dsh-ptc-plus 0.5.0 → 0.5.2

package/docs/client-ui.md

@@ -29,19 +29,19 @@ Client 按数据、传输、注册与视图分文件，沿用既有 `createX(Rea
 
 能力列表通过能力 Remote 的只读 `catalog` 操作观察 code agent 的当前公共工具、Skill inventory 和已捕获的 MCP server 目录，与 `inspect` 返回的冻结方案分开。分组标题旁的总开关保存 `capabilityContextEnabled`，整体暂停而不改写子项；控制仍可编辑，配置库和冻结来源复制保留该维度。重新开启恢复保存组合，仍遵守新会话与明确刷新边界。`src/client-capabilities-view.js` 拥有能力配置、提示设置、使用统计和配置方案四个页签；页签支持方向键与 Home/End，字段仍由原配置 owner 保存。能力页首先显示搜索、类型按钮和能力清单；每行分别展示名称与精确 ID、类型、来源、保存规则的启停结果和上下文提供方式。名称下方不使用 provider 原始介绍。只有公共目录证明 MCP 来源时才标记 MCP，不从工具名称猜测服务器。Skill 来源使用公开 provider/source，冲突显示未确认。
 
-行内启停只修改 availability；上下文入口打开独立小窗编辑。该小窗不使用折叠入口：可用性与说明两个下拉并排、常用基线为带说明的开关、能力说明与来源规则、所选会话方案全部平铺。保留 availability/disclosure 的独立继承、常用集、Skill 调用资格、完整目录描述及已证明来源规则。来源关闭优先于子项，但子项偏好仍保留。缺失、未知和能力配置未开启分别显示，保存规则不冒充会话实际状态。筛选在独立小窗中按需打开，批量设置使用独立的一次性小弹窗；筛选可组合来源、已保存启停、已保存说明、常用项和库存状态，活跃条件显示摘要并可清除。类型切换清除不兼容来源，五列表头三态排序保留同值项的默认相对顺序，列表独立滚动。默认不打开单项或选取首个会话；详情中的冻结方案只供明确目标观察。目录失败保留最后观察内容并标为未确认，已保存的缺失项仍可编辑或移除。基础 REPL 公共能力不列为受管设置项。
+行内启停只修改 availability；上下文入口打开独立小窗编辑。该小窗不使用折叠入口：可用性与说明两个下拉并排、常用基线为带说明的开关、能力说明与来源规则、所选会话方案全部平铺。保留 availability/disclosure 的独立继承、常用集、Skill 调用资格、完整目录描述及已证明来源规则。来源关闭优先于子项，但子项偏好仍保留。缺失、未知和能力配置未开启分别显示，保存规则不冒充会话实际状态。清单支持勾选多个条目（表头复选框选择当前筛选结果），批量设置使用独立的一次性小弹窗且只对所选条目生效；筛选可组合来源、已保存启停、已保存说明、常用项和库存状态，活跃条件显示摘要并可清除。类型切换清除不兼容来源，五列表头三态排序保留同值项的默认相对顺序，列表独立滚动。默认不打开单项或选取首个会话；详情中的冻结方案只供明确目标观察。目录失败保留最后观察内容并标为未确认，已保存的缺失项仍可编辑或移除。基础 REPL 公共能力不列为受管设置项。
 
-提示设置页使用固定功能导航与单项编辑的两栏结构，导航仅包含“初始提示”“提示恢复”“输出节选”，没有编号或新增条目动作。名称旁与摘要复用同一保存状态判定：已选用、未选用、已暂停、沿用 DSH 或未确认。初始提示随能力配置应用，提示恢复与输出节选各有独立开关；总开关关闭时保留选择并显示暂停；状态与导航选中高亮分开，不断言现有会话已同步。短名称作为可访问名，状态作为可访问描述；窄容器使用三条全宽紧凑功能行，名称在左、状态在右。能力说明设置默认提供方式，常用集、使用统计与预算各自选用，分配依据、额度与只读分配预览直接展示。分配只影响 adaptive，显式完整说明不会被预算降级。提示恢复和输出节选分别有独立开关，关闭不清除额度，不依赖能力管理。统计页先选择观察会话并显示真实证据，工作区与全局分别查看使用家族数、可用家族数和覆盖率；未知或不完整显示破折号和证据状态，不能计零。采集开关独立于统计消费，窗口、最低样本数和百分比阈值放在“统计设置”中；保存前校验正整数窗口、最低样本不超过窗口与 0–100% 阈值，无效数字草稿不阻止关闭采集。
+提示设置页使用固定功能导航与单项编辑的两栏结构，导航仅包含“初始提示”“提示恢复”“输出节选”，没有编号或新增条目动作。名称旁与摘要复用同一保存状态判定：已选用、未选用、已暂停、沿用 DSH 或未确认。初始提示随能力配置应用，提示恢复与输出节选各有独立开关；总开关关闭时保留选择并显示暂停；状态与导航选中高亮分开，不断言现有会话已同步。短名称作为可访问名，状态作为可访问描述；窄容器使用三条全宽紧凑功能行，名称在左、状态在右。能力说明设置默认提供方式，常用集、使用统计与预算各自选用，分配依据、额度与只读分配预览直接展示。分配只影响 adaptive，显式完整说明不会被预算降级。提示恢复和输出节选分别有独立开关，关闭不清除额度，不依赖能力管理。统计页先选择观察会话作为观察锚点，统计表与预算预览都按它的能力清单展示，统计范围切换该会话的当前工作区或全部工作区；已有记录但家族尚未结算显示“已有记录待结算”，尚无记录显示“暂无样本”，两者显示破折号而不是零；只有可计量的窗口才显示数字（真实的 0/N 与 0% 保持数字），窗口证据不完整或容量超限同样显示破折号和状态。采集开关独立于统计消费，窗口、最低样本数和百分比阈值放在“统计设置”中；保存前校验正整数窗口、最低样本不超过窗口与 0–100% 阈值，无效数字草稿不阻止关闭采集。
 
 配置页采用左配置库、右详情；唯一“保存当前设置”与导入、配置库更多操作位于列表下方。命名保存、重命名与会话复制仅在对应动作后展开；列表可在只读状态浏览，写入遵循公共 settings 资格。详情显示可复用设置摘要与应用按钮，配置库更多导出全部、详情更多导出所选，导入仅加入库。应用用一次原子 mutation 更新保存设置，读回冲突不能显示成功；从会话复制只读取已证明的 frozen.configuration，不复制统计、变量或执行状态。已有会话观察和明确刷新位于独立折叠入口。异步导入遇到只读、关闭插件或卸载永久失效，即使资格恢复也不提交迟到内容。详见 [ADR 0040](adr/0040-separate-capability-configurations-from-session-observations.md)。
 
 页内保存状态来自真实 pending/status 和 settings 资格，说明保存设置供新会话采用；已有会话保留冻结环境，需要明确刷新。任一能力与上下文功能选用时可观察冻结来源，全部关闭时取消方案读取；目录观察与手动配置独立。插件关闭、设置关闭与 transport 释放取消请求，迟到响应不能恢复旧状态。所有开关使用 DSH 尺寸与主题 token，按钮文字居中，边框轻量；六列清单在窄容器中分行，配置页堆叠。
 
-能力与上下文提供独立的“刷新会话能力”操作，必须明确选择活跃 PTC 会话；“重新读取目录/方案”只观察状态。星光菜单的同名操作与“编写新绑定”“修改绑定”共用输入框保护，只将 `/capabilities refresh` 填入空输入框并关闭菜单，由用户发送；已有草稿保留。设置按钮通过宿主 `commands.execute` 提交命令，不发起模型任务。关闭能力管理后仍可主动同步关闭配置；冻结方案观察跟随各独立功能的选用状态。关闭 Global User Bindings 只隐藏绑定操作，保留星光设置与刷新。未确认目标、命令不可用、只读设置或插件关闭时不能刷新；取消、断线、preset 改变、切换会话或卸载使迟到回执失效。Host 回执区分已接受、通知待首次接受与失败，取消只停止等待，需重读状态确认实际效果。
+能力与上下文提供独立的“刷新会话能力”操作，必须明确选择活跃 PTC 会话；“重新读取目录/方案”只观察状态。星光菜单的同名操作与“编写新绑定”“修改绑定”共用输入框保护，只将 `/capabilities refresh` 填入空输入框并关闭菜单，由用户发送；已有草稿保留。设置按钮通过宿主 `commands.execute` 提交命令，不发起模型任务。关闭能力管理后仍可主动同步关闭配置，此时回执报出能力关闭并说明会话沿用宿主能力，不声称会话能力已更新；回执区分“能力与上下文”总开关与能力管理开关两种关闭原因。冻结方案观察跟随各独立功能的选用状态。关闭 Global User Bindings 只隐藏绑定操作，保留星光设置与刷新。未确认目标、命令不可用、只读设置或插件关闭时不能刷新；取消、断线、preset 改变、切换会话或卸载使迟到回执失效。Host 回执区分已接受、通知待首次接受、能力关闭与失败，取消只停止等待，需重读状态确认实际效果。
 
