open-multi-agent-kit 0.98.3 → 0.98.4

package/docs/model-contract.md

@@ -0,0 +1,168 @@
+# Model dispatch contracts
+
+This opt-in working-tree feature implements the first execution-contract slice of
+[the harness roadmap](../../../ROADMAP.md). It restricts **logical stream dispatch**
+and checks the final **Chat Completions model ID and output-limit parameter**.
+Other APIs, network destinations, and billable attempts are not fully covered.
+It is not a sandbox or a benchmark-integrity attestation.
+
+## CLI
+
+Create a UTF-8 JSON policy, replacing the example identities with the exact
+provider and model you intend to use:
+
+```json
+{
+  "allowedModels": [{ "provider": "your-provider", "id": "exact-model-id" }],
+  "allowedProviders": ["your-provider"],
+  "allowedAuthOrigins": ["your-provider"],
+  "thinking": false,
+  "thinkingLevel": "off",
+  "maxOutputTokens": 4096
+}
+```
+
+```bash
+omk --provider your-provider --model exact-model-id --thinking off \
+  --model-contract ./policy.json -p "Run the requested checks"
+```
+
+The flag does not start an extra model call. A normal prompt still calls the
+configured provider and may incur cost. `--offline` suppresses startup network
+work; it does not prevent prompt inference.
+
+The CLI reads the policy once, before migrations and session creation, and keeps
+that snapshot when replacing or resuming sessions within the process. A later
+process must supply the flag again. It does not alter settings, credentials,
+model selection, or a saved transcript. `--help` does not read the policy.
+
+Missing, unreadable, malformed, non-regular, or oversized files exit with code 1.
+Reads are bounded to 64 KiB; invalid UTF-8 and unknown top-level fields are
+rejected. Missing flag values and duplicate flags are errors. Both
+`--model-contract policy.json` and `--model-contract=policy.json` are accepted.
+
+## SDK
+
+`createAgentSession()` and `createAgentSessionFromServices()` accept an optional
+`modelContract` and main-loop `maxTokens`. `Agent` accepts the same options.
+
+```typescript
+const { session } = await createAgentSession({
+  model,
+  thinkingLevel: "off",
+  modelContract: {
+    allowedModels: [{ provider: model.provider, id: model.id }],
+    allowedProviders: [model.provider],
+    allowedAuthOrigins: [model.provider],
+    thinking: false,
+    thinkingLevel: "off",
+    maxOutputTokens: 4096,
+  },
+});
+```
+
+`ModelContract`, `RouteRequest`, `ModelContractViolation`,
+`snapshotModelContract()`, and `assertModelContract()` are exported by
+`omk-agent-core`. No global setting enables this policy implicitly.
+
+The policy is copied and frozen. Each allowlist has 1–64 entries; identities are
+exact, bounded strings, not wildcards. Allowed models are provider/ID pairs.
+`allowedAuthOrigins` names logical credential resolvers, normally the provider;
+it does not authenticate an account or HTTPS origin.
+
+`thinking: false` forbids a requested reasoning level. `thinking: true` permits
+reasoning, while optional `thinkingLevel` pins the effective logical level.
+An absent level is `off` in the compatibility validator. The runtime supplies
+an explicit effective level when checking a request.
+
+Contract and explicit request limits must be positive safe integers. A larger
+explicit limit is rejected rather than silently clamped. When a runtime request
+omits `maxTokens`, the dispatch boundary supplies the smaller of the contract
+cap and model metadata cap. `assertModelContract()` alone retains compatibility
+with an omitted limit and does not fill it in.
+
+## Covered paths
+
+- In contract mode, tool-generated images do not trigger automatic vision routing.
+  For a text-only selected model, the provider view replaces those image blocks
+  with explicit uninspected-image notices and retains the existing text/tool IDs.
+  Original session attachments are unchanged. This is not OCR or visual analysis.
+  User-provided images still require a permitted vision route; they are not silently
+  discarded. A vision-capable selected model and non-contract routing retain their
+  existing behavior. The SDK summary stream uses the same projection.
+- Core prompt and continuation loops check the automatically selected route
+  before resolving its credentials. Policy remains fixed across lifecycle,
+  context, auth, and next-turn callbacks.
+- The SDK stream checks again before authentication, covering first-party
