kiokuko-dsh 0.2.39 → 0.2.41

package/docs/dsh-plugin.md

@@ -5,13 +5,13 @@ Kiokuko provides an out-of-tree DeepSeek Harness bundle at `kiokuko-dsh`.
 not fork DeepSeek Harness or modify a repository's files.
 
 These installation instructions use the full compatibility package. A separate
-`kiokuko-dsh/core` entry and local core/Enno/Lisp artifacts are available through
+`kiokuko-dsh/core` entry and local core/Lisp artifacts are available through
 the [configured module build](core-modules.md). Selecting a subpath alone does
 not remove files or dependencies from an installed full package.
 
 ## Compatibility
 
-Compatibility depends on the native APIs exercised by the disposable-profile tests, not a package-version prefix. CI resolves official DSH master once, builds that exact revision and records it with the test evidence. Historical release records and locked fixtures remain reproducibility data, not proof of current-upstream support.
+Compatibility depends on the native APIs exercised by the disposable-profile tests, not a package-version prefix. Each CI run resolves the latest official DSH master, builds that revision and records it with the test evidence. The resolved SHA forces compatibility coverage even for prose-only changes; daily GitHub runs also detect upstream-only changes. The SHA is shared within that run, never reused as a fixed baseline for later runs. Historical release records and locked fixtures remain reproducibility data, not proof of current-upstream support.
 
 On hosts exposing the batch executor API, development Lisp preserves the Agent’s selected native or PTC executor. Host-owned nested calls use DSH’s exported invocation pipeline, retaining scoped policy, cancellation settlement and host-only task authority. They are not submitted as model batches.
 
@@ -63,7 +63,7 @@ events; ordinary conversation text and native todo items are not state evidence.
 
 `toolExposure.mode` defaults to `auto`. On verified OpenAI API routes, normal
 chat/research/analysis/writing/review omit Kiokuko model tools; build/debug/devops
-and active Enno use phase/nextAction filtering with lean descriptions. Native
+use lean descriptions. Native
 and external tools remain available. Explicit `full` preserves the surface.
 `phase` removes only verified Kiokuko tools that are unavailable in the current
 execution phase. Opt-in `lean` applies the same phase policy and removes the
@@ -439,184 +439,48 @@ depend on a consumer-side build permission.
 