-会话能力工作台使用一份待应用更改，不先切换生效范围。底部提供“放弃更改”“应用到会话”和“应用到全局”：分别清空草稿、写入会话临时选择、保存全局默认并更新当前会话。撤销临时覆盖只允许“应用到会话”，不能把 `inherit` 写入全局设置。全局提交只有重新读取到对应保存选择且该项临时覆盖已清除才从草稿移除；部分失败和无法确认的更改仍可重试。详情区使用独立的 13px/20px 正文与紧凑的状态信息，来源、全局设置、冻结继承、临时覆盖和实际生效分别显示；冻结来源未知时不从全局值猜测。整行都可选中：任意单元格（含空白处）与名称按钮一样打开该条目详情，可用性与上下文单元格保留各自的维度焦点。共享 Select 使用居中的 SVG 箭头，Radix 继续拥有键盘、焦点与独立 Portal。
+会话能力工作台使用一份待应用更改，不先切换生效范围。底部提供“放弃更改”“应用到会话”和“应用到全局”：分别清空草稿、写入会话临时选择、保存全局默认并更新当前会话；页脚以“应用到会话”为主操作，“应用到全局”作为显式保存全局默认的次要操作，不存在默认发生的全局修改；“批量设置”入口位于同一页脚操作组的右端并显示已选数量，未选择条目时禁用。维度选择按结果命名：“不改动（当前：值）”不产生本会话临时修改，已有临时修改时同一位置显示“撤销本会话修改（恢复为：值）”，该撤销只允许“应用到会话”，不能把 `inherit` 写入全局设置；“由上一级规则决定”只在会话来源对该维度确有显式规则或该值已是当前选择时提供；可用性与说明方式的值选项直接写作“启用”“关闭”等动作。每个维度选择下方用“本会话生效：值 · 来源”预览当前草稿的结果，暂存后标注“待应用”。勾选多个条目后“批量设置”在一次性小窗中为所选条目暂存同一维度选择，或清除其本会话修改；暂存不发送命令，仍由底部按钮决定应用到会话或全局，“放弃更改”清空。已确认的批量提交拥有独立生命周期：逐条命令进行期间关闭按钮禁用且关闭路径拒绝执行，可用性或设置的瞬时重算不会取消在途命令；成功、失败或中止后都在同一收尾路径清理“正在应用”状态并核对已确认草稿。全局提交只有重新读取到对应保存选择且该项临时覆盖已清除才从草稿移除；部分失败和无法确认的更改仍可重试。行内“是否启用”和“上下文”单元格显示实际生效值；该维度的生效值来自会话临时选择时附加“（临时）”，与冻结继承的相同取值区分。设置中的“能力与上下文”总开关或能力管理开关关闭时，即使会话仍冻结着已启用方案，工作台也整体只读，并以警示横幅显示对应关闭原因与恢复路径，重新开启并刷新后才能修改会话选择；冻结事实仍可查看。详情区使用独立的 13px/20px 正文与紧凑的状态信息，来源、全局设置、冻结继承、临时覆盖和实际生效分别显示；冻结来源未知时不从全局值猜测。整行都可选中：任意单元格（含空白处）与名称按钮一样打开该条目详情，可用性与上下文单元格保留各自的维度焦点；行首复选框只切换批量目标，不打开详情。共享 Select 使用居中的 SVG 箭头，Radix 继续拥有键盘、焦点与独立 Portal。
 
-`/capabilities refresh` 与结构化状态回执使用独立的 13px/20px 单行提示，只显示当前界面的结果文案，不显示命令标题、重复状态或原始结果入口。运行、待生效和失败保留各自的真实文案，长错误可以换行；历史刷新回执的已记录通知文本同样转换为简短提示。能力查询保留命令卡片。`ptc-capability-catalog/v1` 结果默认显示条目数，展开后以有高度上限的可滚动表格显示列表；其他 JSON 显示详情入口，不直接铺在正文里。查询的原始结果单独折叠，在展开时显示完整原文，既不改写历史结果也不把成功回执当作完整值或模型投递的新证明。
+`/capabilities refresh` 与结构化状态回执使用独立的 13px/20px 单行提示，只显示当前界面的结果文案，不显示命令标题、重复状态或原始结果入口。运行、待生效、能力关闭和失败保留各自的真实文案，长错误可以换行；历史刷新回执的已记录通知文本同样转换为简短提示。能力查询保留命令卡片。`ptc-capability-catalog/v1` 结果默认显示条目数，展开后以有高度上限的可滚动表格显示列表；其他 JSON 显示详情入口，不直接铺在正文里。查询的原始结果单独折叠，在展开时显示完整原文，既不改写历史结果也不把成功回执当作完整值或模型投递的新证明。
 
 ## 可用设置
 
@@ -51,6 +51,7 @@ Client 按数据、传输、注册与视图分文件，沿用既有 `createX(Rea
 | 核心工作区 | REPL 语法 | `bindingUpdates` | 默认 `stateful`；同作用域的声明与赋值更新变量、函数、类和导入。选择 `protected` 后保护新建 const/import，并检测跨 cell 重声明。两种策略均支持静态 import/export。 |
 | 核心工作区 | 状态与恢复 | `durableReplay` / `tipsEnabled` | 默认开启；控制 worker 重启后的状态恢复与失败恢复提示。 |
 | 核心工作区 | 状态与恢复 | `tipCooldownMessages` / `tipEscalationFailures` | 同类提示间隔与详细提示阈值。 |
+| 核心工作区 | 状态与恢复 | `unmeasuredCellLimit` | 连续第几个未测量 cell 触发丢弃（默认 2：第一个保留，第二个丢弃）；已证明 frontier 留给下一 cell 重放。 |
 | 扩展与容错 | 工具扩展 | `userBindingsEnabled` | 默认开启，显式关闭仍有效；开启时加载跨会话 TypeScript helper，并在开关下方显示管理按钮，同时启用全局绑定工作台与 `/binding` Agent 编写入口。 |
 | 扩展与容错 | 工具扩展 | `cordisToolsEnabled` | 默认关闭；开启后为 PTC agent 加入官方 Cordis 工具、指引与精确的 `cordis-plugin-development` companion Skill，不发布同目录 sibling。 |
 | 扩展与容错 | 调用容错 | `autoDescribeRunCode` / `canonicalizeToolCalls` | 默认开启；允许缺少外层摘要的 `run_code` 执行，并修复 schema 可唯一确认的顶层 native 工具误调用。 |
@@ -61,6 +62,8 @@ Client 按数据、传输、注册与视图分文件，沿用既有 `createX(Rea
 | 界面与资源 | 资源限制 | `computeMs` / `maxWallMs` | 单 cell event-loop active（包括同步阻塞）与总耗时预算；前者不证明 CPU 消耗。 |
 | 界面与资源 | 资源限制 | `maxOldGenerationSizeMb` / `maxNestedRunCodeDepth` | kernel worker 内存与嵌套执行深度。 |
 | 界面与资源 | 资源限制 | `maxOutputBytes` | 单 cell 日志与返回结果的合计字节上限。 |
+| 界面与资源 | 资源限制 | `sampleBoundMs` / `workerReclaimMs` | 计算基线采样等待（未观察到的采样按未测量结算；transport 报告退出/断连/无法发送时仍走 worker-exit）；worker 关闭阶段上限（默认 5000ms、最小 1000ms；exit 确认与其后的输出关闭各自以此为上界）：cell 触发的 session kernel exit 超时保留 helper 并阻止该会话后续 cell；startup、idle 或输出关闭路径的失败，以及 binding console 与 candidate 只保留实例并在释放时报告。 |
+| 界面与资源 | 资源限制 | `startupProbeMs` / `executionSeamTimeoutMs` | worker 启动探针上限；等待宿主执行入口的上限（只在插件激活或重载时读取）。 |
 | 界面与资源 | 资源限制 | `maxValueNodes` / `maxValueEdges` / `maxValueArrayLength` / `maxValueBigIntDigits` | Value Graph 与大数组、BigInt 的返回上限；数组长度限制同时约束单数组和一份 graph 的累计槽位。 |
 | 实验性 | 能力与上下文 | `capabilityManagementEnabled` | 默认关闭；开启实验性能力管理，冻结新会话的能力方案。 |
 | 实验性 | 能力与上下文 | `capabilityBaseline` / `capabilityPolicy` | 可搜索的能力列表、常用勾选、独立可用性与说明规则；默认/类别/来源/单项覆盖，分配依据及预算分别选择。 |
@@ -71,11 +74,11 @@ Client 按数据、传输、注册与视图分文件，沿用既有 `createX(Rea
 
 旧配置的五个开关（`looseTopLevelRedeclarations`、`looseTopLevelFunctionClassRedeclarations`、`autoRewriteImports`、`autoStripExports`、`autoSplitRedeclarations`）先由共享 resolver 迁移。完整策略映射到 `stateful` 或 `protected`；混合选择保留显式兼容态，只有该状态才显示旧控件。兼容态的统一策略控件显示“沿用旧版设置（尚未迁移）”，可直接选择“允许重声明和覆盖”或“启用名称保护”；选择后一次写入同时保存 `bindingUpdates` 并清除兼容标记，随后执行和模型指引采用相同的新语言策略，设置页恢复统一开关。仅查看设置不触发写入。
 