+  compaction and branch-summary calls that use `session.agent.streamFn`.
+  An explicitly requested summary cap above the policy is rejected, not reduced.
+- For `openai-completions`, the payload hook checks the serialized model ID and
+  exactly one defined `max_tokens` or `max_completion_tokens` before HTTP dispatch.
+  The cap must be a positive safe integer no larger than the effective logical
+  request cap. Missing, ambiguous, enlarged, or invalid limits are refused, even
+  without a user hook. Model identity is pinned before asynchronous callbacks.
+- Contracted payload hooks may observe detached immutable payload/model data or
+  return an equivalent payload. In-place changes and replacements are refused.
+  Optional `undefined` payload fields are accepted. Hook-return equivalence is
+  conservative JSON serialization equality, not arbitrary semantic equivalence.
+  Without a user observer, validation does not clone the conversation; nested
+  core/SDK enforcement shares the existing observation boundary.
+- Automatic cross-provider vision routing never forwards the source provider's
+  static API key, request headers, or model headers. This isolation also applies
+  when no contract is configured. Destination credentials must come from the
+  destination resolver or the provider's normal credential path.
+
+## Dispatch events
+
+Contracted **core-loop** calls emit:
+
+| Event | Meaning |
+| --- | --- |
+| `provider_denied` | A logical contract violation or observed cancellation prevented dispatch |
+| `provider_request` | The harness entered its stream-function dispatch boundary |
+| `provider_request_end` | That dispatch finished, errored, or aborted |
+
+`provider_request.omittedToolImages`, when present, counts tool attachments replaced
+in this request's provider view. It does not count visual interpretations or saved
+bytes in the session. A core contract denial becomes a non-retryable `configuration`
+termination rather than a provider-protocol diagnosis.
+
+`requestId` joins the events. Request and end events identify their boundary as
+`stream-dispatch`. Metadata excludes prompts, output, headers, keys, and raw
+errors. The end outcome is a transport/lifecycle result, not task correctness;
+`completed` does not mean an answer passed a verifier.
+
+A start event can be followed by an error before network transmission, including
+an observer or custom-stream error. An abort event does not prove that a remote
+request or custom stream has stopped. Auth/context failures before dispatch are
+not a complete attempted-request ledger. Summaries using the SDK wrapper are
+checked but do not yet emit these core-loop events. Persistence, run/attempt
+correlation, HTTP retry accounting, usage and billing joins remain follow-up work.
+
+## Limits and next steps
+
+The Chat Completions check validates the parameter sent by the first-party
+adapter, not the provider's interpretation or enforcement of it. Reasoning-token
+budgets, remote routing, response model identity, and actual charges still need
+separate evidence. Adapters that rewrite model names (for example, adding a
+namespace) are rejected by this exact-identity check unless the selected model ID
+already equals the transmitted ID.
+
+Other APIs still have only logical checks. For example,
+`adjustMaxTokensForThinking()` can add thinking tokens, and the inspected Codex
+request builder does not serialize `maxTokens`. Thus this contract is **not a
+universal output or billing cap**. A strict single-model benchmark still needs
+adapter-specific request provenance. For Model Studio's thinking fields and
+separate billing endpoints, see [the provider guide](providers.md#model-studio-deepseek-v4).
+
+Direct `omk-ai` calls, the separate `AgentHarness` family, advisory judges, child
+processes, custom streams that replace the SDK wrapper, and arbitrary extension
+code do not acquire this policy automatically. Extensions execute with their
+existing host permissions; freezing hook arguments does not isolate their code.
+Tool permissions, endpoint trust, effect idempotency, deadlines, and semantic
+completion still belong to their existing owners.
+
+A fresh build/restart is required to use source changes in an installed CLI.
+This implementation work did not build, install, deploy, change active settings,
+or run a paid benchmark. See [the boundary redesign](harness-boundaries.md) and
+ROADMAP §15 for dated evidence, limitations, and the remaining architecture work.

