dsh-ptc-plus 0.5.2 → 0.5.4

package/docs/installation.md

@@ -2,7 +2,7 @@
 
 PTC Plus requires Node.js `^22.19.0 || >=24.0.0` and targets the latest available DSH release with TypeScript PTC mode. Historical interface branches are retained through capability detection, without promising a fully verified earlier Host installation; when both generations expose competing presentation evidence, the current DSH contract wins. Compatibility follows those live extension surfaces rather than a version allowlist.
 
-The package declares `engines.dsh: "*"` for DSH's plugin compatibility preflight. This keeps release-number gating open while public capability checks and packed Host contracts establish compatibility; it does not claim that every historical or future Host has been tested. Host-owned service packages remain required peers.
+The package declares `engines.dsh: "*"` for DSH's plugin compatibility preflight. This keeps release-number gating open while public capability checks and packed Host contracts establish compatibility; it does not claim that every historical or future Host has been tested. Host-owned service packages are peers of the plugin because the host supplies them; the PTC tool executor is an optional peer, because a host that keeps tool presentation in its registry does not publish that package at all.
 
 The worker uses the Host's Node executable. Startup verifies native REPL framing, imports, syntax failures, synchronous throws, awaited rejections, and original return values. The adapter combines public eval callbacks with domain error events before REPL formatting; a source-end witness distinguishes empty completion from falsy rejection. A failed or timed-out probe reports a runtime prerequisite failure before user code executes. The engine range follows DSH; CI exercises Node 22.19, 24, and 26, without claiming that untested future releases have already passed.
 
@@ -12,7 +12,7 @@ Install the plugin into the profile that actually runs the target DSH surface. D
 
 | Component | Current contract |
 | --- | --- |
-| DeepSeek Harness | Latest available release; validate the live public extension surfaces after every upstream release |
+| DeepSeek Harness | `>=0.2.1-0 <0.2.3` (the 0.2.1 and 0.2.2 lines), declared once in `engines.dsh`; validate the live public extension surfaces after every upstream release |
 | Runtime | DSH TypeScript PTC mode; cells currently accept modern JavaScript syntax |
 | Node.js | `^22.19.0 || >=24.0.0` |
 | Platforms | Windows CLI/Desktop and Linux CLI/Web verified locally; macOS package tests and import smoke run in CI, while live DSH integration and Desktop require release-time smoke testing |
@@ -20,7 +20,7 @@ Install the plugin into the profile that actually runs the target DSH surface. D
 
 `danger-full-access` is the primary supported experience. The worker isolates the REPL lifecycle; it is not a malicious-code sandbox. DSH continues to own native-tool scope, policy, approval, cancellation, sandboxing, and scheduling. Narrower profiles expose only their available capabilities; PTC Plus does not simulate missing authority or add another permission system.
 
-The optional `cordisToolsEnabled` integration requires the current DSH installation to provide its shipped `cordis` preset plus the public preset, Skill, Cordis, settings, and tool-runtime services. PTC Plus declares the shared service packages as unrestricted required peers instead of installing private runtime copies. For a pathless preset it asks the Host's `pluginPackages.packageOf` service for the active generation's official preset package and requires the exact `cordis-plugin-development/SKILL.md` before mounting it; an older generation with no package service may resolve only its historical plural preset package relative to the Host's `ctx.baseUrl`. This compatibility path is disabled whenever `pluginPackages` exists, so packages merely reachable from the plugin profile cannot override an active Host result. Runtime capability validation owns compatibility, and CI checks the packed plugin against frozen official `latest`, `next`, and newest published release graphs. Each result applies only to the tested cohort. That load step mounts the pathless Cordis companion from a separated active-host resource while a resolvable stale package is present beside the packed plugin, runs `scripts/dsh-execution-seam-smoke.mjs` to exercise public provider composition around the execution service the installed tool runtime uses, and runs `scripts/dsh-rpc-contract-smoke.mjs` to register the packed Remote descriptors with the installed TYPERT registry and evaluate the decoder that generation reads ([ADR 0030](adr/0030-serve-both-typert-codec-generations-from-one-codec.md)); an import alone cannot distinguish a loaded plugin from one whose injection is unsatisfied, because Cordis leaves the latter pending without an error, and it cannot show that the Host accepts a wire contract it validates only at registration. The same suite round-trips argument diagnostics through the selected Host's compressed JSONL Session persistence. Service packages retain the dependency graph selected by their Host distribution rather than independently selecting each service's release tag. DSH's profile module fallback must resolve the peers, while `pluginPackages` identifies the official preset resource from an active installation that publishes the service. Do not copy `SKILL.md` or add the Cordis preset's Skill directory to global roots. If the host surface is incomplete, plugin activation or enabling the setting fails instead of loading a second DSH core.
+The optional `cordisToolsEnabled` integration requires the current DSH installation to provide its shipped `cordis` preset plus the public preset, Skill, Cordis, settings, and tool-runtime services. PTC Plus declares the shared service packages as unrestricted required peers instead of installing private runtime copies. For a pathless preset it asks the Host's `pluginPackages.packageOf` service for the active generation's official preset package and requires the exact `cordis-plugin-development/SKILL.md` before mounting it; an older generation with no package service may resolve only its historical plural preset package relative to the Host's `ctx.baseUrl`. This compatibility path is disabled whenever `pluginPackages` exists, so packages merely reachable from the plugin profile cannot override an active Host result. Runtime capability validation owns compatibility, and CI checks the packed plugin against the blocking host channels resolved from `compat/channels.json`. Each result applies only to the tested cohort. That load step mounts the pathless Cordis companion from a separated active-host resource while a resolvable stale package is present beside the packed plugin, runs `scripts/dsh-execution-seam-smoke.mjs` to exercise public provider composition around the execution service the installed tool runtime uses, and runs `scripts/dsh-rpc-contract-smoke.mjs` to register the packed Remote descriptors with the installed TYPERT registry and evaluate the decoder that generation reads ([ADR 0030](adr/0030-serve-both-typert-codec-generations-from-one-codec.md)); an import alone cannot distinguish a loaded plugin from one whose injection is unsatisfied, because Cordis leaves the latter pending without an error, and it cannot show that the Host accepts a wire contract it validates only at registration. The same suite round-trips argument diagnostics through the selected Host's compressed JSONL Session persistence. Service packages retain the dependency graph selected by their Host distribution rather than independently selecting each service's release tag. DSH's profile module fallback must resolve the peers, while `pluginPackages` identifies the official preset resource from an active installation that publishes the service. Do not copy `SKILL.md` or add the Cordis preset's Skill directory to global roots. If the host surface is incomplete, plugin activation or enabling the setting fails instead of loading a second DSH core.
 
 The plugin attaches to whichever program-execution service the installed DSH registers, and it presents the capabilities of the execution it performs ([ADR 0028](adr/0028-attach-to-the-host-ptc-execution-seam.md)). Cells run in the session kernel under the session's configured budgets, so `run_code` advertises neither a per-call deadline nor a file sandbox, and DSH rejects `timeoutMs` and `sandbox_permissions` with its own message instead of the plugin accepting an input it would then ignore.
 