-能力配置通过可搜索列表、常用勾选与独立可用性／说明方式选择编辑；默认、类别、MCP 来源、单项分别按维度覆盖。“沿用上层规则”撤销当前维度的显式选择，“按依据分配”独立选用常用集、统计和预算。使用统计、提示恢复与输出节选分别设置，Client 负责序列化。统计数字输入保留未完成或无效草稿，失焦时仅保存有效组合；无效草稿显示错误，统计开关仍可独立保存并恢复最近有效的数字组合。方案展示通过公共能力 RPC 读取当前会话的选择原因、覆盖率、预算超额和待刷新状态，保存配置本身不等于旧会话已更新。
+能力配置通过可搜索列表、常用勾选与独立可用性／说明方式选择编辑；默认、类别、MCP 来源、单项分别按维度覆盖。“不单独设置”撤销当前维度的显式选择，“按依据分配”独立选用常用集、统计和预算。使用统计、提示恢复与输出节选分别设置，Client 负责序列化。统计数字输入保留未完成或无效草稿，失焦时仅保存有效组合；无效草稿显示错误，统计开关仍可独立保存并恢复最近有效的数字组合。方案展示通过公共能力 RPC 读取当前会话的选择原因、覆盖率、预算超额和待刷新状态，保存配置本身不等于旧会话已更新。
 
 ## enabled 开关与正文功能标记
 
-保存设置后，Host 在 settings watch 中安装、卸载或重配置对应 owner。能力与上下文的独立职责输入用于新会话；已有会话保持冻结方案，执行 `/capabilities refresh` 后才同步说明、发现与执行成员。其他可重配置字段即时生效。已提交的 cell 固定使用提交时的配置快照，运行中的更新从随后提交的 cell 开始使用；这不会替换 session-bound REPL 或已有 binding。`maxOldGenerationSizeMb` 在活动 worker 存在时因 Node 的创建期限制而拒绝并回滚，其他可重配置字段照常交给 owner。关闭后唯一的宿主副作用是注册 settings 命名空间，
+保存设置后，Host 在 settings watch 中安装、卸载或重配置对应 owner。能力与上下文的独立职责输入用于新会话；已有会话保持冻结方案，执行 `/capabilities refresh` 后才同步说明、发现与执行成员。其他可重配置字段即时生效；`executionSeamTimeoutMs` 由激活期等待拥有，只在插件激活或重载时读取。已提交的 cell 的预算与策略固定使用提交时的配置快照，运行中的更新从随后提交的 cell 开始使用；worker 生命周期上界（`maxOldGenerationSizeMb`、`workerReclaimMs`、`startupProbeMs`）在 worker 创建或关闭时从当前配置读取；这不会替换 session-bound REPL 或已有 binding。`maxOldGenerationSizeMb` 在活动 worker 存在时因 Node 的创建期限制而拒绝并回滚，其他可重配置字段照常交给 owner。关闭后唯一的宿主副作用是注册 settings 命名空间，
 保证设置卡片仍然可读；此时只有 `enabled` 可写，其他控件被禁用。运行时重配置失败时回滚到上一次已应用值。
 
 `cordisToolsEnabled` 默认关闭并即时生效。它不切换 preset，而是把官方 Cordis 工具、owner guidance 与 `cordis-plugin-development` Skill 作为一个 agent-scoped mount 加入或移出同时暴露 `run_code`、`skill` 工具与 preset/Skill service 的 PTC agent；顶层仍只有 `run_code`，编辑器通过程序内的 `tools.edit_run_code` 调用，普通 agent 不继承。暴露面齐全但挂载失败时，启用会完整回滚；agent scope 缺少 companion surface 时只是延后，不报错也不发布。完整运行要求见 [运行时参考](runtime-reference.md)。
@@ -92,7 +95,7 @@ Client 按数据、传输、注册与视图分文件，沿用既有 `createX(Rea
 
 代码控制台直接执行当前条目的未保存源码草稿。用户可输入 `readText("./example.txt")`、声明变量或使用顶层 `await`，通过运行按钮或 Ctrl/Cmd+Enter 执行；下一条命令可继续使用临时变量。控制台通过 `console-run` 取得 Host 生成的 opaque environment handle，并以 `console-release` 释放；单次候选导出调用通过兼容的 `run` RPC 提供。控制台 worker 使用共同 root 编译与逻辑状态机制，源码草稿使用共同模块编译入口，Node REPL 承担底层求值；它不连接 Agent kernel，也不写入其 journal。模块导出可直接按名称调用，相对 import 从 binding 存储目录解析。运行、停止、重置环境、清空记录分别是独立动作；折叠不重置环境。普通语法或运行错误保留状态和此前修改，停止、超时、输出超限与 worker 故障会释放环境。执行代码具有 DSH 进程的 Node/OS 权限，这种状态隔离不构成 sandbox。
 
-首次执行才创建 worker。源码草稿改动后的下一次执行、切换条目、保存修改后的源码、离开工作台或手动重置都会清空旧环境。连续 10 分钟没有执行代码时自动释放，输入输出记录保留；下一次从当前草稿开始，绝不自动重放旧命令。Host 最多保留 4 个临时环境，每个环境一次仅执行一个命令，并沿用 `maxWallMs`、`maxOutputBytes` 和 `maxOldGenerationSizeMb`。源码与单次命令各限制 1 MiB；Client 最多保留 40 条、合计 131072 个 UTF-16 code unit 的展示记录，单条最多 65536 个，截断有明确标记。关闭全局绑定功能或插件时释放全部临时环境。
+首次执行才创建 worker。源码草稿改动后的下一次执行、切换条目、保存修改后的源码、离开工作台或手动重置都会清空旧环境。连续 10 分钟没有执行代码时自动释放，输入输出记录保留；下一次从当前草稿开始，绝不自动重放旧命令。Host 最多保留 4 个临时环境，每个环境一次仅执行一个命令，并沿用 `maxWallMs`、`maxOutputBytes`、`maxOldGenerationSizeMb` 和 `workerReclaimMs`。源码与单次命令各限制 1 MiB；Client 最多保留 40 条、合计 131072 个 UTF-16 code unit 的展示记录，单条最多 65536 个，截断有明确标记。关闭全局绑定功能或插件时释放全部临时环境。
 
 每次执行的命令与输出分开展示。输出沿用会话工具结果的灰色背景、边框和 12px 圆角，带独立标签；长结果在至多 240px 高的内容区内滚动，窄屏自动换行，错误使用错误色。设置弹窗与 REPL 页复用同一输出组件。
 
@@ -168,7 +171,7 @@ live 配置若因宿主能力缺失或 runtime 安装/重配置失败，会先
 
 会话的能力与上下文暂停或能力管理未启用时，工作台明确标注该状态并关闭暂存与提交；清单每行显示沿用宿主的事实，不再显示无法收敛的待生效。只有已启用管理、但尚未刷新折入方案的宿主动态成员才显示待生效。
 
-“批量设置”打开独立小弹窗，对打开时当前筛选中的真实可用能力执行一次单项变更。可用性和说明方式独立选择，初始均为不更改；确认前只保留临时草稿，取消不写入。确认使用最新配置，仅改目标单项的所选维度，保留非目标项、其他维度及继承规则；目标失效或保存失败时显示错误，不能显示成功。默认、类别和 MCP 来源的持久继承规则通过“继承规则”入口编辑，与批量操作分开。保存选择仍只在新会话或明确刷新后生效。
+“批量设置”只对清单中已勾选的行生效，未选择任何行时按钮不可用；表头复选框把当前筛选结果加入选择，选择不随筛选或排序变化而丢失。弹窗对所选真实可用目标执行一次单项变更，选中但当前不可用的目标单独计数并排除。可用性和说明方式独立选择，初始均为不更改；确认前只保留临时草稿，取消不写入。确认使用最新配置，仅改目标单项的所选维度，保留非目标项、其他维度及继承规则；目标失效或保存失败时显示错误，不能显示成功。默认、类别和 MCP 来源的持久继承规则通过“继承规则”入口编辑，与批量操作分开。保存选择仍只在新会话或明确刷新后生效。
 
 提示设置的三个侧栏项在选用状态旁显示具体配置摘要，分别来自默认说明方式及其分配依据、恢复额度和输出额度；总开关暂停和未知配置保持明确标识。分配依据、额度与当前能力分配直接展示，统计设置同样直接展示。观察会话旁以灰色说明其只读统计与预算预览用途，窄屏可自然换行。
 
@@ -201,4 +204,4 @@ npm run build
 如果 DSH settings service 不可用，Host half 不会因缺少设置服务而加载失败：设置卡片不可用时直接回退为 composition `config`，
 `enabled` 默认开启，运行时按 composition config 工作。
 
-MCP 列表按 server 分组，来源可用性与说明方式使用和单项一致的独立选择器，均可撤销为沿用上层规则。来源显式关闭是外层移除，优先于子项启用；默认关闭仍可由子项启用覆盖，二者不混同。会话详情显示保存选择、临时规则、冻结来源结果及生效的维度来源，空规则显示继承或无覆盖。目录分别保留当前保存设置与冻结会话各自代际的事实；新保存规则不能把历史 scalar 来源改写成空结构规则。已证明的冻结 `managementEnabled` 决定是否预测来源关闭；管理未选用时保留关闭偏好、显示实际 Host 可用，不报待关闭。待应用的来源关闭会在子项详情预告；正式提交和重新读取确认之后才改变生效状态。
+MCP 列表按 server 分组，来源可用性与说明方式使用和单项一致的独立选择器，均可撤销为不单独设置。来源显式关闭是外层移除，优先于子项启用；默认关闭仍可由子项启用覆盖，二者不混同。会话详情显示保存选择、临时规则、冻结来源结果及生效的维度来源，空规则显示不单独设置或无覆盖。目录分别保留当前保存设置与冻结会话各自代际的事实；新保存规则不能把历史 scalar 来源改写成空结构规则。已证明的冻结 `managementEnabled` 决定是否预测来源关闭；管理未选用时保留关闭偏好、显示实际 Host 可用，不报待关闭。待应用的来源关闭会在子项详情预告；正式提交和重新读取确认之后才改变生效状态。

package/docs/client-visual-contract.md

@@ -43,7 +43,7 @@ The draft oracle measures the CSS-owned preview budget and compact header contro
 
 The sparkle-menu typography oracle also requires the public Menu class slot to retain a bordered, rounded card with padding and shadow when Host CSS loads after plugin installation; injected border, radius and shadow removal must fail on the native surface. It requires a plugin-owned 13px/18px content base, 13px disclosure captions and binding names, 12px purposes and 11px states, all with 18px line-height and the inherited font family. It measures text ranges within their row for vertical clipping and checks the caret center against the caption line center, rather than its potentially stretched flex box; injected caption stretching must fail. Horizontal name/purpose ellipsis remains valid. Native/fallback fixtures reproduce a single disabled binding under larger carrier typography, preserve the full purpose title, reject injected inherited font-size and line-height, and accept a smaller carrier. The mixed-catalog root and revision paths and packed official-Host acceptance share the same oracle.
 
