project-tiny-context-harness 0.8.12 → 0.8.16

package/assets/skills/design-resource-authoring/references/open-design-provider.md

@@ -25,6 +25,25 @@ Current structured tool names may include `list_agents`, `list_skills`, `list_pl
 
 Functional skills and rendering templates are different registries. Finding `frontend-design` does not prove that a `mobile-app` or `wireframe-mobile-flow` template is installed, and a remembered template ID is not live capability evidence.
 
+## Highest-performance generation selection
+
+Open Design quality takes precedence over model-call price for every formal first generation, every major revision and every final-candidate defect repair that requires material regeneration. A major revision changes the adopted visual direction or design system, cross-surface information architecture, primary interaction model, or enough of the selected canonical source/Fact manifest to invalidate the former candidate. Pure discovery, reads, resource enumeration, metadata queries and review of an already sufficient selected resource do not trigger this policy.
+
+The durable policy is `highest_available_capability + highest_supported_reasoning_effort`, not a permanent model name. Apply it immediately before each applicable run:
+
+1. Discover the live provider/tool schemas and returned agent/model metadata. Determine whether the actual run surface exposes model, reasoning-effort or service-tier inputs and which run/project/result fields can confirm their effective values. Never invent an input or result field that the provider does not expose.
+2. Filter to eligible models before ranking. Eligibility requires every tool, visual/multimodal capability, context capacity, authentication path and data-residency/disclosure boundary required by the commission. An ineligible model cannot win on nominal capability.
+3. Rank eligible models only by the provider's explicit capability order or documented recommended-replacement relation. If that is absent, the sole permitted fallback is one versioned, evidence-linked provider-local mapping owned in this reference; do not duplicate it in the main Skill, Context, README, tests or adapters. Price, model-name shape, publication date, apparent generation number and provider list order are not ranking evidence. This reference currently defines no fallback entries: when live provider evidence cannot order two or more eligible candidates, stop formal generation or major revision with `highest_performance_unverified` instead of guessing.
+4. For the selected model, use its actually declared ordered legal reasoning-effort values and select the highest supported value. Examples such as `max` or `xhigh` illustrate possible highest values; they are not a cross-provider ordering or permanent product vocabulary. If several advertised values cannot be authoritatively ordered, the highest effort is unverified and the applicable generation must fail closed.
+5. Keep service tier distinct from model capability and reasoning effort. Discover and report it when the provider exposes control or provenance, but never use price, latency tier or a service-tier label to rank model capability.
+6. When model selection is controllable, requesting anything below the proved highest eligible model is an invocation error. When reasoning is controllable, requesting anything below the proved highest supported effort is likewise an error. A missing remembered example model is not an error when live evidence selects a different actual highest model.
+7. Compare requested values with the effective model, reasoning effort and service tier reported by the completed run. A mismatch fails the run. If the provider accepts a request but does not expose effective provenance, keep the result `highest_performance_unverified`; do not claim the requested values were used.
+8. If the provider exposes reasoning control but no model control, request the proved highest effort and report that model selection could not be independently enforced. If it exposes neither control nor enough candidates to create an unresolved ranking choice, its current default generation path may be used, but the result remains `highest_performance_unverified`. If it explicitly exposes multiple eligible models and no authoritative order, rule 3 blocks the run.
+
+Capability discovery happens at call time so a provider's new highest model or effort can replace an older example without a Skill edit. This is a provider adapter policy, not a scheduler: create no persistent model registry, routing state, retry loop or cross-provider optimizer. Reduce cost by avoiding unnecessary generations, irrelevant resources and separable revisions, or by reusing a sufficient selected resource—never by lowering the generation model or effort.
+
+Repository tests can prove only that these branches remain distributed in the managed guidance. Only a normalized live provider trace that freezes provider/version, candidate and eligibility metadata, ranking authority, request fields and effective result provenance can prove the model and effort actually used. Without that trace, report the boundary as unverified.
+
 ### Rendering-template discovery compatibility
 
 Prefer, in order:
@@ -56,14 +75,14 @@ Never silently use the provider's default or a different system. A provider-side
 
 ## Structured commission sequence
 
-1. Record provider version, selected agent/model, functional capability, rendering template, adopted design system and relevant plugin/export readiness as reported live.
+1. Record provider version, selected agent/model, reasoning effort and service tier when exposed, functional capability, rendering template, adopted design system and relevant plugin/export readiness as reported live. For an applicable generation, retain the eligibility/ranking basis and the request-versus-effective comparison required by the highest-performance policy.
 2. Reuse an existing task-local project only when its scope, prior inputs and required design-system binding match; otherwise create a bounded project. For style-bearing work, pass `designSystem` and verify `get_project.designSystemId` before the run.
 3. Start a run with the product-specific commission envelope, provider-native capability identifier and—when the intent is a formal Web/App implementation handoff—the complete prederived authoring obligation universe. That universe is based on requested scope, product semantics, adopted design system and target environments; it must not be inferred only from provider output.
 4. Poll with a bounded cadence. During a long run, report meaningful progress at least once per minute without flooding the user.
 5. Preserve run IDs and the latest provider diagnostic. Support cancellation when the user requests it and the provider exposes it.
 6. Resolve the actual entry explicitly, retrieve the artifact/source, inspect it according to intent and preserve its immutable identity before later iterations or handoff.
 
-Open Design may launch Codex CLI as its configured inner agent. That is provider execution, not recursive invocation of this outer Skill. Do not hardcode a model when the provider can report the current configured model.
+Open Design may launch Codex CLI as its configured inner agent. That is provider execution, not recursive invocation of this outer Skill. Do not hardcode a remembered model when live discovery and authoritative ranking can select the current highest eligible model.
 