@@ -32,11 +32,11 @@ The Client root requires `slots`, `locale`, `connection`, and `remote`; it adopt
 
 ### Compatibility Evidence
 
-The frozen dependency graphs are installation cohorts, not proof of distinct capability generations. `compat/latest/package-lock.json`, the root `package-lock.json`, and `compat/current/package-lock.json` record the latest-tag, next-tag, and newest published-release cohorts respectively; their recorded provenance does not prove live registry availability or untested compatibility. The latest/next cohorts exercise `ptcRuntime`, `configForms`, `plugins.row.config`, volatile configuration and `codec.create()`. `npm run host:baseline:verify` checks frozen graph consistency, not every historical fallback or current registry availability.
+The plugin states its runtime requirement once, in `engines.dsh`: DSH evaluates that range alone and ignores the `peerDependencies` on its own packages, so the peers stay unrestricted while the accepted runtime line is one fact. The range admits both the 0.2.1 and 0.2.2 lines, prereleases included; 0.2.0 is outside it. Support is expressed as channels, not versions. `compat/channels.json` records, per channel, the host release each official dist-tag resolves to and the tarball integrity of every host package whose published surface the plugin probes. `latest` and `next` are the blocking channels; `alpha` carries the line this checkout develops against and reports without blocking a release. The development graph declares that channel rather than a release — every host `devDependencies` entry names it, and the lock resolves it — so a supported line is reached by moving the channel definition, not by editing the graph by hand. A probed package the release does not publish is recorded at the version and integrity its own declared dependency range resolves to, so a publish inside that range is a recorded drift; a probed package the release neither publishes nor depends on is recorded as absent, and the install proof rejects a graph that contains one. The recorded versions do not prove live registry availability or untested compatibility, and behaviour never branches on them: presentation, transport ownership and state retention are detected from the host's published shapes. `npm run host:channels:verify` checks the tracked manifest offline; `npm run host:channels:update` is the only command that resolves it from the registry.
 
 | Retained interface | Evidence and consequence of removal |
 | --- | --- |
-| `retainedBy.mainView`, `plugins.row.config`, volatile updates, `codec.create()`, composer props carrying their own `sessionId` | Required by the frozen graphs; these are current paths, not optional historical fallbacks. |
+| `retainedBy.mainView`, `plugins.row.config`, volatile updates, `codec.create()`, composer props carrying their own `sessionId` | Required by the installed channel graphs; these are current paths, not optional historical fallbacks. |
 | `settingsScope`, `settings.plugin.item`, section-installer variants | Historical, unfrozen Host shapes, covered with fixtures. Removal loses their live settings, card seat or reconfiguration path. |
 | `snapshot.current`, bare summary `agentPreset` | Historical, unfrozen selection and preset shapes. Removal can strand their session-specific views or PTC eligibility. Binding and draft evidence never use the preset fallback. |
 | Historical icon names and missing primitives | Fixtures establish component fallback, not a complete earlier Client. Removal of icon candidates loses native glyphs; usable text/component fallbacks must remain. |
@@ -47,14 +47,14 @@ The frozen dependency graphs are installation cohorts, not proof of distinct cap
 | `sessionQuery.observeSession` and host-only `sessionProjections` | Current history and presentation owners; missing services are diagnosed, not treated as empty recovery evidence. The projection publishes no Client wire view. |
 | Legacy session event arrays and V0 boundary migration | Read-only fixtures preserve historical ancestry and file conversion through the shared event transition. Removal can discard reconstructable older sessions; malformed arrays are diagnosed, and format conversion does not prove a complete older Host's live behavior. |
 
-Capabilities select behavior, never a release number. Historical fixture success is not packed-Host evidence. Full Host smoke is bounded to its selected graph, and a clean build is not live browser activation. Public provider composition supports frozen original execution instances without changing their descriptors. The result bridge requires mutable registered tool definitions ([ADR 0028](adr/0028-attach-to-the-host-ptc-execution-seam.md)); frozen tool definitions remain unsupported. The public admission boundary uses DSH's published `ptc` mode: `run_code` is the sole top-level transport, and the agent-scoped editor is invoked through `tools.edit_run_code` inside a program ([ADR 0005](adr/0005-temporary-rejected-cell-edit-transport.md#public-integration-status)). Packed lifecycle evidence covers actual nested admission, derived execution, persisted recovery and provider handback on its frozen official Host graph; an internal fixture or provider seam probe alone does not establish that compatibility. Proven native miscalls are normalized before Host dispatch; an unnormalized root call can reach approval before the plugin rejects it.
+Capabilities select behavior, never a release number. Historical fixture success is not packed-Host evidence. Full Host smoke is bounded to its selected graph, and a clean build is not live browser activation. Public provider composition supports frozen original execution instances without changing their descriptors. The result bridge requires mutable registered tool definitions ([ADR 0028](adr/0028-attach-to-the-host-ptc-execution-seam.md)); frozen tool definitions remain unsupported. The public admission boundary uses DSH's published `ptc` mode: `run_code` is the sole top-level transport, and the agent-scoped editor is invoked through `tools.edit_run_code` inside a program ([ADR 0005](adr/0005-temporary-rejected-cell-edit-transport.md#public-integration-status)). Packed lifecycle evidence covers actual nested admission, derived execution, persisted recovery and provider handback on its installed channel host graph; an internal fixture or provider seam probe alone does not establish that compatibility. Proven native miscalls are normalized before Host dispatch; an unnormalized root call can reach approval before the plugin rejects it.
 
 ## npm Release
 
 Use this form after the selected version is available from the npm registry:
 
 ```sh
-dsh plugin --profile <profile> add dsh-ptc-plus@0.5.1
+dsh plugin --profile <profile> add dsh-ptc-plus@0.5.3
 dsh --profile <profile> --dump-config
 ```
 
@@ -91,7 +91,7 @@ pnpm dsh --profile <profile> --dump-config
 
 ```sh
 npm pack
-dsh plugin --profile <profile> add /absolute/path/to/dsh-ptc-plus-0.5.1.tgz
+dsh plugin --profile <profile> add /absolute/path/to/dsh-ptc-plus-0.5.3.tgz
 dsh --profile <profile> --dump-config
 ```
 
