dsh-completion-guard 0.9.0 → 0.10.0

package/docs/ACTIVATION_MIGRATION.md

@@ -1,8 +1,8 @@
 # Session activation migration / 会话启用模式迁移
 
-0.9.0 makes `always` the default for **new unseeded root sessions**. It preserves each old session's pre-upgrade effective mode using a write-once private binding. Mode is independent of `standard` policy, execution/publication authority and completion certificates. Empty old sessions belong in the inventory too. Recorded off/on continues to control enablement; neither configuration nor adoption re-signs history.
+This guide covers upgrades to **0.10.0**, including upgrades from **0.9.0**. Since 0.9.0, `always` has been the default for **new unseeded root sessions**. A write-once private binding preserves each old session's pre-upgrade effective mode. Mode is independent of `standard` policy, execution/publication authority and completion certificates. Empty old sessions belong in the inventory too. Recorded off/on continues to control enablement; neither configuration nor adoption re-signs history.
 
-0.9.0 将**新建无继承根会话**的默认模式改为 `always`，旧会话通过不可覆盖私有绑定保留升级前有效模式。模式独立于 `standard` 策略、执行与发布权限及完成证书。旧空会话也必须清点，已记录的 off/on 继续控制启用状态；配置及 adoption 都不重签历史。
+本指南用于升级到 **0.10.0**，包括从 **0.9.0** 升级。自 0.9.0 起，**新建无继承根会话**的默认模式为 `always`，旧会话通过不可覆盖私有绑定保留升级前有效模式。模式独立于 `standard` 策略、执行与发布权限及完成证书。旧空会话也必须清点，已记录的 off/on 继续控制启用状态；配置及 adoption 都不重签历史。
 
 ## Prepare before changing the installed version / 升级前准备
 
@@ -10,16 +10,16 @@ Stop the relevant Web, Headless and Desktop session writers. Preserve their inst
 
 先停止相关 Web、Headless、Desktop 会话写者，在升级前保留旧安装包身份及有效配置回读。可从独立准备的候选工具目录运行新工具，此时旧 Guard 仍安装在原位。不能把升级后的新缺省当作旧模式，不得在回读中包含凭据或会话正文。
 
-Prepare an operator-owned JSON file in the following format. `previousPackage.sha256` identifies the preserved old package bytes; `sourceSha256` hashes the relevant sanitized, pre-upgrade source readback. Cohort names describe that verified source. If all relevant cohorts have one known mode, that uniform mode can cover the inventory. If modes differ, each session needs an explicit `sessionIds` mapping based on verified old provenance; absent or contradictory mappings stay `pending`. Profile paths, dates, event counts and `on` markers cannot supply that mapping. A checksum checks integrity; it is not an issuer signature or proof that an operator's asserted mapping is correct.
+Prepare an operator-owned JSON file in the following format. `previousPackage.sha256` identifies the preserved old package bytes; `sourceSha256` hashes the relevant sanitized, pre-upgrade source readback. Cohort names describe that verified source. If all relevant cohorts have one known mode, that uniform mode can cover the inventory. If modes differ, each session needs an explicit `sessionIds` mapping based on verified old provenance; absent or contradictory mappings stay `pending`. Profile paths, dates, event counts and `on` markers cannot supply that mapping. A checksum checks integrity; it is not an issuer signature or proof that an operator's asserted mapping is correct. Use the verified old mode in the example; package version alone does not establish whether it is `opt-in` or `always`.
 
-准备以下格式的操作者 JSON 文件。包摘要指向保留的旧包字节，来源摘要指向相关的脱敏升级前回读。来源组名描述已核验来源。所有相关来源模式一致时可覆盖库存；模式不同则必须提供基于已核验旧来源的 `sessionIds` 映射，缺失或冲突保持 `pending`。不能用 profile 路径、日期、事件数量或 on 标记替代来源映射。摘要核验完整性，不是发行签名，也不能证明操作者的映射断言正确。
+准备以下格式的操作者 JSON 文件。包摘要指向保留的旧包字节，来源摘要指向相关的脱敏升级前回读。来源组名描述已核验来源。所有相关来源模式一致时可覆盖库存；模式不同则必须提供基于已核验旧来源的 `sessionIds` 映射，缺失或冲突保持 `pending`。不能用 profile 路径、日期、事件数量或 on 标记替代来源映射。摘要核验完整性，不是发行签名，也不能证明操作者的映射断言正确。示例中的 `opt-in` 应按已核验的旧模式填写，不能仅按包版本判断。
 
 ```json
 {
   "schema": "dsh-activation-prior-modes/v1",
   "previousPackage": {
     "name": "dsh-completion-guard",
-    "version": "0.8.4",
+    "version": "0.9.0",
     "sha256": "<64 lowercase hex characters>"
   },
   "sourceSha256": "<64 lowercase hex characters>",
@@ -27,6 +27,10 @@ Prepare an operator-owned JSON file in the following format. `previousPackage.sh
 }
 ```
 
+The 0.10.0 toolkit accepts verified prior-mode records for predecessor versions `0.0.x`–`0.9.x`, including `0.9.0`. It refuses `0.10.0` as a prior package.
+
+0.10.0 工具接受前驱版本 `0.0.x`–`0.9.x` 的已核验旧模式来源，包括 `0.9.0`；不能把 `0.10.0` 本身作为旧包。
+
 ## Official old-format refusals and an explicit readable subset / 官方旧格式拒绝与显式可读子集
 
 The official persistence reader may reject an older session with `SessionFormatUnsupportedError`. This names a host format-support boundary; it does not by itself prove corruption or a Guard regression. Do not delete, rewrite, rename or repair the raw log to force acceptance. Preserve it, the old package and its verified effective-mode source. `inventory` can record this **specific official open refusal** as pending. Other failures (corruption, permissions, missing files, unknown errors, list/stat failure or drift) abort; they are not automatically skipped. Default `inspect/adopt/verify` still requires the whole inventory to be readable.
@@ -91,16 +95,16 @@ When a later official host supports the pending format, use its **read-only** pe
 
 ### Copyable migration prompts / 可复制迁移提示词
 
-> Help me migrate session activation to DSH Completion Guard 0.9.0. Lifecycle constraint: [fill in which writers may be stopped and whether restart is allowed]. Reuse scope, write and lifecycle authorization already supplied in this conversation; ask only for missing or materially changed decisions. First report the current host/persistence/compression settings, preserved 0.8.x package identity and sanitized pre-upgrade effective-mode sources. If they cannot be verified, keep affected sessions pending. Do not replace packages, stop/restart processes or write bindings before that lifecycle and mutation authority is established. Run the packaged read-only inventory command; show total/readable/official-format-refused counts and a local pending report. Use my existing explicit selection, or ask me to choose the included scope if none was supplied; do not silently expand it or treat readability alone as authorization. Bind that explicit selection through inspect/adopt/verify, detect all inventory changes, preserve raw logs and old sources, and never infer modes/origin/cuts from paths, dates or event counts. No log bodies, credentials or private IDs leave my machine. Once the scope and writes are covered by my authorization, adopt, repeat to check no-op, and verify; report selected completion and remaining pending separately. For unsupported rows, give the future official-reader/re-inventory/source-validation route; without a recoverable source, keep pending or use a new session. Do not treat old certificates as new authority.
+> Help me migrate session activation to DSH Completion Guard 0.10.0. Lifecycle constraint: [fill in which writers may be stopped and whether restart is allowed]. Reuse scope, write and lifecycle authorization already supplied in this conversation; ask only for missing or materially changed decisions. First report the current host/persistence/compression settings, preserved predecessor package identity (for example 0.9.0) and sanitized pre-upgrade effective-mode sources. If they cannot be verified, keep affected sessions pending. Do not replace packages, stop/restart processes or write bindings before that lifecycle and mutation authority is established. Run the packaged read-only inventory command; show total/readable/official-format-refused counts and a local pending report. Use my existing explicit selection, or ask me to choose the included scope if none was supplied; do not silently expand it or treat readability alone as authorization. Bind that explicit selection through inspect/adopt/verify, detect all inventory changes, preserve raw logs and old sources, and never infer modes/origin/cuts from paths, dates or event counts. No log bodies, credentials or private IDs leave my machine. Once the scope and writes are covered by my authorization, adopt, repeat to check no-op, and verify; report selected completion and remaining pending separately. For unsupported rows, give the future official-reader/re-inventory/source-validation route; without a recoverable source, keep pending or use a new session. Do not treat old certificates as new authority.
 