-The sparkle-menu oracle requires at least 24 px of catalog reading space, viewport containment, nonoverlapping catalog and footer, no outer scrolling, and fully reachable footer actions of at least 24 px height, including the capability-refresh command shortcut. The root starts with the enabled group without a scope caption, disabled-group disclosure uses a neutral rounded surface, binding states use green enabled and gray disabled pills in both root and revision lists; the oracle rejects missing state attributes or indistinguishable text/background colors, and authoring plus utility actions use two-column buttons with centered captions, balanced icon gutters and a soft fill without borders. The oracle measures caption centering against each button and rejects visible button borders. Command shortcuts fill the empty composer and close the menu; they never execute a command or overwrite unsent text. All settings and workbench switches use the official 36×20 capsule and 16px thumb with public theme tokens. Both checkbox pseudo-element and button/span switch thumbs are measured. The off-state oracle requires exact official geometry and token colors with a distinguishable thumb; checked states retain the contrast assertion and same-color thumb counterexample. MCP server source availability and disclosure use independent selectors with the shared Select appearance contract; browser fixtures change source availability from closed to parent rules while retaining child disclosure preferences. Capability workbench fixtures use the shared refresh component and verify explicit target selection, management-off synchronization and read-only reload separation. Scrolling the expanded mixed catalog and the revision list in both directions must leave footer geometry unchanged. Injecting a shared outer scroll container must fail the oracle; restoring the layout must pass. Actual catalog writes must retain a focused control whose center is inside the catalog clip and passes hit testing: collapsed disable, expanded enable, revision Back, and pending close/reopen are covered. Removing the reveal by resetting only the catalog scrollTop must fail this focus oracle; restoring it must pass. Page scroll and footer geometry remain unchanged. Packed official-Host acceptance repeats the mixed-catalog checks through the isolated profile and exercises actual management and settings actions.
+The sparkle-menu oracle requires at least 24 px of catalog reading space, viewport containment, nonoverlapping catalog and footer, no outer scrolling, and fully reachable footer actions of at least 24 px height, including the capability-refresh command shortcut. The root starts with the enabled group without a scope caption, disabled-group disclosure uses a neutral rounded surface, binding states use green enabled and gray disabled pills in both root and revision lists; the oracle rejects missing state attributes or indistinguishable text/background colors, and authoring plus utility actions use two-column buttons with centered captions, balanced icon gutters and a soft fill without borders. The oracle measures caption centering against each button and rejects visible button borders. Command shortcuts fill the empty composer and close the menu; they never execute a command or overwrite unsent text. All settings and workbench switches use the official 36×20 capsule and 16px thumb with public theme tokens. Both checkbox pseudo-element and button/span switch thumbs are measured. The off-state oracle requires exact official geometry and token colors with a distinguishable thumb; checked states retain the contrast assertion and same-color thumb counterexample. MCP server source availability and disclosure use independent selectors with the shared Select appearance contract; browser fixtures change source availability from closed to parent rules while retaining child disclosure preferences. Capability workbench fixtures use the shared refresh component and verify explicit target selection, management-off synchronization and read-only reload separation. Per-row pick checkboxes with the first-column select-all drive the batch window in both the settings list and the session workbench; the session batch lists exactly the picked rows, stages without running commands, and keeps every action reachable at the smallest captured viewport. Scrolling the expanded mixed catalog and the revision list in both directions must leave footer geometry unchanged. Injecting a shared outer scroll container must fail the oracle; restoring the layout must pass. Actual catalog writes must retain a focused control whose center is inside the catalog clip and passes hit testing: collapsed disable, expanded enable, revision Back, and pending close/reopen are covered. Removing the reveal by resetting only the catalog scrollTop must fail this focus oracle; restoring it must pass. Page scroll and footer geometry remain unchanged. Packed official-Host acceptance repeats the mixed-catalog checks through the isolated profile and exercises actual management and settings actions.
 
 ## Limits
 

package/docs/durability-design.md

@@ -106,7 +106,11 @@ SessionRuntime 创建 kernel 时完全忽略历史 nodes、head、checkpoints
 求值的 cell 无论静态分类如何都记录为 `volatile`。这是已知配置态，不是运行时降级，因此不
 发送模型可见警告；system prompt 直接告知模型 binding 仅在当前进程可复用，`repl.state(list)`
 返回同一状态。未进入 evaluator 的调用仍是 `noop`，取消、超时和 worker failure 仍是
-`discarded`。关闭期间不能保存 durable named state；restore 后的下一 cell 仍被强制为 volatile。
+`discarded`；例外是无法测量而在 run 帧发出前结束的 cell（未观察到采样答复、墙钟或 compute 上限先到），
+它以 `noop` 结算：默认 2 时第一次保留 live worker 与既有 binding，连续达到 `unmeasuredCellLimit` 次才丢弃 live worker 并保留可重放的
+已证明 frontier；transport 报告 helper 退出、断连或无法接收请求时仍按 worker-exit 丢弃并重置 worker，见
+[ADR 0027](adr/0027-run-the-session-kernel-in-a-killable-helper-process.md)。关闭期间不能保存
+durable named state；restore 后的下一 cell 仍被强制为 volatile。
 
 journal、diagnostic、source、cause、call、operation、completion 和 completion error 都使用封闭字段集合；未知、symbol 或非枚举自有字段会使 journal 无效。capability-call `args`/`value` 与 return completion `value` 都是封闭、规范化的 `ptc-value-graph/v1` envelope。诊断结构、source frame 依赖和稳定代码见[架构说明](architecture.md#journal-与恢复)。
 
@@ -221,6 +225,8 @@ surface replacement 是否删除状态取决于模型失去了什么，而不取
 
 基础设施失败会终止当前 worker，并把 log-only recovery boundary 放入当前已结算 `tool/result` 的私有 metadata。kernel 从失败 node 的 parent 重新重放；若该 frontier 仍失败则继续向 parent 收缩，直到最大可验证 frontier 或空 REPL。触发恢复的当前 `run_code` 在候选 frontier 验证成功前不执行，验证后在同一次请求中继续。boundary 的失败身份可为顶层 call，或已经由共享 timeline 证明两组 dispatch pairs 和根最终关联的真实派生 start 序号；原始 nested start 不足以证明该身份。收缩保留失败 node 的已证明 parent，之后独立的有效 carrier 仍可进入新 ancestry。boundary 无效或历史本身无法完整折叠时，相关记录和可能依赖它的状态不得进入 frontier；这类历史 PTC metadata 损坏本身不返回永久 recovery error，而是继续收缩，最差用空 worker 执行当前 cell，并在其最终 result 持久表达新 ancestry。已经写入旧版自定义 boundary event 的日志必须先通过显式、非破坏迁移转换为 DSH 可加载的 metadata；迁移失败时不得覆盖原始日志。
 
+记录的 diagnostics 与 completion 是同一 settlement 的两份表述：`completion.error.message` 由第一条 diagnostic 渲染得到，因此两者一致只证明这份记录内部自洽，不能证明文字未被改写（编辑 diagnostic 后重新渲染 completion 仍一致）。发布 `tool/result` 私有 metadata 时，runtime 同时写入这些 diagnostic 所述事实的摘要 `dshPtcPlusDiagnosticWording.digest`，覆盖 `message` 以及 code、severity、phase、stateEffect、dispatchState、cause、collisions；`help` 与 `source` 属于呈现（历史记录的 help 措辞和 caret 位置可来自更早 generation），不进入摘要。恢复折叠在把该记录当作证据前重算并比较摘要：摘要缺失表示记录发布于该字段引入之前，仍按旧证据规则处理；摘要存在而不再匹配时，该 cell 不能证明自己的 binding，与其它损坏 metadata 一样建立收缩点。该摘要证明记录未被部分改写，不是不可伪造的边界。
+
 ## State Operations
 
 ```ts

package/docs/installation.md

@@ -2,6 +2,8 @@
 
 PTC Plus requires Node.js `^22.19.0 || >=24.0.0` and targets the latest available DSH release with TypeScript PTC mode. Historical interface branches are retained through capability detection, without promising a fully verified earlier Host installation; when both generations expose competing presentation evidence, the current DSH contract wins. Compatibility follows those live extension surfaces rather than a version allowlist.
 
+The package declares `engines.dsh: "*"` for DSH's plugin compatibility preflight. This keeps release-number gating open while public capability checks and packed Host contracts establish compatibility; it does not claim that every historical or future Host has been tested. Host-owned service packages remain required peers.
+
 The worker uses the Host's Node executable. Startup verifies native REPL framing, imports, syntax failures, synchronous throws, awaited rejections, and original return values. The adapter combines public eval callbacks with domain error events before REPL formatting; a source-end witness distinguishes empty completion from falsy rejection. A failed or timed-out probe reports a runtime prerequisite failure before user code executes. The engine range follows DSH; CI exercises Node 22.19, 24, and 26, without claiming that untested future releases have already passed.
 
 Install the plugin into the profile that actually runs the target DSH surface. Do not assume a profile named `default` is active.
@@ -52,7 +54,7 @@ Capabilities select behavior, never a release number. Historical fixture success
 Use this form after the selected version is available from the npm registry:
 