package/docs/models.md

@@ -4,7 +4,7 @@ Add custom providers and models (Ollama, vLLM, LM Studio, proxies) via `~/.omk/a
 
 ## Table of Contents
 
-- [Built-in NVIDIA GLM-5.2](#built-in-nvidia-glm-52)
+- [Catalog availability](#catalog-availability)
 - [Minimal Example](#minimal-example)
 - [Full Example](#full-example)
 - [Supported APIs](#supported-apis)
@@ -16,9 +16,15 @@ Add custom providers and models (Ollama, vLLM, LM Studio, proxies) via `~/.omk/a
 - [Anthropic Messages Compatibility](#anthropic-messages-compatibility)
 - [OpenAI Compatibility](#openai-compatibility)
 
-## Built-in NVIDIA GLM-5.2
+## Catalog availability
 
-With `NVIDIA_API_KEY` configured, `nvidia/z-ai/glm-5.2` supports OMK thinking levels through NVIDIA NIM. Its generated metadata explicitly enables `reasoning_effort`, so `/think max` is sent as `reasoning_effort: "max"`. Other NVIDIA models do not inherit that capability automatically.
+The NVIDIA catalog is filtered against NIM's live model IDs and known compatibility
+limits. A historical GLM route is not evidence that NIM still lists it. Use the
+current model selector rather than copying a removed ID from older examples.
+
+The [2026-09-09 catalog refresh](model-catalog-refresh.md) records new models,
+provider-specific thinking ladders, and verification limits. Model discovery does
+not prove that an account can invoke that model.
 
 ## Minimal Example
 
@@ -420,7 +426,18 @@ For providers with partial OpenAI compatibility, use the `compat` field.
 | `openRouterRouting` | OpenRouter provider routing preferences. This object is sent as-is in the `provider` field of the [OpenRouter API request](https://openrouter.ai/docs/guides/routing/provider-selection). |
 | `vercelGatewayRouting` | Vercel AI Gateway routing config for provider selection (`only`, `order`) |
 
-`openrouter` uses `reasoning: { effort }`. `together` uses `reasoning: { enabled }` and also `reasoning_effort` when `supportsReasoningEffort` is enabled. `qwen` uses top-level `enable_thinking`. Use `qwen-chat-template` for local Qwen-compatible servers that require `chat_template_kwargs.enable_thinking`.
+`openrouter` uses `reasoning: { effort }` for enabled thinking and
+`reasoning: { enabled: false }` for its supported off toggle. Mandatory-thinking
+models do not offer off. Declared per-route efforts override model-family guesses.
+`together` uses `reasoning: { enabled }` and also `reasoning_effort` when `supportsReasoningEffort` is enabled. `qwen` uses top-level `enable_thinking`. Use `qwen-chat-template` for local Qwen-compatible servers that require `chat_template_kwargs.enable_thinking`.
+
+On official HTTPS Model Studio hosts, automatic defaults use `max_tokens`, the
+`system` role, and `enable_thinking`; OpenAI store and long-cache fields are omitted.
+The legacy `thinkingFormat: "deepseek"` override is translated to `qwen` on those
+hosts only. DeepSeek V4 also sends `reasoning_effort` when enabled; an explicit
+`supportsReasoningEffort: false` remains an opt-out. A custom proxy hostname needs
+explicit compatibility settings because its upstream protocol cannot be inferred.
+See [Model Studio endpoint and plan guidance](providers.md#model-studio-deepseek-v4).
 