-> 帮我迁移到 DSH Completion Guard 0.9.0 的会话启用模式。生命周期约束：[填写允许停止的写者及是否允许重启]。沿用本会话已给出的范围、写入及生命周期授权，仅询问缺失或实质变化的决定。先报告现有宿主、持久化目录/压缩配置、保留的 0.8.x 包身份及脱敏的升级前有效模式来源；不能核验就将受影响会话保持 pending。取得明确生命周期和写入权限前，不替换包、不停/重启进程、不写绑定。运行打包工具的只读 inventory，报告总数/可读/官方格式拒绝数量并保存本地 pending 报告；沿用我已明确选择的范围，尚未选择时再请我决定；不静默扩大范围，也不把可读性本身当作授权。让显式 selection 贯穿 inspect/adopt/verify，检测全部库存变化，保留原日志和旧来源，不按路径、日期、事件数猜模式/origin/cut。正文、凭据、私有 ID 不离开本机。范围和写入已有授权覆盖后 adopt、重复检查 no-op，再 verify，分别报告选中行完成及剩余 pending。被拒绝项给出未来官方读取器支持后重盘点、核验身份/旧来源的方案；没有可恢复来源就保留 pending 或改用新会话。旧证书不当作新权限。
+> 帮我迁移到 DSH Completion Guard 0.10.0 的会话启用模式。生命周期约束：[填写允许停止的写者及是否允许重启]。沿用本会话已给出的范围、写入及生命周期授权，仅询问缺失或实质变化的决定。先报告现有宿主、持久化目录/压缩配置、保留的前驱包（如 0.9.0）身份及脱敏的升级前有效模式来源；不能核验就将受影响会话保持 pending。取得明确生命周期和写入权限前，不替换包、不停/重启进程、不写绑定。运行打包工具的只读 inventory，报告总数/可读/官方格式拒绝数量并保存本地 pending 报告；沿用我已明确选择的范围，尚未选择时再请我决定；不静默扩大范围，也不把可读性本身当作授权。让显式 selection 贯穿 inspect/adopt/verify，检测全部库存变化，保留原日志和旧来源，不按路径、日期、事件数猜模式/origin/cut。正文、凭据、私有 ID 不离开本机。范围和写入已有授权覆盖后 adopt、重复检查 no-op，再 verify，分别报告选中行完成及剩余 pending。被拒绝项给出未来官方读取器支持后重盘点、核验身份/旧来源的方案；没有可恢复来源就保留 pending 或改用新会话。旧证书不当作新权限。
 
 
 ## Full-inventory inspect, adopt, verify / 整库清点、采纳、核验
 
-The entry `node /absolute/prepared-package/bin/dsh-completion-guard-activation.mjs` below uses the independently prepared 0.9.0 toolkit; it does not assume a new command is installed on PATH while the old Guard remains installed. The tool mounts only the official JSONL persistence service, without starting the agent loop, UI or model. `--runtime-anchor` is a file in the physical official runtime; the tool resolves its real path before loading dependencies. `--persistence-root` and optional `--compression none|zstd` must match the active persistence configuration. No storage path or encoding is guessed. Inspection uses public `list`, read-only `open`, exact header/inherited-cut metadata and revision readback; it outputs no event bodies. Keep writers stopped through the sequence.
+The entry `node /absolute/prepared-package/bin/dsh-completion-guard-activation.mjs` below uses the independently prepared 0.10.0 toolkit; it does not assume a new command is installed on PATH while the old Guard remains installed. The tool mounts only the official JSONL persistence service, without starting the agent loop, UI or model. `--runtime-anchor` is a file in the physical official runtime; the tool resolves its real path before loading dependencies. `--persistence-root` and optional `--compression none|zstd` must match the active persistence configuration. No storage path or encoding is guessed. Inspection uses public `list`, read-only `open`, exact header/inherited-cut metadata and revision readback; it outputs no event bodies. Keep writers stopped through the sequence.
 
-下方使用独立准备的 0.9.0 工具入口 `node /absolute/prepared-package/bin/dsh-completion-guard-activation.mjs`，不假定旧 Guard 仍安装时新命令已在 PATH。工具只挂载官方 JSONL persistence 服务，不启动 agent loop、界面或模型。runtime anchor 必须是官方 runtime 中的文件，加载依赖前先解析物理路径。持久目录及可选压缩格式必须匹配实际配置，不推测目录或编码。清点使用公开 list、只读 open、精确 header/cut 元数据及 revision 回读，不输出事件正文。整个操作期间保持写者停止。
+下方使用独立准备的 0.10.0 工具入口 `node /absolute/prepared-package/bin/dsh-completion-guard-activation.mjs`，不假定旧 Guard 仍安装时新命令已在 PATH。工具只挂载官方 JSONL persistence 服务，不启动 agent loop、界面或模型。runtime anchor 必须是官方 runtime 中的文件，加载依赖前先解析物理路径。持久目录及可选压缩格式必须匹配实际配置，不推测目录或编码。清点使用公开 list、只读 open、精确 header/cut 元数据及 revision 回读，不输出事件正文。整个操作期间保持写者停止。
 
 The following example is for a POSIX shell. Run `inspect` before replacement; run `adopt` and `verify` before starting the upgraded host. Keep the prepared toolkit path explicit throughout.
 
@@ -140,9 +144,9 @@ Missing/corrupt/changed records invalidate cached projections and certification.
 
 缺失、损坏或变化的记录使缓存投影和认证失效。根据具名原因诊断，再使用保留且已核验的收据采纳同一缺失旧身份与模式。损坏或冲突的 final 拒绝自动修复，请保留诊断；无可信旧来源时保持 unknown，在新合格会话中建立新工作。不删除历史，也不触发无穷纠正。fork 需核验父绑定并继承父模式；精确 cut 由官方 Session/persistence 合同提供及验证，不由前缀长度推断模式。
 
-A fresh 0.9.0 creation that leaves `.pending` has no general recovery command in this toolkit. `inspect` accepts preserved pre-0.9.0 sources, and `adopt` requires a verified legacy migration receipt; neither permits inventing such a receipt for a fresh creation. Without an existing trusted legacy receipt, keep the mode unknown, diagnose the retained state, or continue new work in another qualified fresh session. The exported same-value writer is a programmatic controlled recovery primitive, not an operator CLI. Do not delete `.pending` merely to make the final readable.
+A fresh creation that leaves `.pending`, including a fresh 0.10.0 session, has no general recovery command in this toolkit. `inspect` accepts verified pre-upgrade predecessor sources (`0.0.x`–`0.9.x`, including `0.9.0`), but `adopt` still requires a verified migration receipt for the same old session identity and mode. Predecessor support does not authorize treating a failed fresh creation as a legacy migration or inventing a receipt to repair it. Without an existing trusted legacy receipt, keep the mode unknown, diagnose the retained state, or continue new work in another qualified fresh session. The exported same-value writer is a programmatic controlled recovery primitive, not an operator CLI. Do not delete `.pending` merely to make the final readable.
 
-新的 0.9.0 会话创建留下 .pending 时，本工具没有通用恢复命令。inspect 只接受已保留的 0.9.0 前来源，adopt 需要核验过的旧迁移收据，不能为新建会话编造旧收据。没有既有可信旧收据时，保持模式 unknown、诊断保留状态，或在另一合格新会话中继续新工作。导出的同值 writer 是程序受控恢复原语，不是操作者 CLI；不能为了让 final 可读而删除 .pending。
+新建会话（包括 0.10.0 新会话）留下 .pending 时，本工具仍没有通用恢复命令。inspect 可使用已核验的旧版本模式来源（`0.0.x`–`0.9.x`，包括 `0.9.0`），但 adopt 仍需针对同一旧会话身份与模式的已核验迁移收据。支持这些前驱版本不意味着可以把失败的新建会话当作旧会话迁移，或编造收据来修复它。没有既有可信旧收据时，保持模式 unknown、诊断保留状态，或在另一合格新会话中继续新工作。导出的同值 writer 是程序受控恢复原语，不是操作者 CLI；不能为了让 final 可读而删除 .pending。
 
 For rollback, stop writers, retain the receipt and bindings, and select the previous mode explicitly in each old profile before reinstalling the old Guard. A pre-0.9.0 Guard does not read these bindings; mixed-mode inventories need separate correctly mapped profiles or remain unsuitable for rollback. Keep host-lock and certificate identities separate: re-inspect the actual installed host as required, and never re-sign old certificates merely to change mode. Cross-machine transfer includes only verified bindings/receipts, with owner permissions restored; it transfers no host lock, credentials or native authority.
 

package/docs/ARCHITECTURE.md

@@ -16,27 +16,30 @@ Context Guard does not own Goal, Todo, Compaction, or continuation. It intervene
 ## Call-time Host working-directory evidence
 