 ## Runtime contract
 
-The Core SQLite database remains the semantic authority for Akinator, memory,
-Enno-Oduno, receipts, leases, and verifier evidence. DeepSeek `SessionEvent`
-is the canonical current-session transcript and tool-evidence boundary.
-Kiokuko copies events and verified attachment bytes into a separate,
-rebuildable cache for bounded export and post-completion finalization. Cache
-listeners contain their own failures; only an orchestration-requested native
-`sessions.flush()` remains an awaited, fail-closed durability boundary.
-
-Conversation-first intake permits text answers before execution preparation. Native `read`, `glob`, `grep`, `web_search`, and `web_fetch` demands automatically prepare the complete original request; when its action type is unresolved, `research` is advisory only. Models can read a plan or inspect files directly without a separate `prepare_requested_work` call. Missing targets, unresolved user choices, native permissions, current session ownership, and pending memory checks still govern admission. Other unclassified tools and arbitrary PTC programs retain explicit preparation requirements.
-
-The dsh integration provides:
-
-- the exact bundled `kiokuko-soul` system-prompt section and seven standard Skill
-  providers;
-- named context fragments deduplicated against the retained native conversation
-  and current message batch. Turns and phase changes append only changed
-  fragments; the SOUL body stays in the system prompt. Compaction, session resume,
-  and plugin reload restore missing fragments from current host state. A proposed
-  message is not treated as delivered until the native loop retains or queues it;
-- the original human request and attachments remain native messages. Kiokuko's
-  task context contains only additional intake facts, omitting exact request
-  copies and request prefixes in those fields;
-- one current Akinator question at a time only when the task type remains
-  ambiguous; the canonical workspace and exact user request ground the target
-  and completion fields without asking the user to repeat known context, and
-  unresolved intake blocks the model and tools;
-- Japanese task-type labels with concrete examples and guidance distinguishing
-  file changes from drafting text. Kiokuko's initial Web question supports
-  number keys 1–8 to select and Enter to confirm; digits entered in the custom
-  field (including full-width digits) resolve in the same displayed order.
-  Shift+Enter and IME composition do not submit. Pending drafts survive a
-  Session switch. Every single-select question carrying one to nine options uses
-  the same numbered card — Kiokuko's own intake, the Enno and Deep selection
-  questions, an agent-composed choice such as a release step, and another
-  plugin's question alike — so a shortcut is never missing from a question this
-  composer shows. Carriers a single number key cannot address — multi-select
-  batches, optionless prompts, several questions in one request, and catalogs
-  larger than nine options outside the Enno and Deep flows — retain their native
-  UI. Plan-review cards also use numbered choices: discussion first, refusal
-  when offered, then approval. Cmd/Ctrl+1–3 selects a choice and Enter confirms;
-  selecting a number alone never submits approval. The plan remains rendered as
-  Markdown, and answers preserve the host's exact option labels. Discussion
-  cancels the request through the native carrier;
-- an explicit `chat` intake choice (including free-form aliases such as
-  `just chatting` and `雑談`) and the task-type question's **Skip this
-  question** action; both skip target/success follow-ups and never create an
-  Enno-Oduno contract, and the chat choice carries across conversational
-  follow-ups until an explicit actionable request starts a new run;
-- the Kiokuko operations, with only the nine model-facing operations
-  exposed as model tools and host identity injected after argument validation;
-- host-bound capability catalogs are carried into plan submission, while
-  advisory digests remain host-owned and the current model reports only its
-  per-slot advisory dispositions after receiving the bounded advisory evidence;
-- Oduno ideal directives distinguish the mandatory Skill reading list from
-  Akinator-discovered Skill contributions, constrain the latter to the exact
-  selected names (including an exact empty list), and return bounded corrective
-  field diagnostics to DSH when a submission is rejected;
-- request-scoped Ponytail state for concurrent DSH conversations, with native
-  commands routed to the exact invoking agent and session;
-- revision, route, phase, lease, idempotency, confirmation, verifier, and
-  meditation gates through the Kiokuko core;
-- final verification compares the workspace at verification start, so completed
-  implementation edits are allowed. Git and ordinary directories use the same
-  file selection as their repository snapshots; unchanged content and ignored
-  build output do not trigger plan approval. Actual source changes still
-  invalidate evidence, while an unavailable mutation audit stops with a host
-  error instead of requesting another plan or repeating completed work;
-- a non-terminal tool result whose next action requires host work (plan confirmation or
-  final verification) calls DSH `concludeTurn()` only after
-  the successful result exists. Plan submission therefore concludes its model
-  step before DSH opens a dedicated `plan-review` interaction. Receipt,
-  handoff, outbox, and seal commit atomically; a separate durable job then owns
-  approval or cancellation. `agent/turn-stopping` only kicks that worker, so no model tool call remains
-  live while the user decides and no stale confirmation directive can race the
-  next Goki role. The card offers approve/cancel; **Chat about it** returns the
-  normal composer, and the next human message becomes same-run revision
-  feedback before Zenki resumes. DSH defines the card chrome from its own UI
-  locale, while Kiokuko supplies the plan body as Markdown. Kiokuko derives an
-  English or Japanese body language from the original task, instructs Zenki to
-  keep every natural-language plan field in that language, and renders headings,
-  lists, paths, commands, dependencies, checks, and limits without changing the
-  DSH `plan-review` intent or decision labels;
-- a durable run-to-`turn/start` binding and an immutable terminal `turn/end`
-  boundary. A successful Oduno meditation result deliberately does not call
-  `concludeTurn()`: the same native turn remains open for one visible assistant
-  response summarizing the outcome, changes, verification, and remaining
-  uncertainty. On the resulting genuinely terminal idle boundary, the adapter
-  awaits DSH's exact live `sessions.flush(session)` before the ledger close,
-  including the tool result and that final assistant/turn suffix. The
-  background finalizer reads only that inclusive range even if the session has
-  already received later turns. If the final response is empty or its provider
-  fails, a durable plugin-owned result appears in chat, using recorded work,
-  verification, and remaining issues. It does not impersonate a model message
-  or make another model request. The fallback remains visible after reload;
-- bounded turn continuation, exact run/session/workspace/route binding, and
-  in-memory plaintext continuation tokens.
-
-Natural model stops before a required phase submission enter the same durable
-three-delivery loop guard. Boundary workers serialize per session, not across
-unrelated sessions. New human input aborts pending questions and supersedes old
-jobs; delivery rechecks ownership after native flushing. Future retry times and
-expired-owner recovery are scheduled from the database after restart as well
-as during normal operation.
-
-CI requires full native-loop coverage against the pinned published runtime,
-including natural stops, identical work-report retries, approval cancellation,
-and both empty and failed final responses. Package installation alone is not
-treated as proof of workflow completion.
-
-Expected validation or omission failures become bounded retry receipts. The
-first identical failure retries the same phase with temporary evidence; the
-second asks Akinator. A deterministic continuation is delivered only after a
-native flush. Human input supersedes a pending continuation, and plugin delivery
-IDs alone are deduplicated at the next pre-step.
-
-A DSH model-request failure, including a WebSocket failure, also leaves an
-unfinished Enno run active and does not automatically replay model or tool
-work. When the user continues in a later turn, the adapter revalidates the exact
-DSH session, contract revision, and current WorkUnit, then rotates its execution
-lease before reinjecting the directive. Recovery therefore remains available
-after the old 15-minute lease expires without allowing an older turn to report.
-
-Ordinary chat remains open while the agent is idle between conversational
-messages. An explicit build, debug, review, research, writing, analysis, or
-DevOps request closes the preceding chat run before starting its task run.
-An unfinished, resumable non-chat run remains bound across later user turns so
-a follow-up instruction does not orphan the existing plan. Completed,
-cancelled, and blocked runs are closed before the next independent request
-starts; blocked runs retain their failed ledger outcome rather than lingering
-as unusable active bindings. Disposing the DSH session closes its current run
-after queued events are durable.
-
-Short status checks such as `all fixed?` are classified as analysis rather than
-as a new fix request, and commit-message requests are classified as writing.
-If either arrives while an earlier Enno run is still at the unstarted Oduno
-ideal boundary, the old run is cancelled and the explicit lightweight request
-starts independently instead of being trapped inside that contract.
-
-After a plugin reload or process restart has cleared in-memory turn state, the
-adapter resumes only the single unambiguous active Enno-Oduno run already bound
-to the same persistent DSH session and canonical repository. The session is
-revalidated through the core continuation gate, persisted pending advisory evidence is restored once, and
-previous ordinary-memory context is not replayed implicitly. Multiple matching
-runs, a continuation limit, a conflicting execution lease, or a changed
-capability catalog still fails closed instead of selecting or advancing a run.
-User questions retain the exact live native Agent object; confirmation answers
-revalidate both that scope and the bound catalog/revision before they can mutate
-the core state machine.
-
-`runId` is required for dsh resume. The plugin never selects a repository-wide
-latest run. Ambiguous, stale, cancelled, aborted, lease-conflicting, or
-unavailable states stop without converting the failure into a normal success.
+Kiokuko owns the input → model → tool → result → continue/finish loop through
+DSH's AgentFactory/Agent API. The default bundle disables the stock AgentLoop;
+model connections, native SessionEvent records and Web/CLI consumers retain
+their DSH contracts. The explicit legacy-loop profile selects the stock loop
+instead of the Kiokuko factory; the two loops never drive the same agent.
+
+The native session retains the human request, attachments, model responses and
+tool results. Kiokuko's SQLite database owns task identity, execution receipts
+and memory. AgenticReplay records correlated execution for inspection; it does
+not replace the memory store or authorize replay of effects.
+
+Current session ownership, explicit operation permissions, cancellation and
+Plan state are checked at the operation boundary. Memory retrieval, extraction
+and saving are optional: their failure cannot authorize an operation, block
+unrelated development or establish completion. Diagnostics distinguish work,
+verification, receipt persistence and memory storage.
+
+Owned operations keep stable request identities and durable receipts. Exact
+retries return saved results; changed arguments conflict. After interruption,
+unknown effects are reported without re-execution. Receipt persistence retries
+and memory adoption retries reuse their existing journals and staged results.
+
+A follow-up stays in its native session. Resume requires the exact session and
+repository binding; ambiguous or stale ownership cannot be replaced with a
+repository-wide latest task. Explicit task completion advances its authority;
+final closing rechecks that authority so a delayed close cannot retire resumed
+work. An idle model or a passing intermediate test is not task completion.
+
+Lisp is an optional tool surface. Every Lisp worker is OS-isolated; workspace
+changes and external commands use host tools and their permission checks.
+The development surface coexists with ordinary tools, and its worker failure
+leaves those tools available. See [owned execution](owned-execution.md) for
+operation receipts, recovery and the protected compatibility mode.
 