 `cacheControlFormat: "anthropic"` is for OpenAI-compatible providers that expose Anthropic-style prompt caching through `cache_control` markers on text content and tool definitions.
 

package/docs/provider-resilience.md

@@ -21,7 +21,7 @@ Configure resilience in `~/.omk/agent/settings.json` or `.omk/settings.json`:
     "autoFailoverOnSafetyStop": true,
     "failoverCandidates": [
       { "provider": "kimi-coding", "id": "k3" },
-      { "provider": "modelstudio-maas", "id": "qwen3.8-max-preview" }
+      { "provider": "modelstudio-maas", "id": "qwen3.8-max" }
     ]
   }
 }
@@ -52,14 +52,16 @@ For a safety stop or recognized quota/billing error, OMK:
 
 A content/safety stop gets at most one automatic retry, including a retry that switches model, regardless of the larger transport retry budget. Other transient failures keep the configured retry policy and backoff. Plain authentication errors remain non-retryable and do not trigger failover.
 
-Recognized quota shapes include billing-cycle usage limits, `insufficient_quota`, exhausted balances, `GoUsageLimitError`, `FreeUsageLimitError`, and out-of-budget responses. These are classified as `provider.rate_limit`, even when a provider wraps them in HTTP 403.
+Recognized quota shapes include billing-cycle usage limits, `insufficient_quota`, exhausted balances, `GoUsageLimitError`, `FreeUsageLimitError`, and out-of-budget responses. These are classified as `provider.rate_limit`, even when a provider wraps them in HTTP 403. Provider-capacity bodies that omit a status or limit token are classified the same way: xAI `currently at capacity` / `high demand` (HTTP 429) and Anthropic `overloaded_error` / `Overloaded` (HTTP 529). Left unmatched they fall through to `provider.protocol` and advertise orphan-`tool_call_id` sanitize.
+
+Two HTTP 400s are permanent `configuration.invalid`, not retryable protocol faults: Anthropic `claude_code_version_too_old`, and Codex ChatGPT-account `The '<slug>' model is not supported when using Codex with a ChatGPT account.` Same-model retry, transcript sanitize, and `/new session` re-send the same client version or slug. Switch with `/model`, or for Codex use an API-key route that has the model.
 
 Gateway/upstream availability failures — "503 Upstream request failed", "Endpoint is unavailable", or a stream that ended without a finish reason — are classified as `provider.network`: transport problems that heal by retry or model switch, never by transcript sanitization.
 
 The default candidate order is:
 
 1. `kimi-coding/k3`
-2. `modelstudio-maas/qwen3.8-max-preview`
+2. `modelstudio-maas/qwen3.8-max`
 3. `xai/grok-4.5`
 4. `deepseek/deepseek-v4-pro`
 5. `deepseek/deepseek-v4-flash`

package/docs/providers.md

@@ -32,6 +32,41 @@ Alibaba Model Studio Token Plan is recognized as **QWEN TOKEN PLAN** and reads i
 
 With a stored native `xai` OAuth credential, OMK reads `GET https://cli-chat-proxy.grok.com/v1/billing?format=credits` and shows the weekly SuperGrok pool from `config.creditUsagePercent` plus its reset from `config.currentPeriod.end`. `XAI_API_KEY` is a separate API-billing credential and does not authorize this subscription endpoint.
 