 For an ordinary named `npm test` or `pnpm test` Host call that omits `workdir`,
-the Guard captures a read-only working-directory receipt before execution and
-defers its provider-visible plugin context until the host has persisted the
-complete tool-result batch. This is a call-time derivation from the original Session header, the scoped sandbox
-policy, the active shell service, and exact audited DSH `0.1.5-rc.2` producer
-bytes. It is **not** a working directory returned by the Host process. The
-notice binds the original call ID, sequence, turn, arguments digest, root
-source, Session digest, Host-lock digest, physical directory, and policy root.
-On replay it is accepted only after the matching result and before the next
-assistant step, with the same source and Host identity. A legacy notice between
-a call and result is not upgraded. The observer always lets the Host tool proceed;
-it grants no ordinary mutation or execution qualification.
-
-The Bash producer chooses the scoped policy workspace root, or the Session
-header cwd when no policy is mounted; this candidate only certifies the
-audited policy route when its physical root equals the immutable header cwd.
-PowerShell uses the immutable header cwd under its separately audited local
-executor. An explicit `workdir` is checked on its own merits. Missing or
-ambiguous provider identity, a lexical filesystem alias, absent physical
-directory, changed policy or graph bytes, background execution, or missing
-call-time notice leaves target attribution insufficient. Historical logs
-without such a notice cannot be upgraded by reading today's Host config.
+Guard observes the proposed default directory before execution. The observation
+binds the original Session header, committed cwd epoch, scoped policy and
+`WorkingDirectoryService`, active shell service, and audited DSH `0.2.1-rc.2`
+implementation bytes and dependency routes. Its provider-visible context is
+deferred until the host has persisted the complete tool-result batch. It is
+not a directory returned by the executed process.
+
+Bash and PowerShell obtain their default from the host's asynchronous
+`workingDirectory.ensure()`. That service can recover a missing directory after
+`tool/call`. Guard therefore withholds the receipt if the current service readback
+disagrees or the directory history changes while the call is in flight. The
+ordinary call still proceeds; its cwd-dependent result stays unconfirmed and
+retains the call-epoch target. An explicit absolute workdir or file target is
+bound independently; a relative shell workdir resolves against the call epoch only under the epoch reader. Historical logs with no cwd-change events retain the exact 0.9.0 projection under the same host binding and its frozen evidence/digests, including relative workdir spelling. The reader version is chosen from effective epochs committed through the result, so a future change cannot rewrite a completed legacy fact.
+
+A receipt binds call ID, sequence, turn, arguments digest, root source, Session
+and host-lock digests, physical directory and policy root. Replay accepts v1
+only in unchanged header history. V2 additionally binds the governing epoch
+and the original cwd supplied by the actual Session header, and refuses
+in-flight directory changes and transplanted histories. Neither version
+creates permission to execute or proves resource cleanup. Missing or ambiguous
+provider identity, a lexical filesystem alias, background execution or an absent
+receipt leaves the omitted-workdir completion shortcut unavailable. Historical
+logs cannot acquire a missing receipt from today's configuration.
 
 ## Durable state model
 

package/docs/COMPATIBILITY.md

@@ -2,9 +2,51 @@
 
 Guard binds each accepted installation to its exact package identities, implementation bytes and dependency routes. Version admission and implementation qualification are separate checks; a matching version alone does not establish compatibility.
 
