dsh-completion-guard 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -2,14 +2,60 @@
 
 All notable changes to this project are documented here. The project is pre-1.0; release versions track the plugin lifecycle, not stabilised API promises.
 
-## 0.9.0
+Each entry describes that version. Historical host ranges, defaults, plans and candidate validation results are not current setup instructions or proof that a later release passed. Use [installation and first load](docs/GETTING_STARTED.md) for the current setup and [acceptance records](docs/LOCAL_ACCEPTANCE.md) for version-specific evidence.
+
+<details>
+<summary>Version index</summary>
+
+[0.11.0](#0110) · [0.10.0](#0100) · [0.9.0](#090) · [0.8.4](#084) · [0.8.3](#083) · [0.8.2](#082) · [0.8.1](#081) · [0.8.0](#080) · [0.7.1](#071---2026-09-22) · [0.7.0](#070---2026-09-21) · [0.6.3](#063---2026-09-18) · [0.6.2](#062---2026-09-16) · [0.6.1](#061-2026-09-15) · [0.6.0](#060---2026-09-14) · [0.5.3](#053---2026-09-14) · [0.5.2](#052---2026-09-11) · [0.5.1](#051---2026-09-10) · [0.5.0](#050---2026-09-10) · [0.4.3](#043---2026-09-08) · [0.4.2](#042---2026-09-07) · [0.4.1-rc.1](#041-rc1---2026-09-04) · [0.4.0](#040---2026-09-02) · [0.3.2](#032---2026-09-01) · [0.3.1](#031---2026-08-31) · [0.3.0](#030---2026-08-31) · [0.2.1](#021---2026-08-28) · [0.2.0](#020---2026-08-28) · [0.1.2](#012---2026-08-27) · [0.1.1](#011---2026-08-27) · [0.1.0](#010---2026-08-27)
+
+</details>
+
+## 0.11.0
+
+- **Upgrade DSH to `0.2.1-rc.3` or later before installing Guard 0.11.0.** Package declarations, runtime admission and the default audited cohort now use rc.3 as the minimum. Existing session and Guard data protocols remain compatible; rc.2 identities are retained as historical evidence.
+
+- **Host-lock injection preserves JSON-shaped patch sequences.** The managed entry stays inside the sequence, with user entries retained. Existing block YAML, inline flow values, activation and disabled-only overrides remain supported. Invalid syntax, duplicate keys, ambiguous Guard fields and malformed managed markers refuse before profile mutation; the bundled YAML reader does not evaluate `!!js` expressions. Full composition and native loading remain separate checks.
+
+- **Known upstream risk:** for this 0.11.0 release, the maintainer explicitly accepted three Undici 8.11.2 high-risk findings through **2026-11-05 inclusive**. The signed host remains unfixed; see the [risk scope and expiry](docs/DEPENDENCY_SCAN.md). We will update after the upstream fixed chain is verified.
 