 ```sh
-dsh plugin --profile <profile> add dsh-ptc-plus@0.5.0
+dsh plugin --profile <profile> add dsh-ptc-plus@0.5.1
 dsh --profile <profile> --dump-config
 ```
 
@@ -89,7 +91,7 @@ pnpm dsh --profile <profile> --dump-config
 
 ```sh
 npm pack
-dsh plugin --profile <profile> add /absolute/path/to/dsh-ptc-plus-0.5.0.tgz
+dsh plugin --profile <profile> add /absolute/path/to/dsh-ptc-plus-0.5.1.tgz
 dsh --profile <profile> --dump-config
 ```
 
@@ -157,7 +159,7 @@ dsh plugin add github:muyuanjin/dsh-ptc-plus#main
 dsh --dump-config
 ```
 
-After an npm release, the package spec may instead be `dsh-ptc-plus@0.5.0`. For a local package, use its absolute tarball path. Restart DSH Desktop after installation. Linux Desktop is not a current DSH Desktop release target; use DSH CLI/Web on Linux.
+After an npm release, the package spec may instead be `dsh-ptc-plus@0.5.1`. For a local package, use its absolute tarball path. Restart DSH Desktop after installation. Linux Desktop is not a current DSH Desktop release target; use DSH CLI/Web on Linux.
 
 ## Upgrades
 

package/docs/publishing.md

@@ -1,6 +1,6 @@
 # Publishing
 
-本仓库是普通 DSH bundle：`package.json` 声明 `dsh.bundle.patch`、入口、依赖、Node 范围和发布白名单，`cordis.patch.yml` 只插入 `dsh-ptc-plus`。插件自带的运行时依赖由 npm 包声明；必须与宿主共享实例的 DSH service 包声明为 peer dependencies，并由宿主按 `inject` 装配。
+本仓库是普通 DSH bundle：`package.json` 声明 `dsh.bundle.patch`、入口、依赖、Node 范围和发布白名单。`cordis.patch.yml` 隔离原 `ptc-runtime` 的服务，并插入 `ptc-plus-execution`（`dsh-ptc-plus/execution-provider`）与 `ptc-plus`（`dsh-ptc-plus`）两项；安装时保留完整 bundle。插件自带的运行时依赖由 npm 包声明；必须与宿主共享实例的 DSH service 包声明为 peer dependencies，并由宿主按 `inject` 装配。
 
 `npm run build` 生成 Client bundle，以及私有编译器使用的 `compiler-core.cjs`、`compiler-platform.cjs`、按需加载的 `compiler-amaro.cjs`、`compiler-typescript.cjs` 和对应 source maps。依赖中的大型字符串参数由构建提取为 `compiler-asset-*.txt`，`compiler-assets.json` 拥有精确加载清单，避免 WASM 等数据同时驻留于源码与字面量池。这些编译器产物由 `scripts/compiler-bundle.mjs` 从源码紧凑生成，并列入发布白名单；不能手工修改生成文件。构建同时核验编译器源码所导入的必需平台成员。`npm run build:check` 同时比较 Client、编译器和资源产物，`prepack` 通过该检查阻止陈旧产物进入 tarball。源码验证还须把私有 realm 的执行映射回原始编译器文件，不能只统计调用服务的外层代码。
 
@@ -44,7 +44,7 @@ npm.cmd stage approve '<stage-id>' --registry=https://registry.npmjs.org/
 
 1. 提交前在稳定工作树上运行完整 `npm run check`，执行无覆盖插桩的完整普通后端测试并生成 review proof。覆盖率只在准备发布新版本时运行；Release workflow 在打包与 npm staging 前对 release tag 执行 `npm run coverage`，要求行与函数覆盖率 100%、分支覆盖率至少 95%。发布准备期间可在本地运行同一命令，并用 `npm run coverage:focus` 诊断覆盖率缺口；日常开发、审查与提交不运行覆盖率专用套件、采集探针或插桩分支；这些测试由 `test/coverage/` 和发布入口的显式标记拥有。仓库 CI 在 Linux Node `22.19.0`、24.x、26.x，以及 Windows 与 macOS Node 24.x 的干净安装上运行 `npm run verify:ci`，检查构建、Client 与跨平台关键运行契约；Ubuntu Node 24.x 另运行打包后的 `latest` / `next` Host contracts。普通 CI 不收集 coverage 或执行穷尽式后端套件。
 2. 运行 `npm audit --omit=dev`、`npx publint`、`git diff --check`、Markdown local-link check 和 `npm pack --silent --dry-run --json`。audit 检查随包安装的 production 依赖图；宿主 DSH 及其开发依赖不进入插件 tarball，由冻结宿主契约和 CI 单独验证。确认 tarball 只包含发布白名单内的运行时代码、文档和展示资产，不含凭据、本地路径、开发脚本或测试夹具，并执行 `npm run test:package:consumer -- <tarball>`：入口先校验当前安装的宿主与其 lock 一致，再将宿主实际提供的 peer 版本与 tarball 放在同一次 npm 安装事务中，在空目录执行 ESM import、内置编译器栈与内核 worker 加载 smoke。不能让 npm 对各宿主 peer 分别选用 dist-tag；插件继续声明不限制版本的 required peers，不私装宿主服务副本。机器读取 `npm pack --json` 时保持 `--silent`，避免 lifecycle 输出混入 JSON stream。
-3. 更新到最新可用 DSH release 并记录 `dsh --version`。分别从 npm 包、固定 Git commit、源码 checkout 和 tarball 安装到临时 profile，再执行 `dsh --profile <profile> --dump-config`，确认只新增 `ptc-plus` row。每个上游 release 都重新验证公共扩展面、CLI/Web 集成和 profile 装配，不设置版本白名单。
+3. 更新到最新可用 DSH release 并记录 `dsh --version`。分别从 npm 包、固定 Git commit、源码 checkout 和 tarball 安装到临时 profile，再执行 `dsh --profile <profile> --dump-config`，确认与 `cordis.patch.yml` 一致：新增 `ptc-plus-execution`、`ptc-plus` 两项，并将原 `ptc-runtime` 的 `ptcRuntime` 服务隔离到 `ptc-plus-original`。每个上游 release 都重新验证公共扩展面、CLI/Web 集成和 profile 装配，不设置版本白名单。
 4. 在 Windows 与 Linux 运行无模型调用的 `npm run test:client:web -- --dsh-entry <latest-installed-dsh/lib/bin.js>`，验证 tarball 安装后的真实 Web Client、设置与对话 surface；浏览器前置条件见 [安装指南](installation.md)。`build:check`、Host ESM import 和 factory smoke 均不能替代浏览器激活验收。macOS 由原生 runner 验证 CLI/Web；Windows 与 macOS Desktop 从托盘打开当前 profile 的 DSH Terminal 安装，重启 Desktop 后做一次 PTC 模式 smoke。Desktop 当前发布平台不包括 Linux。界面有变化时用同一前置条件刷新 README 截图：`npm run readme:screenshots -- --dsh-entry <latest-installed-dsh/lib/bin.js>` 从当前打包候选各写回一帧中英文 REPL 工作台与设置窗口；先用 `--out <directory>` 落到别处检查，命令、前置条件与失败边界见 [安装指南](installation.md)。
 5. 只有在明确授权模型消耗后才运行 `npm run test:expensive` 与 `npm run test:ab`；发布候选还要用 `DSH_PTC_ACCEPTANCE_SCENARIOS=managed-adaptive-surface,managed-session-resume,managed-surface-change,subagent-continuity` 追加托管能力面、会话恢复、宿主表面变化与子代理场景（运行方式、预算与版本差异判别见[评估](evaluation.md#managed-session-continuity-cohort)）。发布结论以结构化测试结果为准，不把一次模型样本推广为普遍保证。
 6. 确认 npm 包名可用、待发布版本高于 registry 版本、README 截图来自真实 DSH 会话，并核对 repository、homepage、bugs、license 与 `dsh-plugin` topic。

