布状态不会阻塞无关的普通工作。
-
-### 迁移与回滚
-
-- 0.6.0 语义从新的 `Context Guard protocol boundary: v5.0.0` notice 开始，写在新会话首个真实根输入步之前。旧二进制会忽略该 notice，因此回滚方向是 fail-closed，而不是误读新记录。
-- 从未写过该边界的会话继续沿用整会话契约、版本 1 证书与旧摘要域。
-- 写过该边界的会话中，边界之前的义务保留出生规则，新工作使用工作单元、交付与版本 2 证书。
-- 回滚到 0.5.x 必须恢复 0.5.x 的状态快照。用 0.5.x 重放 0.6.0 日志会以 `certificate_replay_mismatch` fail-closed；切勿手工把新 schema 数据降级。
-
-### 尚未成立
-
-- **跨语言 parity 与正式镜像尚未完成。** 上游 `codex-context-guard` 尚未落地冻结的 v2 fixture，因此本仓库的 v2 文件明确是 DSH 产出的**候选**（`2.0.0-candidate.1`、`status: "dsh-candidate"`）。`UPSTREAM_PIN.json` 仍绑定未变的 v1 镜像，本次发布不刷新它。
-- `release` 档只保护 Guard 自身路由的表面：经 Guard 自有动作工具发布 npm 制品受保护；`git tag`、GitHub Release 各操作和复合 runner 在本宿主没有拦截点，会在效果前拒绝，而不是假装已覆盖。完全绕过 Guard 的可信进程内调用属于宿主信任边界，只能披露，不能否认。
-- 发布后若 registry 回读生产者没有回应，结算保持 `unconfirmed`；未确认的操作绝不重发。
-- 确定性测试、CI、macOS/Windows 原生验收、发布与安装是相互独立的证据范围。本次记录源码与确定性证据；原生验收与发布另行进行。
+</details>
 
 ## 0.5.3 - 2026-09-14