-- Explicit readable-subset migration: read-only `inventory` distinguishes the official old-format refusal from errors, and `select` freezes user-chosen IDs. Selected inspect/adopt/verify checks the entire inventory for drift, preserves original logs/old-mode sources and reports selected completion with excluded rows pending. The whole-inventory default stays fail-closed; see the bilingual command and AI-prompt guide.
+- Default host audits check declared files and dependency routes without scanning unrelated directories. Audits backed by a qualification receipt continue to check the complete file inventory.
+
+- **Reviewed Chinese instruction forms such as 请分别执行 no longer create false bans.** Words such as 分别 stay intact in those forms; genuine bans such as 这个别推送 and 完成前别 remain in force.
+
+- **Long host-lock configuration exports now reach pipes in full.** `verify-dump` explicitly reports that it checks only Guard lock fields; complete configuration parsing and host loading remain separate checks.
+
+- **The activation CLI supports official rc.3 persistence exports.** Inventory and explicit mode adoption accept both the default-plugin and namespace-plugin module shapes, and reject invalid modules before persistence access.
+
+- **Release tgz identity is now read through one auditable tar subset.** Guard, npm and every release stage agree on which `package.json` the bytes encode: resolution, the final pre-effect check and post-publish readback all use one strict reader that validates header checksums, models ustar prefixes and npm's path normalization, and refuses links, PAX/GNU extensions, duplicate normalized names and paths outside `package/`. A crafted archive whose two manifests disagree (prefix shadowing plus `./` aliasing) is rejected before any authorization, so a publish can no longer be bound to one package name while npm installs another. Reading is bounded on every axis — compressed bytes actually read, decompressed output, member size, member count and manifest size — so a high-ratio archive can no longer stall the host before authorization completes.
+- **The registry readback owns its deadline and body budget.** Post-publish reconciliation reads the exact-version registry document under a plugin-owned total deadline combined with the caller's cancellation, streams the response under a hard byte budget, and releases the reader on every exit. A slow, hanging or oversized registry ends within the recorded budget with a stable refusal; the attempt stays in flight, no settlement is written from a refused readback, and a publish is never re-sent.
+- **Private storage protection follows the official working directory.** The Bash/Pwsh guard now reads the official `workdir` parameter (absolute, relative or symlink-aliased) instead of a field no host sends, resolves relative file targets against the caller's trusted effective directory — the last committed working-directory epoch — and fails closed when a relative target has no provable base. The same matrix is enforced through the registered production guard, not just the helper.
+- **File readback binds to the directory that governed the call.** After a committed `working-directory/change`, the independent file observer reads a relative edit target against the cwd epoch of the call's own sequence, not the immutable header directory and not the current end-of-log directory. A later directory change can no longer rebind a completed effect to a different same-named file; an unreadable timeline refuses relative targets while absolute targets stay observable.
+- **Sanitization now strips URL credentials and the documented token families.** `user:password@` is removed from URLs by structure, and the bounded GitHub token spellings (`ghp_`/`gho_`/`ghu_`/`ghs_`/`ghr_`/`github_pat_`) are redacted before normalized text, URL subjects or recovery packets are stored. The [privacy note](docs/PRIVACY.md) states the exact pattern set and its limits; capture→replay digests stay deterministic and historical digests are never silently recomputed.
+- **One interrupted anchor write no longer damages other sessions.** A torn final line in the shared session-anchors file is treated as an uncommitted append: every complete line stays authoritative for its session, the next lock holder repairs the tail before appending, and invalid middle lines or conflicting anchors still refuse for every session.
+- **A qualified first creation survives a brief writer-lock race.** When a new startup session's activation write loses a short lock race, the runtime retries the same creation while its intent is still provable — within a bounded budget — and then reports the explicit `activation_writer_unavailable` status. The retry is same-value and idempotent, and never applies to resume, late attach or a deleted binding.
+- **Plain forks are root conversations again.** `parentSession` is fork lineage, not delegation: first-step boundary and guidance, work units and confirmation semantics now apply to ordinary and resumed forks, while the host's explicit subagent markers (`origin=subagent`, positive `delegationDepth`) keep the delegated restrictions. Contradictory markers stay delegated.
+- The rc.3 core graph has registry-verified package identities and implementation digests. Its official macOS arm64 and Windows x64 Desktop distributions have separately registered vendor signatures and signed archive identities. Installation, lifecycle, real-model and UI performance acceptance remain separate gates.