 ## Verification
 
-From the Kiokuko checkout:
-
-```bash
-npm run test:e2e:dsh
-```
-
-This builds the package, runs the Cordis composition test with an in-memory
-host adapter, validates model/tool/question/ledger/turn-end boundaries, and
-then runs the pack/install/dump-config/Web-start/Web-stop/remove flow when a
-`dsh` executable is available. When `DSH_BIN` points into a local DeepSeek
-Harness source checkout (or `KIOKUKO_DSH_SOURCE_ROOT` is set), it also resumes a
-persisted pending advisory round and runs two consecutive full Enno agent-loop
-flows through intake, ideal, planning, dedicated review, work reporting, final
-verification, advisory disposition, meditation, native DSH checkpoint,
-terminal close, and post-completion memory finalization. The second flow
-dismisses review, carries revision feedback through the
-next human turn, resubmits, and approves before work starts. It then handles
-consecutive `all fixed?` and commit-message turns without creating another Enno
-contract. The first flow includes a long streamed response and verifies that
-no DSH events are copied into the Kiokuko ledger; the rebuildable mirror retains
-them for cursor-backed finalization/export and records cache usage. Without a dsh executable the CLI portion is reported
-as `unsupported`; CI sets `KIOKUKO_REQUIRE_DSH_CLI=1` so absence is a failure
-rather than an unverified success.
+From the Kiokuko checkout, `npm run build && node scripts/run-tests.mjs tests/dsh/e2e`
+builds the package, runs the Cordis composition test with an in-memory host
+adapter, and validates model/tool/ledger/turn-end boundaries. The
+pack/install/Web-start/Web-stop/remove flow is exercised by the pinned
+end-to-end suite when a `dsh` executable is available; without one the CLI
+portion is reported as `unsupported`.
 
 The terminal profile has a separate acceptance runner. Supply a built DSH CLI,
 packed UI and Kiokuko tarballs, the installed `node-pty/package.json`, and a

package/docs/execution-ledger.md

@@ -4,8 +4,7 @@ The ledger records one DSH run, its Akinator intake, ordered lifecycle events,
 evidence, context deliveries, and feedback. Every `ledger_runs` row carries its
 authoritative `dsh_session_id`; the schema baseline has no client-kind column.
 
-DSH session rebinding emits `enno.dsh_session_bound` or
-`enno.dsh_session_rebound` with
+DSH session rebinding emits its rebind lifecycle event with
 only the previous and next DSH session IDs. The route epoch increments at the
 same mutation. A current WorkUnit lease prevents rebinding; an expired lease may
 be replaced atomically by the new session.

package/docs/execution-support.md

@@ -5,7 +5,7 @@
 上限付きの表示に置き換えます。圧縮で消えた snapshot は再提示の抑制に使いません。
 設定、限界、無効化と検証結果は [continuity.md](continuity.md) を参照してください。
 
-対応するDSHは `0.2.1-alpha.2`。この機能はKiokukoの任意の補助状態として動作し、モデル呼び出しや独立した承認画面を追加しません。Ennoの必須検証、改訂番号、WorkUnitの実行権限、receipt、outbox、最終回答の境界は従来の処理が管理します。
+対応するDSHは `0.2.1-alpha.2`。この機能はKiokukoの任意の補助状態として動作し、モデル呼び出しや独立した承認画面を追加しません。改訂番号、receipt、outbox、最終回答の境界は従来の処理が管理します。
 
 ## 作業条件の指定
 
@@ -36,13 +36,13 @@
 
 `completion.mode` は `shadow` が既定です。条件別に `satisfied`、`unmet`、`unknown`、`stale` を記録しますが、従来の終了動作は変えません。`enforce` を明示した場合は、その設定で開始した新しいrunだけを対象とし、明示・承認済みの必須条件に新しい証拠がそろうまで検証待ちとして保持します。会話ターンの終了や、追加の指示・取消は妨げません。
 