 ## Separate three kinds of state
 
@@ -138,3 +157,4 @@ Figma, Penpot, OpenPencil, image, video, 3D/WebGL and other providers are option
 - Re-discover capability after provider upgrades or registry mismatches.
 - If structured paths fail but a UI artifact exists, UI inspection may recover it while retaining the degraded-provider qualifier.
 - If the provider is unavailable and no justified fallback exists, return `unavailable` with the minimum setup needed rather than generating with an unrelated image tool and calling it equivalent.
+- Provider recovery and DRA semantic recovery are separate: this reference may re-read the current run/resource identity, while [recovery-and-writeback.md](recovery-and-writeback.md) alone owns Base/Delta replay, the conditional checkpoint and Proposal CAS. Never restore a live Provider state or suitability conclusion from that checkpoint.

package/assets/skills/design-resource-authoring/references/recovery-and-writeback.md

@@ -0,0 +1,199 @@
+# DRA Semantic Replay, Recovery And Proposal Writeback
+
+Load this reference only for a material generation/revision loop which needs complete semantic replay, a selected-Proposal writeback, current bidirectional audit or real recovery across interruption. It strengthens upstream Source quality and does not become Design Authority, implementation acceptance or Long-Task proof.
+
+## Simple path and admission
+
+A simple scoped preview creates zero recovery files and persisted recovery bytes, adds no user pause or Provider generation beyond the one requested commission, runs no formal handoff/preflight, performs no Proposal writeback and opens no helper write transaction. Its ordinary requested preview is the commission itself; recovery adds and reports zero tool actions. Keep its temporary reasoning in the current turn.
+
+Use a recovery checkpoint only when interruption would otherwise lose material accepted/rejected/unresolved semantics, immutable Provider identity or a pending CAS writeback. It is versioned, ignored, task-local, non-authoritative and deletable. It is not Source, Context, a Contract, Authority, Evidence, Receipt, Gate, Provider registry, scheduler, acceptance state or completion conclusion. There is no global session registry, event log, heartbeat, polling loop or state-machine service.
+
+For deterministic classification, apply four fail-closed invariants before details: validate every semantic key independently; retain every valid accepted/rejected/unresolved decision and its authority row even when a later patch, audit or owner fails; reject deterministic checkpoint input whose claimed Source authority is invalid; and report a requested or pending unsafe reconciliation/writeback as blocked rather than as no action. Provider/resource selection never fills a missing authority row, and one key's authority never covers another key.
+
+## Base and replayable Delta
+
+Freeze one current Base with:
+
+```yaml
+locator: repository/relative/file
+raw_byte_digest: sha256
+encoding: detected-by-helper
+eol_policy: detected-by-helper
+scope_ceiling: bounded-scope-key
+in_scope_keys: []
+explicitly_excluded_keys: []
+```
+
+The Base must be repository-readable and raw-digest verifiable: ordinary project Source, a materialized project-native Proposal, or an explicitly authorized disclosure-reviewed recovery snapshot. A Provider resource is recoverable only when its immutable identity can be fetched again and checked. Conversation-only input, expiring external documents, unavailable attachments and sensitive inputs are not recovered from locators. Materialize only with explicit user authorization. Never persist credentials, tokens, secrets, protected raw values or sensitive originals. Otherwise report exactly `cross-session deterministic recovery unavailable`; when no checkpoint exists, its checkpoint disposition is `none`, not rejection of a nonexistent file.
+
+Every Delta stores actual replay semantics, never only an ID:
+
+```yaml
+delta_id: stable-key
+sequence: 1
+supersedes: []
+proposes_replacement_of: []
+operation: add | replace | remove | preserve
+semantic_kind: exact-visual | product | business | permission | data | algorithm | commercial | safety-security | technical
+target_keys: []
+before_semantics: complete-value-or-null
+after_semantics: complete-value-or-null
+origin: user-direct | necessary-derived | repository-evidence-backed | provider-suggested
+decision_authority: explicit-user | delegated:<bounded-scope-key> | none
+evidence_refs: []
+source_refs: []
+explicitly_unchanged_keys: []
+status: accepted | rejected | unresolved
+```
+
+Retain all statuses, exact ordering, one-way supersession and explicit unchanged keys. Only an accepted Delta may supersede an earlier active accepted Delta, and it must replace the same target set, semantic kind and exact prior `after_semantics`; a rejected or unresolved Delta never deactivates accepted meaning. Use `proposes_replacement_of` for a rejected/unresolved proposal which may be decided later. Cross-target or semantic mismatch fails closed.
+
+After legal supersession, every stable semantic target key has at most one active accepted Delta owner. Two active accepted Deltas for one target without a legal replacement relationship fail closed. This version deliberately has no generic merge or composition DSL; a future need to compose one semantic key from several Deltas requires a separately admitted mechanism.
+
+Derive the complete inactive universe as rejected plus unresolved plus superseded accepted Delta IDs. The current audit supplies exactly one leakage row for every inactive ID with the matching reason and `leaked: false`; missing, extra, duplicate or active-ID rows fail closed. If an inactive meaning remains in the Proposal, selected-resource projection or resulting writeback, reconciliation is blocked.
+
+Status inventories contain stable target-key identities, never `key=value` strings; semantic values stay in the Delta rows. The same key can therefore remain in the accepted inventory while a later rejected or unresolved proposal for that key remains visible in its own inventory. A blocked audit or illegal final owner does not rewrite an independently authorized accepted Delta as unresolved.
+
+Each `source_ref` resolves through `authority_sources` to one repository-contained Source document, its current raw-byte digest, one actual marked Source item, the item kind and item-text digest. An arbitrary string or conversation-only locator cannot create authority or enter deterministic recovery. For deterministic accepted authority, that same marked Source Item also contains one strict, non-rendered, package-owned single-line `ty-dra-authority-v1` JSON projection covered by the Item text digest. Free text without this projection can continue through ordinary conversational DRA, but it cannot machine-close deterministic recovery authority or enter a checkpoint as accepted authority.
+
+An explicit projection uses `mode: explicit-user` and enumerates exact target keys, semantic kinds, allowed origins and the canonical `after_semantics` SHA-256. Its `target_keys` set must equal the bound Delta target set; a coupled `[A, B]` decision cannot be rebound as an independently authorized `[A]` meaning. A delegation projection uses `mode: delegation` and enumerates its stable delegation key plus exact allowed target keys, semantic kinds and origins. `delegated:<id>` names the matching task-local delegation row, and the accepted Delta binds that same decision Source. Delegation is deliberately a bounded superset: every Delta target must be a member of the delegation's allowed targets. Do not substitute an incidental target path for delegation identity. A hierarchical-looking key such as `checkout.confirmation` does not implicitly authorize `checkout.confirmation.fade_duration`, a sibling or a broader target.