package/docs/releases/v0.5.2.md

@@ -0,0 +1,79 @@
+[中文](#cn-v052) | [English](#en-v052)
+
+<h3 id="cn-v052">宿主适配</h3>
+
+* 目标发行仍是当前官方 DSH，插件继续使用它的公共扩展面（设置卡片座位、会话投影和公共 `Menu`），本版本不要求宿主侧改动
+* 升级前写下的会话日志检查点会按新格式重新折叠，旧会话照常恢复，不需要先清空会话或配置
+
+<h3>新增</h3>
+
+* 「能力与上下文 → 提示文本」可以逐句改写插件写给模型的固定提示：每一行标明所属通道、存在条件、字节数和只读原因，只读段落与宿主段落（系统提示与工具说明）只展示、不能改
+* 提示文本是一张紧凑表格，点一行展开该行的编辑区；编辑先进草稿，**保存**才生效，**取消**丢弃，保存前可以看到逐条差异及其生效时机（下一次请求、新会话或下次触发）
+* 检查点的保留窗口在设置里可调：保留最近单元格数（8–512，默认 8）、保留载荷预算（1 MiB–16 MiB，默认 8 MiB，最坏情况约 32 MB）、单元格簇上限（默认与保留单元格数一致，`0` 表示只由载荷预算约束）
+* 计算基线采样、worker 回收、启动探针与宿主执行入口的等待上限，以及连续未测量 cell 的丢弃阈值，都可以按机器情况调整
+
+<h3>修复</h3>
+
+* 会话日志检查点的体积由窗口与预算决定，不再随会话累计写入量无限增长：窗口按条数与字节双重上限把旧结算折成摘要记录，超出预算的单个单元格整簇移除。以每格 20 KB 代码加 20 KB 写入的会话实测，450 格为 0.62 MB、900 格为 0.83 MB
+* 被移出检查点的单元格在需要时从会话日志重新折叠，因此仍可编辑和查看；日志无法提供时，编辑会提示「该单元格超出保留窗口，已不可编辑」
+* 单个单元格本身就超过载荷预算时，它会连同参数原文一起移出检查点并提示「最新单元格超出保留预算，已从检查点移除」，而不是让检查点无限变大
+* 提示文本面板里的原因码与槽位种类按界面语言显示，中文界面不再出现内部代码；只读槽位的说明与按钮样式与设置页其余部分一致
+* 选中提示文本的某一行后，编辑区会滚动到可见位置，不再出现「点了行却没看到编辑器」
+
+<h3>升级</h3>
+
+* 需要 Node.js `^22.19.0 || >=24.0.0`；升级插件后请重启 DSH
+* 现有配置不需要迁移：没有显式设置的保留参数使用上述默认值，已有配置里的其它字段照旧生效
+
+```sh
+dsh plugin --profile <profile> add dsh-ptc-plus@0.5.2
+```
+
+---
+
+<h3 id="en-v052">Host Compatibility</h3>
+
+* This release targets the current official DSH release and keeps using its public extension surfaces (the settings card seat, the session projection and the public `Menu`); no host-side change is required
+* Session-log checkpoints written before this version are refolded in the new format, so existing sessions keep recovering without clearing the session or the configuration
+
+<h3>New Features</h3>
+
+* **Capabilities & context → Prompt text** now lets you rewrite, sentence by sentence, the fixed text the plugin writes for the model. Each row states its channel, when it applies, its byte size and why it is read-only; read-only and host-owned sections (system prompt and tool descriptions) are shown only
+* The prompt text surface is a compact table: select a row to expand its editor. Edits stay in a draft, **Save** applies them, **Cancel** discards them, and the pending diff with its effect time (next request, new session or next trigger) is visible before saving
+* The checkpoint retention window is configurable: retained recent cells (8–512, default 8), retained payload budget (1 MiB–16 MiB, default 8 MiB, worst case about 32 MB) and the retained cluster limit (defaults to the retained cells; `0` means the payload budget is the only bound)
+* The bounds for compute-baseline sampling, worker reclamation, the startup probe and the host execution seam, plus the threshold for consecutive unmeasured cells, can be tuned for the machine
+
+<h3>Fixes</h3>
+
+* The session-log checkpoint is bounded by the window and the budget instead of growing without limit with what the session writes: a count and byte window folds older settlements into summary records and removes a single cell that exceeds the budget on its own. Measured on sessions writing 20 KB of code plus 20 KB per cell: 0.62 MB at 450 cells and 0.83 MB at 900
+* A cell removed from the checkpoint is refolded from the session log when it is needed, so it stays editable and readable; when the log cannot provide it, editing reports "This cell is outside the retention window and can no longer be edited"
+* A single cell larger than the payload budget is removed with its argument text and reported as "The newest cell exceeded the retention budget and was removed from the checkpoint", instead of letting the checkpoint grow without bound
+* The reason codes and slot kinds in the prompt text surface follow the interface language, so Chinese users no longer see internal identifiers; read-only slot descriptions and buttons match the rest of the settings page
+* Selecting a prompt text row scrolls its editor into view, so a selected row always shows the editor it expands
+
+<h3>Upgrade</h3>
+
+* Requires Node.js `^22.19.0 || >=24.0.0`; restart DSH after upgrading the plugin
+* No configuration migration is needed: retention fields that are not set use the defaults above, and other configured fields keep their values
+
+```sh
+dsh plugin --profile <profile> add dsh-ptc-plus@0.5.2
+```
+
+---
+
+Full Changelog: https://github.com/muyuanjin/dsh-ptc-plus/compare/v0.5.1...v0.5.2
+
+<h3>稳定性</h3>
+
+* 表面重发布（例如切换工作目录、能力观测、宿主重渲染）不再重建内核：只要 worker 还活着，绑定就在原地保留，视图变化不影响计算状态
+* 恢复提示只在真的需要时出现：完整恢复不再发通知，只有确实无法恢复的绑定才被点名（`PTC-R002`），曾被宣布可用之后消失的绑定另有 `PTC-R006` 点名
+* 编辑命令是追加语义：被接受的编辑新增一次调用，原有单元格与其绑定保持不变；改写历史是可选的未来能力，默认关闭
+* 长会话实测：163 个 run_code 单元格的会话中恢复类诊断数为 0
+
+<h3 id="en-stability">Stability</h3>
+
+* A surface republish (working-directory change, capability observation, host re-render) no longer rebuilds the kernel: while the worker is alive the bindings stay where they are, and a change of view does not change computation state
+* Recovery notices appear only when they are needed: a complete restore is silent, a binding that truly cannot be restored is named (`PTC-R002`), and one that was announced live and later vanished is named separately (`PTC-R006`)
+* An accepted edit appends a call: the original cell and its bindings stay unchanged; rewriting history remains a future opt-in, off by default
+* Measured on a long session: 163 run_code cells produced zero recovery diagnostics

package/docs/runtime-reference.md

@@ -20,7 +20,7 @@ Every program namespace is leased to one cell. Namespace objects or member funct
 
 Official PTC mode declares only top-level `run_code`. PTC Plus registers `edit_run_code` in the program SDK before the first model request. Call `tools.edit_run_code` inside a cell. Actual derived `run_code` dispatches have their own recorded start/settle events and retain the live root transport as their parent. The private root evidence distinguishes the editor cause (`startSeq`) from derived execution identity (`executionStartSeq`); the latter identifies the published revised cell. See [ADR 0005](adr/0005-temporary-rejected-cell-edit-transport.md) for its settlement and recovery contract.
 
-The editor captures the most recent eligible cell when its official nested dispatch starts, including a successful cell that needs a small adjustment. The target remains fixed while the call is in flight. It accepts exactly one atomic `edits` or `regex_edits` array and an optional `expected_target_call_seq` guard. Invalid, unavailable or mismatched-target edits return `{ accepted: false, scheduled: false, reason }` without executing source. Regex replacement uses JavaScript `$1`, `$<name>` and `$$` templates; backslash forms such as `\\1` remain literal. Every regex item requires `pattern`, `flags`, `replacement` and `expected_matches`, including an explicit `""` flags string when no flags are needed.
+The editor captures the most recent eligible cell when its official nested dispatch starts, including a successful cell that needs a small adjustment. The target remains fixed while the call is in flight. It accepts exactly one atomic `edits` or `regex_edits` array and an optional `expected_target_call_seq` guard. Invalid, unavailable or mismatched-target edits return `{ accepted: false, scheduled: false, reason }` without executing source. Every rejection names the captured cell (`run_code call <seq>` plus a bounded first line), so a drifted target stays identifiable, and a guard mismatch also states that only the most recent settled cell remains editable and that corrected source should be re-submitted with `run_code` when the intended cell is gone. The settled log line reports the same target identity. Regex replacement uses JavaScript `$1`, `$<name>` and `$$` templates; backslash forms such as `\\1` remain literal. Every regex item requires `pattern`, `flags`, `replacement` and `expected_matches`, including an explicit `""` flags string when no flags are needed.
 
 An accepted nested editor call returns `{ accepted: true, scheduled: true, target_call_seq }`. This is a scheduling receipt. The outer cell continues with its current state and original return value or error; after it finishes, PTC Plus dispatches the complete revised source through DSH's real `run_code` tool pipeline before settling the root result. The root result retains the outer canonical value or error and forwards the derived result's Host-rendered content, images, additional contexts and, for a successful root result, turn-conclusion flag; the next cell sees revised bindings. Official nested dispatch events retain editor identity and arguments. Private root-result metadata retains the derived source and journal for cold recovery without rewriting assistant history or emitting edit-specific runtime context. Rejecting the nested receipt prevents dispatch; losing root metadata after derived execution instead invalidates recovery evidence and does not undo effects. When the public Host skips the nested metadata projector, PTC Plus may retain private derived evidence only if its exact pre-policy frozen canonical value survives final policy with unchanged base metadata and execution identity. Block/error, value replacement, missing capture or removal of projected metadata rejects that evidence. The Host result remains unchanged; see [Derived journal settlement](durability-design.md#两阶段确认).
 