+## 0.10.0: DSH >=0.2.1-rc.2
+
+0.10.0 raises the host floor to `0.2.1-rc.2` (upstream release `dsh-v0.2.1-rc.2`, commit `687f282e8625c6b8d11ff58211a90524be2e4317`, cumulative over `0.2.1-rc.1`). There is no upper bound: later RCs on any tuple, stable and future releases pass VERSION ADMISSION and must still pass the graph, byte, route and contract audits. `0.2.0-rc.2`, `0.2.0` and `0.2.1-rc.1` keep their recorded-evidence rows but are refused as below the floor. Cordis keeps a separate `>=4.0.4` peer range and qualification (the reviewed baseline moved to Cordis `4.0.5` with the same range).
+
+The reviewed host baseline is DSH `0.2.1-rc.2` / Cordis `4.0.5`, with 47 package identities and published implementation digests in `manifests/rc021-rc2-byte-audit.json`, regenerated from the published `0.2.1-rc.2` tarballs (the audited cohort id is `dsh-0.2.1-rc.2-core-v1`). Native acceptance of the final Guard artifact on each platform remains a separate gate; no native validation of a future host is claimed.
+
+### Official Desktop distribution bytes
+
+The official Desktop `0.2.1-rc.2` distribution retains generated `lib/types/invariant.js` companions that the npm packages no longer contain. Guard does not load these companions. Desktop qualification additionally checks the exact released archive identities and eight critical-package file tuples in [`desktop-distribution.v1.json`](../manifests/desktop-distribution.v1.json). Each program was independently reproduced from the fixed upstream source before its removal; the manifest keeps that public source pin separate from the application's declared build identity. The local ASAR hash table cannot authorize extra code. The carrier must pass vendor-signature verification, the authenticated ASAR header must match a registered platform distribution, and registry bytes and active dependency routes must still pass their existing audits. Unknown files, changed bytes, versions, headers or routes are refused. Ordinary registry runtime qualification is unchanged. A new Desktop build requires qualification of its own bytes even when its version string is unchanged.
+
+Desktop's physical hoisted profile reader accepts the observed pnpm `11.7.0` and `11.28.5` JSON layouts only when the profile's manager agrees with the verified carrier. Duplicate keys, unsupported YAML, linked or escaped locations and invalid dependency routes are refused. The `dsh-desktop-bound/v2` contract is unchanged: Guard's second single-package add must preserve all tracked bytes and its complete package tree; only object-key order in `.modules.yaml` may differ in the later multi-package add. Qualification and read-only preflight do not establish installation, no-op, lifecycle or real-model acceptance.
+
+官方 Desktop `0.2.1-rc.2` 分发包保留了 npm 包已移除的 `lib/types/invariant.js` 编译产物，Guard 不加载这些伴随插件。Desktop 另行核对固定发行包身份和八个关键包的精确文件清单；每份程序均由删除前的固定上游源码独立编译复现，公开源码 pin 与应用声明的构建标识分开记录。ASAR 自带哈希表不能授权额外代码：仍须通过官方签名、已登记平台的 archive header、registry 字节和实际依赖路由核验。未知文件、改字节、错版本、错 header 和错路由均被拒绝，普通 registry runtime 的闭合规则不变。同版本重新构建的 Desktop 也须重新核验其分发字节。
+
+Desktop 平铺安装索引只接受已观察的 pnpm `11.7.0`、`11.28.5` JSON 布局，版本必须与已验证的 carrier 一致；重复 key、未知 YAML、链接或越界目录、错误依赖路由仍会被拒绝。v2 两步 no-op 合同不变：Guard 单包第二次 add 要求全部跟踪文件及包树字节不变；后续多包 add 仅容许 `.modules.yaml` 的对象 key 顺序变化。资格核验及只读 preflight 不等于安装、no-op、生命周期或真实模型验收通过。
+
+### Host-surface changes Guard 0.10.0 actually handles
+
+- **Session V4 catalog adds `job/registered`, `job/settled`, `working-directory/change`.** Job registrations and settlements are durable lifecycle facts, not completion evidence: a `job/settled` record with `status: "completed"` refines the external-wait view only when the producer itself reported fulfilment (`cause: "producer"`, `producerReported: true`); killed and failed settlements are explicit failures, and an unreported completion is unconfirmed. A settlement never certifies resource cleanup, file readback or the completion of a user obligation. Only a validated registration/settlement pair owned by the current session may refine its wait; supplied tool/root identities must match the original persisted invocation. The host writes lifecycle records best effort, so a well-formed orphan settlement remains audit-only. Missing or malformed identity, time or optional fields and conflicting repeats fail closed. A forked history never transfers the original owner.
+- **Working directory is switchable inside a session.** The immutable Session header keeps the original project; each committed `working-directory/change` opens a new cwd epoch. Captured targets, paths and receipts keep the meaning of the epoch they were bound in — a later change never re-interprets an older relative path. A cwd-dependent call keeps its call-epoch target; a directory change before its result makes execution unconfirmed, including recovery by the host after dispatch. Absolute explicit execution targets remain independently bound. Drive-root and complete Windows UNC directories preserve their original spelling. Host default-workdir receipts gained a v2 shape that binds the governing epoch and the original project; receipts replayed next to different directory history are refused. Root-locator digests bind the epoch each root was captured in. Historical logs without `working-directory/change` preserve the 0.9.0 frozen projection under the same host binding, and preserve its evidence fields and digests, including the original spelling of explicit relative shell workdirs. The epoch reader applies only once a committed effective epoch is visible through that result; it resolves relative shell workdirs against the call epoch and keeps ambiguous Windows workdirs unconfirmed. Later events never reinterpret an already completed legacy fact.
+- **Plugin records exist (`appendPluginRecord`/`pluginRecordOf`, `plugin:` namespace).** They are ignorable, never model-visible, and retained on a best-effort basis across format migrations; the upstream gate restricts production callers to its own experimental packages, so this API is not a stable third-party persistence interface. Guard does NOT migrate its private hash-chained ledger onto plugin records; the ledger keeps its own storage, writer lock and loss model. Foreign plugin records are retained-and-skipped: they never trigger capture, never authorize anything, and never break seq-driven call/result pairing.
+- **Session append gained a publication-reentrancy check and per-listener exception isolation.** Guard's synchronous `snapshotEvents()` reads remain valid on the pinned local Session implementation; the existing flush-before-control and boundary durability flows are unchanged.
+- **The invariant companion plugin and the `./invariant` exports were removed upstream.** Guard never imported them and adds no substitute. The official Desktop distribution's retained compiled files require the separate qualification above.
+- **Subagents and Teams.** The subagent tool name `subagent` stays in Guard's delegation allowlist: a subagent result remains bounded evidence and never closes a parent obligation. Team delivery moved to direct inbox acceptance (the old outbox retry/dedupe path is gone upstream); `team/message/delivered` records reception only — reception is not execution, and neither is completion. Waiting for a subtask, a plan-review end turn, or a Goal pause does not consume or fabricate a completion.
+- **Search/Fetch APIs and new models** are ordinary host tools: their success is non-authoritative evidence, never proof that a user task is complete.
+
+### 升级、临时禁用与恢复（0.10.0 中文说明）
+
+最低宿主为 DSH `>=0.2.1-rc.2`，没有隐式上限。升级顺序不变：先停写者、保留旧模式来源，升级宿主到 `0.2.1-rc.2` 或更高，安装 Guard，重新注入宿主锁并回读（见[宿主锁升级](HOST_LOCK_UPGRADE.md)）。已审查基线为 DSH `0.2.1-rc.2` / Cordis `4.0.5`（cohort `dsh-0.2.1-rc.2-core-v1`，47 包，见 `manifests/rc021-rc2-byte-audit.json`，上游提交 `687f282e8625c6b8d11ff58211a90524be2e4317`）。
+
+新宿主事件语义：`job/settled` completed 不证明资源释放，只有本会话所有、注册与结算身份一致且工具根调用匹配的配对记录，在 producer 自己报告完成（`cause: "producer"` 且 `producerReported: true`）时才把外部等待标记为完成；合法孤立结算仅保留为审计事实，畸形或冲突记录拒绝；killed/failed 是显式失败，未报告的 completed 保持未确认。`working-directory/change` 开启新的 cwd 纪元：此前捕获的目标与证据保留原含义，不会随当前目录重新解释；调用与结果之间若发生目录变化（包括宿主自动恢复），默认或相对目录的执行保持未确认；显式绝对目标独立绑定。Windows 完整 UNC 和 drive-root 路径保留拼写，drive-relative/root-relative 拒绝。没有 `working-directory/change` 的日志在同一宿主绑定下保留 0.9.0 冻结投影，并保留其证据字段与摘要，包括显式相对 shell workdir 的原始拼写。新读法只在该结果之前已有实际生效的提交纪元时使用；后来追加的事件不能重新解释已经完成的旧证据。`plugin:` 记录一律忽略且不触发捕获；Guard 私有账本不迁移到 plugin records。子代理结果仍是有界证据；Team 直投 Inbox 的接收成功不等于执行完成；Goal 等待与计划审阅的结束等待不算完成。
+
+临时禁用与恢复：升级窗口内可在 profile 配置中把 Guard 从 bundles 移除或保持不加载（临时禁用是独立状态，不影响 `activation=always` 与完整原有 config 的保留）。禁用期间会话事件不被捕获；重新启用时按既有规则恢复——新建无继承根会话回到默认模式，旧会话沿用 write-once 私有绑定的原模式。宿主锁在禁用期间不变质；重新启用后若宿主或 profile 图未变，原锁继续有效，若变化则按 `--rebind-registry` 流程重建。市场兼容卡片显示"兼容"不等于 Guard admission 已通过；插件加载成功也不等于审计通过。
+
+### Consumer prerelease semantics
+
+The plain npm/node-semver expression `>=0.2.1-rc.2` excludes later-tuple prereleases by default. The installed DSH plugin compatibility check (`dsh-app-boot`'s `evaluatePluginCompatibility`) reads the TOP-LEVEL `engines.dsh` first and ignores the DSH peers entirely when it exists; it uses `semver.satisfies(..., { includePrerelease: true })`, so the declaration admits `0.2.1-rc.3` and later RCs on any tuple, and refuses below-floor values. Both shipped layers (`engines.dsh` and `dsh.engines.dsh`) carry the same range so consumers reading either layer agree; peers keep the same range for peers-only consumers. `benchmarks/incidents/acceptance/semver-matrix.json` records the verified matrix for the new floor, and `tests/v100-app-boot-admission.test.ts` pins the real consumer's decisions. Package installation is not a version-admission proof — Guard's own floor check rejects a below-floor host independently.
+
+The default-workdir shortcut additionally authenticates the published `dsh-working-directory` implementation, its dependency routes and the scoped `WorkingDirectoryService`. Missing, substituted or modified providers emit no trusted receipt. A v1 receipt is valid only before any directory-change event; v2 replay binds its origin to the actual Session header supplied by derivation, rather than trusting the receipt's own origin field. A pre-execute receipt is refused if directory history changes before the result; a pre-execute observation does not prove that `ensure()` later executed in that directory.
+
+默认目录快捷证据还核验 `dsh-working-directory` 的发布字节、依赖路由和当前 scoped 服务身份。服务缺失、替换或修改时不发可信回执。v1 只能用于调用前没有目录变化的历史；v2 的 origin 必须绑定派生器从实际 Session header 取得的原始目录，不能只信回执自报。调用后目录发生变化时，执行前回执不再证明实际执行目录。
+
 ## 0.8.2–0.9.0: DSH >=0.2.0-rc.2 and official Desktop
 
-0.9.0 retains the host admission and Desktop support introduced in 0.8.2. Each release still requires its own artifact acceptance.
+0.9.0 retained the host admission introduced in 0.8.2 with the floor `0.2.0-rc.2`; 0.10.0 supersedes it. Historical description:
 
 Version admission uses strict SemVer precedence, including later-tuple RCs and ignoring build metadata. The floor is `0.2.0-rc.2`, with no upper limit. `0.2.0-rc.1` keeps its recorded-evidence row but is refused as below the floor. Below-floor and malformed versions are refused. Cordis has a separate `>=4.0.4` peer range and qualification; a DSH version does not establish arbitrary Cordis compatibility.
 