+
+`origin` records where the meaning arose, not where its Source item happens to be stored. Materializing a direct user choice in the repository leaves it `user-direct`; use `repository-evidence-backed` only when repository evidence itself supplies the meaning. A separate decision Source can authorize a meaning without changing that meaning's origin.
+
+A selected resource is evidence and never authorizes itself. An accepted Provider suggestion requires explicit user authority or a delegation which covers its origin, semantic kind and every target. Delegation authorizes bounded choice; it is not automatically the Source for the chosen non-visual meaning. Product capability, business, permission, data, algorithm, commercial and safety/security meaning additionally binds an independent authoritative Source Item, separate from the delegation item, whose own projection simultaneously matches the exact target set, semantic kind, origin and canonical `after_semantics` digest. An unrelated requirement kind cannot fill that slot. A specific explicit-user decision item may carry both meaning and acceptance, but a general bounded-delegation decision alone is not the meaning. Exact visual values may remain exclusively resource-owned, but their adoption authority remains independently Source-bound. A visual-color delegation therefore cannot be rebound to product, business or permission meaning. Provider-added meaning lacking authority remains `unresolved` unless an authoritative decision explicitly rejects it. Rejected/unresolved meaning never enters accepted requirements or writeback.
+
+The helper proves consistency between Source-owned structured scope and Delta fields. Interpreting the higher-level semantics of arbitrary free text remains part of the Authoring TCB; the helper does not implement general natural-language entailment.
+
+Reconstruct each round only from:
+
+```text
+current Base@raw digest
++ ordered active accepted Delta semantics
++ current unresolved decisions
++ current scope/exclusions
++ current Design Authority identity
+```
+
+Never use a prior Agent summary or generated resource as the next Base. Missing semantics, stale Base, invalid sequence/supersession/delegation or an out-of-scope/excluded target fails closed.
+
+## Conditional checkpoint and helper
+
+Prepare one disclosure-reviewed JSON input using schema `design-resource-recovery-input-v4`, including session identity, Base, `authority_sources`, delegations/Deltas, exact accepted/rejected/unresolved sets, current Design Authority identity, immutable Provider project/run/resource references, `selected_resource_bindings`, one frozen `audit_expectations` catalog and optional writeback. The catalog owns the exact changed, unchanged, resource-decision, blast-radius and inactive-leakage row expectations, including Delta/resource/condition/basis/binding identities. Every resource-decision binding freezes one and only one `final_disposition`: `proposal-written` with its exact operation ID, `resource-owned-exact-visual` with its selected resource/conditions/structured owner, `not-adopted` for rejected or superseded meaning, or `unresolved` for unresolved meaning. Audit observes and verifies this owner; it never selects it. Changing an owner requires checkpoint `update` with digest CAS. The catalog is the only checkpoint audit-universe/owner owner; current audit rows must be set-equal to it rather than merely non-empty. Selected resource bindings declare one unique resource key, generic `repository-snapshot` or `external-immutable` identity, locator, raw-byte digest and exact condition identities. Arbitrary condition strings and duplicate identities fail closed.
+
+Create/retain a checkpoint for a real interruption or pending CAS writeback; use `none` when neither exists, and `reject` when a requested new checkpoint, input, destination or existing checkpoint cannot be admitted. Never turn an invalid authority request into `none` merely because no file was written. Then explicitly create it when required:
+
+```text
+ty-context design-resource recovery create <session> --input <state.json>
+```
+
+When a real recovered loop changes Delta, resource or pending writeback inputs, replace the existing checkpoint only through digest CAS:
+
+```text
+ty-context design-resource recovery update <session> --input <state.json> --expected-sha256 <current-checkpoint-sha256>
+```
+
+The helper writes the next canonical checkpoint to an exclusive same-directory temporary file, rechecks the current digest, atomically replaces and rereads it. A mismatch retains the old checkpoint and fails closed. Repeated identical input is an idempotent no-write. This creates no session registry.
+
+The helper writes only:
+
+```text
+tmp/ty-context/design-resource-recovery/<session>/checkpoint.json
+```
+
+and requires the path to be ignored and untracked. It validates strict schema/version, canonical bytes, Base identity, complete Delta/delegation semantics, repository containment/no-follow parents, symlink/junction/hardlink and user collision boundaries. The checkpoint adds detected Base encoding/EOL and, when applicable, detected target encoding/EOL. It stores no current activity, live Provider execution, Artifact readiness, Design suitability, next action, readiness/completion or acceptance.
+
+Use `inspect` after interruption. It re-reads Base and repository Design Authority, validates raw identities, reconstructs ordered active accepted/rejected/unresolved semantics and derives writeback state. External Provider/resource and external Design Authority identities remain explicitly listed for current revalidation; the helper does not contact or manage Providers.
+
+```text
+ty-context design-resource recovery inspect <session> [--json]
+```
+
+Unknown schema, corrupt JSON, stale Base/authority or unavailable semantics fails closed. In particular, v3 input/checkpoint/audit and exact-patch-v3 are never silently interpreted as v4/exact-patch-v4; reconstruct current state from Source, Provider identities and Proposal instead of inferring missing bindings or establishing a migration registry. The helper's deterministic boundary is supported repository files and exact bytes; a locator alone is not proof of recoverability.
+
+## Current audits and status card
+
+Before selection/writeback and after every material revision, re-read current resources and perform three upstream audits:
+
+1. **Requirements → Resource:** every frozen active accepted changed key has the catalog's exact Delta, selected immutable resource and condition bindings. Every frozen explicit-unchanged key has exactly the catalog's resource, condition and authority-basis Source bindings. A referenced condition must belong to the selected resource's declared conditions. Missing, extra, duplicate, unresolved, distorted or falsely claimed coverage fails closed.
+2. **Resource → Requirements:** freeze every material resource-decision row and its one final disposition per binding in the checkpoint catalog. Each row binds exact Delta IDs and a separate stable binding ID plus requirement-key/Delta/origin/decision-authority/Source tuple for every key; authorization of one key never covers another. The global `(resource_ref, requirement_key, delta_id)` and `(delta_id, target_key)` identities are unique across all rows; duplicate arrays or cross-row bindings fail before any Map/Set normalization. Every active non-preserve `Delta × target` has exactly one final disposition. `proposal-written` binds one real patch operation ID. `resource-owned-exact-visual` is limited to exact visual meaning and binds one immutable selected resource, exact declared conditions and a structured `selected-source-record` or `external-immutable` owner. Rejected/superseded uses `not-adopted`; unresolved uses `unresolved` and blocks readiness. Provider success, audit choice or a selected file cannot create authority.