+- **The release tgz identity survives file growth.** The audited tar reader now reads to a confirmed end of file in bounded chunks and binds the identity to the complete bytes actually read, so an artifact that grows after the metadata check can no longer be accepted on its old prefix digest. Private-storage protection refuses a shell or file call whose default directory cannot be proven (no trusted working directory), and URL credential stripping follows URL authority semantics for any scheme, case-insensitively, without treating a legal authority quote as a terminator. Observing an activation binding from any writer permanently retires the new-session first-creation retry, so a later deletion can never recreate the file. Registry reconciliation releases every response body — including error responses and bodies that stall — under the combined deadline. The dependency advisory gate now honors the scanner's exit protocol (a failed scan never reads as clean), matches exceptions against every installed finding version, and records real GitHub advisory identifiers. Anchor writes inject real boundary faults (partial write, failed fsync, failed tail repair) in the regression suite: committed peers stay readable and the next writer repairs an uncommitted tail.
+- **Migration inventories accept `0.10.x` as the previous package version**, so upgrading from 0.10.0 keeps the documented activation-migration path; earlier-version rules are unchanged.
+- **A fail-closed dependency advisory gate is now part of required CI.** The new `dependency-scan` job blocks on any unaccepted high/critical advisory and fails when the scan itself cannot complete; accepted exceptions live in a validated, expiring table documented in [the dependency advisory gate](docs/DEPENDENCY_SCAN.md). The development chain moved to vitest 4.1.12 (dropping the vulnerable tinypool 1.x pool) with compatible vite and source-map-js floors.
+
+## 0.10.0
+
+- **Upgrade DSH before installing Guard 0.10.0.** The minimum host is `0.2.1-rc.2`, with no implied upper limit. Preserve old-session modes and configuration, upgrade the host, install Guard, then rebuild and read back each profile's host lock before re-enabling it. Old locks and completion certificates do not transfer to a changed graph. See [compatibility and upgrade boundaries](docs/COMPATIBILITY.md#0100-dsh-021-rc2) for the reviewed host identities and the separate market, load and admission checks.
+- **Job lifecycle events refine external waits without ever completing work.** A validated `job/registered`/`job/settled` pair owned by the current session can end its pending external wait; a healthy orphan settlement remains audit-only: a `completed` settlement counts as finished only when the producer itself reported fulfilment; killed and failed settlements are explicit failures, and an unreported completion stays unconfirmed. A settlement never certifies resource cleanup, file readback or a user obligation — the model still owes the verification. The recorded owner never transfers to a forked or resumed copy of the history.
+- **Working-directory changes no longer re-interpret captured evidence.** Each committed `working-directory/change` opens a new cwd epoch: targets, paths and receipts keep the meaning of the epoch they were captured in, and the session's original project directory stays immutable in the header. Shell workdir receipts bind the audited cwd provider and an epoch-bound v2 shape. A directory change while a call is in flight leaves its cwd-dependent execution unconfirmed; replay cannot reassign it to the new directory. Historical logs without cwd-change events preserve the 0.9.0 frozen projection under the same host binding, and preserve its evidence fields and digests, including explicit relative workdirs; later events cannot rewrite completed legacy facts.
+- **Experimental `plugin:` records are retained-and-skipped.** They never trigger capture, never authorize anything and never break tool pairing; Guard's own private ledger is not migrated onto them. Guard never imported the removed upstream invariant companions, and synchronous `snapshotEvents()` reads remain valid on the pinned host.
+- **Qualify retained official Desktop distribution files separately.** Exact release/header and independently reproduced source-byte pins cover eight retained invariant companions without adding them to the registry inventory. Vendor signatures, ordinary module bytes and active routes remain mandatory. Physical pnpm `11.7.0` and `11.28.5` profiles must agree with the carrier; both v2 no-op gates remain strict. Native fixtures bind newly allocated temporary roots to physical paths before deriving evidence targets, preserving exact readback assertions. See [Desktop distribution qualification](docs/COMPATIBILITY.md#official-desktop-distribution-bytes).
+- **Subagent, Team inbox and Goal-waiting semantics carry over unchanged.** A `subagent` tool result stays bounded evidence that cannot close a parent obligation; direct inbox delivery records reception, not execution; waiting for a subtask, a plan-review end turn or a paused Goal neither fabricates nor consumes a completion.
+- **Migration inventories now accept `0.9.x` as the previous package version**, so upgrading from 0.9.0 keeps the documented activation-migration path; earlier-version rules are unchanged. Development dependencies pin DSH `0.2.1-rc.2`, and the shipped floor is pinned against the official app-boot consumer's real admission decisions.
+
+## 0.9.0
 