package/docs/GETTING_STARTED.md

@@ -0,0 +1,110 @@
+# Installation and first load / 安装与首次载入
+
+[English README](../README.md) · [中文 README](../README.zh-CN.md)
+
+## Before installation
+
+Use the profile you actually run: Web, Headless or Desktop. Stop the relevant host/session writers first. If this installation has old Guard sessions, preserve the old package and effective mode sources, then prepare a frozen inventory and migration receipt using [the migration guide](ACTIVATION_MIGRATION.md) **before replacing DSH or Guard**. Empty old sessions count too. The 0.10.0 migration toolkit can run from a separately prepared package directory while the old package stays installed.
+
+With no old Guard sessions, there is no old-mode adoption step. Upgrade the host to DSH `>=0.2.1-rc.2` if necessary, install Guard, and complete the installation checks before startup. Requires Node.js `>=22`, pnpm `>=11` and a qualified Cordis `>=4.0.4` installation. Do not load both `dsh-context-guard` and `dsh-completion-guard` in one profile; the internal entry ID remains `context-guard`.
+
+## 安装前
+
+先确认实际使用的 Web、Headless 或 Desktop profile，并停止相应宿主与会话写者。如果已有旧 Guard 会话，替换 DSH 或 Guard **之前**，按[迁移指南](ACTIVATION_MIGRATION.md)保留旧包、核验有效模式来源，冻结会话库存并准备迁移收据。旧空会话也需要清点。0.10.0 迁移工具可以从另行准备的包目录运行，旧包此时仍留在原安装位置。
+
+没有旧 Guard 会话时，不需要旧模式 adoption。先按需将 DSH 升级到 `>=0.2.1-rc.2`，再安装 Guard，完成安装核验后启动。需要 Node.js `>=22`、pnpm `>=11` 及通过资格验证的 Cordis `>=4.0.4`。同一 profile 不要同时加载 `dsh-context-guard` 和 `dsh-completion-guard`，内部条目 ID 仍是 `context-guard`。
+
+## Web installation / Web 安装
+
+Keep the host stopped through these steps. Substitute the actual absolute runtime/profile paths. Back up the profile's `cordis.patch.yml` before `inject`, which writes the lock into that file. The three host-lock checks—`inspect`, `inject` and `verify-dump`—must each return `status: "supported"`; a nonzero exit or another status stops this path. This status requirement does not apply to `dsh plugin add`.
+
+以下步骤期间保持宿主停止，将目录替换为实际绝对路径。`inject` 会把锁写入 profile 的 `cordis.patch.yml`，执行前先备份。`inspect`、`inject` 和 `verify-dump` 三条宿主锁检查都须返回 `status: "supported"`；非零退出或其他状态都不能继续启动。该状态要求不适用于 `dsh plugin add`。
+
+```sh
+dsh plugin --profile web add dsh-completion-guard@0.10.0
+
+DSH_RUNTIME_ROOT=/absolute/path/to/.dsh-runtime
+DSH_PROFILE_ROOT=/absolute/path/to/.dsh/profiles/web
+GUARD_HOST_LOCK="$DSH_PROFILE_ROOT/node_modules/.bin/dsh-completion-guard-host-lock"
+
+"$GUARD_HOST_LOCK" inspect --runtime-root "$DSH_RUNTIME_ROOT" --profile-root "$DSH_PROFILE_ROOT"
+"$GUARD_HOST_LOCK" inject --runtime-root "$DSH_RUNTIME_ROOT" --profile-root "$DSH_PROFILE_ROOT"
+dsh --profile web --dump-config | "$GUARD_HOST_LOCK" verify-dump --runtime-root "$DSH_RUNTIME_ROOT" --profile-root "$DSH_PROFILE_ROOT" --dump-config -
+```
+
+The reviewed baseline is DSH `0.2.1-rc.2` / Cordis `4.0.5`. A later compatible host requires `--rebind-registry` on the three lock commands; it checks official archives and qualifies changed programs before rebuilding the lock. See [compatible-version rebinding](HOST_LOCK_UPGRADE.md#rebinding-compatible-package-versions). Changes to DSH, Guard or the profile location require fresh checks. An ordinary market-only update does not require reinjection; installing or removing the Desktop market does.
+
+已审查基线为 DSH `0.2.1-rc.2` / Cordis `4.0.5`。更新的兼容宿主需要在三条锁命令中添加 `--rebind-registry`，核对官方归档并验证变化的程序后重建锁，见[兼容版本重绑定](HOST_LOCK_UPGRADE.md#rebinding-compatible-package-versions)。DSH、Guard 或 profile 路径变化后需要重新检查。仅 market 的普通更新不需重新注入，Desktop 市场的安装或移除则需要。
+
+### Windows, Headless and Desktop / 其他入口
+
+- **Windows Web:** run the same lock subcommands through `node_modules\.bin\dsh-completion-guard-host-lock.cmd` inside the actual Web profile directory, with Windows absolute paths. Use your shell's variable syntax; the block above is POSIX shell syntax.
+- **Headless:** use the Headless profile and its own installed lock tool throughout, including `--profile headless` on DSH commands. See [the host-lock guide](HOST_LOCK_UPGRADE.md) for the profile-specific flow.
+- **Desktop:** use the app's bundled CLI for installation and `--profile desktop` when building the lock. Bind the app archive and actual Desktop profile. Its CLI has no `--dump-config`; run `dump-desktop` and verify that newly generated output. The complete commands are in [official Desktop setup](HOST_LOCK_UPGRADE.md#official-desktop-profile). After installing or removing `dshmarket`, repeat `inspect`, `inject`, `dump-desktop` and `verify-dump` on the new output.
+
+中文对应路径：
+
+- **Windows Web**：通过实际 Web profile 下的 `node_modules\.bin\dsh-completion-guard-host-lock.cmd` 运行相同锁子命令，使用 Windows 绝对路径和当前 shell 的变量语法；上方示例是 POSIX shell。
+- **Headless**：全程使用 Headless profile 及其安装的锁工具，DSH 命令选择 `--profile headless`，完整流程见[宿主锁指南](HOST_LOCK_UPGRADE.md)。
+- **Desktop**：使用应用附带 CLI 安装，以 `--profile desktop`、应用归档和实际 Desktop profile 建锁。该 CLI 没有 `--dump-config`，要用 `dump-desktop` 生成新配置，再核验这份输出。[官方 Desktop 步骤](HOST_LOCK_UPGRADE.md#official-desktop-profile)给出完整命令。安装或移除 `dshmarket` 后重新执行 `inspect`、`inject`、`dump-desktop`，并对新输出执行 `verify-dump`。
+
+## Finish an upgrade before startup
+
+A host lock verifies the installation, not old session modes. While writers remain stopped, use the frozen pre-upgrade receipt for `adopt` and `verify`. Start the host only after installation/lock checks and the intended migration scope pass. Unknown old sources, missing bindings and conflicts stay pending; do not fill them with the upgraded `always` default.
+
+If the official persistence reader refuses old formats, preserve those logs and mode sources. The [readable-subset flow](ACTIVATION_MIGRATION.md) freezes the whole report, then a user-reviewed selection of exact readable IDs. All three migration commands carry the same `--selection`; exclusions remain pending even when selected rows succeed. A zero exit or `selected_complete` does not establish whole-inventory completion. Corruption, permissions and other errors abort rather than becoming exclusions. The guide also contains [copyable migration prompts](ACTIVATION_MIGRATION.md) and recovery steps.
+
+## 升级核验完成后再启动
+
+宿主锁核验安装环境，不会迁移旧会话模式。保持写者停止，用升级前冻结的收据完成 `adopt` 和 `verify`。安装、锁核验及目标迁移范围全部通过后才能启动；旧来源未知、绑定缺失或冲突时保持待处理，不能用升级后的 `always` 默认值填补。
+
+官方 persistence 若拒绝旧格式，保留原日志和模式来源。按[可读子集流程](ACTIVATION_MIGRATION.md)先冻结全库报告，再明确选择精确的可读 ID。三个迁移命令都携带同一 `--selection`，选中行通过后排除项仍待处理。零退出或 `selected_complete` 不代表整库完成；损坏、权限等其他异常会中止，不会转成排除项。指南还提供[可复制迁移提示词](ACTIVATION_MIGRATION.md)和恢复步骤。
+
+## First load and status
+
+When you open or restore a session that already has history, DSH loads that history and Guard reconstructs its saved state. You may see “载入历史” (loading history); wait for loading to finish before continuing. A later visit can still wait.
+
+0.9.0 reuses completed history checks only when it can verify that the history is unchanged and the results are safe to reuse. Each operation still checks the current mode and performs the required fresh checks of Goal state, private records and the host environment. It does not modify the official host's history-view lifecycle or decode cache and does not guarantee an instant first opening or subsequent visit.
+
+Once loading finishes, run `/context-guard status`. With the default configuration, a new empty root session reports `armed`, waiting for the first real input; Guard has written no session events yet. DSH may have written its own initialization events. Images and attachments count as real input, blank messages do not. An explicit `activation: opt-in` instead requires `/context-guard on`. In an old session, check the retained mode and any binding diagnosis. Protection does not grant new authority; the default policy remains `standard`.
+
+## 首次载入与状态
+
+打开或恢复已有历史的会话时，DSH 载入历史，Guard 重建已保存的状态。界面可能显示“载入历史”，等加载结束后再继续；再次进入也可能需要等待。
+
+0.9.0 只在确认历史未变、检查结果可安全复用时，复用已经通过的历史检查。每次操作仍核对当前模式，并按需要重新核验 Goal 状态、私有记录和宿主环境。它没有修改官方宿主的历史视图生命周期或解码缓存，不能保证首次或后续打开立即完成。
+
+加载结束后执行 `/context-guard status`。使用默认配置的新建空根会话显示 `armed`，等待首条真实输入，此前 Guard 没有写入会话事件；DSH 可能已记录自身的初始化事件。图片、附件算真实输入，纯空白不算。显式配置的 `activation: opt-in` 则需要执行 `/context-guard on`。旧会话查看保留模式和可能的绑定诊断。保护不增加权限，默认策略仍为 `standard`。
+
+## Choose the default for new sessions
+
+Profiles that omit `activation` already use `always` for new roots. To adopt that default while retaining old modes, complete the old-session migration first, back up `cordis.patch.yml`, then remove the `activation` field from the existing `context-guard` entry's `config`. Keep the entry, injected host-lock fields and all other settings. Do not replace the old field with an explicit `activation: always`: an explicit setting applies when reading existing bindings too and reports `activation_mode_conflict` if they disagree. Omitting the field lets new roots use `always` while old sessions use their bound initial modes. Forks inherit their parent's bound mode.
+
+If you want future new roots to remain opt-in, keep `activation: opt-in`; any existing bindings must agree with that explicit setting. To choose a different initial mode, use a new root session. `/context-guard on` and `off` change the saved enabled state of the current session without changing its bound initial mode.
+
+## 新会话默认模式
+
+profile 未填写 `activation` 时，新建根会话已默认采用 `always`。要采用新默认值并保留旧模式，先完成旧会话迁移、备份 `cordis.patch.yml`，再删除原 `context-guard` 条目 `config` 下的 `activation` 字段。保留整个条目、注入的宿主锁字段及其他配置。不要直接替换为显式 `activation: always`：读取已有绑定时也会核对显式配置，矛盾时报告 `activation_mode_conflict`。省略该字段，才能让新根会话使用 `always`，旧会话沿用绑定的初始模式。分叉会话继承父会话绑定的模式。
+
+若希望后续新根会话仍需手动开启，保留 `activation: opt-in`，但已有绑定也须与这一显式设置相符。需要不同的初始模式时应新建根会话。`/context-guard on`、`off` 改变当前会话保存的启用状态，不改变绑定的初始模式。
+
+Default settings paths / 默认配置路径：
+
+| System / 系统 | Profile | Settings / 配置 |
+| --- | --- | --- |
+| macOS / Linux | Web | `$HOME/.dsh/profiles/web/cordis.patch.yml` |
+| macOS / Linux | Headless | `$HOME/.dsh/profiles/headless/cordis.patch.yml` |
+| macOS | Desktop | `$HOME/.dsh/profiles/desktop/cordis.patch.yml` |
+| Windows | Web | `%USERPROFILE%\.dsh\profiles\web\cordis.patch.yml` |
+| Windows | Headless | `%USERPROFILE%\.dsh\profiles\headless\cordis.patch.yml` |
+| Windows | Desktop | `%USERPROFILE%\.dsh\profiles\desktop\cordis.patch.yml` |
+
+Use a custom `DSH_HOME` instead of the default `.dsh` directory when configured. Restart the appropriate host after the edit, once the required lock and migration checks have passed. Guard `on`/`off` controls this session's protection, not its DSH standard/minimal/custom preset.
+
+设置了自定义 `DSH_HOME` 时，使用该目录而非默认 `.dsh`。修改后在必要的锁及迁移核验通过时重启相应宿主。Guard 的 `on`、`off` 控制当前会话保护，不改变 DSH 的标准、极简或自定义 preset。
+
+Copyable configuration prompt / 可复制配置提示词：
+
+> Use dsh-completion-guard 0.10.0's default always mode for future new root sessions while preserving old modes. Find the cordis.patch.yml for the Web, Headless or Desktop profile I actually use. First verify that old-session mode migration is complete for the authorized scope; keep exclusions and unknown sources pending. Back up the file, then remove only the activation field from the existing context-guard config, or leave it absent. Preserve bindings, all other settings and host-lock fields. Do not rewrite bindings or restart DSH. Show the path and exact diff, and report any lock or migration checks remaining before restart.
+
+> 让后续新根会话使用 dsh-completion-guard 0.10.0 的默认 always，保留旧模式。找到我实际使用的 Web、Headless 或 Desktop profile 的 cordis.patch.yml；先确认授权范围内的旧会话模式迁移已通过，排除项和来源未知项继续待处理。备份配置后，仅删除原 context-guard config 下的 activation 字段；原本没有该字段则保留不填。保留绑定、其他配置和宿主锁字段，不重写绑定，不重启 DSH。报告文件路径、精确差异，以及重启前尚缺的锁或迁移核验。