+3. **Unexpected Blast Radius and inactive leakage:** the catalog freezes the complete blast-radius universe, including every explicit Base exclusion, and every inactive Delta leakage row. Inspect every blast row for out-of-scope pages, controls, copy, layout, tokens and states, and every leakage row for reappearance of rejected, unresolved or superseded meaning. Missing, extra, duplicate, unexpected or unresolved rows fail closed.
+
+Provider execution, Artifact readiness and Design suitability are independent. Provider success, complete fields or repeated values never prove suitability; a valid shared Token or inherited component variant must not be rejected merely because a value repeats. Block direct/Design-Authority conflict, wrong target/condition, missing material state, placeholder-final content, unsupported added meaning, unresolved promotion, stale identity and incomplete formal closure.
+
+Derive—not restore—a status card containing Base identity; accepted/rejected/unresolved Delta; current changed and explicitly unchanged keys; Provider run identity; current live Provider execution; current Artifact readiness; freshly audited Design suitability; all three audit findings; current digest-derived writeback CAS state; and next action. A requested status card re-runs the current audits: an executing run or incomplete current resource is `blocked`, not a restored or `not-applicable` audit conclusion. The checkpoint contains none of those live conclusions.
+
+Derive status fields with one meaning each:
+
+- checkpoint: `none` when no checkpoint exists or is needed, `create` for a real interruption/pending CAS writeback, `retain` for an existing valid checkpoint, and `reject` for a proposed or existing invalid/unsupported checkpoint, input or unsafe destination;
+- write action: `none` when no Proposal writeback/promotion is pending or requested (including a recovery-availability inquiry), `preview` for a safe pending patch not yet approved for apply, `apply` only for pre-digest plus balanced audit, `idempotent-no-write` for expected-post bytes, and `block` when a requested/pending writeback is unauthorized, stale, conflicting or audit-blocked;
+- audit: `not-applicable` only when no current selected/resource surface is available to audit, `blocked` when any current audit cannot balance, and `balanced` only after all three current audits and leakage checks pass.
+
+An unauthorized meaning in a selected resource therefore blocks its Proposal promotion/writeback even if the file remains valid visual evidence; an unavailable conversation-only Base with no writeback request reports no write action.
+
+Project the decision inventory before projecting the action result. An independently Source-valid accepted Delta stays in the accepted inventory and keeps its authority row when a later patch, resource identity, condition/basis binding, audit row or final owner is invalid; those later defects block reconciliation, readiness and writeback but do not demote or erase the accepted meaning. When balanced reconciliation, promotion, handoff or writeback is requested or imminent, any duplicate identity/cross-row binding, condition/basis mismatch, illegal/multiple/unreadable final owner, inactive leakage or patch mismatch means a blocked result, blocked current audit and blocked write action—not `none` or `unavailable`—with every affected audit direction reported. If the authority Source/projection itself fails target, semantic kind, origin, meaning digest or repository identity, reject the deterministic input/checkpoint and do not accept that meaning. For a deterministic create/update input, this is checkpoint `reject` even when no prior checkpoint exists; normalizing the invalid claimed acceptance into rejected or unresolved meaning does not turn the invalid input into checkpoint `none`. Retain an existing valid checkpoint when an update/cleanup conflict or partial cleanup prevents the requested operation.
+
+Apply the table to imminent work, not only completed commands: a valid authorized Delta plus an immutable resource and a real interruption expected before writeback requires checkpoint `create` and write action `preview`; a handoff-ready request with any current audit/authority gap requires write action `block`; and frozen pre/post digests plus a balanced current audit are a pending CAS writeback requiring checkpoint `create` or `retain` and write action `apply`.
+
+## Safe writeback and reconciliation
+
+Create a writeback only when at least one frozen active binding is `proposal-written`. Freeze target locator, pre-write raw digest, exact `design-resource-exact-patch-v4`, canonical patch digest, expected post bytes/digest, selected resource identities and `proposal_written_delta_ids`. The immutable replay Base and mutable writeback target must be distinct locators; if the current Proposal itself must be updated, first use an explicitly authorized immutable Source/snapshot as Base. The exact patch universe is only the active accepted `Delta × target` bindings frozen as `proposal-written`; resource-owned exact values remain in effective requirements and audit but never enter or get copied into Proposal.
+
+Every patch operation has one unique ID, exactly one Delta, one target, one semantic binding and one `source_span` in `utf16-code-unit-v1` coordinates over the original decoded pre-write Proposal. Every non-null before/after semantics has exactly one JSON scalar leaf, and the declared local text projection must cover that leaf. Ordinary string scalars containing CR, LF, NUL or another control character are unsupported; never permit a value such as `red\npermission.admin: true` to escape its scalar carrier.
+
+For `replace`, split each local before/after text at its projected scalar. The complete prefix before the scalar and suffix after it must be character-for-character equal; only the projected scalar may change. Adding a permission line, renaming a label or deleting nearby prose inside the same operation is blocked and requires a separately authorized Delta rather than piggybacking on the scalar replacement.
+
+Free-text add/remove cannot establish non-interference. `add` requires null before semantics, preserves one exact nonempty insertion anchor and adds exactly one package-canonical single-line `ty-dra-proposal-scalar-v1` carrier plus the current uniform EOL. That carrier contains only `target_key`, `semantic_path` and the canonical JSON scalar value. `remove` projects one before leaf to null, requires empty `after_text` and deletes exactly one already canonical carrier whose target/path/value match the Delta; it cannot widen over an adjacent heading, requirement, explanation or other target. `disabled`, `removed`, `deprecated` or another non-empty substitute is new meaning requiring a separate Delta. If the current Proposal has no supported anchor/carrier, report exactly `deterministic Proposal writeback unavailable`; return a complete revised Proposal for user confirmation or retain the exact value as resource-owned instead of falling back to generic string replacement.
+
+Fail closed from the actual patch-v4 operation and Proposal bytes, not from omitted detail in a concise audit summary. A statement that an operation exactly projects its one leaf and that its anchor/carrier, preimage and expected post bytes are current is a positive claim of those named invariants unless another fact contradicts it; do not invent a missing carrier, malformed carrier or free-text fallback merely because the summary does not repeat the serialized carrier. Conversely, a claimed valid operation never overrides an observed parser, target/path/value, anchor, scaffold or span mismatch.