+### Model Studio DeepSeek V4
+
+Model Studio uses `enable_thinking`, including for DeepSeek. OMK's Chat Completions
+adapter recognizes official HTTPS DashScope and `*.maas.aliyuncs.com` hosts, defaults
+to `max_tokens` and the `system` role, and omits unsupported OpenAI store/long-cache
+fields. Legacy `thinkingFormat: "deepseek"` on these hosts is translated to the
+`enable_thinking` format. Native DeepSeek endpoints keep their native format.
+
+DeepSeek V4 sends the selected `reasoning_effort` when compatibility settings permit
+it. Without a model-specific mapping, `minimal` maps to the supported `low` value.
+An explicit `supportsReasoningEffort: false` still suppresses that field; remove
+that override or enable it for the model if you intend to send `high`, `xhigh`, or
+`max`. With thinking off, OMK sends `enable_thinking: false` rather than relying on
+the server default. See [custom model configuration](models.md#openai-compatibility).
+
+Keep the key paired with its purchased product and region. These are distinct
+billing paths, not interchangeable aliases:
+
+| Product | Example OpenAI-compatible base URL |
+| --- | --- |
+| Token Plan, Singapore | `https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1` |
+| Coding Plan, China | `https://coding.dashscope.aliyuncs.com/v1` |
+| Pay-as-you-go | `https://dashscope.aliyuncs.com/compatible-mode/v1` |
+
+Protocol detection never changes the URL, credentials, model ID, or subscription.
+For a comparison run, pin the exact Flash snapshot offered by that endpoint in
+both arms; `deepseek-v4-flash-0731` and an unversioned alias are not automatically
+the same experimental condition. Apply a [model contract](model-contract.md), and
+verify the installed adapter and final request before starting a benchmark.
+
+Sources: Alibaba's [DeepSeek API](https://www.alibabacloud.com/help/en/model-studio/deepseek-api)
+and [plan endpoint separation](https://www.alibabacloud.com/help/en/model-studio/token-plan-team-quickstart),
+consulted 2026-09-08. The local tests exercise serialization, not account availability,
+provider compliance, billing, or benchmark performance.
+
 ### OpenAI Codex
 
 - Requires ChatGPT Plus or Pro subscription
@@ -94,6 +129,7 @@ omk
 | Fireworks | `FIREWORKS_API_KEY` | `fireworks` |
 | Together AI | `TOGETHER_API_KEY` | `together` |
 | Kimi For Coding | `KIMI_API_KEY` | `kimi-coding` |
+| Meta Model API | `META_API_KEY` (or `META_MODEL_API_KEY`, `MODEL_API_KEY`) | `meta` |
 | MiniMax | `MINIMAX_API_KEY` | `minimax` |
 | MiniMax (China) | `MINIMAX_CN_API_KEY` | `minimax-cn` |
 | Xiaomi MiMo | `XIAOMI_API_KEY` | `xiaomi` |
@@ -106,7 +142,38 @@ Reference for environment variables and `auth.json` keys: [`const envMap`](https
 
 #### NVIDIA NIM
 
-Set `NVIDIA_API_KEY` and select an NVIDIA model with `/model`. The built-in `nvidia/z-ai/glm-5.2` entry sends `reasoning_effort`, including the `max` level. Other NVIDIA models keep conservative compatibility defaults unless their model metadata explicitly enables reasoning effort.
+Set `NVIDIA_API_KEY` and select a currently listed NVIDIA model with `/model`.
+NIM entries are filtered against its live `/v1/models` list; historical GLM examples
+may no longer be listed. Thinking capabilities stay model-specific. See the
+[latest catalog audit](model-catalog-refresh.md) for source coverage and limits.
+
+#### Meta Model API
+
+Meta's first-party [Muse Spark](https://dev.meta.ai/docs/overview) endpoint, served over the OpenAI
+Responses API at `https://api.meta.ai/v1`:
+
+```bash
+export META_API_KEY=...
+omk --provider meta --model muse-spark-1.3
+```
+
+Two auth paths:
+
+- **Subscription:** `/login` → Use a subscription → Muse Code. Device-code sign-in at
+  `auth.meta.com`, then a mint at `https://api.meta.ai/muse-code/key`. Honors `HTTP_PROXY` /
+  `HTTPS_PROXY`. The minted key is what inference uses.
+- **Pay-as-you-go:** `META_API_KEY` (then `META_MODEL_API_KEY`, then `MODEL_API_KEY`), or paste a
+  Model API key under `/login` → Use an API key → Meta Model API. Extra keys you create on the
+  dashboard are billed [per token](https://dev.meta.ai/docs/muse-code/subscriptions), even with an
+  active Muse Code subscription.
+
+Standard tier: `muse-spark-1.3`, `muse-spark-1.2`, `muse-spark-1.1`. Contributor tier:
+`muse-spark-1.3-contributor`, `muse-spark-1.2-contributor`. All carry a 1M-token context window.
+
+Thinking levels run `minimal` → `max`. Muse Spark's own effort ceiling is `xhigh`, which its docs
+call "maximum reasoning depth", so omk's `max` level maps onto `xhigh` rather than sending an enum
+the API would reject. Thinking cannot be switched off: Muse Spark rejects `reasoning_effort: "none"`
+with HTTP 400, so omk never sends it.
 