@@ -159,7 +159,7 @@ dsh plugin add github:muyuanjin/dsh-ptc-plus#main
 dsh --dump-config
 ```
 
-After an npm release, the package spec may instead be `dsh-ptc-plus@0.5.1`. For a local package, use its absolute tarball path. Restart DSH Desktop after installation. Linux Desktop is not a current DSH Desktop release target; use DSH CLI/Web on Linux.
+After an npm release, the package spec may instead be `dsh-ptc-plus@0.5.3`. For a local package, use its absolute tarball path. Restart DSH Desktop after installation. Linux Desktop is not a current DSH Desktop release target; use DSH CLI/Web on Linux.
 
 ## Upgrades
 
@@ -172,7 +172,7 @@ dsh --profile <profile> --dump-config
 
 For a tarball or a different pinned Git revision, replace the `add` argument with the absolute tarball path or `github:muyuanjin/dsh-ptc-plus#COMMIT_SHA`. This updates the profile dependency spec; the Loader module name remains `dsh-ptc-plus`. `dsh plugin --profile <profile> update dsh-ptc-plus` updates within its saved dependency constraint, so it cannot move an exact pinned revision to a different revision. Bare commands in Desktop's **Open DSH Terminal** target its active profile.
 
-Restart the selected Host after the package transaction and verify its selected package and full bundle in the plugin page and `--dump-config`; installing dependencies alone does not replace already loaded JavaScript. Preserve the bundle's existing enabled/disabled choice. A source-checkout `npm ci` only prepares developer dependencies, and Windows build-cache preparation only prepares a tarball: neither upgrades a profile. Avoid `npm install` in an unrelated shell directory and do not edit Loader module names to encode revisions. The plugin never patches DSH or requires a custom Host build. Compatibility claims require the current published cohort's packed acceptance evidence.
+Restart the selected Host after the package transaction and verify its selected package and full bundle in the plugin page and `--dump-config`; installing dependencies alone does not replace already loaded JavaScript. Preserve the bundle's existing enabled/disabled choice. A source-checkout `npm ci` only prepares developer dependencies, and Windows build-cache preparation only prepares a tarball: neither upgrades a profile. Avoid `npm install` in an unrelated shell directory and do not edit Loader module names to encode revisions. The plugin never patches DSH or requires a custom Host build. Compatibility claims require the resolved channel release's packed acceptance evidence.
 
 Your settings document and session logs are not rewritten by an upgrade. A release that adds a configuration field applies its documented default until you choose a value. A release that raises the Session format generation requires the migration below before an older log is opened by the new Host; the plugin reports that condition instead of rewriting history on its own.
 
@@ -185,6 +185,13 @@ Start from the exact diagnostic: every message below names the surface that is m
 - `ptc-plus: Cordis companion tooling withdrew from an agent scope` — an exposed companion service, preset, Skill or child fiber failed its required contract. Repair the specific cause attached to the warning, or disable `cordisToolsEnabled` if that integration is unavailable. A scope missing optional companion surfaces instead waits silently and retries when its tool surface changes or its next prompt is assembled.
 - A commit is refused with a verification or proof error — follow [deterministic verification](verification.md): resolve any incomplete lanes shown by `npm run review:status`, run `npm run check` on the frozen tree, then `npm run review:finalize`. Stage that verified candidate and retry. Use `npm run hooks:install` if the hook is missing; never bypass it.
 - A historical PTC session cannot be resumed — follow the Session format upgrade below, keep the original log, and report the exact refusal message.
+- A session cannot be exported or reopened, and the export reports `HTTP 500` — its log carries a session decision (a capability choice or a binding adoption) as a surface message appended before the Host had published its protected system head, and the released format refuses such a log on every read. The plugin now records both decisions as plugin records and adds no surface message. Stop the Host that owns the profile, then repair the artifact with the repair script from this repository's checkout (the installed package does not ship `scripts/`); the repair keeps every sequence number and turns only the offending statements into ignorable records, and each statement keeps the form that names its owner, so the capability panel and the binding group read back the decisions the session recorded:
+
+  ```sh
+  node scripts/repair-session-log.mjs --input /path/to/session.v4.jsonl.zstd --write --dsh-entry /path/to/dsh/lib/bin.js
+  ```
+
+  `--write` copies the original to `<input>.bak` first, and the command refuses to write a log the released format would still reject. Without `--write` it writes `session.repaired.jsonl.zstd` beside the input and leaves the original untouched, which is the way to inspect the result first.
 
 ## Session format upgrades
 

package/docs/panel-concept.md

@@ -0,0 +1,171 @@
+# 能力面板：施工契约（已被取代）
+
+## 0. 权威
+
+**本文的页面形状已被 [能力面：概念契约](capability-surface.md) 取代。** 现行列集、取值、回执、入口与唯一渲染器由那份契约决定；本文继续生效的部分是 §1 的红线、§5 的写通道（行上的决定走的仍是同一条命令）与 §9 的落地位置，以及读路径的一致性要求。下文出现的七列、证据列、设置页清单投影都随该契约失效，保留在这里作为历史来源，不再是缺陷判据。
+
+
+非目标：不跨会话检索能力；不改冻结语义与 `/capabilities refresh` 的同步含义；不展示 prompt 原文、恢复快照或 worker 内部；不改 REPL 控制台与工作台的分工；**本面板不陈述物化**——方案由运行时在执行前构建，面板只陈述供给、记录与证据；不新增写入器、RPC 写操作或第二写通道。
+
+## 1. 红线：取值不得由面板之外的开关决定
+
+一个字段、一句文案、一个控件状态，若它的取值能被面板之外的任何来源改变——某个进程／服务／运行时／命令没有在运行，或任何全局开关没有启用——它就是缺陷。
+
+判定只有一句：**把那个来源摘掉，这个值会变吗？会变，它就不许存在。**
+
+这条覆盖两类来源，不是一类。「没有在跑」和「没有启用」是同一个错误的两种写法：都让面板去陈述一件它没有资格陈述的事。屏幕上的「未观察／尚未清点／暂不可用／未启用」之所以禁止，是因为它们都是同一个翻译动作的产物：把面板之外的缺失，翻译成面板之内的状态。
+
+推论：面板不需要知道有没有 PTC 运行时，也不需要知道某个开关是开是关；它一旦知道，就一定会在某处把这个知识画到屏幕上。行不存在，是唯一合法的「不能做这件事」的写法。
+
+**这条分界线不落在运行时的有无上，落在「声明面」与「运行时」上。** 两者只差一句：
+