-モデル向け `task_completion` の `status` は条件と不足理由を返し、`bind` は条件と検証方法の対応を提案します。`bind` はコマンドを実行しません。通常実行では、検証方法の承認後、リポジトリ直下で実行した正確なforegroundコマンドと対象ファイルの状態をホストが観測します。Ennoでは承認済みの最終verifierを参照しますが、そのverifierと個別条件の対応は別に承認を受けます。条件の変更、対象ファイルの変更、別runの結果は古い証拠として扱います。回答文だけで条件を達成済みとは判定しません。
+モデル向け `task_completion` の `status` は条件と不足理由を返し、`bind` は条件と検証方法の対応を提案します。`bind` はコマンドを実行しません。検証方法の承認後、リポジトリ直下で実行した正確なforegroundコマンドと対象ファイルの状態をホストが観測します。条件の変更、対象ファイルの変更、別runの結果は古い証拠として扱います。回答文だけで条件を達成済みとは判定しません。
 
-`exit_zero` は指定コマンドの正常終了だけを表します。`selected_tests_pass` は対象を絞ったNode test/TAPの最終集計が必要です。対象テストのスキップ・未完了は未達、集計が欠ける場合は不明です。Ennoで検証後に条件との対応を承認した場合、その前の結果は使わずホストが検証し直します。旧verifierの確認範囲が不明な場合も、自動的に全テスト実行済みへ変更しません。通常実行にEnnoのWorkUnitは作りません。
+`exit_zero` は指定コマンドの正常終了だけを表します。`selected_tests_pass` は対象を絞ったNode test/TAPの最終集計が必要です。対象テストのスキップ・未完了は未達、集計が欠ける場合は不明です。
 
 パス指定はリテラルです。glob式や自然文の「src以外は変更しない」を新しい機械制約へ自動変換しません。引用行、コードブロック、インデントされた例からも強制条件を作りません。添付ファイルの内容をこの抽出器へ読み込むことはありません。原文と出典のダイジェストを保持し、再提示が長くなる場合は表示だけを短縮します。強制対象のパス条件を黙って間引くことはありません。
 