-- **Major default-mode change:** new root sessions default to `always`, with no Guard T0 log writes and protection from the first real input. Existing sessions retain their pre-upgrade effective mode via verified write-once bindings. Prepare old-mode inventory before upgrade and use the packaged inspect/adopt/verify migration flow; mixed cohorts need exact mappings. Unknown, damaged or conflicting bindings refuse certification. Explicit configuration selects new root sessions; persisted off/on stays effective. Policy remains `standard`, with no automatic authority or certificate grant.
-- Per-session adoption preserves the old replay epoch and valid certificates without rewriting history or re-signing. Fresh restore reads the binding on every sync; deletion or replacement invalidates cached certification. Forks inherit the verified parent mode and the official host's exact inherited cut. See [migration and rollback](docs/ACTIVATION_MIGRATION.md) for partial recovery and storage capability limits.
-- Repeated session syncs reuse proofs of fully frozen event subtrees, avoiding another recursive walk of unchanged history after an append. Mutable, accessor-backed, cyclic and unfinished graphs stay ineligible for reuse; Goal, private-ledger and host-sensitive decisions retain their fresh checks. Desktop audits share ASAR indexes and verified bytes only within one audit operation. These reduce component work; they do not establish faster history-window opening or UI end-to-end latency.
-- Adds a read-only local-history measurement script that reports anonymous per-session read, decompression, JSON parsing and pure Guard-fold timings. It inventories historical log generations without migrating or certifying them and excludes runtime migration, private-ledger, host audits, IPC and rendering.
+- **New root sessions now default to `always` when `activation` is omitted.** Explicit `opt-in` remains supported. Protection begins with the first real input; Guard adds no session events before it. Existing sessions, including empty ones, keep their verified pre-upgrade mode. Saved `off`/`on` remains effective. Explicit settings that contradict a bound mode are refused; [omit the override after migration](docs/GETTING_STARTED.md#choose-the-default-for-new-sessions) to use the new default while preserving old modes. The default policy stays `standard`: activation grants no execution or publication authority and does not automatically certify completion.
+- **Upgrade existing installations before reopening sessions.** Stop the relevant writers, preserve the old package and effective mode sources, and freeze the old-session inventory before replacement. After installation, rebuild the host lock, adopt the preserved modes and verify them before startup. Missing, conflicting or damaged bindings remain uncertified. History and valid old certificates are retained without rewriting or re-signing. See [migration and rollback](docs/ACTIVATION_MIGRATION.md).
+- **Expect a history-loading wait.** First opening or restoring a session with history loads it and rebuilds Guard state; “载入历史” may appear, and later visits can still wait. The cache reuses completed history checks only when it can verify that the history is unchanged and the results are safe to reuse; a single Desktop installation check also reuses application files already read and verified. Each operation still checks the current mode and performs the required fresh checks of Goal state, private records and the host environment. The official host's history-view lifecycle and decode cache are unchanged; this is not a promise to eliminate UI waits. A read-only measurement script separates local read, decompression, JSON parsing and pure Guard replay timings from runtime migration, IPC and rendering.
+- **Migrate an explicitly chosen readable subset when the official host refuses old formats.** `inventory` reports the full scope; `select` freezes chosen IDs. Use the same `--selection` throughout inspect/adopt/verify. Exclusions retain their original logs and mode sources and remain pending; `selected_complete` does not mean the whole inventory completed. Other errors still abort. The [guide](docs/ACTIVATION_MIGRATION.md) includes commands, recovery and copyable AI prompts.
 