 #### Zyloo
 

package/docs/quickstart.md

@@ -85,6 +85,10 @@ Additional built-in read-only tools (`grep`, `find`, `ls`) are available through
 
 ## Give omk project instructions
 
+For optional, portable user defaults, preview `omk init --global --dry-run`, then
+run `omk init --global`. Existing instructions and settings are preserved.
+See [User context setup](context-files.md) for migration, loading, and interoperability.
+
 OMK loads context files at startup. Add an `AGENTS.md` file to tell it how to work in a project:
 
 ```markdown

package/docs/release-audit-0.98.4.md

@@ -0,0 +1,112 @@
+# Release audit: v0.98.4
+
+Date: 2026-09-10. This records pre-publication checks and approved history cleanup,
+not a semantic-correctness/performance claim. The tag workflow and registry versions
+remain the evidence for completed publication.
+
+## Scope and history
+
+The candidate retains the public v0.98.3 ancestry and the reviewed local implementation
+commits. Preparation uses only committed implementation files plus explicit release
+metadata. Twelve existing modified files and two untracked test files were snapshotted
+and isolated before preparing the candidate; they are not part of this candidate.
+Credentials, the active model, private agent-home settings and stopped benchmarks are
+not modified. Catalogs are reused from the reviewed commit, not regenerated.
+
+The deletion commit alone did not remove the internal research document from history.
+After explicit approval, only the unpublished range of `main` was filtered in a separate
+bare repository. The cleaned branch has no path history or reachable blob for that
+document. The resulting candidate tree is byte-identical to the previously checked tree;
+the public main ancestor, other local refs and existing tags are unchanged. A scoped
+compare-and-swap updated local main without resetting working files. Private recovery
+material remains outside the repository and is not published.
+
+The cleaned unpublished history also passed gitleaks with no findings. Publication uses
+only the explicit main and v0.98.4 refs, without force-pushing or sending other local refs.
+
+## Changelog audit
+
+The audit compares committed changes since v0.98.3. New entries cover model contracts,
+DeepSeek V4.1 routes and provider thinking, metrics v2, gate/sandbox narrowing, shared-DAG
+repairs and witness policy, CLI/skill/provider changes, clipboard/Markdown links, and WPL
+submission checks. User-visible lower-level changes are also summarized in the CLI
+changelog. Already released lifecycle/advisory changes are not advertised as new.
+Unrelated pending retry/timeout/TB changes are not included. Published changelog sections
+at v0.98.3 and earlier must remain byte-identical after the version bump.
+
+## Package/version contract
+
+The seven public packages are `open-multi-agent-kit`, `omk-ai`, `omk-agent-core`, `omk-tui`,
+`omk-protocol`, `omk-adaptorch-wpl`, and `omk-book-to-skill`, all at candidate version
+0.98.4. Root/example manifests and locks, internal dependency ranges, the book compiler's
+version constant, CLI shrinkwrap and README pointers are synchronized in the same unit.
+
+The checks below ran on the isolated 0.98.4 candidate. Tests and pack/build commands
+used no real provider credentials. Catalogs remained byte-identical to the reviewed
+committed snapshot.
+
+## Verification status
+
+| Gate | Observed status |
+| --- | --- |
+| Workspace version bump | `npm run version:patch` exited 0; seven public versions are 0.98.4 |
+| Published changelog preservation | Seven histories at v0.98.3 and earlier byte-preserved |
+| Workspace build/typecheck | Build exited 0; six changed runtime files and the version constant confirmed clean by primary LSP |
+| Full offline tests | Second run exited 0: 7,859 passed, 837 skipped, no failed tests or collection failures |
+| `npm run check` | Candidate-index check exited 0; module-size and import-cycle gates passed without broader baselines |
+| Release consistency | `check-release-consistency.mjs --release` exited 0 for version/ancestry/README consistency; history cleanup is checked separately below |