-同じラベルを後の人間の入力で明示し直すと、その条件を更新します。単なる「続行」では消えません。自然文の解釈候補は、Oduno/Zenkiが任意の `executionHints` として提出できます。
+同じラベルを後の人間の入力で明示し直すと、その条件を更新します。単なる「続行」では消えません。自然文から取り出した条件は候補として扱い、明示された入力と照合します。
 
 ```json
 {
@@ -58,7 +58,7 @@
 
 対応する構造化ツールは `read`、`read_image`、`glob`、`grep`、`write`、`edit`、および `str_replace_editor` の `view/create/str_replace/insert/undo_edit` です。探索ツールの省略されたパスは作業ディレクトリです。パスの祖先も解決するため、新規ファイルをシンボリックリンク経由で範囲外へ作る操作も拒否します。
 
-拒否は当該ツールの通常のエラー結果です。報告・質問回答・取消・記憶保存をこのガードで拒否しません。既存のEnnoのフェーズやleaseの検証は別に適用されます。既知の条件を復元できない場合は、その条件に依存する操作を保留し、会話と復旧入力を受け付けます。
+拒否は当該ツールの通常のエラー結果です。報告・質問回答・取消・記憶保存をこのガードで拒否しません。既知の条件を復元できない場合は、その条件に依存する操作を保留し、会話と復旧入力を受け付けます。
 
 これはOSのサンドボックスではありません。任意Shell、未対応ツール、別のファイルシステムを持つ外部サービス、呼び出し後の外部変更を完全に制御する機能ではありません。検索の指定パスを検査するもので、外部サービスの検索実装全体を仲介するものでもありません。
 
@@ -69,9 +69,8 @@
 同じ検索・読み取りと同じ結果を3回観測すると、次の要求で軌道修正を一度提示します。その提示後に開始された操作が同じ結果を繰り返した場合、入力を消費しないステップ境界で一時停止します。同時実行された4件を、注意後の再反復とは判定しません。24件ごとの整理要求は助言です。
 
 - 実際の子call IDでPTCを識別し、同じイベントの再配送は計数しません。
-- ホスト検証、Enno提出、状態確認、記憶保存は計数しません。
+- ホスト検証、状態確認、記憶保存は計数しません。
 - 再検証の実行世代が変わったら、正当な再読を新しく扱います。
-- カウンターや提示状態はEnnoの進展ダイジェストに入りません。
 - 停止通知をネイティブログへ保存しflushできた場合だけ停止します。失敗時は助言へ縮退します。
 - ターン封鎖や成功receiptを作って停止を偽装しません。「提出忘れ」の継続も生成しません。
 - 新しいユーザー入力で停止を解除し、条件・承認・検証結果は保持します。別sessionには波及しません。

package/docs/harness-map.md

@@ -8,7 +8,7 @@ Use this map to find the current entry point and a focused check before editing.
 | Advisory decision provenance and diagnostics | `src/dsh/decisions/diagnostics.ts`, `src/dsh/decisions/service.ts`, `src/dsh/on-demand-intake.ts`; [contract](decision-diagnostics.md) | `node scripts/run-tests.mjs tests/dsh/integration/decision-diagnostics.test.ts tests/dsh/integration/decision-diagnostics-native.test.ts tests/dsh/integration/turn-process.test.ts` |
 | Independent intent comparison and finite-domain judge | `src/dsh/decisions/intent-assessment.ts`, `src/dsh/decisions/micro-judge.ts`, `crates/micro-judge/src/main.rs`; [contract](micro-judge.md) | `KIOKUKO_REQUIRE_MICRO_JUDGE=1 node scripts/run-tests.mjs tests/dsh/integration/micro-judge.test.ts tests/dsh/integration/request-intent-clarification-native.test.ts` |
 | Task conditions and structured file scope | `src/dsh/execution-frame.ts`, `src/dsh/execution-support.ts` | `node scripts/run-tests.mjs tests/dsh/unit/execution-support.test.ts` |
-| Normal and Enno completion evidence | `src/dsh/task-completion.ts`, `src/enno-oduno/service.ts` | `node scripts/run-tests.mjs tests/dsh/unit/task-completion.test.ts tests/dsh/integration/final-verification` |
+| Normal completion evidence | `src/dsh/task-completion.ts` | `node scripts/run-tests.mjs tests/dsh/unit/task-completion.test.ts` |
 | Durable continuation and recovery | `src/dsh/turn-process.ts`, `src/dsh/boundary-worker.ts` | `node scripts/run-tests.mjs tests/dsh/integration/boundary-worker.test.ts` |
 | Memory selection and application | `src/dsh/message-sources.ts`, `src/dsh/memory-application.ts` | `node scripts/run-tests.mjs tests/dsh/integration/memory-application.test.ts` |
 | Context projection and provenance | `src/dsh/context-projection.ts`, `src/dsh/agenticreplay-event-mapper.ts` | `node scripts/run-tests.mjs tests/dsh/unit/agenticreplay-request-manifest.test.ts tests/dsh/integration/continuity` |

package/docs/japanese-output.md

@@ -3,7 +3,7 @@
 Kiokuko automatically includes the complete bundled
 [Natural Japanese Output Skill](../skills/japanese-translation-for-oss-models/SKILL.md)
 in native Agent prompts for DeepSeek, Kimi, GLM, Qwen, HY/Hunyuan, MiMo and
-MiniMax model families. This covers ordinary work, Enno roles and Deep workers.
+MiniMax model families. This covers ordinary work and Deep workers.
 No additional configuration or Skill tool permission is needed.
 
 The exact selected **model ID** determines the match, after host routing.

package/docs/keyboard-shortcuts.md

@@ -1,6 +1,6 @@
 # 選択画面のキー操作
 
-質問カードは、質問IDに関係なく番号で選べます。通常実行、Enno、Deep、AgenticReplay、Lisp、承認画面も同じ操作です。
+質問カードは、質問IDに関係なく番号で選べます。実行方式、Deep、AgenticReplay、Lisp、承認画面も同じ操作です。
 
 | 操作 | キー |
 | --- | --- |

package/docs/kiokuko-harness.md

@@ -0,0 +1,71 @@
+# Kiokuko-owned harness
+
+This unreleased source build replaces DSH's agent factory through a plugin. It does not modify DSH core or dsh-cli. The bundle disables `agent-loop` and installs `kiokuko-dsh/harness`; do not enable both factories in one profile.
+
+## Configuration
+
+Build the package, then install the resulting local tarball into an isolated profile:
+
+```sh
+npm ci --ignore-scripts
+npm run build
+npm pack --ignore-scripts
+dsh plugin --profile dsh-cli add ./kiokuko-dsh-0.2.39.tgz --ignore-scripts
+dsh --profile dsh-cli --dump-config
+dsh-cli
+```
+
+The profile must already supply DSH and the CLI's required peer services. DSH delegates plugin installation to pnpm; adding a tarball with npm to an existing dsh-cli dependency tree can reject the CLI's bundled `workspace:*` dependencies. Keep the host dependency graph coherent. Do not disable compatibility checks or relax permissions to repair a missing peer package.
+
+The resolved configuration must have one enabled `kiokuko-dsh/harness` and a disabled `agent-loop`. Harness options are provider/model defaults and an explicit step budget:
+
+```yaml
+- id: kiokuko-harness
+  config:
+    maxSteps: 128
+```
+
+Reaching the budget records a failed turn for inspection; it does not assert task success. Set a suitable budget for longer work. Tool authority still belongs to the native tool scope and approvals.