 ## 0.8.4
 
@@ -186,8 +232,7 @@ exact-artifact native annexes attached to the versioned Release.
 
 ### Validation
 
-This is a source release candidate. Local checks and remaining CI,
-native T06, exact-artifact and publication gates are recorded in
+At preparation, this entry recorded a source release candidate. Its local checks and then-pending CI, native T06, exact-artifact and publication gates are recorded in
 [local acceptance](docs/LOCAL_ACCEPTANCE.md) and the
 [release plan](https://github.com/GreenLv/dsh-completion-guard/blob/784b5452b0da366a351dff6490fa46eeed2839a9/docs/RELEASE_PLAN_0_6_2.md).
 
@@ -205,7 +250,128 @@ Repairs attachment handling, conservative request interpretation, discovery pagi
 
 The new interpretation records and reasons are additive. Attachment capture text retains its 0.6.0 bytes; an old log without interpretation records keeps pending attachments. Source checks, CI, frozen-artifact acceptance and native Web/Headless acceptance are separate results recorded in [LOCAL_ACCEPTANCE](docs/LOCAL_ACCEPTANCE.md). The local test-host cleanup now disposes persistence hosts explicitly to prevent FileHandle garbage-collection errors. No platform or publication result is implied by this changelog.
 
-## 0.6.0 third repair round after targeted review (2026-09-14)
+## 0.6.0 - 2026-09-14
+
+Brings ordinary DSH tasks through entry, execution, delivery and recovery under one rule set, adding selected shared Context Guard behaviors. Cross-language parity and a formal v2 mirror were not yet established in this version. Everything before the new protocol boundary keeps its original meaning; nothing is reinterpreted or relabelled.
+
+The repair rounds below belong to this same version, not additional releases. They retain the original findings, scope decisions and test evidence; read the initial candidate behavior together with these corrections.
+
+### Added
+
+- **Answer delivery is tracked separately from execution certification.** A
+  question or explanation is closed only by the host's own evidence: an
+  `assistant/message` in the turn's final step, with no interrupted marker,
+  followed by `turn/end` with `reason.kind: "completed"`. A status summary, a
+  draft, an intermediate reply, another turn's answer, a subagent's answer, or
+  an aborted turn never closes anything. `answered` means "the answer was
+  handed over" — never that it was right, complete, or executed.
+- **Work units with a required-descendant closure.** Tasks are grouped into
+  derived units. A delegation-marked instruction opens a child unit whose open
+  work is required by the parent's closure, so delegating a sub-task can never
+  drop the parent's own work; an ordinary task switch opens a sibling that does
+  not block the newer task. A subagent's result is bounded evidence: it is
+  recorded and visible, and it never closes a parent obligation.
+- **Ancestor constraints stay in force.** A prohibition or an unsatisfied
+  condition the root declared in an earlier unit continues to govern the same
+  action and target in a later one, and the certifier refuses those bindings
+  before examining evidence.
+- **Proof v2 with a real capability matrix.** Five new proof kinds — input
+  asset check, output visual readback, object/URL readback, execution fact, and
+  external fact — each bind a current subject, a declared source, and a real
+  operation. A successful tool call is only ever an execution fact: a browser
+  call that merely returned cannot prove an image was looked at, an input asset
+  check must be a prior-state fact, and a delegated subagent result is never a
+  proof source. When the installed host exposes no producer, the result is
+  `unavailable`, never a silent pass. The old three-kind manifest and its digest
+  domain are unchanged and remain readable.
+- **Explicit release tickets.** A release contract is adopted only by an
+  explicit root command. Once adopted, each operation spends one reservation,
+  written before the effect and settled afterwards from a trusted readback.
+  Wrong candidate SHA, ref, artifact digest or version, an expired or
+  unevaluable ticket, a consumed ticket, a replay, an operation that is already
+  in flight, an unresolved target, and an opaque runner are all refused before
+  any effect. A "release" keyword, a loaded Skill, or an installation never
+  adopts a contract.
+- **A strict proof tier.** On top of the default `standard` tier, a visual or
+  complete-scope verification the user explicitly asked for must be discharged
+  by a real readback fact. Strict adds no approval step to ordinary actions, and
+  installing never enters the `release` tier.
+- **One diagnosis language.** Every incomplete item now reports one of seven
+  classes — parameter missing, source insufficient, condition unmet, producer
+  capability unavailable, historical gap, integrity failure, policy boundary —
+  next to its exact reason code. `/context-guard migration` reports which rule
+  set is in force, which obligations keep their pre-0.6.0 rules, and what a
+  rollback requires.
+- **A host-neutral v2 conformance fixture** covering S01–S12 through the real
+  derive/delivery/closure/Goal chains. Every expectation is compared against a
+  value computed from the events and the production projection alone; the runner
+  never reads an expectation to decide an actual result.
+
+### Changed
+
+- A document "update" or "modify" is decided by the object, not by the verb:
+  a recognized document noun becomes a bounded `modify` the assistant may
+  resolve to an exact file inside the captured scope and type, while an
+  unrecognized object keeps its honest unresolved reading instead of being
+  forced into an action.
+- A trusted answer from the host's own question tool now narrows where a
+  bounded file choice may land, and is recorded separately from sandbox
+  approvals. Pasted or restated answer text forms nothing.
+- A later root instruction that contains a pending generic obligation verbatim
+  supersedes it atomically, keeping both revisions. Explanations, prohibitions
+  and waits never delete an obligation by similar wording.
+- `/context-guard status` reports the active policy tier, the reason-class
+  histogram, the migration facts, and the release state.
+
+### Fixed
+
+- The first step of a session now sees the input persisted in that same step,
+  and a failed durability flush reports an explicit unavailability instead of
+  serving a stale projection.
+- The v2 conformance runner computes `interpreted`, `closure`, `delivery`,
+  `turn_bound` and the correction decision from production state instead of from
+  the fixture's own expectations.
+- A malformed release record is reported as a bounded diagnostic and never
+  marks the whole session corrupt, so damaged release state cannot block
+  unrelated ordinary work.
+
+### Migration and rollback
+
+- The 0.6.0 semantics start at the new `Context Guard protocol boundary:
+  v5.0.0` notice, written at the first real root-input step of a new session.
+  An older binary ignores that notice, so a rollback fails closed instead of
+  misreading new records.
+- A session that never wrote the boundary keeps the previous whole-session
+  contract, version-1 certificates, and its old digest domains.
+- A session that wrote it keeps pre-boundary obligations under their birth
+  rules while new work uses units, delivery and version-2 certificates.
+- Rolling back to 0.5.x requires restoring a 0.5.x state snapshot. Replaying a
+  0.6.0 log with 0.5.x fails closed with `certificate_replay_mismatch`; never
+  migrate new-schema data down by hand.
+
+### Not yet established
+
+- **Cross-language parity and the canonical mirror are not done.** The
+  upstream `codex-context-guard` repository has not landed a frozen v2 fixture,
+  so the v2 file here is explicitly a DSH-authored *candidate*
+  (`2.0.0-candidate.1`, `status: "dsh-candidate"`). `UPSTREAM_PIN.json` still
+  pins the unchanged v1 mirrors and is not refreshed by this release.
+- The `release` tier protects only surfaces Guard itself routes. Publishing an
+  npm artifact through the Guard-owned action tool is protected; `git tag`, the
+  GitHub Release operations, and any composite runner have no interception
+  point in this host and are refused before effect rather than pretended to be
+  covered. A trusted in-process caller that bypasses Guard entirely is a host
+  trust boundary, documented rather than denied.
+- After a publish, the settlement stays `unconfirmed` unless the registry
+  readback producer answers; an unconfirmed operation is never re-sent.
+- Deterministic tests, CI, native macOS/Windows acceptance, publication and
+  installation are separate evidence scopes. This release records source and
+  deterministic evidence; native acceptance and publication follow separately.
+
+<details>
+<summary>Pre-release review and repair details for 0.6.0</summary>
+
+### 0.6.0 third repair round after targeted review (2026-09-14)
 