+- **会话的声明面属于会话，必须读。** 这个会话作用域里的工具注册表视图、该作用域解析出的 Skill 层、prompt 装配在该作用域贡献的段，都是宿主对这个会话的供给。会话还有 agent 时，这三样都在它的 scope 上；`agent` 在这里只是取 scope 的句柄，不是「会话可用」的判断，也不是运行时。把它当成运行时来回避，就是把会话自己的声明面误记成 §1 禁止的来源。
+- **PTC 运行时不属于声明面，一律不读。** worker、`canRefresh`、`run_code` 是否存在、方案投递（`prepare`／`refresh` 的重建与投递）、`session.append` 回答的是「这个会话现在能不能执行」，面板从不问这个问题。它们一旦被读，§1 的翻译动作就会以另一种拼写回来。
+- **会话的 agent 已不在时，作用域随之消失**，面板读这个会话自己记录的冻结方案（§7）。冻结方案是会话的事实，不是运行时状态；拿宿主平面顶替它就是把这个缺陷换了方向——把「这个会话的声明面读不到」画成一张更小的表。记录里本来就没有面时（没有方案、方案损坏、或组合时就没有要求库存）这条读失败并点名缺的那条记录，而不是退回宿主平面、也不是画一张空表。
+
+分界只在读哪一处声明：有没有 agent 决定读 scope 还是读那份记录，不决定任何一格怎么写。
+
+## 2. 概念
+
+| 概念 | 回答的问题 | 边界（属于 / 不属于） | 属于它的后果 | 不得混淆的邻居 |
+| --- | --- | --- | --- | --- |
+| **供给** | 宿主对这个会话声明存在什么 | 属于：该会话作用域里的工具注册表视图（含 preset 在 agent 作用域注册的工具）、该作用域解析出的 Skill 层、prompt 装配在该作用域贡献的 MCP／资源服务声明；这个会话的 agent 已不在时，属于它自己记录的冻结面。不属于：这个会话选了它没有、它有没有被证明用过 | 一条供给至少一行；供给没有，行就没有 | 记录：供给说「存在」，记录说「选了什么」 |
+| **记录** | 这个会话写下过哪些决定 | 属于：绑定取用事件、能力选择事件。不属于：运行时构建出的方案、worker 装了什么 | 没有记录 ⇒ 该格取跟随保存的值；只有最后一条已投递方案带 `sessionOverrides` 的旧会话按那条方案折算出的同一条记录作答；绑定取用记录损坏 ⇒ 该行报记录损坏 | 供给：记录不能说某条目存在 |
+| **证据** | 这个会话里有没有一条被接受的执行证明它被拿到过 | 属于：`tool/result` 的 `meta.dshPtcPlusCapabilities.used` 含该 id。不属于：方案、安装、模型是否知道 | 有 ⇒ 一个标记；没有 ⇒ 空格子，不是否定的词 | 记录：记录说「选了」，证据说「拿到过」 |
+| **行** | 哪些对象各自构成一个可决定的单位 | 属于：宿主声明的能力、声明的 MCP 服务、全局绑定文档里 `enabled` 的条目。不属于：没有声明的、没有被供给的、统计聚合出来的 | 一行至少一个控件；对象不能被单独决定，它就不是行 | 组与批量：批量是「对已存在的行同时做同一个决定」，不产生行 |
+| **控件** | 把一条新记录写进这个会话 | 属于：本会话的决定。不属于：全局配置（在设置页）、运行时动作 | 一行必有，永远可点，没有失败分支；写不进去说明该行不该存在 | 设置页的全局开关：它不决定这一行 |
+
+被删除的概念：清单可用性、就绪、处境、投递、`scope`、`plan`、`management`、`live`、`unreadableSupply`。它们不回答任何别的决定，只把面板之外的缺失翻译成界面。**没有这个概念，就没有它的词。**
+
+## 3. 行
+
+- **能力行**：每个宿主声明的能力一条，恒在。声明没有的条目不会因为配置、记录或运行时有无而出现或消失。
+- **服务行**：每个被声明的 MCP 服务一条，`mcpServers.<server>` 是它自己的决定。它是行，不是一批行：整台服务关掉是这个对象自己的决定，不是「筛选后批量」的替代品。
+- **绑定行**：全局绑定文档里 `enabled` 的条目一条。未被供给的条目不进本面板——把它画成一行只会得到一个按不动的按钮。
+- 行集只由供给决定；配置、记录、证据都不增减行。
+
+现行列集是 `对象 | 类型 | 来源 | 保存·启用 | 保存·披露 | 本会话·启用 | 本会话·披露` 加 `回执`（会话入口），由 [能力面：概念契约](capability-surface.md) §4 决定。下面这段是历史形状，不是缺陷判据：
+
+- **保存**：当前配置里的值。能力行曾两维并写（`自动 · 自动`）——「自动」不是取值，这正是契约把它换掉的原因。
+- **可用性／披露**：本会话记录的值，控件就在各自那一格，一格一个控件。
+- **证据**：有执行报告时出现标记。这一列已随裁决四移出决定页，换成点名记录的回执列。
+
+## 4. 词表
+
+下面这张表是历史词表，不是缺陷判据：现行列名、取值与回执由 [能力面：概念契约](capability-surface.md) §4 与 §6 决定，本文的 `可用性`／`证据` 列名与 `开启`／`宿主`／`完整`／`按需`／`自适应`／`已证明` 已随该契约退场。
+
+没有否定词。每个词陈述一件存在的事实。
+
+| 列 | 取值 |
+| --- | --- |
+| 来源 | `DSH 工具`｜`MCP`｜声明的 MCP 服务器名（全部列出，以 `、` 连接）｜`多个服务器`｜Skill 来源桶｜`技能`｜`全局绑定` |
+| 保存·可用性 | `开启`｜`关闭`｜`自动` |
+| 可用性 | `开启`｜`关闭`｜`自动`｜`继承` |
+| 保存·披露 | `宿主`｜`完整`｜`按需`｜`自适应`｜`自动` |
+| 披露 | `宿主`｜`完整`｜`按需`｜`自适应`｜`自动`｜`继承` |
+| 可用性·取用 | `使用`｜`不使用` |
+| 证据 | `已证明` |
+
+`自动` 是「这份记录没有为这个对象写下这一维」，`继承` 是「跟随保存列」，两者不互答。没有记录时可用性列与披露列写 `继承`，不写空、不写「未记录」。日志没有任何选择记录、而最后一条已投递方案带着 `sessionOverrides` 时，这两列陈述的是那条方案折算出的同一条记录（`decided`，标记 `legacy`）；那条方案没有带任何选择时仍是 `继承`。方案的选择表读不出来时这条读是 `unreadable`：能力行没有表达它的词，这两列照常写 `继承`，`记录损坏` 只属于绑定组那条记录（见 §9 的未交付项）。
+
+唯一的例外，且必须同时满足三条：**只由 `classifyBindingAdoption` 返回 `unreadable` 触发**（记录存在但无法解析；记录不存在返回 `none`，不产生这个词）；**陈述的是那条记录，不是面板的状态**；**同一行的控件仍然可点，写一条新记录即取代它**——`记录损坏`。它存在的理由只有一个：另一种做法是替会话报告一个它从未做过的决定。这个词只在面板的行上出现：模型可见的绑定目录没有位置表达「记录不可读」，它对同一条记录发布整份供给，所以 `记录损坏` 不能被读成模型目录的陈述（见 §9 的未交付项）。
+
+一个工具名同时被两个 server 命名空间命名时（`mcp__docs__deep__search` 同时以 `docs`、`docs__deep` 开头），来源列列出这两个 server；历史载荷只声明「有多个 server」而没有名单时写 `多个服务器`。两种写法都陈述存在的事实，来源列不写「未确认／未知／unknown」。
+
+## 5. 写通道
+
+一个意图：把一条新记录写进这个会话。写者只有一个，回执只有一种。
+
+- 绑定 → 取用事件。能力／服务 → 选择事件（携带 id 与选择）。两者同形，都是这个会话的日志事件：`user/message` 携带 PTC 的 `source.form`，不新增事件类型（未知类型会让整份日志拒读）。
+- 写者是**这个会话当前的写所有权**，不是「有没有 PTC 运行时」：
+  - 会话在 DSH 里活着（`sessions.get(id)` 有它，即使没有 PTC 运行时）：用它的 `session.append`。
+  - 会话是冷的（不在 `sessions.get`）：用持久化写句柄 `open(id, 'write')` → `append` → `flush` → **close**，并照运行时交还路径的做法先 `snapshotSessionEvent` 再 `foldSurface` 验证，再 append。
+  - 两个分支写的是同一条记录，回执由写者统一给出。**新会话不进入 PTC 模式时，它是活着的会话，走 append**——这正是今天会抛「select an active PTC session」的那一格。
+- 命令事务（`/binding`、`/capabilities set`）与面板控件走同一个 owner、写同一条记录、给同一种回执。人类输入与面板不是两条路。
+- 记录的物化在运行时：`preStep` 发现记录摘要与现有方案摘要不同时重建方案；`reconcilePendingChoice`、`pendingCommand`／`pendingPrevious` 失去依据，删除。
+- **控件没有失败分支。** 没有禁用、没有预检、没有「先启用某开关」。凡是「这一行现在不能改」的情形，都说明该行不该存在。
+
+一个必然的推论：会话记录了选择，这个会话就是被管理的。全局开关决定这份记录**是否被应用**，不改变页面的任何一格：关掉时记录照旧保留、两列照常陈述，新的决定要到重新启用后才改变运行结果（`src/client-capabilities-view.js` 的格子不读这个开关；它决定的是方案的 `enabled`，以及只由管理开关决定的那种配置是否被发布）。要它成为 §1 禁止的那个来源，除非它开始改变某一格的值——那正是这条推论禁止的。
+
+## 6. 面板形状（出稿依据）
+
+一个 Modal（`管理会话能力`），五区，顺序固定：
+
+1. **头**：标题 + 当前会话标识 + 关闭。
+2. **工具栏**：搜索、类型筛选、来源筛选、批量（对已勾选的行做同一个决定）。
+3. **行区**：表格，§3 的列。
+4. **绑定组**：表格下方，同一套行与列语义；组永远在，行可以为零，零行就是空表，不配一句解释。
+5. **底部**：最近一次写入的回执。能力写入按当前界面语言陈述这次写了哪条记录、什么选择、写进哪个会话或全局设置；绑定组的写入回执是 `/binding` 命令返回的原文（英文），面板不改写它。回执不陈述证明程度，原始载荷留在命令自己的结果里。
+
+行不可展开：面板不陈述第六件事。七列已经分别陈述供给、记录与证据，行里没有可再展开的陈述。
+
+禁止出现在截图上：侧栏、产品名、版本号、服务状态、整块 `disabled` 的区域、空表头配一句解释的整块区域、任何否定词。
+
+**图与词的分工**：稿决定版式、层级、控件形态与密度；**版式以本节文字为准，稿是它的实现目标**；文字一律按 §4 的词表写，图片模型生成的文字不作为契约。两者冲突时以本节与 §4 为准。
+
+本版设计稿：`artifacts/panel-mock/panel-0.5.5.png`（生成物，不入库）。
+
+## 7. 读契约
+
+一次读，三个来源，全成功或全失败：
+
+1. **会话头与事件**：同一次日志取用（`sessionLogOf`：`readSessionLog({id}, query)`；宿主没有 projection 服务时取该会话自己的 `snapshotEvents()`）同时给出 header（含工作目录）与事件。会话头与事件来自同一次日志取用；该次取用失败则整次读失败，不返回部分行集——没有 header 就没有目录，日志读不出时目录也没有。事件只用于取记录与证据。
+2. **供给**：读这个会话自己的声明面。两条分支，都不碰 PTC 运行时：
+   - **会话还有 agent**（任何 DSH agent；不看 `canRefresh`、不看 `run_code`、不看 worker）：`assemble({ agent, scope: agent, ptcPlusCapabilityObservation: true })`、`toolSchemasForAgent(agent)`、`observeSkillsAt({ scope: agent, cwd })`。观察标志让这次公共装配保持被动：它贡献该作用域的段，不准备、不投递，也不重贴 model-facing 传输投影。`agent` 只作作用域句柄——用它判断会话是否可用、调用 `change`／`prepare`／`refresh` 的运行时分支、或 `session.append`，都是缺陷。
+   - **没有 agent 的冷会话**：从会话日志里最新一条方案消息的 `source.snapshot.capabilities` 取面（id／category／name／presentation），交给同一条行合成路径。这是这个会话记录的冻结面，不是宿主平面。这条记录能陈述面的前提是它真的冻结过一份库存：一份记录的 `settings` 经 `requiresCapabilityInventory` 判定为不要求库存时（能力与上下文总开关关闭，或能力管理关闭且记录的策略未启用统计与恢复——判据与组合时同一个 owner，`effectiveCapabilitySettings` 先按总开关压掉管理、统计与恢复）`capabilities` 是空数组，它陈述的是「这次组合没有把任何能力供给模型」，不是「宿主没有声明」。没有方案、方案损坏、或这种没有库存的记录，都让这条读失败并点名缺失的那条记录：不拿宿主平面顶替，也不返回空表——宿主平面只回答「宿主声明了什么」，不回答「这个会话被供给过什么」。