+
+For the previous plugin integration, pass the installed overlay **after** the bundle:
+
+```sh
+dsh --profile dsh-cli --patch /absolute/install/path/kiokuko-dsh/dsh/cordis.legacy.patch.yml
+```
+
+It disables the Kiokuko factory, enables the standard factory, and removes the main plugin's replacement-factory dependency. The default bundle still selects the replacement. With a supporting CLI, `dsh-cli --ignore-kiokuko` excludes Kiokuko for that launch and restores the other bundles' configuration. A profile containing only DSH and dsh-cli remains independent of Kiokuko.
+
+## Runtime contracts
+
+`AgentFactory.createAgent` and `resume` publish agents only after scoped setup. The registry, session storage, model adapters, system prompt assembly, tool execution and UI remain native DSH services. Kiokuko owns the inbox, turn/step scheduling, direct intake and continuation callbacks. Public pre-step, turn-stopping and idle notifications remain available to other plugins; the standard AgentLoop is not required to drive them.
+
+`followup` wakes the next turn; `steer` wakes the next step; `inject` queues context without waking an idle agent. Rejected intake retains its request and parks until another wake, rather than consuming it or spinning. Cancellation preserves a streamed prefix, closes the turn and leaves subsequent input usable. Resume reads the persisted session, closes interrupted turns with native recovery records and does not automatically repeat past tool effects. This does not provide exactly-once effects after an unacknowledged external operation: inspect its receipt before retrying.
+
+Parent and child agents use the same factory and native scope inheritance. A separately scheduled turn clears the caller's ambient task lease and resolves its own authority at tool admission. A child restricted by the native tools service cannot execute a denied tool through this driver.
+
+Lisp function definition, composition, invocation and workspace observation do not require switching to task mode or creating a Working task. Only the caller's own protected-mode worker may be reused; development workers and other owners' heaps are never borrowed. Other calls use protected scratch without a repository mount or host RPC. Arbitrary Lisp is not certified pure by a JSON schema. Shared publication, file changes and external commands retain their existing task/approval/receipt boundaries. A child with an exact live native owner inherits only Lisp capabilities its native scope already exposes, with separate results and scratch execution. There is no worker handoff layer. Real SBCL behavior remains an explicit environment-dependent acceptance check.
+
+## Memory and improvement
+
+Native repository learning consumes the canonical turn observations, emits hypotheses with source references, persists the compact projection and supplies it to later requests as untrusted reference data. A terminal `completed` event means the turn ended, not that the task was independently verified. Re-check hypotheses against current files. Root discovery matches the runtime registration even when launched from a repository subdirectory.
+
+Optional retrieval, validation or reflection failures leave ordinary permitted work usable. Diagnostics distinguish saved, not saved and unknown acknowledgement. Existing pending admissions support repository-learning recovery after reload; exact approved curated-memory candidates retain their original save identity for retry. Neither path reruns the original task. Capture refusal, exclusion, stale authority and actual operation approvals remain enforced. Curated replay-memory proposals still require the native question and approval of the exact preview revision.
+
+The improvement loop is recorded outcome → bounded reflection → evidence-linked hypothesis → later retrieval and current-source verification. It does not rewrite production code or infer approval from logs. The live assistant acceptance has exercised generation, persisted hypothesis retrieval after process restart, and re-reading the current input before using the recalled suggestion.
+
+## Logs and limits
+
+| Path | Evidence retained | Limits |
+| --- | --- | --- |
+| Inbox and lifecycle | Native session commands, turn/step boundaries, harness action metadata | Host/process death can leave a final boundary pending until resume |
+| Model stream | Native assistant stream, committed message or interrupted attempt, error/cancel/retry metadata | Provider internals and activity outside this driver are not observable |
+| Tool execution | Native call/result IDs, harness start/result/error/cancel metadata; flush before effect | A crash between effect and receipt leaves an uncertain external outcome |
+| Parent/child | Native ownership, session parent identity and call/turn correlation; child capability filters are preserved | Detached external agents and real SBCL child execution remain unverified |
+| AgenticReplay | Existing model/tool hooks plus bounded harness metadata when recording is enabled and the session is bound | Early unbound lifecycle records remain only in the canonical DSH session; recorder completion is not task success |
+| Memory | Capture/retrieval diagnostics, source references, reflection status, saved revision | Unavailable stores cannot be described as saved; optional generation is not a permission grant |
+