+| npm package inspection | Seven local packs declared 0.98.4 and contained manifests/changelogs; restricted path matches 0; local seven-package install exited 0 |
+| Standalone binary smoke | Linux x64 archive built; clean-environment Node CLI and standalone binary both reported 0.98.4 |
+| Native initcheck | Go vet, race/shuffle tests and debug-symbol validation exited 0 |
+| Candidate secret scan | gitleaks on the candidate source snapshot exited 0, findings 0; not a history-clearance claim |
+| Dependency audit | Production dependencies: 0 vulnerabilities. Including development dependencies: 3 existing moderate Vitest-family advisories; suggested fix is a major upgrade, not applied implicitly |
+| Public Git history | Scoped cleanup verified: forbidden path/blob reachability 0, candidate tree unchanged, public ancestor and other refs/tags preserved; unpublished-history gitleaks exited 0 |
+
+Package test counts were WPL 149, agent 868, AI 631, book compiler 22,
+coding-agent 5,425, protocol 34, and TUI 730. AI skipped 786 and coding-agent
+skipped 51 live/environment-gated tests. These counts are verification coverage,
+not measured harness quality.
+
+### Failures found and repaired during preparation
+
+The first full run exposed 31 failed tests and five collection failures; those results
+were not counted as a pass. Narrow reruns separated stale fixtures from runtime defects:
+
+- Pre-aborted requests already stopped before authentication/provider dispatch. The old
+  test expected the provider to run after abort. It now checks zero auth/provider calls,
+  preserved cancellation reason and coherent stream termination. Queued steering input
+  remains in the transcript without starting another provider after cancellation.
+- The native legacy Flash alias now serves a vision model. Vision-routing tests use an
+  explicit text-only fixture instead of asserting a volatile catalog alias is text-only.
+- Four hoisted mocks used a not-yet-initialized namespace import; they now load the real
+  source through `vi.importActual`. The provider-doctor wiring check exercises the actual
+  source CLI rather than an obsolete import string in `main.ts`.
+- Invalid tokenizer results now fail at their boundary and trigger the existing noted
+  fallback. Non-finite estimates fall back to the heuristic; optional-context sorting
+  remains antisymmetric/transitive instead of returning NaN.
+- Domain matching normalizes whitespace without changing its deliberate repeated-keyword
+  scoring policy. Metamorphic regressions cover spaces, tabs and line breaks.
+- Redaction preserves narrowly recognized non-secret references, placeholders and nearby
+  type annotations. Known credential patterns and literal values still mask; adversarial
+  suffix/literal cases are tested. The documented global persistence opt-out was incorrect:
+  the existing alias affects input only, and forced persistence/report masking remains on.
+  No global safety setting was enabled or weakened.
+
+The corrective changes were committed separately. After scoped history cleanup their
+IDs are `ec6db009df` (token counts/order), `f88b791a53` (whitespace routing),
+`23e4b75d14` (redaction and its actual contract), and `779447c883` (current-runtime
+test fixtures). Their source content and the recorded test results are unchanged.
+Release metadata is a separate unit.
+
+Full tests use the repository's `test.sh` with an isolated HOME, a credential-free
+allowlisted environment and bounded Vitest workers. Toolchain locations may be passed
+without credentials. Live provider tests, paid inference, benchmark execution and TUI
+session restarts are excluded. A Linux smoke does not validate all target platforms.
+
+## Publication procedure
+
+Review the final source tree, check the approved history, and tag the
+exact main commit. The existing `build-binaries.yml` CI path owns npm publication and
+GitHub Release creation; local pack/build commands are not publication. CI authentication
+is unchanged and does not claim OIDC/Sigstore provenance. Completion requires the main tag,
+GitHub Release and npm latest for all seven packages to agree.