+   配置：`capabilityConfiguration(currentConfig)`。
+3. **绑定文档**：`bindingRows` 读的全局绑定供给（`readUserBindings`），只为绑定组那几行，且只在全局绑定开关打开时读；它读不出时整次读同样失败，不返回部分行集。
+
+来源在实现里各自读，便于定位错误；但**任何一步失败就是整次读失败**：不做部分成功的响应。少了几行而屏幕不说，就是谎。
+
+这条读只有一个入口：`describeSessionCatalog`，两个入口都读它。请求指名会话时读该会话自己的日志与供给（同一个 scope，或同一份冻结方案）；不指名会话时读 `hostSupply({})`，即宿主自己的进程级声明（不含 preset 在 agent 作用域注册的条目），不是任何会话的陈述，因此不充作会话的供给，且这样一次读不列出任何绑定行（绑定采纳没有保存地址）。读路径不得调用 `change`／`prepare`／`refresh` 的运行时分支、不得写（`session.append`）、不得 reconcile 待处理提案，也不得用 `canRefresh`／`run_code`／worker 判断这个会话能不能读：读不产生写，不改变进程态。
+
+读要么给出完整行集，要么整次失败。不存在部分成功的响应：少了几行而屏幕不说，就是谎。失败不是状态，是缺陷——面板给出原始错误、出错的文件或来源，以及重试；空表只表示「宿主真的没有声明」。
+
+响应（`ptc-capability-session-catalog/v2`）：
+
+```
+{ schema: 'ptc-capability-session-catalog/v2', sessionId,
+  rows: [ { id, kind: 'capability'|'server'|'binding',
+            name, category, source,
+            saved,        // 每行都有：能力/服务行取自己的规则，绑定行取绑定文档
+            session,      // 本会话记录的值；绑定行另带 recorded 标明这条采纳是否被写下
+            record,       // 能力/服务行：记录自己的字，layers 标明每一维由哪一层写下
+            evidence } ],  // 能力行：boolean
+  config: { bindingsEnabled } }
+```
+
+- 没有 `live`、没有 `scope`、没有 `plan`、没有 `management`、没有 `unreadableSupply`、没有 `capabilities: null`、没有 `defect` 字段。
+- 失败走 RPC 错误通道，带原始错误；错误不分类来源枚举——来源枚举正是运行时重新溜回来的入口。
+
+## 8. 验收
+
+截图必须能判定：
+
+1. 五区齐备且顺序正确；没有 §6 的禁止项。
+2. 行区有真实的能力行与工具行（`tools.*`，含 `tools.mcp__<server>__*`）与 Skill 行（`skills.*`），条数可数；有被声明的 MCP 服务行。
+3. 每一行都有控件，形态是下拉或按钮，不是开关。
+4. 绑定组在表格下方，每行一个取用控件；组存在，即使零行。
+5. 全屏文字不含否定词族：`未观察`、`尚未清点`、`不可用`、`暂不可用`、`未记录`、`未证明`、`未启用`、`未确认`、`未知`、`unknown`、`unconfirmed`。
+6. 没有整块 `disabled` 区域。
+7. 新会话、不进入 PTC 模式打开面板：1–6 全部成立；进入 PTC 模式再打开：行集、行数与控件数不变。
+8. 点任一控件都能得到一种回执，底栏文字，与有无运行时无关。
+
+**证伪方式**：把运行时摘掉重开面板，行集改为这个会话记录的冻结面：它与活读的差异只允许是方案冻结之后新注册的条目（集合差 ⊆ 新注册）；该记录没有冻结过面时（没有方案、方案损坏、组合时没有要求库存）读失败并说明缺的是哪条记录，既不给一张更小的表，也不给一张空表。把任一全局开关关掉重开，行集必须只按供给变化（开关关掉的是供给，不是行里的值）。若变而本文没有授权，实现即缺陷。
+
+## 9. 实施落点
+
+本节只陈述已交付的落点；未交付的部分单列在末尾，读到它们不算读到授权。
+
+- `internal/capability-selection.js`：`ptc-capability-selection/v1` 的正文与词表、`CAPABILITY_ENTRY_ID`（条目 id 的唯一词表）、`normalizeCapabilitySelection`；`capabilitySelectionText` 是一份记录的唯一正文字面；`capabilityRuleOfSelection` 是一个整选择与它陈述的维度规则相遇的唯一位置；`classifyCapabilitySelection` 与 `capabilitySelectionOf` 是启用与披露两列和组合入口共用的三态读（`none`／`decided`／`unreadable`）；`capabilitySelectionOf` 在日志没有任何选择记录时把最新一条已投递方案的 `sessionOverrides` 折算成同一形态的 `decided`（带 `legacy` 标记）：整选择词与维度规则写的同一个决定读成同一条记录，`prepare` 因此原地恢复那条方案而不是重建；有记录时以记录为准；该方案没有带任何选择时仍是 `none`（这两列照常写 `继承`），方案的选择表读不出来时是 `unreadable`，方案的 `source.sessionId` 不是本会话时不作为本会话的陈述。
+- `internal/capability-environment.js`：`change()` 是唯一写者，按词表判断后写一条语句，不比较方案、不查运行时、不跑预检；`recordSelection` 通过宿主的 `appendPluginRecord` 把这条语句写成 `plugin:ptc-plus/capability-selection` 记录：决定做出的那一刻就落盘，不占 surface、不需要受保护 head、也不等待任何 step，因此新会话开始前的改动在下一次组合里就生效；记录不进入模型可见 surface，`capabilitySelectionOf` 直接读它（`user/message` 形态只作为 0.5.4 及更早会话的历史载体保留，`scripts/repair-session-log.mjs` 会把被旧版本写在 head 之前的语句转成同样的记录）；写入后把这条事件并进本次观察的切面，紧接着的读不会回到被取代的那条；`prepare()` 在记录与已交付组合的 choices 不一致时重建（比较的是两者陈述的决定，不是拼写），重建沿用该组合的 `sourceSettings`（普通刷新仍以冻结来源为准，只有 `refresh` 读当前保存配置）；`describeSessionCatalog` 按 §7 三源读：`sessionCatalogSupply` 决定读哪处声明（`liveAgentFor` 找到 agent 时由 `hostSupply` 以该 agent 为作用域取供给，否则读 `frozenSupply` 重放的冻结面），并在记录没有冻结过面时失败（没有方案、方案损坏、组合时没有要求库存——最后一种由记录自己的 `settings` 经 `requiresCapabilityInventory` 判定，与组合时的判据同一个 owner），`inventory` 接受 `access` 提供的注册表视图与 Skill 观察结果；server 行在 `capabilityRows` 合成且没有自己的披露；`bindingRows` 用 `bindingAdoptionOf` 的三态写绑定行的启用列（取用）。
+- `internal/capability-command-receipt.js`：回执只校验它自己那句话需要的形式（无空白、有界长度）。条目 id 的词表由记录 owner 决定，回执不再保留第二个更窄的词表——更窄的那一个会拒掉会话已经写下的记录，于是写成功而回执成文为失败。
+- `src/client-capabilities-view.js`：八列行模型、常驻绑定组、行内控件直接走命令通道、底栏与聊天卡片共用 `capabilityReceiptNotice`；`src/client-copy.js` 拥有页面自己的标签、区域标题与唯一一份取值词表（`capabilities.word.*`，两种语言各一份），词表的形状与退场词由 [能力面：概念契约](capability-surface.md) §4/§6 决定，接线与本地化由它自己的结构用例校对；`client.cjs` 是 `src/` 的构建产物，与 `scripts/client-fallback-smoke.mjs` 的断言在同一次改动里一起走。
+
+未交付，不得读成已交付：
+
+- **模型可见的绑定目录没有「记录不可读」的表达。** 不可读的最新取用记录只在面板的行上读作 `记录损坏`；同一条记录交给模型目录时按「没有否决」处理，因此整份供给仍然发布给模型。要让模型也知道这条记录不可读，需要一个新增的模型可见陈述，本文没有授权它，也就没有它的词。
+- **能力选择读不可读时面板没有词。** 一条无法解析的能力选择记录（或方案里读不出的选择表）让这条读成为 `unreadable`，而 §4 的例外只授权绑定组写 `记录损坏`：能力行的启用列与披露列没有词陈述它，仍按「没有记录」写 `继承`。要让能力行也陈述这条记录，需要一个本文没有授权的词，因此这里只把它记作未交付。
+- **旧形态只覆盖以 `user/message` 投递的方案。** 一条只存在于命令回执提案里的方案由环境的恢复路径读（`recordedPlan`），不由这条陈述读覆盖：它不是会话的陈述，`prepare` 只把记录读到的选择与那条方案的选择逐项比较，相等时原地恢复那条方案，否则按该组合自己的 `sourceSettings` 与记录重算，那条提案自己的会话选择因此不被恢复（`docs/capability-planning-components.md` 记录了这一边界）。
+- **冷会话的 Skill 来源桶没有记录。** 冻结方案里的 Skill 能力带 id、name、description 与调用资格，不带 provider／source 桶（它们不进入冻结能力快照），因此冷会话的 Skill 行来源列只写「技能」，不写活读能写出的桶名。要让冻结面也陈述桶，需要一个新增的冻结字段，本文没有授权它。这是两个面唯一按设计不同的列，`test/capability-environment.test.js` 的「the replayed Skill row states every column the live row states except the provider bucket」把这条边界钉成断言：重放行除来源桶外每一列都必须与活读相同。
+- **绑定写所有权只有活会话这一条分支。** `internal/user-bindings-owner.js` 的 `recordAdoption` 要求活的 `session.append`；§5 的冷会话持久化写分支没有实现，冷会话写不了取用记录。

package/docs/releases/v0.5.2.md

@@ -12,6 +12,13 @@
 * 检查点的保留窗口在设置里可调：保留最近单元格数（8–512，默认 8）、保留载荷预算（1 MiB–16 MiB，默认 8 MiB，最坏情况约 32 MB）、单元格簇上限（默认与保留单元格数一致，`0` 表示只由载荷预算约束）
 * 计算基线采样、worker 回收、启动探针与宿主执行入口的等待上限，以及连续未测量 cell 的丢弃阈值，都可以按机器情况调整
 
+<h3>稳定性</h3>
+
+* 表面重发布（例如切换工作目录、能力观测、宿主重渲染）不再重建内核：只要 worker 还活着，绑定就在原地保留，视图变化不影响计算状态
+* 恢复提示只在真的需要时出现：完整恢复不再发通知，只有确实无法恢复的绑定才被点名（`PTC-R002`），曾被宣布可用之后消失的绑定另有 `PTC-R006` 点名
+* 编辑命令是追加语义：被接受的编辑新增一次调用，原有单元格与其绑定保持不变；改写历史是可选的未来能力，默认关闭
+* 长会话实测：163 个 run_code 单元格的会话中恢复类诊断数为 0
+
 <h3>修复</h3>
 
 * 会话日志检查点的体积由窗口与预算决定，不再随会话累计写入量无限增长：窗口按条数与字节双重上限把旧结算折成摘要记录，超出预算的单个单元格整簇移除。以每格 20 KB 代码加 20 KB 写入的会话实测，450 格为 0.62 MB、900 格为 0.83 MB
@@ -19,6 +26,8 @@
 * 单个单元格本身就超过载荷预算时，它会连同参数原文一起移出检查点并提示「最新单元格超出保留预算，已从检查点移除」，而不是让检查点无限变大
 * 提示文本面板里的原因码与槽位种类按界面语言显示，中文界面不再出现内部代码；只读槽位的说明与按钮样式与设置页其余部分一致
 * 选中提示文本的某一行后，编辑区会滚动到可见位置，不再出现「点了行却没看到编辑器」
+* REPL 绑定面板在会话投影刷新时保留最后一次确认的清单，不再短暂显示后变成「当前绑定状态尚不可确认」
+* 依赖安全：`zod` 解析到 4.6.7（GHSA-mrhx-c7xc-m3w5，high）
 
 <h3>升级</h3>
 
@@ -29,6 +38,10 @@
 dsh plugin --profile <profile> add dsh-ptc-plus@0.5.2
 ```
 