package/docs/HOST_LOCK_UPGRADE.md

@@ -1,23 +1,23 @@
 # Upgrading the core host lock
 
-Version 0.9.0 requires DSH `>=0.2.0-rc.2` and qualified Cordis `>=4.0.4`. Fresh installations have no old-mode inventory to adopt; existing installations must preserve their old mode sources before any replacement. Follow this order:
+Version 0.10.0 requires DSH `>=0.2.1-rc.2` and qualified Cordis `>=4.0.4`. Fresh installations have no old-mode inventory to adopt; existing installations must preserve their old mode sources before any replacement. Follow this order:
 
 1. Stop the relevant host/session writers. For an **existing installation**, preserve the old installed package and sanitized effective-mode sources, then prepare the public persistence inventory and frozen receipt with the [prepared-candidate migration toolkit](ACTIVATION_MIGRATION.md), **before replacing DSH or Guard**. Unresolved old provenance stays pending. A **fresh installation with no old Guard sessions** skips this old-mode preparation.
-2. Upgrade DSH to `0.2.0-rc.2` or a later version, then install this Guard version, keeping writers stopped.
+2. Upgrade DSH to `0.2.1-rc.2` or a later version, then install this Guard version, keeping writers stopped.
 3. Rebuild the host lock for each profile with `inspect`, `inject` and `verify-dump` from the accepted package or matching prepared source. For a POSIX shell, the entry is `node /absolute/prepared-package/bin/dsh-completion-guard-host-lock.mjs`; pass the actual runtime/profile roots. A successful rebuild reads back `supported` with `audit_provenance` stating how the graph was established.
 4. For an **existing installation**, run mode `adopt` and `verify` with its frozen old receipt while writers remain stopped, **before starting any host**. Host-lock rebuilding does not perform adoption. For a fresh installation there is no old receipt to adopt.
 5. Start each Web/Headless/Desktop profile only after the applicable mode and host-lock checks pass. These checks do not require a running host.
 
-0.9.0 的全新安装没有旧模式需要采纳；已有安装必须在替换前保留旧来源。顺序为：先停相关写者，保存旧安装包和脱敏有效模式来源，以独立准备的候选工具冻结公开库存及旧收据；再升级 DSH、安装 Guard、重建宿主锁；保持写者停止，在启动任何宿主前完成旧收据 `adopt` 和 `verify`；最后按需启动。全新安装跳过旧模式准备与 adoption，未知旧来源仍保持 pending，宿主锁不替代模式核验。
+0.10.0 的全新安装没有旧模式需要采纳；已有安装必须在替换前保留旧来源。顺序为：先停相关写者，保存旧安装包和脱敏有效模式来源，以独立准备的候选工具冻结公开库存及旧收据；再升级 DSH、安装 Guard、重建宿主锁；保持写者停止，在启动任何宿主前完成旧收据 `adopt` 和 `verify`；最后按需启动。全新安装跳过旧模式准备与 adoption，未知旧来源仍保持 pending，宿主锁不替代模式核验。
 
 Failure readbacks distinguish these cases:
 
 - `host_lock_migration_required`: the configuration lacks the policy or source roots. Supply `--runtime-root` and `--profile-root` when rebuilding the lock.
-- `host_lock_version_below_minimum`: DSH is older than `0.2.0-rc.2`. Upgrade DSH first.
+- `host_lock_version_below_minimum`: DSH is older than `0.2.1-rc.2`. Upgrade DSH first.
 - `host_lock_version_mismatch`: the installed graph differs from the reviewed baseline in version or integrity. For a later compatible version, use `--rebind-registry` to acquire and qualify the published graph. For the baseline, restore the recorded identities.
 - `host_lock_installed_graph_drift`: installed bytes or routes changed after the audit. Inspect the change before rebuilding the lock.
 
-The floor is `>=0.2.0-rc.2` with no upper bound. Passing the version check does not establish native validation; validated versions are recorded separately. Guard's exact DSH core is separate from optional market versions.
+The floor is `>=0.2.1-rc.2` with no upper bound. Passing the version check does not establish native validation; validated versions are recorded separately. Guard's exact DSH core is separate from optional market versions.
 A normal market update no longer changes the core digest. A plugin that changes
 which core packages actually resolve still invalidates the lock.
 