 Two findings from the targeted review of `fcc3813`, both fixed.
 
@@ -233,13 +399,15 @@ projection still valid), a certificate that existed at adoption is frozen by
 identity and survives a later obligation,
 and invalid/mistyped adopt input leaves a valid contract usable.
 
-## 0.6.0 second repair round after follow-up review (2026-09-14)
+### 0.6.0 second repair round after follow-up review (2026-09-14)
 
 A follow-up review of the repair commit found five remaining defects in the new
 wiring. All five reproduced and are fixed. The reviewer's counterexamples are
 kept as permanent regression cases in the suites they belong to.
 
-### Fixed
+The changes below also include a new recovery entrypoint supporting those fixes; the list is not a one-to-one count of the five findings.
+
+#### Fixed
 
 - **Adding the v5 boundary no longer answers a pre-v5 question.** Deliveries were
   only gated by the watermark of their own turn; appending the boundary at the
@@ -284,7 +452,7 @@ kept as permanent regression cases in the suites they belong to.
   valid certificate. Signing, persistence and replay use the same call argument,
   and the Goal gate consumes only a certificate whose proof still binds.
 
-### Verification
+#### Verification
 
 - The reviewer's five follow-up counterexamples pass and remain as regression
   cases: pre-v5 delivery, read-only status, the frozen candidate closure, the
@@ -302,7 +470,7 @@ kept as permanent regression cases in the suites they belong to.
 - The proof suite gained the missing-proof, Goal-consumption and
   accurate-evidence-boundary cases.
 