+Harness metadata contains no copied tool arguments or model bodies. AgenticReplay retains its existing redaction and metadata modes. DSH's canonical conversation persistence remains DSH's own content contract; this change does not retrofit redaction into old sessions. Do not put API keys into prompts or tool arguments.
+
+Cloud checks exercised DSH `0.2.1-rc.5`, dsh-cli `0.14.18`, Node `24.19.0` and pnpm `11.25.0`, plus unit contracts against the repository's declared development dependencies. These identify tested artifacts, not a version-number compatibility fence. Scripted providers test wire contracts; live assistant-in-loop transport uses fresh decisions by the executing assistant and is not an authenticated external provider API session.
+
+SBCL is required for real Lisp execution. It was absent in this cloud runtime and its configured OS package source returned HTTP 403. Manager/transport contracts and a real DSH child read/scope test passed without SBCL; these are not Lisp execution or OS isolation proof. Real SBCL tests now include resident composition, preserved parent state, child scratch, restart and reader-time write refusal, but still require execution on a supported host. Deep native planning contracts (24 cases) ran against the replacement factory with scripted adapters. External provider authentication and the actual browser UI remain unverified. No complete-compatibility claim follows from these checks.

package/docs/kiokuko-models.md

@@ -31,7 +31,7 @@ once, preserving any preceding path prefix.
 returns nothing usable, register the exact model ID and limits manually under
 **Advanced settings → Register model manually**, then **Save connection**. Search the
 resulting list. **Use in current chat** only changes that idle chat; **Default for new
-chats** saves the native default for future chats. Enno, Deep and model-auto use the
+chats** saves the native default for future chats. Deep and model-auto use the
 same registered adapters and model capabilities. An unavailable model is rejected
 rather than silently substituted.
 
@@ -52,13 +52,8 @@ a different normal head model also leaves pair mode for the selected scope. Sele
 the exact same provider and head model preserves the worker choice. Profile defaults are
 snapshotted per chat, so changing the default does not rewrite existing chats.
 
-The execution-choice card also offers the pair for just the current normal task,
-and Enno's model-configuration menu offers the same pair. Lisp is an execution-tool
-choice and uses the normal parent/worker routing. In Enno, `ideal`, `zenki`, `goki`
-and `check` use the head; the delegated `worker` uses Flash. A profile/chat pair
-seeds the initial Enno role review. An already approved Enno task keeps its explicit
-role configuration until the next task; selecting another Enno custom configuration
-continues to work.
+The execution-choice card also offers the pair for just the current normal task.
+Lisp is an execution-tool choice and uses the normal parent/worker routing.
 
 Selection and dispatch require the exact live catalog bindings. The head ID is
 `gpt-6.1-sol`. The worker ID is `deepseek-flash` on a DeepSeek route,
@@ -101,7 +96,7 @@ appear in list responses, normal profile settings or command history. The settin
 necessarily grants access to the shared credentials through login, replacement and logout.
 Session tool permissions do not govern these explicit human settings operations.
 
-OrcaRouter is no longer offered or recommended. Legacy saved Enno/Deep configurations
+OrcaRouter is no longer offered or recommended. Legacy saved Deep configurations
 remain readable and require explicit model reselection before reuse. Replay history and
 migrations are unaffected.
 

package/docs/lisp-hot-tools.md

@@ -23,10 +23,12 @@ ZIP の試作をそのまま別の実行環境にするのではなく、既存
 
 設定の `lisp.enabled: true` と SBCL が必要です。既存の選択画面で Lisp を選べば、
 共有関数をそのまま利用できます。選択肢の順序、番号キー・修飾キー・Enterによる操作、
-通常実行／役小角の選択とは別に、Lisp の選択をタスクと scopeVersion に保存します。新しい実装タスクでは再確認し、未回答・閉じる操作では起動しません。
-常駐Lispがある場合は、同じsession・agent・repoの評価枠を再利用します。
-PID・世代・既存定義を維持し、別SBCLの起動やmode切替はしません。評価中は `BUSY`、
-別ownerの場合は `REPOSITORY_IN_USE` です。常駐workerがない作業用modeでは従来の一回限りworkerを使います。
+実行方式の選択とは別に、Lisp の選択をタスクと scopeVersion に保存します。新しい実装タスクでは再確認し、未回答・閉じる操作では起動しません。
+`lisp_define`・`lisp_call`・`lisp_observe` は、Working taskや `enable-task` への切替を要求しません。
+同じsession・agentの保護済み常駐workerは再利用し、PID・世代・既存定義を維持します。
+開発用workerや別ownerのheapは借りず、リポジトリをマウントしない保護付きscratchで計算します。
+JSON schemaは任意Lispの安全性を証明しません。計算側のホストRPCを拒否し、実際の副作用には従来の承認・scope・証拠を要求します。
+親のworkerを停止・譲渡する必要はありません。同じownerの評価中は `BUSY` です。
 ワーカー枠がすべて使用中の場合は `WORKER_LIMIT` で停止します。
 
 次は任意の確認コマンドです。有効化の追加操作は不要です。
@@ -113,9 +115,11 @@ PID・世代・既存定義を維持し、別SBCLの起動やmode切替はしま
   各検証は新しいpackageで行います。常駐ownerがない場合は検証ごとにworkerを起動します。
 - 入力・結果はセッションとエージェントに束縛されます。共有関数の呼び出しは
   他人の `resultRef` の参照権限や、作業ファイルの書き込み権限を与えません。
-- 常駐workerを再利用する呼び出しは、新しいpackage・object参照表・専用結果scratchを使い、
-  host RPCを許可しません。同じownerのCommon Lisp heap全体を隔離する仕組みではないため、
-  明示的な依存関数と入力だけを使う純粋関数として記述してください。別ownerとはworkerを共有しません。
+- 保護済み常駐workerを再利用する呼び出しは、新しいpackage・object参照表・専用結果scratchを使い、host RPCを許可しません。
+  同じownerのheap全体を分離する仕組みではありませんが、外部への操作はOSの保護範囲に制限します。
+  別owner・開発用workerとはheapを共有せず、リポジトリマウントも渡しません。
+- nativeの生きた親子所有関係と同じ作業場所を確認できる子には、見えているLisp計算機能だけを準備します。
+  拒否済みのツールを子のローカル登録で復活させず、親のtask leaseや入力・結果参照も渡しません。
 
 再送は同一の操作 ID と同一の引数で行います。保存結果を返し、再実行しません。
 `UNKNOWN` は成功でも安全な再試行でもありません。
@@ -135,5 +139,6 @@ npm run test:skill-delivery
 ```
 