+<h3>致谢</h3>
+
+* 感谢 @smter 的 #11：定位了「宿主事件循环停顿后，已经到达的采样回复被当成超时丢弃」的竞态，并贡献了随本版本合入的回归用例
+
 ---
 
 <h3 id="en-v052">Host Compatibility</h3>
@@ -43,6 +56,13 @@ dsh plugin --profile <profile> add dsh-ptc-plus@0.5.2
 * The checkpoint retention window is configurable: retained recent cells (8–512, default 8), retained payload budget (1 MiB–16 MiB, default 8 MiB, worst case about 32 MB) and the retained cluster limit (defaults to the retained cells; `0` means the payload budget is the only bound)
 * The bounds for compute-baseline sampling, worker reclamation, the startup probe and the host execution seam, plus the threshold for consecutive unmeasured cells, can be tuned for the machine
 
+<h3>Stability</h3>
+
+* A surface republish (working-directory change, capability observation, host re-render) no longer rebuilds the kernel: while the worker is alive the bindings stay where they are, and a change of view does not change computation state
+* Recovery notices appear only when they are needed: a complete restore is silent, a binding that truly cannot be restored is named (`PTC-R002`), and one that was announced live and later vanished is named separately (`PTC-R006`)
+* An accepted edit appends a call: the original cell and its bindings stay unchanged; rewriting history remains a future opt-in, off by default
+* Measured on a long session: 163 run_code cells produced zero recovery diagnostics
+
 <h3>Fixes</h3>
 
 * The session-log checkpoint is bounded by the window and the budget instead of growing without limit with what the session writes: a count and byte window folds older settlements into summary records and removes a single cell that exceeds the budget on its own. Measured on sessions writing 20 KB of code plus 20 KB per cell: 0.62 MB at 450 cells and 0.83 MB at 900
@@ -50,6 +70,8 @@ dsh plugin --profile <profile> add dsh-ptc-plus@0.5.2
 * A single cell larger than the payload budget is removed with its argument text and reported as "The newest cell exceeded the retention budget and was removed from the checkpoint", instead of letting the checkpoint grow without bound
 * The reason codes and slot kinds in the prompt text surface follow the interface language, so Chinese users no longer see internal identifiers; read-only slot descriptions and buttons match the rest of the settings page
 * Selecting a prompt text row scrolls its editor into view, so a selected row always shows the editor it expands
+* The REPL binding panel keeps the last confirmed inventory when the session projection refreshes, instead of briefly showing it and then falling back to "Current binding state cannot be confirmed"
+* Dependency security: `zod` resolves to 4.6.7 (GHSA-mrhx-c7xc-m3w5, high)
 