-### Evidence boundary
+#### Evidence boundary
 
 The release chain test pins the audited host cohort through an explicit
 `RuntimeExecutorSeams.hostLock` acceptance seam, because the host-lock
@@ -311,13 +479,13 @@ host-lock evaluation; the release gate, the reservation and settlement records,
 the evidence producers and the replay are the production ones, and the host lock
 keeps its own suites and native acceptance.
 
-## 0.6.0 repairs after concentrated review (2026-09-14)
+### 0.6.0 repairs after concentrated review (2026-09-14)
 
 A concentrated review of the `0dce898` candidate produced fifteen targeted
 counterexamples; all fifteen reproduced a real defect. This section records the
 repair. The stable finding numbers (`F01`–`F08`, `R1`–`R15`) are the reviewer's.
 
-### Fixed
+#### Fixed
 
 - **F01 certificate replay was timing-dependent.** Deliveries were applied after
   the whole log was replayed, so a checkpoint recorded in a later turn was
@@ -373,7 +541,7 @@ repair. The stable finding numbers (`F01`–`F08`, `R1`–`R15`) are the reviewe
   production-chain suite drives producer → persisted log → derive → checkpoint →
   replay.
 
-### Scope rulings (coordinator, 2026-09-14)
+#### Scope rulings (coordinator, 2026-09-14)
 
 Two scope facts were decided once, and both are recorded as fact rather than as
 a general parity claim:
@@ -393,7 +561,7 @@ a general parity claim:
 The plugin therefore does not claim "C01–C12 core alignment" with Codex Context
 Guard, and it does not claim a complete release coverage surface.
 
-### Verification
+#### Verification
 
 The reviewer's fifteen counterexamples are kept as
 `tests/domain/review-counterexamples.test.ts` and now pass; the expectations
@@ -404,124 +572,7 @@ cases, including a real certified closure and every identity refusal), and the
 extended v2 fixture (S09 proof binding, per-timeline release probes, and the
 scope-attribution table).
 