+
+For a decision-only review whose supplied facts are an invariant summary rather than the serialized operation, treat these as sufficient positive patch-v4 claims unless another supplied fact names a mismatch: an add with null before semantics, exactly one after scalar, `before_text` used only as a preserved structural anchor, exact after projection and current pre/post bytes; or a remove with exactly one before scalar, null after semantics, empty `after_text`, exact before projection and current post bytes in which the old `before_text` is absent. Such a positive summary is `allow`/balanced and does not itself reveal missing carrier bytes. This interpretation never relaxes create/update: when actual operation bytes are available, the helper must parse and verify the canonical carrier, anchor and source span and fail closed on any mismatch.
+
+A carrier, scaffold, projection or source-span defect is a downstream patch defect, not a new authority decision. When the Delta's Source and decision authority remain valid, preserve that Delta in `accepted_keys` and preserve its authority row while returning a blocked disposition/audit/write action and rejecting the invalid checkpoint input. Never erase or demote already accepted meaning merely to express that its proposed patch cannot be applied; only an actual Source/authority failure changes the accepted inventory.
+
+Checkpoint create/update resolves every source span against the same original Proposal before mutation. The frozen interval must equal `before_text` and both text digests, and all spans must be pairwise disjoint and non-nested; operations cannot share a character or insertion anchor. Apply sorts original spans by descending offset and replaces only those intervals, so a later operation cannot consume output generated by an earlier operation. Readback calculates each final interval from original offsets and length deltas, checks its exact output plus the whole-file expected digest and thereby conserves untouched prefix, suffix and inter-operation gaps. A source span cannot represent two independent meanings. Inactive, unknown or resource-owned bindings cannot enter the patch, and changing red semantics to purple text without changing the Delta is rejected during create/update. For an active superseder, the declared prior `before_text` projection must also be absent from the computed and reread post-write Proposal; its survival is inactive-meaning leakage. This is a bounded scalar-carrier projection proof, not general NLP entailment or arbitrary text-diff semantics. Preview before mutation:
+
+```text
+ty-context design-resource recovery preview <session> [--json]
+```
+
+Current target digest determines state:
+
+```text
+current == pre-write digest       => unapplied
+current == expected post digest   => already applied/idempotent
+otherwise                         => concurrent conflict; fail closed
+```
+
+Produce a fresh `design-resource-reconciliation-audit-v4` bound to the same Base, Design Authority, Provider run, selected resource digests, optional expected target digest, current decision sets and the checkpoint's complete audit-expectations catalog. Include Requirements→Resource, per-key Resource→Requirements, blast-radius and inactive-leakage rows. For a Proposal writeback, apply:
+
+```text
+ty-context design-resource recovery apply <session> --audit <audit.json>
+```
+
+The helper first requires a balanced fresh audit, validates checkpoint-frozen structured downstream owners and CAS, reapplies the exact patch from the frozen original spans in memory, preserves supported UTF-8/BOM or UTF-16 encoding and the existing non-mixed EOL policy, writes a same-directory exclusive temporary file, syncs it, rechecks the target, atomically renames, rereads expected bytes, verifies every operation's calculated final interval—or removed canonical carrier—plus whole-file digest, and reconciles again. An already-post state performs no write. A `selected-source-record` owner must be repository-readable at its bound digest; an external-only Provider locator stays revalidation-pending.
+
+When no binding is `proposal-written`, omit writeback and do not invent an empty patch or transaction. Re-read Source, selected resources and downstream owners and reconcile the complete catalog read-only:
+
+```text
+ty-context design-resource recovery reconcile <session> --audit <audit.json>
+```
+
+Recovery uses only generic repository snapshot/source-record identity. It does not accept a `formal-handoff-target` label or duplicate the formal handoff parser; formal Web/App handoff readiness remains owned by `ty-context design-resource preflight`.
+
+A valid resource-owned-only case may be `allow` plus `reconciliation-balanced` with `write_action: none`, but the helper-level `handoff_ready` projection remains false. Any later readiness claim waits for the Skill-owned composition of current Provider/resource revalidation, durable final ownership and applicable formal preflight; never infer readiness merely from a balanced read-only reconcile.
+
+The helper reports only `reconciliation-balanced`, `writeback-applied`, `writeback-idempotent`, `blocked` or `external-resource-revalidation-pending`. It does not report `handoff-ready`. Missing/extra/duplicate/unresolved/distorted/unsupported coverage, per-key authority mismatch, ambiguous/illegal final ownership, inactive leakage, changed explicit-unchanged meaning, unexpected blast radius or any identity mismatch returns `blocked`. A selected external resource which the helper cannot currently reread keeps external revalidation pending even after a valid Proposal writeback.
+
+Same-directory rename, filesystem durability and the remaining same-user pre-rename race are the named Windows/macOS filesystem TCB. This is not hostile-writer linearizability or crash-proof storage. Cleanup failure is explicit. The helper removes only an exact digest-matched valid checkpoint and its now-empty session directory:
+
+```text
+ty-context design-resource recovery remove <session> --expected-sha256 <sha256>
+```
+
+Before removal it inventories the session directory. It removes the checkpoint and directory only when the directory contains exactly the helper-owned digest-matched checkpoint. Any other entry returns an explicit `partial` result and preserves both the checkpoint and unowned content; a race after checkpoint removal also returns `partial` with the retained entries. It never scans or deletes unrelated `tmp`, `.work_products`, `artifacts` or reports.
+
+## Downstream boundary
+
+Proposal–Resource reconciliation is upstream diagnostic information. It never replaces the Proposal, selected immutable resources, formal handoff, downstream UI Authority Closure or project implementation checks. A later Long-Task can prove only final Source/Contract bindings, current implementation and current Evidence. Its sole Final Gate cannot prove historical Provider execution, and the checkpoint/audits/status card never enter Long-Task Source, Contract, Authority, Evidence or completion.
+
+Only the DRA Skill may derive final `handoff-ready`, and only from helper reconciliation balance plus current Provider/resource revalidation, one durable final owner per active binding, every applicable formal handoff/preflight and no unresolved blocker. This composition is not a new Gate and says nothing about Provider history, subjective optimality, arbitrary natural-language truth or completed product implementation.