@@ -76,7 +76,7 @@ The result labels `inspection_scope: pre_install_target` and `profile_graph.stat
 ## What changes in the lock
 
 The generator writes `hostLockPolicy: dsh-core/v1`, the actual runtime/profile
-source roots, platform/profile kind and the actual core package graph (46 rows in the reviewed baseline). The
+source roots, platform/profile kind and the actual core package graph (47 rows in the reviewed baseline). The
 core manifest is version 2. Each session mount validates those graph sources
 exactly once; ordinary replay (resume, compaction, step and command refresh)
 consumes that result without rescanning, and every entry that grants
@@ -84,7 +84,7 @@ certificate authority — completion certificates, mutation authorization,
 release pre-effect decisions and Goal/Stop boundaries — validates the lock
 freshly at the moment of its own decision.
 
-Version 0.9.0 registers `dsh-0.2.0-rc.2-core-v1` as the audited baseline cohort and derives graph cohorts for compatible hosts above the version floor (see the compatibility guide). Runtime checks authenticate the mapped files and verify that each critical dependency resolves to the mapped instance. Installation imports use native Node resolution; Profile imports use the host's local-first routing and installation fallback only when no local package is selected. A nearer shadow, missing edge, wrong export target or escaped path is rejected even when the recorded versions match.
+Version 0.10.0 registers `dsh-0.2.1-rc.2-core-v1` as the audited baseline cohort and derives graph cohorts for compatible hosts above the version floor (see the compatibility guide). Runtime checks authenticate the mapped files and verify that each critical dependency resolves to the mapped instance. Installation imports use native Node resolution; Profile imports use the host's local-first routing and installation fallback only when no local package is selected. A nearer shadow, missing edge, wrong export target or escaped path is rejected even when the recorded versions match.
 
 The manifest's `registry-derived-pending-native-audit` provenance and empty `auditedPlatforms` list describe its immutable source audit, which is part of the lock digest. Native acceptance belongs to each exact artifact's separate Release annexes; it does not rewrite that digest. Inspection, injection and dump verification report `audit_provenance` alongside the cohort and digest.
 
@@ -103,14 +103,14 @@ that matters for deciding whether you are migrating or just drifting:
   a DSH upgrade, and both are cured by re-running inspect, inject and verify against
   the new runtime rather than by editing the lock.
 
-Historical requirements and session records are retained; old certificates do not become certificates for the new lock. Historical host cohorts are test data only and are not accepted by 0.9.0.
+Historical requirements and session records are retained; old certificates do not become certificates for the new lock. Historical host cohorts are test data only and are not accepted by 0.10.0.
 The shared digest-v3 encoder and its upstream fixtures are unchanged.
 
 ## Official Desktop profile
 
 Stop the Desktop app before installing or rebuilding its lock. Use the CLI carrier shipped with that app: `Contents/Resources/runtime/cli/bin/dsh` on macOS, or `resources\runtime\cli\bin\dsh.cmd` in the Windows installation. A separately installed `dsh` CLI cannot manage the reserved Desktop profile.
 