-## 0.6.0 - 2026-09-14
-
-This release makes ordinary DSH work enter, execute, deliver, and resume under
-one set of rules. It also closes the substantive gaps against the shared
-Context Guard semantics. Everything before the new protocol boundary keeps its
-old meaning; nothing is re-read or re-labelled.
-
-### Added
-
-- **Answer delivery is tracked separately from execution certification.** A
-  question or explanation is closed only by the host's own evidence: an
-  `assistant/message` in the turn's final step, with no interrupted marker,
-  followed by `turn/end` with `reason.kind: "completed"`. A status summary, a
-  draft, an intermediate reply, another turn's answer, a subagent's answer, or
-  an aborted turn never closes anything. `answered` means "the answer was
-  handed over" — never that it was right, complete, or executed.
-- **Work units with a required-descendant closure.** Tasks are grouped into
-  derived units. A delegation-marked instruction opens a child unit whose open
-  work is required by the parent's closure, so delegating a sub-task can never
-  drop the parent's own work; an ordinary task switch opens a sibling that does
-  not block the newer task. A subagent's result is bounded evidence: it is
-  recorded and visible, and it never closes a parent obligation.
-- **Ancestor constraints stay in force.** A prohibition or an unsatisfied
-  condition the root declared in an earlier unit continues to govern the same
-  action and target in a later one, and the certifier refuses those bindings
-  before examining evidence.
-- **Proof v2 with a real capability matrix.** Five new proof kinds — input
-  asset check, output visual readback, object/URL readback, execution fact, and
-  external fact — each bind a current subject, a declared source, and a real
-  operation. A successful tool call is only ever an execution fact: a browser
-  call that merely returned cannot prove an image was looked at, an input asset
-  check must be a prior-state fact, and a delegated subagent result is never a
-  proof source. When the installed host exposes no producer, the result is
-  `unavailable`, never a silent pass. The old three-kind manifest and its digest
-  domain are unchanged and remain readable.
-- **Explicit release tickets.** A release contract is adopted only by an
-  explicit root command. Once adopted, each operation spends one reservation,
-  written before the effect and settled afterwards from a trusted readback.
-  Wrong candidate SHA, ref, artifact digest or version, an expired or
-  unevaluable ticket, a consumed ticket, a replay, an operation that is already
-  in flight, an unresolved target, and an opaque runner are all refused before
-  any effect. A "release" keyword, a loaded Skill, or an installation never
-  adopts a contract.
-- **A strict proof tier.** On top of the default `standard` tier, a visual or
-  complete-scope verification the user explicitly asked for must be discharged
-  by a real readback fact. Strict adds no approval step to ordinary actions, and
-  installing never enters the `release` tier.
-- **One diagnosis language.** Every incomplete item now reports one of seven
-  classes — parameter missing, source insufficient, condition unmet, producer
-  capability unavailable, historical gap, integrity failure, policy boundary —
-  next to its exact reason code. `/context-guard migration` reports which rule
-  set is in force, which obligations keep their pre-0.6.0 rules, and what a
-  rollback requires.
-- **A host-neutral v2 conformance fixture** covering S01–S12 through the real
-  derive/delivery/closure/Goal chains. Every expectation is compared against a
-  value computed from the events and the production projection alone; the runner
-  never reads an expectation to decide an actual result.
-
-### Changed
-
-- A document "update" or "modify" is decided by the object, not by the verb:
-  a recognized document noun becomes a bounded `modify` the assistant may
-  resolve to an exact file inside the captured scope and type, while an
-  unrecognized object keeps its honest unresolved reading instead of being
-  forced into an action.
-- A trusted answer from the host's own question tool now narrows where a
-  bounded file choice may land, and is recorded separately from sandbox
-  approvals. Pasted or restated answer text forms nothing.
-- A later root instruction that contains a pending generic obligation verbatim
-  supersedes it atomically, keeping both revisions. Explanations, prohibitions
-  and waits never delete an obligation by similar wording.
-- `/context-guard status` reports the active policy tier, the reason-class
-  histogram, the migration facts, and the release state.
-
-### Fixed
-
-- The first step of a session now sees the input persisted in that same step,
-  and a failed durability flush reports an explicit unavailability instead of
-  serving a stale projection.
-- The v2 conformance runner computes `interpreted`, `closure`, `delivery`,
-  `turn_bound` and the correction decision from production state instead of from
-  the fixture's own expectations.
-- A malformed release record is reported as a bounded diagnostic and never
-  marks the whole session corrupt, so damaged release state cannot block
-  unrelated ordinary work.
-
-### Migration and rollback
-
-- The 0.6.0 semantics start at the new `Context Guard protocol boundary:
-  v5.0.0` notice, written at the first real root-input step of a new session.
-  An older binary ignores that notice, so a rollback fails closed instead of
-  misreading new records.
-- A session that never wrote the boundary keeps the previous whole-session
-  contract, version-1 certificates, and its old digest domains.
-- A session that wrote it keeps pre-boundary obligations under their birth
-  rules while new work uses units, delivery and version-2 certificates.
-- Rolling back to 0.5.x requires restoring a 0.5.x state snapshot. Replaying a
-  0.6.0 log with 0.5.x fails closed with `certificate_replay_mismatch`; never
-  migrate new-schema data down by hand.
-
-### Not yet established
-
-- **Cross-language parity and the canonical mirror are not done.** The
-  upstream `codex-context-guard` repository has not landed a frozen v2 fixture,
-  so the v2 file here is explicitly a DSH-authored *candidate*
-  (`2.0.0-candidate.1`, `status: "dsh-candidate"`). `UPSTREAM_PIN.json` still
-  pins the unchanged v1 mirrors and is not refreshed by this release.
-- The `release` tier protects only surfaces Guard itself routes. Publishing an
-  npm artifact through the Guard-owned action tool is protected; `git tag`, the
-  GitHub Release operations, and any composite runner have no interception
-  point in this host and are refused before effect rather than pretended to be
-  covered. A trusted in-process caller that bypasses Guard entirely is a host
-  trust boundary, documented rather than denied.
-- After a publish, the settlement stays `unconfirmed` unless the registry
-  readback producer answers; an unconfirmed operation is never re-sent.
-- Deterministic tests, CI, native macOS/Windows acceptance, publication and
-  installation are separate evidence scopes. This release records source and
-  deterministic evidence; native acceptance and publication follow separately.
+</details>
 
 ## 0.5.3 - 2026-09-14