package/assets/skills/design-resource-authoring/references/resource-selection.md

@@ -42,7 +42,7 @@ Preserve each supplied item's actual role:
 - `current-implementation-evidence`: evidence of current behavior, not desired behavior by default;
 - `background`: product/technical context that informs but does not expand generation scope.
 
-An optional Source Plan is one possible input. Raw notes or an initial proposal are equally valid. Never require one merely to make the other usable.
+An optional pre-existing planning document is one possible input. Raw notes or an initial proposal are equally valid. Never require a special intermediary format merely to make another input usable.
 
 ## 4. Derive development-corresponding coverage
 
@@ -164,7 +164,7 @@ This is an explanatory shape, not a required file or schema. Never paste or para
 - For exploration, stop as soon as the requested decision is supported.
 - For a final-selected formal Web/App implementation handoff, apply the dedicated formal reference's exact stop conditions. Honest `decision_required`, `unavailable` or capability gaps remain blocking; they cannot be called ready or authorize fidelity work.
 
-During iteration, keep accepted, rejected and unresolved implications in a task-local delta buffer. Do not require or emit an interim delta after every iteration and never continuously synchronize the initial proposal. After explicit human selection or explicitly delegated selection, consolidate the buffer once and reconcile only accepted decisions into the initial proposal. If it is a writable file, update it in place while preserving original intent/provenance; otherwise return one complete revised proposal. The operation must be idempotent, name selected artifact locators/hashes and affected stable keys, and exclude rejected/unresolved choices. Never write a Source Plan, Context, `DESIGN.md`, code, tests or Contract.
+During simple iteration, keep accepted, rejected and unresolved implications in a task-local delta buffer. Do not require or emit an interim delta after every iteration and never continuously synchronize the initial proposal. If the loop requires durable semantic replay, a selected-Proposal file writeback or cross-interruption recovery, load [recovery-and-writeback.md](recovery-and-writeback.md) and use its independent origin/decision-authority/evidence/status model plus package helper; prompt prose alone cannot establish CAS or deterministic recovery. After explicit human selection or explicitly delegated selection, consolidate the buffer once and reconcile only accepted decisions into the initial proposal. If it exists only in conversation and safe materialization was not explicitly authorized, return one complete revised proposal and report cross-session deterministic recovery unavailable. Never create another intermediary planning document or mutate Context, `DESIGN.md`, code, tests or Contract.
 