@@ -81,6 +81,11 @@ Capability management is experimental and defaults to off. These inputs are froz
 | `capabilityRecoveryEnabled` | `false` | Select optional description recovery independently |
 | `capabilityRecoveryBytes` | `8192` | Separate description-recovery budget in UTF-8 bytes, minimum 1 |
 | `modelPreviewEnabled` | `false` | Select plugin result/log previews; otherwise delegate to the Host policy |
+| `retentionPayloadRuns` | `8` | Newest cells whose argument text stays in the session-log checkpoint, 8–512; older cells must be refolded from the log to be edited or republished |
+| `retentionPayloadBytes` | `8388608` | Cumulative budget for that retained text, 1 MiB–16 MiB; the oldest payload is dropped past it and a single larger cell is dropped as well, so the checkpoint never grows with what the session wrote. A checkpoint is roughly twice this budget, so the maximum bounds the worst case near 32 MB |
+| `retentionClusters` | `8` | Cell clusters that keep identity and observations before the oldest fold into an interval summary, 0–50000; it defaults to `retentionPayloadRuns`, which is what keeps a long session from growing linearly. `0` means unlimited (no count-based folding, the payload budget is the only bound) |
+
+A window below 8 cells or 1 MiB is not supported: a checkpoint with fewer cells in flight than that cannot keep its stored publication and its replay equal, so a smaller request falls back to the default instead of being honoured.
 | `modelPreviewTokens` | `4096` | Estimated model-presentation token cap, minimum 1 |
 
 The configuration uses `ptc-plus` as the DSH plugin ID and `dsh-ptc-plus` as the package name. The distinction is intentional: the former is the runtime/settings identity, while the latter is the repository and npm package identity.
@@ -101,6 +106,8 @@ Missing-description diagnostics append a complete DSH user message to `additiona
     autoDescribeRunCode: true
     bindingUpdates: 'stateful'
     durableReplay: true
+    unmeasuredCellLimit: 2
+    officialReplPriority: false
     tipsEnabled: true
     cordisToolsEnabled: false
     userBindingsEnabled: true
@@ -109,6 +116,10 @@ Missing-description diagnostics append a complete DSH user message to `additiona
     maxOldGenerationSizeMb: 512
     maxNestedRunCodeDepth: 8
     maxOutputBytes: 67108864
+    sampleBoundMs: 1000
+    workerReclaimMs: 5000
+    startupProbeMs: 5000
+    executionSeamTimeoutMs: 30000
     maxValueNodes: 100000
     maxValueEdges: 1000000
     maxValueArrayLength: 1000000
@@ -119,7 +130,11 @@ Missing-description diagnostics append a complete DSH user message to `additiona
 
 The five legacy binding and module switches remain migration inputs. Complete enabled/protected choices map to the corresponding new policy; mixed old choices retain their effective controls until the user explicitly selects the new switch. The Host schema preserves an omitted `bindingUpdates` value until migration, and the settings card resolves the same policy. Selecting the switch also clears the compatibility marker.
 
-`enabled: false` is the settings-based kill switch: the Host keeps the settings namespace, client card, and passive cleanup that can withdraw old PTC declarations at the next permitted accepted step. It removes execution hooks, prompt sections, and tool surfaces without reading binding storage. Settings are applied live when their owner can reconcile them, except the capability inputs frozen per session above. A submitted cell retains one configuration snapshot through preflight, execution, binding calls, completion validation, and diagnostics; an update accepted while it runs applies to cells submitted afterward. Node fixes a worker's V8 old-generation limit at creation, so changing `maxOldGenerationSizeMb` while a session worker is active or a submitted cell is preparing to execute is rejected and rolled back rather than reported as applied. Other non-`enabled` updates reconfigure existing owners without replacing session-bound bindings. The settings card renders in whichever settings seat the installed DSH declares — the sidebar **Plugins → Installed** page per-bundle configuration (`plugins.row.config`), or the preceding Host's **Settings → Plugin configuration** card (`settings.plugin.item`) ([ADR 0019](adr/0019-plugin-settings-and-kill-switch.md)) — places the main switch beside the PTC Plus title and disables every other control while the plugin is off. The card does not register in General settings; the sparkle menu opens the same complete form in an application dialog. If a live enable or reconfiguration cannot install a complete runtime, PTC Plus unwinds or restores every owner and persists the last applied settings; a failed compensating settings write is surfaced as an activation diagnostic. The TypeScript language check is deferred until runtime activation, so a non-TypeScript host can load the plugin in disabled mode but cannot enable it.
+`enabled: false` is the settings-based kill switch: the Host keeps the settings namespace, client card, and passive cleanup that can withdraw old PTC declarations at the next permitted accepted step. It removes execution hooks, prompt sections, and tool surfaces without reading binding storage. Settings are applied live when their owner can reconcile them, except the capability inputs frozen per session above and the activation-only seam wait `executionSeamTimeoutMs`, which is read when the plugin activates or reloads. A submitted cell retains one configuration snapshot for its budgets and policies through preflight, execution, binding calls, completion validation, and diagnostics; an update accepted while it runs applies to cells submitted afterward. Worker lifecycle bounds are not cell budgets: `maxOldGenerationSizeMb` is fixed at creation, and `workerReclaimMs` and `startupProbeMs` are read from the current configuration when a worker is created or closed. Node fixes a worker's V8 old-generation limit at creation, so changing `maxOldGenerationSizeMb` while a session worker is active or a submitted cell is preparing to execute is rejected and rolled back rather than reported as applied. Other non-`enabled` updates reconfigure existing owners without replacing session-bound bindings. The settings card renders in whichever settings seat the installed DSH declares — the sidebar **Plugins → Installed** page per-bundle configuration (`plugins.row.config`), or the preceding Host's **Settings → Plugin configuration** card (`settings.plugin.item`) ([ADR 0019](adr/0019-plugin-settings-and-kill-switch.md)) — places the main switch beside the PTC Plus title and disables every other control while the plugin is off. The card does not register in General settings; the sparkle menu opens the same complete form in an application dialog. If a live enable or reconfiguration cannot install a complete runtime, PTC Plus unwinds or restores every owner and persists the last applied settings; a failed compensating settings write is surfaced as an activation diagnostic. The TypeScript language check is deferred until runtime activation, so a non-TypeScript host can load the plugin in disabled mode but cannot enable it.
+
+`startupProbeMs` bounds the worker startup conformance probe, which must settle before the kernel reports ready. The worker reads the value from its startup data and falls back to 5000 ms when it is absent; a healthy probe settles inside the worker's own microtasks, so the bound can only fire when startup itself yields or blocks, and the failure is reported as a startup diagnostic without executing any cell. That worker-side read is verified by inspection rather than by a timer test, because a healthy probe never reaches the bound.
+
+`officialReplPriority` defaults to `false` and is evaluated against the live provider capability rather than a release number: a provider reporting `programFormat: 'repl'` is an official persistent in-memory REPL. With the setting enabled and that provider live, this host attachment installs no session runtime, so `run_code` and its descriptors — `programFormat`, `executionInstructions`, `sandboxMode` and `timeout` — stay with the official provider, and the plugin's REPL guidance, session-state semantics, recovery, editor tool, capability SDK, REPL observation and binding workbench are suspended until ownership changes back. The settings card, enablement and stored global bindings remain available so the switch can be reversed. Changing the setting or the host mode re-evaluates ownership as an installation change: the retired attachment disposes its live kernels before the other shape installs, so no committed cell mixes owners. Calls executed under the official mode produce no plugin journal records and are never recovery evidence. The plugin's provider surface forwards `programFormat` to the live original and retains weak owner-to-original dispatch provenance for `release(owner)` — captured Agent cleanup reaches the original instances that served that owner even after adapter removal or source replacement, and a failed cleanup remains available for explicit retry. Owner-keyed retained environments and the executed program format belong to the provider that actually runs the program, and non-session consumers such as the workflow adapter keep executing through it — while `executionInstructions`, `sandboxMode` and `timeout` stay withheld while PTC Plus owns session execution. The plugin's own session kernel state is keyed by session and released through the plugin lifecycle, not by `release(owner)`.
 
 `cordisToolsEnabled: true` atomically mounts the official `@deepseek-ai/dsh-tool-cordis` plugin and exactly the shipped `cordis-plugin-development` companion Skill in agent scopes that expose the `run_code` and `skill` tools plus the public preset and Skill services. PTC Plus resolves the official `cordis` preset through DSH's public preset service, lets the maintained filesystem provider read its Skill root as an immutable bundled Host resource, and filters that provider at the public registration boundary so sibling Skills are never published to the PTC scope. It does not copy the Skill or switch the agent's preset. The first request waits until the Cordis tool fiber, owner guidance, exact Skill provider, and scoped Skill load are all ready. An agent scope that omits one of those surfaces is left for later: the owner publishes nothing there, reports nothing, and retries when the tool surface changes or the next prompt is assembled. A scope whose exposed preset, Skill/tool service, declared Cordis service, inspect manifest, or activation contradicts the host contract fails the setting change at installation and removes every provisional contribution; reached through the host's own `agent/created` or assemble call it withdraws from that scope with one warning instead, so this plugin's unavailability never fails an agent another plugin created ([ADR 0029](adr/0029-keep-plugin-unavailability-out-of-the-host-agent-lifecycle.md)). Disable and agent/runtime disposal remove both fibers. Native agents inherit neither the resulting `tools.*` members nor the Skill, and the code-only direct-tool projection remains `[run_code]`. Cordis can evaluate model-written plugins against the live runtime, so enabling it grants shell-equivalent trust.
 