 通常の `npm test` は保護付き SBCL / ネイティブ DSH の任意テストを省略します。
+`hot-tools.test.ts` の常駐合成・親子scratch・読込時書込み拒否の実SBCL試験も、明示した必須実行で確認します。
 上記の必須実行を別途確認してください。ローカルテストの成功は、稼働中の
 DSH プロファイルの更新、別プラットフォームの実行、リモート CI の成功を意味しません。

package/docs/lisp.md

@@ -10,7 +10,7 @@ For explicit semantic decisions and `/kioku-typesafe-key` setup, see
 [TypeSafe from Lisp](typesafe.md). Answers can guide inspection and proposals;
 the existing permission and approval boundaries still apply.
 
-The default is `lisp.executionMode: development`. Old `approvalMode` values remain readable. Set `executionMode: protected` explicitly to select the legacy worker/approval/fence behavior. See [owned execution and memory evidence](owned-execution.md).
+The default is `lisp.executionMode: development`. Old `approvalMode` values remain readable. Set `executionMode: protected` explicitly to select the additional approval and tool-fence policy. See [owned execution and memory evidence](owned-execution.md).
 
 ## Task state at execution boundaries
 
@@ -87,9 +87,43 @@ Session disposal also stops its workers. Normal suspension appears as `SUSPENDED
 retains protection and resumes automatically on the next use; status polling never
 starts a worker. Variables, definitions and references are lost on restart; the
 agent receives the new generation and must rebuild helpers without replaying
-completed effects. Crashes and explicit cancellation still require human recovery.
-
-One canonical repository has one runtime owner and one persistent supervisor/SBCL,
+completed effects. A clean host restart or an exited idle child resumes on the next
+admitted request after confirmed process termination and journal reconciliation.
+Fault replacements are limited to two per owner in 60 seconds. Explicit cancellation,
+unresolved effects, unconfirmed termination and exhausted restart limits require recovery.
+
+Kiokuko owns a local master–worker hierarchy: `LispManager` binds requests and their
+existing operation journals; `LispSupervisor` owns shared capacity, compiled startup,
+isolation probes and confirmed release for persistent and disposable children;
+`LispWorker` owns one RPC evaluation slot and reports process failures immediately.
+The external `supervisor.mjs` retains OS process ownership and stops descendants when
+the host pipe closes. Local process events and bounded RPC deadlines provide liveness
+signals; no network heartbeat, separate task router or recovery daemon is involved.
+Restarting replaces a process generation, never a journaled operation. A worker whose
+termination is uncertain continues to consume capacity.
+
+This separates durable work from execution, as in the
+[DeepSeek executor](https://github.com/deepseek-ai/dsh-superagent-prototype/blob/main/src/executor/dsh.ts),
+and uses bounded, per-child recovery following
+[OTP supervision](https://www.erlang.org/doc/system/sup_princ.html).
+It preserves the existing Kiokuko execution loop and DSH Agent/SessionEvent contracts.
+
+Routed child work sessions each own a persistent Lisp runtime, private heap,
+scratch directory and owner-bound result journal. The router supplies the task
+and receives the native child result; siblings do not inherit each other's
+variables, object references or task authority. Repeated model steps reuse the
+same worker generation. Completing/disposal of a child stops only its runtime.
+The session worker starts before the first child model request; startup failure
+prevents that request instead of silently selecting another execution route.
+Existing disposable child sessions are promoted on their next admitted request,
+and the saved session mode survives a host restart without replaying old code.
+
+These workers compute in private scratch without taking a repository-wide lease.
+Project reads, commands and changes still use the owning session's host adapters,
+native tool restrictions, permission checks and operation journal. Shared project
+files are not separate worktrees; callers must still coordinate conflicting edits.
+
+A standalone repository runtime has one owner and one persistent supervisor/SBCL,
 including across separate DSH databases and sessions. Git subdirectories and symlink
 aliases resolve to the same repository; separate worktrees retain their own root.
 The existing supervisor holds an OS-backed SQLite lease under the current user's
@@ -125,7 +159,7 @@ rejection and model abstention defer classification. Native adapters let the
 ordinary model infer advisory intent or ask a concrete clarification; they do not
 repeat the generic category dialog merely because the classifier abstained. Classification does not authorize implementation. For an explicit coding request the agent defines the Goal, implementation items and their observable criteria, then the host asks whether to use Lisp for that task. Both yes and no persist for the task and scope across restart. Conversation, review and plan-only requests do not trigger this prompt. Closing, free text without a clear choice or a disconnected question leaves implementation pending. Cancellation preserves the prepared work. A selected Lisp startup failure remains a recoverable blocker.
 
-Normal/Enno execution mode and Lisp choice are separate. The task question remains available when the Lisp module is disabled; no needs no Lisp runtime, while yes requires the enabled module and working SBCL. To explicitly change the current task's Lisp route or inspect its state, use these commands in the desired DSH session:
+Execution-mode selection and Lisp choice are separate. The task question remains available when the Lisp module is disabled; no needs no Lisp runtime, while yes requires the enabled module and working SBCL. To explicitly change the current task's Lisp route or inspect its state, use these commands in the desired DSH session:
 
 ```text
 /kioku-lisp enable
@@ -192,7 +226,7 @@ not the complete worker startup or the speed of an individual Lisp computation.
   copied into the worker's read-only inputs. Files from other sessions and arbitrary
   absolute paths are refused. The original attachment store stays inaccessible to
   Lisp and its subprocesses. Limits: 64 MiB per file, 256 MiB per worker generation.
-- Lisp/FFI/Python/shell use the normal user environment. Prefer owned tools and broker APIs for host-observed execution; direct arbitrary effects are not verification evidence.
+- Lisp/FFI runs inside OS isolation without workspace access or inherited credentials. Project file changes and external Python/shell commands cross the host tool boundary, which checks operation permissions and records the result.
 - Project proposals freeze targets, preserve backups and reject duplicate targets. Writes/edits are authorized; source/data deletion requires concrete confirmation. Generated/temp/disposable artifacts are routine development.
 - Refusal, skip, timeout, cancelled confirmation or unavailable UI means no change.
   File identities/content are checked again after approval. Links, directories,
@@ -271,8 +305,8 @@ The host serializes conflicting target proposals and checks their captured hashe
 
 ## Stop and recover
 
-The control beside the session input shows the Lisp state and opens a recovery view on a detected
-failure. It offers stop/recovery without needing a model response. The commands
+The control beside the session input shows the Lisp state. Selecting it opens the
+recovery view; failures do not repeatedly open a modal. It offers stop/recovery without needing a model response. The commands
 remain available when the AI loop is stopped:
 
 ```text
@@ -366,7 +400,7 @@ subprocesses use the same output limit and parent-liveness supervisor as workers
 Published bundles are limited to 256 MiB each. Concurrent first enables share one
 serialized build under the host's existing exclusive data-directory lease.
 
-Lisp workers and processes use the normal user environment and process groups for termination. kioku.process run/start-job use the owned execution service; directory defaults to the admitted workspace and may select a real subdirectory. Collect background results rather than rerunning commands.
+Lisp workers remain OS-isolated. Host processes launched through kioku.process run/start-job use the normal user environment and supervised process groups after the host permission check; directory defaults to the admitted workspace and may select a real subdirectory. Collect background results rather than rerunning commands.
 `python`, `shell`, `run-lines`, `python-stdout` and `shell-stdout` also accept
 `:directory`. The output-only helpers signal an error on process failure, so a
 composed operation stops before its next step. Use `run` when the function needs