 ## Worked scope examples
 

package/assets/skills/long-task-workflow/SKILL.md

@@ -7,27 +7,29 @@ description: Author, preflight, execute, resume, verify, or close one complete S
 
 ## Boundaries
 
-Use one currently selected host execution Goal, one repository, one selected verification workspace, one complete Contract and one Final Gate. This workflow never creates, invokes or manages a scheduler, agent runtime, App Server, branch/worktree fan-out, merge, push, PR, deployment, Campaign/SFC/Packet/Wave chain, matrix, verdict or second Contract plan. The parent Goal owns Source, Contract, Authority, architecture, Context writeback, integration, current-candidate checks, formal verification, Final Gate, close and completion. Harness never allocates, schedules, retries or recovers delegated workers; their reports are not Progress, Evidence or proof, and every result must converge into the selected verification workspace before verification counts. Never activate from task size alone.
+Use one currently selected host execution Goal, one repository, one selected verification workspace, one complete Contract and one Final Gate. This workflow never creates, invokes or manages a scheduler, agent runtime, App Server, branch/worktree fan-out, merge, push, PR, deployment, legacy orchestration chain, matrix, verdict or second Contract plan. The parent Goal owns Source, Contract, Authority, architecture, Context writeback, integration, current-candidate checks, formal verification, Final Gate, close and completion. Harness never allocates, schedules, retries or recovers delegated workers; their reports are not Progress, Evidence or proof, and every result must converge into the selected verification workspace before verification counts. Never activate from task size alone.
 
 That Goal is host/user-selected; Harness does not create, persist or reconnect a Goal identifier. Compaction may continue inside it; a later physical Goal/session restores semantic state through `resume`, not a prior Turn. With a valid binding, run `ty-context long-task resume <workdir>`, then directly load the installed `long-task-workflow` Skill; recovery needs no implicit invocation.
 
 The host/user owns model selection. Exactly one unconditional terminal-turn checkpoint follows the first Authority Lock before implementation. Harness neither switches nor verifies the model, persists checkpoint/acknowledgement/route state, nor creates a model scheduler, automatic switch or native-Goal completion state. Do not otherwise pause a healthy Goal solely to change models.
 
-A Codex-root `long-task` install may expose optional fixed package-owned `long_task_implementation` with child multi-agent disabled. It is static, stateless, non-Authority and post-checkpoint—not a checkpoint option, model route or runtime. Install proves no discovery or selection. If unavailable/invalid/colliding or not exactly selectable, the parent implements; never substitute a generic child or add dynamic tiers, retry or scheduling.
+A Codex-root `long-task` install may expose fixed package-owned `long_task_implementation` with child agents disabled. It is static, stateless, non-Authority and post-checkpoint; install proves neither selection nor effective model/reasoning/tier. Profile and spawn never set `service_tier`. Exact-call or capability failure returns a packet to the parent; never infer it, use a generic child, or add tiers/retry/scheduling.
 
-`long-task-delivery-v2` is the only active Contract schema. `delivery-contract.yaml` is the one root authoring file. New authoring uses inline Outcomes; existing `outcome_files` are physical compatibility only. `delivery-set` is retired and non-executing.
+`long-task-delivery-v2` is the active Contract schema. `delivery-contract.yaml` is the root authoring file. New authoring uses inline Outcomes; existing `outcome_files` are compatibility only. Legacy split-delivery commands are non-executing.
 
 ## Controlling Objective
 
-Prevent false completion inside declared authority. Given complete and accurate Source at the declared observable granularity, a meaning-preserving Source-to-Contract projection, complete applicability expansion and a sound named verifier/runner trust boundary, `AcceptedDeliveryTerminal` must imply that no declared observable drift remains. Implementation may drift, fail or require rework, but every declared requirement, semantic Fact, selected-design Fact, proof obligation and independently falsifiable AC must remain traceable; every unsatisfied, unverifiable, stale, failed, externally pending or otherwise unproved item must block or explicitly qualify completion.
+Prevent false completion inside declared authority. Given complete and accurate Source, a meaning-preserving Contract projection, complete applicability and the admitted-observer boundary, `AcceptedDeliveryTerminal` implies no declared machine-observable drift remains. Machine completion requires package-admitted Actual and Harness-owned comparison; unsupported proof remains blocking External Confirmation. Implementation may drift or require rework, but every declared requirement, Fact, proof obligation and independently falsifiable AC stays traceable, and every unproved item blocks or qualifies completion.
 
-Complete Source is not a prose or current-code ceiling. Material non-UI meaning uses the finest independently decidable standard and custom semantic Facts plus every required proof method. For selected design resources, Agent implementation, acceptance and testing fully conform to every material Fact in declared scope and conditions; formal input therefore uses complete canonical acquisition, Census, atomic Fact/proof closure and exact production-target evidence. Deliberately partial design input remains an explicitly scoped constraint or blocking unresolved input; incomplete implementation-source acquisition is blocking, and an exact target requires layout and pixel Facts for every declared condition. `UI symbolic V2 is explicit opt-in; V1 remains the default.` `Non-UI symbolic admission and Provider/P0 trust-boundary work remain out of scope.` Read the Source, Contract and Evidence references for the exact V1/V2 authoring and proof rules.
+Complete Source is not a prose or current-code ceiling. Material non-UI meaning uses the finest independently decidable standard and custom semantic Facts plus every required proof method. For selected design resources, Agent implementation, acceptance and testing fully conform to every material Fact in declared scope and conditions; formal input therefore uses complete canonical acquisition, Census, atomic Fact/proof closure and exact production-target evidence. Deliberately partial design input remains an explicitly scoped constraint or blocking unresolved input; incomplete implementation-source acquisition is blocking, and an exact target requires layout and pixel Facts for every declared condition. `UI symbolic V2 is explicit opt-in; V1 remains the default.` Non-UI symbolic admission remains out of scope; machine-observer and verifier/runner trust-boundary closure is mandatory rather than deferred Provider/P0 work. Read the Source, Contract and Evidence references for the exact V1/V2 authoring and proof rules.
 