@@ -157,6 +172,14 @@ Every completed cell records the exact source-derived active snapshot in private
 
 `durableReplay: false` starts new kernels without recorded REPL state while preserving live bindings in the current process. It does not delete session logs.
 
+`promptText` holds a `ptc-prompt-text/v1` document that replaces individual prompt slots, keyed by slot id (`guidance.opening`, `runCode.description`, `plan.navigationSentence`, `tip.body.platform`, ...). An absent id keeps the built-in sentence; an empty value omits that slot when it is omittable. Limits are measured in effective UTF-8 bytes — 4096 per slot, 16384 per anchor and 65536 for the whole document — and the same ceilings are enforced twice: the save path rejects with the slot id, and rendering re-enforces them on effective bytes, dropping an offending override back to its default and reporting `slot-exceeds-limit`, `anchor-exceeds-limit` or `document-exceeds-limit`. A projected slot must keep exactly one of each registered hole at render time as well, or it is reported as `missing-hole` and falls back; rendering never throws.
+
+Slots carry an owner and, when read-only, one of six reason codes: `fact-derived` (generated from configuration or runtime facts), `aggregate-frozen` (an aggregate container whose item set is frozen because adding or removing an item moves its neighbours' bytes), `protocol-exact-text` (compared byte for byte by a recognizer), `protocol-structural` (a structural contract nothing matches as text), `shadows-host` (replaces or appends into host-owned text) and `other-owner` (text you wrote elsewhere, shown read-only). An override of a read-only slot is refused instead of being silently ignored.
+
+Delivery follows the channel: prompt text and the `run_code` schema are rebuilt on the next request, the `edit_run_code` schema resolves when an agent installs the tool surface and therefore applies to a new session, the capability plan applies to a new session or an explicit refresh (a customized plan records `ptc-capability-environment/v5`), and the runtime and result channels apply to the next accepted step or the next trigger. Recognition does not depend on the sentence it is recognizing: a catalog message records whether it delivered an empty catalog in its own source, and a recorded message without that flag is compared against frozen historical constants, so rewriting today's empty-catalog sentence cannot reinterpret records written by another version and cannot cause a catalog to be redelivered. `internal/prompt-text.js` owns the registry and the accounting; the settings pane derives its counters from `accountPromptText`, so an unconnected channel is reported as unmeasured instead of zero bytes, and an empty document reproduces the built-in bytes exactly.
+
+Submission admission belongs to the exact DSH tool execution. Reentry within that execution shares its admission; a later root execution gets a fresh admission and session observation even when a background callback inherits the same session's asynchronous context or reuses a call ID. Only a proved derived edit may inherit its composite source and settlement evidence. Disposing a child agent/session leaves the parent's live bindings intact. Disposing the parent cancels its pending preparation; the next admitted call can recover from the verified journal without reusing that cancelled admission.
+
 With `durableReplay: true`, recovery claims only bindings backed by both verified journal ancestry and exact provenance available to the model that produced the current call. DSH's append-only event log proves reconstructability; its ordered model-visible surface proves awareness. Before every subsequent cell in a structured host session, the runtime revalidates each existing live call against that exact surface even when `replaceGeneration` is unchanged. Raw events shadowed from the surface and UI-only `dshPtcPlusBindings` metadata do not make a binding model-knowable. A result-only replacement may retain a cell when the assistant call containing its source remains visible. If compaction shadows that call, the live worker and cold recovery contract the affected state unless an explicitly selected bounded structured projection exposes the exact bindings in model context. Such a projection is not injected by default merely to retain hidden state. Natural-language summaries are not parsed as state evidence.
 
 An invalid historical association, prune replacement, or recovery boundary is also rejected as evidence for its bindings; it is not by itself a reason to reject every later valid `run_code`. Recovery takes the intersection of the model-knowable and structurally verified frontiers, then discards cells and bindings that may depend on an unknown boundary. Because the current journal does not contain a complete per-binding dependency graph, the conservative unit is an affected cell and suffix unless stronger owned evidence exists. If no non-empty frontier is provable, the worker starts from an empty REPL and executes the current cell as a new root.
@@ -214,7 +237,7 @@ Inside a cell, omitting the JavaScript argument of a native `tools` member is ac
 
 ## Limits
 
-`computeMs` measures worker event-loop active time, including synchronous blocking operations such as `execSync`; it is not a measurement proving CPU consumption. Asynchronous waits are instead bounded by `maxWallMs`. Either timeout terminates the worker and resumes later work from verified recovery state. It does not establish child-process cancellation or external-effect rollback; use an asynchronous process API when waiting on external work.
+`computeMs` measures worker event-loop active time, including synchronous blocking operations such as `execSync`; it is not a measurement proving CPU consumption. Asynchronous waits are instead bounded by `maxWallMs`. Either timeout terminates the worker and resumes later work from verified recovery state once the cell's run frame was posted. A cell that ends before that frame because its compute baseline could not be observed within `sampleBoundMs` (default 1000 ms), or because one of those bounds expired first, settles as an unmeasured no-op instead: no source ran and earlier settlements are kept. With the default limit of two the first such cell keeps the live worker; reaching `unmeasuredCellLimit` consecutive cells drops it while the proved frontier stays replayable, and the outcome is `budget-unavailable`. `workerReclaimMs` (default 5000 ms, at least 1000 ms) bounds each close stage of a stopped helper: its exit confirmation, measured from the close start with the fixed release grace capped so the kill keeps at least a 1000 ms window, and then the output pipes ending, measured from the exit. A cell-driven session-kernel exit miss keeps that helper and blocks later cells of the session; a startup, idle or output-close miss, and the binding console and candidate helpers, only retain the instance; an output that never closes retains only the instance and is reported when the session is released, without blocking later cells. A sampling failure that reports the worker itself as gone (exit, disconnect, unsendable request) keeps the worker-exit reset route. None of these outcomes establishes child-process cancellation or external-effect rollback; use an asynchronous process API when waiting on external work.
 
 - The runtime is identified as `typescript`. Stateful and protected cells erase type-only syntax and lower enums, namespaces, parameter properties, and decorators through maintained TypeScript and decorator transforms. JSX is outside the cell syntax. Historical cells retain their recorded language generation.
 - `tools.read` is a bounded inspection window in the current DSH tool contract. Whole-file computation in `danger-full-access` should use `node:fs/promises.readFile` or streams and becomes `volatile`.
@@ -227,6 +250,22 @@ Inside a cell, omitting the JavaScript argument of a native `tools` member is ac
 - Cold recovery replays journals from the session log; there are no compressed checkpoints or worker-LRU eviction.
 - DSH services or plugin APIs not exposed as a native tool or owner-provided program binding are not made callable through name-based reflection.
 
+## 注入上下文的重复成本
+
+一次会话里模型看到的内容由几个来源拼成，只有其中一小部分由本插件产生：
+
+| 来源 | `source.kind` | 归属 | 实测字节（2026-10-25 会话） |
+| --- | --- | --- | --- |
+| 能力环境说明 | `plugin:ptc-plus` | 本插件 | 498 B，每会话一次 |
+| 全局绑定 API 参考 | `plugin:ptc-plus` | 本插件 | 1 690 B，每会话一次 |
+| 工作区指令（`AGENTS.md`） | `agent-instructions` | 宿主 `@deepseek-ai/dsh-agent-instructions` | 23 122 B，每会话一次 |
+| 技能目录 | `skill-catalog` | 宿主 | 8 974 B，每会话一次 |
+| 运行时上下文 / 时间 / 工作目录 | `runtime-context`、`time-context`、`working-directory` | 宿主 | 各数百字节，按事件发生 |
+
+本插件对每个会话只追加两条消息，且各自只出现一次；`test/runtime-messages.test.js` 与 `test/capability-environment.test.js` 钉住该行为。任何“同一段注入出现多次”的现象都不由本插件产生：`agent-instructions` 的生成点是宿主包 `dsh-agent-instructions`，本仓库没有写入该 `source.kind` 的代码。
+
+历史观测：2026-10-12 的会话 `session-066846e1-…` 里 `agent-instructions` 出现三次（23 122 B 一次，随后两次逐字节相同的 23 221 B）；2026-10-25 的会话只有一次。因此重复注入属于宿主的按轮/按步重发行为，本仓库既不能复现也无法修复——调整注入策略需要修改宿主，或由宿主按摘要去重。测量这类成本时，应区分“插件的两条固定消息”和“宿主的会话级注入”，不要把后者计入插件噪音。
+
 ## 值传输失败
 
 [PTC Value V1](value-wire.md) 区分 live 值、canonical IPC 与模型展示。输出失败 `PTC-O001` 报告不支持的类型/shape 或预算超限及值路径：类型失败需显式选取支持的数据，预算失败需缩小 graph。普通输出编码失败保留 live binding，不重复执行 cell。程序参数编码失败不派发调用；已完成调用的结果编码失败明确报告可能已有外部效果，不自动重试或重置。诊断不为识别类型执行 getter、toJSON 或用户方法。