 <h3>Upgrade</h3>
 
@@ -60,20 +82,10 @@ dsh plugin --profile <profile> add dsh-ptc-plus@0.5.2
 dsh plugin --profile <profile> add dsh-ptc-plus@0.5.2
 ```
 
----
-
-Full Changelog: https://github.com/muyuanjin/dsh-ptc-plus/compare/v0.5.1...v0.5.2
+<h3>Thanks</h3>
 
-<h3>稳定性</h3>
+* Thanks to @smter for #11: they located the race where a buffered sampling reply was discarded as a timeout after a host event-loop stall, and contributed the regression case that ships with this release
 
-* 表面重发布（例如切换工作目录、能力观测、宿主重渲染）不再重建内核：只要 worker 还活着，绑定就在原地保留，视图变化不影响计算状态
-* 恢复提示只在真的需要时出现：完整恢复不再发通知，只有确实无法恢复的绑定才被点名（`PTC-R002`），曾被宣布可用之后消失的绑定另有 `PTC-R006` 点名
-* 编辑命令是追加语义：被接受的编辑新增一次调用，原有单元格与其绑定保持不变；改写历史是可选的未来能力，默认关闭
-* 长会话实测：163 个 run_code 单元格的会话中恢复类诊断数为 0
-
-<h3 id="en-stability">Stability</h3>
+---
 
-* A surface republish (working-directory change, capability observation, host re-render) no longer rebuilds the kernel: while the worker is alive the bindings stay where they are, and a change of view does not change computation state
-* Recovery notices appear only when they are needed: a complete restore is silent, a binding that truly cannot be restored is named (`PTC-R002`), and one that was announced live and later vanished is named separately (`PTC-R006`)
-* An accepted edit appends a call: the original cell and its bindings stay unchanged; rewriting history remains a future opt-in, off by default
-* Measured on a long session: 163 run_code cells produced zero recovery diagnostics
+Full Changelog: https://github.com/muyuanjin/dsh-ptc-plus/compare/v0.5.1...v0.5.2

package/docs/releases/v0.5.3.md

@@ -0,0 +1,77 @@
+[中文](#cn-v053) | [English](#en-v053)
+
+<h3 id="cn-v053">宿主适配</h3>
+
+* 装在较新的官方 DSH 上照常可用：宿主把 PTC 的工具呈现交给工具执行器后，`run_code` 不再是注册的工具定义。插件向"实际发布它的那一面"要它——注册表注册了就问注册表，执行器拥有它就问执行器——两种形态都不按版本判断。本版本的阻塞通道 `latest` 与 `next` 发布的是注册表形态；执行器形态属于 `alpha` 线，按该线发布的形状适配并只报告结果
+* 状态保留按宿主声明读取：宿主的运行期提供方声明是否为同一个状态所有者保留环境时，插件照它说的报告，不会把一个有状态的程序环境说成无状态；"让位给官方 REPL"也因此看这份声明，而不是看某种源码形式
+* 插件自己的会话执行、`edit_run_code` 改写与其结算证据在新的派发契约上照旧成立：一次工具派发按宿主发布的形式提交（单次调用或整批），改写后的单元格仍读得到新值
+* 宿主若在提示装配之后才声明模型可见的工具，那份声明归宿主所有；插件只在它自己拥有的层面（程序内绑定、SDK、供给规则）继续生效，不会假装替换了宿主未交给它的声明
+* 支持的宿主线用通道表达而不是版本：`latest`（最新发布）、`next`（在途候选）与 `alpha`（尚未发布的那条线）各自对应一条宿主线，插件按每条线发布的形状安装与运行。`latest` 与 `next` 是阻塞通道，本版本的安装与运行证据以它们为准；`alpha` 是提前适配，只报告、不阻塞发布。插件行为不按宿主版本分支
+* 目标发行仍是当前官方 DSH，插件继续使用它的公共扩展面（设置卡片座位、会话投影、能力探测与公共 `Menu`），本版本不要求宿主侧改动
+* 旧版本写下的会话日志照常恢复：本版本之前的结算记录没有新的自证字段，恢复按旧规则读取它们，不需要清空会话或配置
+
+<h3>新增</h3>
+
+* 绑定取用变成会话自己的决定：`/binding status` 列出全局提供的条目，`/binding use <id>` 与 `/binding skip <id>` 决定这个会话用不用，`/binding reset` 回到缺省。没有表态就是全部取用，所以升级后不设置也没有行为变化；决定记在会话里，重启后从日志重建
+* 全局删掉的条目不能在会话里被"救回来"：它已不在目录里，取用只可能收窄，不存在覆盖复活这条路径
+* 设置里新增开关「编辑时替换原单元格」（`editRewritesHistory`，默认关闭）。打开后，已接受的 `edit_run_code` 修订取代目标单元格：后续单元格读到修订的值，目标单元格仍留在日志里但不再参与环境重建，修订不再声明的名字以"被取代"报告（`PTC-R007`），而不是当作丢失
+* 能力设置的收据与本面板的面板把三件事分开说：已保存（全局设置记录了这项选择）、已投递（模型可见目录里已出现该项）、已可用（本会话有完成的执行真的取到了它）。保存或发布都不构成"已可用"，没有证据时如实说未证明
+
+<h3>修复</h3>
+
+* 被事后改动的历史记录不再能充当证据：每个结算在发布时留下自己陈述的摘要，恢复折叠会重算并比较它。status、completion 或诊断措辞被改过的单元格会被判为不可信、被跳过并点名（`PTC-R002`），而不是重放一个从未发生过的单元格；判定是终态，不会进入重试
+* 打开「编辑时替换原单元格」时，被取代单元格的绑定以专门诊断点名，而不是静默消失
+* 取代关系不再取决于修订自己怎么结算：修订读到时间、随机数等 live 状态时按记录值安装，被收缩时干脆不在环境里，但两种情况都仍然取代目标单元格
+* 修订接在被编辑单元格的位置，原本跟在其后的单元格改从修订继续：在编辑之前读到该单元格声明的 cell 不再于冷恢复时丢掉这个声明，恢复也不再因此收缩回被编辑前的值
+* 一次恢复既装入了记录值又取代了单元格时，取代关系照旧报告，不再因为已经发了恢复通知而被丢掉
+* REPL 绑定面板说明清单来自哪个运行期：同一运行期内的投影刷新仍然保留清单；上一个进程留下的快照显示为不可确认，并给出原因，不再静默续用
+
+<h3>升级</h3>
+
+* 需要 Node.js `^22.19.0 || >=24.0.0`；升级插件后请重启 DSH
+* 不需要配置迁移：新开关默认关闭，其它字段沿用既有配置；旧会话日志不需要清理或重写
+
+```sh
+dsh plugin --profile <profile> add dsh-ptc-plus@0.5.3
+```
+
+---
+
+<h3 id="en-v053">Host Compatibility</h3>
+
+* It runs on a newer official DSH: once the host hands PTC tool presentation to a tool executor, `run_code` is no longer a registered tool definition. The plugin asks whichever surface actually publishes it — the registry when one registers it, the executor when one owns it — and neither shape is decided by a version. The blocking channels of this release, `latest` and `next`, publish the registry shape; the executor shape belongs to the `alpha` line, which this release adapts to and reports on without blocking
+* State retention follows the host's declaration: when the host's program runtime declares whether it keeps an environment per state owner, the plugin reports what it says instead of describing a stateful environment as stateless, and handing execution over to the official REPL follows that declaration rather than one source form
+* The plugin's own session execution, its `edit_run_code` revisions and their settlement evidence still hold on the new dispatch contract: one tool dispatch is submitted in the form the host publishes (a single call or a complete batch), and a rewritten cell still reads the revised value
+* When a host declares the model-facing tools after prompt assembly, that declaration belongs to the host; the plugin keeps its own layers (program bindings, SDK, supply rules) and does not claim to have replaced a declaration it was never given
+* Supported host lines are expressed as channels, not versions: `latest` (newest release), `next` (in-flight candidate) and `alpha` (a line the host has not released yet) each name one host line, and the plugin installs and runs on the shape each line publishes. `latest` and `next` are the blocking channels this release's install and run evidence comes from; `alpha` is an early adaptation that reports without blocking a release. Plugin behaviour never branches on a host version
+* This release targets the current official DSH release and keeps using its public extension surfaces (the settings card seat, the session projection, capability probing and the public `Menu`); no host-side change is required
+* Session logs written by earlier versions keep recovering: settlements recorded before this version carry none of the new self-proof fields, and recovery reads them by the older rules, so no session or configuration has to be cleared
+
+<h3>New Features</h3>
+
+* Binding adoption is now the session's own decision: `/binding status` lists the globally supplied entries, `/binding use <id>` and `/binding skip <id>` decide whether this session uses one, and `/binding reset` returns to the default. Saying nothing means every entry is used, so upgrading without touching it changes nothing; the decision lives in the session and is rebuilt from the log after a restart
+* An entry deleted globally cannot be revived from a session: it is no longer in the catalog, adoption can only narrow what is supplied, and there is no override that brings it back
+* New setting **Replace the edited cell in place** (`editRewritesHistory`, off by default). When it is on, an accepted `edit_run_code` revision supersedes its target: later cells read the revision's value, the target keeps its place in the log but no longer rebuilds the environment, and names the revision no longer declares are reported as superseded (`PTC-R007`) instead of being treated as lost
+* A capability receipt and the capability pane now state three facts separately: saved (the global setting records the choice), delivered (the model-visible catalog lists it) and usable (a completed execution in this session actually reached it). Neither saving nor publishing proves usability, and without evidence the pane says so
+
+<h3>Fixes</h3>
+
+* A historical record edited after the fact can no longer serve as evidence: every settlement records a digest of what it published, and the fold recomputes and compares it. A cell whose status, completion or diagnostic wording changed is treated as untrusted, skipped and named (`PTC-R002`) instead of replaying a cell that never ran; the decision is terminal and never becomes a retry