-For an existing installation, first preserve the old package/effective modes and freeze the inventory/receipt before replacing the carrier or Guard; after replacement, complete adoption/verification before Desktop startup. For a fresh installation there is no old-mode adoption. Install Guard through that carrier with `plugin --profile desktop add dsh-completion-guard@0.9.0`. Use the profile's own host-lock tool and the app's physical `app.asar` as `--runtime-root`. The default profile is `$DSH_HOME/profiles/desktop`, or `.dsh/profiles/desktop` under the user's home when `DSH_HOME` is unset. This POSIX example starts after installation:
+For an existing installation, first preserve the old package/effective modes and freeze the inventory/receipt before replacing the carrier or Guard; after replacement, complete adoption/verification before Desktop startup. For a fresh installation there is no old-mode adoption. Install Guard through that carrier with `plugin --profile desktop add dsh-completion-guard@0.10.0`. Use the profile's own host-lock tool and the app's physical `app.asar` as `--runtime-root`. The default profile is `$DSH_HOME/profiles/desktop`, or `.dsh/profiles/desktop` under the user's home when `DSH_HOME` is unset. This POSIX example starts after installation:
 
 ```sh
 DSH_DESKTOP_ASAR=/absolute/path/to/DeepSeek-Harness.app/Contents/Resources/app.asar
@@ -159,7 +159,7 @@ exact artifact and platform; publication is recorded on its GitHub Release.
 
 ## Historical 0.5.1 evidence
 
-Version 0.5.1 registered DSH `0.1.5-rc.1` and `0.1.5-rc.2` with 33 critical packages. Its macOS and Windows results belong only to that artifact and those hosts; see the [0.5.1 release annexes](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.5.1). These are historical records, not installation targets for 0.9.0.
+Version 0.5.1 registered DSH `0.1.5-rc.1` and `0.1.5-rc.2` with 33 critical packages. Its macOS and Windows results belong only to that artifact and those hosts; see the [0.5.1 release annexes](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.5.1). These are historical records, not installation targets for 0.10.0.
 
 ## Rebinding compatible package versions
 
@@ -179,9 +179,9 @@ Rebinding writes only its qualification receipt and, for `inject`, the managed l
 
 ## 0.9.0 session modes / 会话模式
 
-This is a major default-mode change for new root sessions only. Preserve old effective modes before replacing Guard, then use [activation inspect/adopt/verify](ACTIVATION_MIGRATION.md). Host-lock rebinding does not migrate modes or re-sign certificates. Existing bindings override defaults; explicit conflicts refuse. `standard` and persisted off/on retain their contracts. Missing modes remain unknown. Rollback and the current Windows storage capability gap are described in that guide.
+The default-mode change introduced in 0.9.0 applies only to new root sessions and remains in 0.10.0. Preserve old effective modes before replacing Guard, then use [activation inspect/adopt/verify](ACTIVATION_MIGRATION.md). Host-lock rebinding does not migrate modes or re-sign certificates. Existing bindings override defaults; explicit conflicts refuse. `standard` and persisted off/on retain their contracts. Missing modes remain unknown. Rollback and the current Windows storage capability gap are described in that guide.
 
-本次只改变新建根会话的默认模式。更换 Guard 前保存旧有效模式，再按迁移说明清点、采纳及核验。重绑宿主锁不迁移模式、不重签证书；已有绑定覆盖缺省，显式冲突拒绝。standard 及持久化 off/on 合同不变，缺失模式保持 unknown，回退及 Windows 存储能力缺口见该说明。
+0.9.0 引入的默认模式变化只适用于新建根会话，0.10.0 继续保留该规则。更换 Guard 前保存旧有效模式，再按迁移说明清点、采纳及核验。重绑宿主锁不迁移模式、不重签证书；已有绑定覆盖缺省，显式冲突拒绝。standard 及持久化 off/on 合同不变，缺失模式保持 unknown，回退及 Windows 存储能力缺口见该说明。
 
 ## Old-format migration refusals / 旧格式迁移拒绝
 

package/docs/LOCAL_ACCEPTANCE.md

@@ -1,8 +1,8 @@
 # Local Acceptance
 
-## 0.8.3 RC.2 and Desktop acceptance
+## 0.10.0 / DSH 0.2.1-rc.2 acceptance contract
 
-The candidate keeps the 0.8.x task, certificate and data protocols. Its host floor remains DSH `0.2.0-rc.2`; use the [upgrade guide](HOST_LOCK_UPGRADE.md) before establishing a new lock. The historical [RC.2/Desktop development plan](https://github.com/GreenLv/dsh-completion-guard/blob/563f144bf8568793da5017b9ff71395a33dcd265/docs/DEVELOPMENT_PLAN_DSH_0_2_0_RC2_DESKTOP.md) records the original adaptation scope; the current source, portability, exact-package, native, model and reader gates are defined below and in the repository instructions.
+Guard 0.10.0 retains the existing task, certificate and data protocols. This section defines the current acceptance contract; it does not report a passing native, model or GUI run. Its host floor is DSH `0.2.1-rc.2`; use the [upgrade guide](HOST_LOCK_UPGRADE.md) before establishing a new lock. The historical [RC.2/Desktop development plan](https://github.com/GreenLv/dsh-completion-guard/blob/563f144bf8568793da5017b9ff71395a33dcd265/docs/DEVELOPMENT_PLAN_DSH_0_2_0_RC2_DESKTOP.md) records the original adaptation scope; the current source, portability, exact-package, native, model and reader gates are defined below and in the repository instructions.
 
 Run the repository entrypoint twice for each native platform, always with the same frozen tgz and source commit. `host_bound_v070` covers Web/Headless. `desktop_bound` takes the physical app archive as `--runtime-root` and the exact DSH version as `--desktop-cohort`; it creates an isolated profile and uses the signed app's bundled CLI and actual Electron Node backend. Pass `--preflight` to each intended command before execution, with distinct unused external output and transfer-receipt paths.
 
@@ -12,7 +12,7 @@ pnpm 11.7.0 builds hoisted-location mappings asynchronously and writes their ins
 
 The backend annex also covers carrier/graph authentication, installation parity, injection and real composed readback, loaded Guard behavior, graceful stop, uninstall and cleanup. It expressly skips `graphical_shell` and `real_model_request`. Those skips require separate GUI/model evidence before the complete Desktop release gate closes. Portable tests, source composition against a real archive and a backend annex cannot substitute for those observations.
 
-每个平台分别运行 Web/Headless 与 Desktop 原生入口，绑定同一份最终 tgz、源码提交及摘要。Desktop 使用 `--gate-profile desktop_bound --runtime-root <app.asar> --desktop-cohort 0.2.0-rc.2`，先加 `--preflight` 做同一次调用环境的能力预检，再去掉该参数执行。该入口在隔离 profile 中验证官方载体、安装字节、单包严格字节 no-op、多包 JSON 值等价、组合配置、实际加载与卸载，并输出独立 annex；它不启动图形界面、不请求真实模型，二者须单独补齐。具体结果留在对应制品的外部回执和 Release 附件，避免文档自引用造成制品身份变化。
+每个平台分别运行 Web/Headless 与 Desktop 原生入口，绑定同一份最终 tgz、源码提交及摘要。Desktop 使用 `--gate-profile desktop_bound --runtime-root <app.asar> --desktop-cohort 0.2.1-rc.2`，先加 `--preflight` 做同一次调用环境的能力预检，再去掉该参数执行。该入口在隔离 profile 中验证官方载体、安装字节、单包严格字节 no-op、多包 JSON 值等价、组合配置、实际加载与卸载，并输出独立 annex；它不启动图形界面、不请求真实模型，二者须单独补齐。具体结果留在对应制品的外部回执和 Release 附件，避免文档自引用造成制品身份变化。
 
 ## 0.8.0 rc.2 source-stage snapshot
 

package/manifests/desktop-distribution.v1.json

@@ -0,0 +1,124 @@
+{
+  "schema": "dsh-desktop-distribution-qualification/v1",
+  "provenance": {
+    "repository": "https://github.com/deepseek-ai/deepseek-harness",
+    "sourceCommit": "3dce1c93d04494376118d574b862d51a7d2ec2f1",
+    "removalCommit": "f028f25667dbf378c83da80fbb29685b197d00e3",
+    "compiler": "TypeScript 5.9.3",
+    "compilerOptions": {
+      "target": "ES2024",
+      "module": "ESNext",
+      "sourceMap": true,
+      "rewriteRelativeImportExtensions": true,
+      "verbatimModuleSyntax": false
+    },
+    "scope": "Exact Desktop distribution supplements only; these are not registry package inventories. The declared Desktop build commit is an opaque signed identity, not a claim that it equals the public source pin."
+  },
+  "files": [
+    {
+      "package": "@deepseek-ai/dsh-agent",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 1058,
+      "sha256": "ff96b77450ecd0b7b75d94e7aa07f073e7d378924f2484866a6a04ffe4542bc3",
+      "sourcePath": "packages/core/agent/src/invariant.ts",
+      "sourceSha256": "9ddb2ac93ba30f723d3d80d5ec0c9d5d645c879e6b6c051ec5408e656dd5fec6"
+    },
+    {
+      "package": "@deepseek-ai/dsh-session",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 8982,
+      "sha256": "975e1640ad5dba930b6031315ee7d98dd01151155d2db7e993021de1feef4f32",
+      "sourcePath": "packages/core/session/src/invariant.ts",
+      "sourceSha256": "f1dda850ed2abad99f773d13dc21aca335a81bbfef86a63a0aa407248eeab000"
+    },
+    {
+      "package": "@deepseek-ai/dsh-tools",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 5628,
+      "sha256": "955311912d27f945c9298bc2add074b04fd04414312ef4f9dec92635639dd121",
+      "sourcePath": "packages/core/tools/src/invariant.ts",
+      "sourceSha256": "919744eaa6c1e6489a68a4ea3be9831e1e6c576a4a2fce96801d0a3a33ac2a79"
+    },
+    {
+      "package": "@deepseek-ai/dsh-goal",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 3206,
+      "sha256": "2eda87df2fffc21e2f761b138d54c9be523627e3b41bd1508906be5cf69a410d",
+      "sourcePath": "packages/goal/goal/src/invariant.ts",
+      "sourceSha256": "92b2156e0ca89f98af1cf904bad892bd68efc986951c7697880132e9780155d1"
+    },
+    {
+      "package": "@deepseek-ai/dsh-commands",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 3034,
+      "sha256": "e4bdb34890eb5b917fb26e5d8987929ef61be4e0587f8975c6cb7692e22be996",
+      "sourcePath": "packages/interaction/commands/src/invariant.ts",
+      "sourceSha256": "bebedf4440f99d6a9f275557edf10081d3ef9e1e22e82e0f3c603313a05c7d8c"
+    },
+    {
+      "package": "@deepseek-ai/dsh-user-approval",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 4858,
+      "sha256": "0ee679ea1449b99266df9dc3c53606a61573caa432cfca3d44badfdac71a0ef8",
+      "sourcePath": "packages/interaction/user-approval/src/invariant.ts",
+      "sourceSha256": "0d91ae6637974853dbb43088d65495840e96e21667b2ffd8237b7889aa4771c4"
+    },
+    {
+      "package": "@deepseek-ai/dsh-jobs",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 5474,
+      "sha256": "8d7b9de3a4928849ef504ea379642e4c60826ec0032ff92ff6fe89839f7fb490",
+      "sourcePath": "packages/jobs/jobs/src/invariant.ts",
+      "sourceSha256": "86633d18b1e73ec1667abb39a1a364f1db46cdb6db732ef8f828964db9d42b47"
+    },
+    {
+      "package": "@deepseek-ai/dsh-llm",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 4401,
+      "sha256": "31e6ab4e29731d461b2bd49fd285666ea1a1fb96fa71ecd5c449c6c27e95d889",
+      "sourcePath": "packages/llm/llm/src/invariant.ts",
+      "sourceSha256": "ba2fd65ba8a0d886b5f21810f5f5d008984ac64387b024de0237ff71a7e483bd"
+    }
+  ],
+  "distributions": [
+    {
+      "id": "desktop-0.2.1-rc.2-darwin-arm64",
+      "platform": "darwin",
+      "arch": "arm64",
+      "version": "0.2.1-rc.2",
+      "runtimeVersion": "0.2.1-rc.2",
+      "pnpmVersion": "11.28.5",
+      "asarHeaderSha256": "4ab76d0724d8124801413e8e939a75c254c8625f9007267bd1531eb3b993e8f8",
+      "desktopManifestSha256": "53ee01d3b1accfbd037d245fb4752fb5fa5f8e2a76b7de634a4223558ee54bb9",
+      "buildCommit": "332895e0f7c9d4dbfb29729f5eb367fa263ff986",
+      "buildDirty": false,
+      "releaseUrl": "https://download.deepseek.com/dsh-desk/bin/mac-arm64/deepseek-harness-0.2.1-rc.2-mac-arm64.zip",
+      "releaseSha512": "vgGV720lZGEd2MnjVFOvhLVafwQH3iUDindQwwSjQ7AJaeZuu6UvjR2Msae2dkGS1SeMxxYCBu5Ks13n+K9Ydw==",
+      "vendorTeam": "NAN929V4UM",
+      "vendorIdentifier": "com.deepseek.dsh"
+    },
+    {
+      "id": "desktop-0.2.1-rc.2-win32-x64",
+      "platform": "win32",
+      "arch": "x64",
+      "version": "0.2.1-rc.2",
+      "runtimeVersion": "0.2.1-rc.2",
+      "pnpmVersion": "11.28.5",
+      "asarHeaderSha256": "487721b329cacfe1a15d206ebc72a096f9ff5b94ba0400c8763c73535429daf2",
+      "desktopManifestSha256": "53ee01d3b1accfbd037d245fb4752fb5fa5f8e2a76b7de634a4223558ee54bb9",
+      "buildCommit": "332895e0f7c9d4dbfb29729f5eb367fa263ff986",
+      "buildDirty": false,
+      "releaseUrl": "https://download.deepseek.com/dsh-desk/bin/win-x64/deepseek-harness-0.2.1-rc.2-win-x64.exe",
+      "releaseSha512": "39POl5osl9PKMqrPXQA52dh/bCV0Z02vOV9cTjOJDHE6gsJwp5bv7lfgB3mVWAKspX7a/w1iTi+8Listdhq45g==",
+      "vendorPublisher": "Hangzhou DeepSeek Artificial Intelligence Co., Ltd."
+    }
+  ]
+}