+* With history rewriting on, the bindings of a superseded cell are named by their own diagnostic instead of disappearing silently
+* Supersession no longer depends on how the revision itself settled: a revision that read live state (a clock, a random source) is installed from its recorded values, and one the fold contracts is not in the environment at all, but both still replace their target
+* A revision takes the edited cell's place in the recorded order and the cells that followed it continue from the revision: a cell that read a binding of the edited cell before the edit no longer loses it during cold recovery, and recovery no longer contracts back to the value the edit replaced
+* A recovery that also installed recorded values still reports the relation it adopted instead of dropping it because a restore notice already existed
+* The REPL binding panel states which runtime its inventory came from: a projection refresh inside the same runtime keeps the inventory, while a snapshot left by a previous process reads as unconfirmed with its reason instead of being reused silently
+
+<h3>Upgrade</h3>
+
+* Requires Node.js `^22.19.0 || >=24.0.0`; restart DSH after upgrading the plugin
+* No configuration migration is needed: the new switch is off by default and other fields keep their values; existing session logs need no cleanup or rewrite
+
+```sh
+dsh plugin --profile <profile> add dsh-ptc-plus@0.5.3
+```
+
+---
+
+Full Changelog: https://github.com/muyuanjin/dsh-ptc-plus/compare/v0.5.2...v0.5.3

package/docs/releases/v0.5.4.md

@@ -0,0 +1,75 @@
+[中文](#cn-v054) | [English](#en-v054)
+
+<h3 id="cn-v054">宿主适配</h3>
+
+* 目标仍是当前官方 DSH 发行：插件继续使用它的公共扩展面（设置卡片座位、会话投影、能力探测与公共 `Menu`），本版本不要求宿主侧改动，也不按宿主版本分支；`engines.dsh` 声明 `>=0.2.1-0 <0.2.3`
+* 会话的能力决定与绑定取用改为写进会话日志本身，不再占用对话消息：重载或重启后恢复会话时，面板读到的仍是当时那次决定，模型也不会因此多收到一条消息
+* 支持哪些宿主仍由通道表达，而不是由版本号判定：`latest` 与 `next` 是阻塞通道，`alpha` 线只报告结果
+
+<h3>新增</h3>
+
+* 会话能力面板按「宿主提供了什么、这个会话记录了哪些决定、证据落在哪一层」重排：每行分列陈述对象、类型、来源、已保存的启用与披露、本会话的启用与披露，以及这一行的回执；点击列头可按该列排序
+* 会话里直接列出全局绑定条目，并在面板里控制这个会话用不用它：每行按本会话的采纳记录读作「使用」「不使用」或「记录损坏」，点这一格就写下这个会话的取用；全局已停用的条目不出现在清单里。点击提交的就是人类输入的同一条 `/binding use|skip <id>` 命令，面板不新增写通道，结果按同一份会话能力目录回读
+* 面板同时出现在会话入口与设置页：设置页编辑保存的规则，会话入口只写本会话的记录，两个入口各自固定自己的地址，不互相代替
+* 支持一次选择多行、批量写下同一个决定，每行仍然各写一条记录，回执列逐行说明这次决定落在哪一层
+
+<h3>修复</h3>
+
+* 本会话关闭过的能力不再出现在任何模型可见处：`tools:sdk` 声明块、程序里真实的 `tools` 成员、`capabilities.*` 的探索结果，以及能力方案与说明段，都与这个会话真正可调的成员保持一致，关闭的能力不会只剩声明还在
+* 已保存的开关单独成列陈述，不再与本会话的记录混读：一列只回答「保存了什么」，另一列只回答「这个会话记录了什么」
+* 能力状态改用整块样式区分，而不是给控件里的文字染色：下拉控件保持正常文字颜色，只改它的填充与边框，行首的标记与那一格的词照旧陈述状态；只陈述文字的那一列改用同样底色的胶囊标签
+* 能力变更的回执在会话里常驻：它不再因为会话里还没有人类消息而在发出第一句话时消失，连续几次写入合并成一张卡片、逐行列出这次改了哪些条目
+* REPL 页签改排在宿主自己的页签之后，不再插在原生页签之间：对话、轨迹与实验性统计仍按宿主的顺序排列，REPL 尾随它们
+* 设置页的能力表格恢复滚轮滚动：鼠标停在表格上时页面照常滚动；名称与来源单行省略，完整文字保留为悬浮提示，长名字不再把整行撑高
+* 本版本写入的能力决定不会再让会话在重载时读不出来；旧版本留下的这类日志不再由新版写入
+* 没有活动运行时的会话不再被读成「读不出来」：面板读它日志里最后一版方案，列出的行与有运行时时一致；真的读不出来时，错误与重试就写在行旁
+* 绑定组永远在：读失败在行旁报出并可重试；可读但没有任何条目时它就是一张空表，不另配一句解释
+
+<h3>升级</h3>
+
+* 需要 Node.js `^22.19.0 || >=24.0.0`；升级插件后请重启 DSH
+* 不需要配置迁移：本版本不改配置字段；已有会话日志不需要清理或重写
+
+```sh
+dsh plugin --profile <profile> add dsh-ptc-plus@0.5.4
+```
+
+---
+
+<h3 id="en-v054">Host Compatibility</h3>
+
+* It still targets the current official DSH release and keeps using its public extension surfaces (the settings card seat, the session projection, capability probing and the public `Menu`); no host-side change is required, and no behaviour branches on a host version. `engines.dsh` declares `>=0.2.1-0 <0.2.3`
+* A session's capability decisions and binding adoption are now written into the session log itself instead of taking up conversation messages: when a session is reloaded or resumed after a restart, the panel still reads the decision that was made, and the model receives no extra message for it
+* Which hosts are supported is still expressed as channels rather than decided by a version number: `latest` and `next` are the blocking channels, and the `alpha` line is reported on without blocking a release
+
+<h3>New Features</h3>
+
+* The session capability panel is organised around what this host supplies, which decisions this session recorded, and which layer the evidence belongs to: each row states its object, type, source, the saved availability and disclosure, this session's availability and disclosure, and that row's receipt; a column header sorts by its own column
+* The panel lists the global binding entries and controls, for this session, whether it uses one: every row reads as used in this session, not used in this session, or a damaged record, and its cell writes this session's adoption when it is clicked; an entry disabled globally is not listed at all. Clicking submits the same `/binding use|skip <id>` command a human types, the panel adds no write channel, and it reads the result back from the same session capability catalog
+* The panel appears at both entrances: the settings page edits saved rules, the session entrance only writes this session's record, and each entrance fixes its own address instead of standing in for the other
+* Several rows can be selected and given the same decision at once, each still writing its own record, and the receipt column says per row which layer the decision reached
+
+<h3>Fixes</h3>
+
+* A capability this session closed no longer appears anywhere the model can see: the `tools:sdk` declaration block, the real `tools` members of a program, what `capabilities.*` can explore, and the capability plans and guidance sections all agree with the members this session can actually call, so a closed capability is never left declared on its own
+* The saved switch is stated in its own column instead of being read together with this session's record: one column answers only "what is saved", the other only "what this session recorded"
+* A capability state is told apart by the whole control instead of by tinting its words: a dropdown keeps the normal label colour and only its fill and border change, the row mark and the cell word still state the state, and a word-only cell states it as a chip of the same tone
+* The receipt of a capability change now stays in the conversation: it no longer disappears when the first message gives the window a starting point, and several writes that arrive together are stated once, as one card listing what each one changed
+* The REPL tab now trails the Host's own tabs instead of sorting between them: Conversation, Trajectory and the experimental statistics tab keep the Host's order, and REPL follows them
+* The settings capability table scrolls with the wheel again: the page scrolls while the pointer is over the table, the name and source clip to one line with the full text kept as a tooltip, and a long name no longer makes its whole row taller
+* A capability decision written by this version no longer makes a session unreadable when it is reloaded, and the logs older releases left behind are no longer written by this one
+* A session with no live runtime is no longer read as unreadable: the panel reads the last plan its log carries and lists the same rows a live session lists, and a read that really fails states the error and its retry beside the rows
+* The binding group is always present: a failed read is reported beside the rows with its retry, and a readable group with no entries is an empty table rather than a sentence explaining it
+
+<h3>Upgrade</h3>
+
+* Requires Node.js `^22.19.0 || >=24.0.0`; restart DSH after upgrading the plugin
+* No configuration migration is needed: no configuration field changes in this version, and existing session logs need no cleanup or rewrite
+
+```sh
+dsh plugin --profile <profile> add dsh-ptc-plus@0.5.4
+```
+
+---
+
+Full Changelog: https://github.com/muyuanjin/dsh-ptc-plus/compare/v0.5.3...v0.5.4