 Only fresh evidence from the complete current final snapshot may create machine acceptance. Exactly fresh `machine_accepted` with no pending External Confirmation is `AcceptedDeliveryTerminal`; `machine_accepted_external_pending` proves only declared machine scope. Progress is repair evidence only and never acceptance authority. Final Gate is the sole Long-Task Engineering Quality Conformance and Architecture Conformance carrier, and it proves only the declared, falsifiable, project-check-bound set—not overall code quality. This adds no quality Boolean, matrix, Source aspect, Claim/risk kind, Contract field, second Gate, state or Receipt, and no separate default Contract Conformance closure runs.
 
-Anti-Degradation Assurance preserves coverage, false-negative resistance, fail-closed Authority and final-snapshot proof before cost. Purpose/invariant replacement requires project-owner design-purpose decision and replacement proof. `F = Implementation Freedom Boundary` keeps order, methods and feedback Goal-owned within Source/Contract, architecture, safety, forbidden shortcuts and external actions. After the checkpoint, one ephemeral Delegation Suitability judgment may use one or more `long_task_implementation` instances only when the host explicitly selects that exact custom agent and independent benefit exceeds coordination cost. Generic/built-in/null/unknown roles, task names, prompt imitation and model-only selection never qualify. If unavailable or an exposed spawned type differs, never rely on/retry a generic child; the parent executes or independently redoes the packet. Prefer read-heavy exploration/entrypoint location, independent diagnosis and log/test analysis, disjoint-path implementation/targeted verification and bounded repetitive work. Parallel writes require disjoint owner/path/source-of-truth scope; shared Contract/Context/configuration and coupled work stays in the parent. Add no development phase/method Gate, fixed count/Outcome mapping, agent allocator/scheduler, retry, queue, DAG, registry, delegation proof or persistent delegation state.
+Anti-Degradation Assurance protects coverage, false-negative resistance, fail-closed Authority and final-snapshot proof before cost. Purpose replacement requires a project-owner design-purpose decision and replacement proof. `F = Implementation Freedom Boundary` leaves methods, feedback, packet decomposition and dynamic count Goal-owned within Source/Contract/safety. After the checkpoint, identify packets before profile/capacity. Each is `independently_safe`, has `positive_expected_parallel_benefit` and `bounded_input_and_output`, is `parent_integratable`, and the set is pairwise `owner_disjoint`, `path_disjoint` and `source_of_truth_disjoint`. Unless explicit user/host policy prohibits agents, make actual host calls for multiple exact workers with `agent_type: long_task_implementation`; intent is not delegation and only call or explicit capability results establish profile/capacity. Count stays dynamic.
 
-Each worker receives only its bounded packet. It may inspect named Source/Contract/Context and implement/check locally, but never author/revise Source, Contract, Authority or Context; create Progress/Evidence/Receipt/Final Gate; run lifecycle commands; choose models; spawn/retry/schedule; create branches/worktrees; or claim acceptance/completion. Active `PreToolUse` denies non-exact creation; exact `SubagentStart` reinforces it without proving trust or acceptance. The parent reviews and integrates every report (advisory only), resolves overlaps, writes Context and runs current-candidate/formal verification.
+Select one zero-start reason by the Workflow Contract's ordered first-match rule: policy prohibition -> insufficient base candidates -> disjointness conflict -> coordination cost -> actual exact-spawn capacity failure -> other exact-worker unavailability. Unknown capacity is not insufficiency. Once any exact worker starts, later profile/capacity failure is partial delegation rather than a parent-only reason: keep that worker, return the rest to the parent and report the cause; use no generic substitute or retry. A type mismatch returns its packet. Never override `service_tier` or claim unobservable inheritance. Add no development phase/method Gate, fixed count/Outcome mapping, allocator/scheduler, queue/DAG/registry/proof or persistent delegation state.
+
+Each worker gets one self-contained packet containing its goal, allowed owners and paths, forbidden paths, relevant Source, Contract and Context references, implementation entrypoints, checks, expected return format and known dependency/integration risk. Before dispatch, the parent reads `git status --short` and `git diff --name-only` non-persistently. Workers only implement/check; truth, Authority, spawning, worktrees and acceptance remain parent-owned. `PreToolUse` denies non-exact creation and freshly checks visible profile parity; `SubagentStart` reinforces type without proving trust, effective execution or load atomicity. After return, the parent inspects the actual diff and integrates results only after comparing actual changed paths and the final working-tree diff with the union of packet envelopes. This proves path-envelope conformance, not per-line actor attribution; unexplained/overlapping/out-of-envelope/shared-owner changes block integration and Final Gate.
 
 ## Progressive Reference Loading
 
@@ -42,7 +44,7 @@ Do not copy reference detail into another Skill, plan or state file. The same `d
 
 ## Contract Draft And Outcome Decomposition
 
-Every external initial proposal, selected design resource, ordinary prose proposal, legacy Source Plan or other material input enters the same non-authoritative `delivery-contract.yaml` Draft immediately. Inventory, Source-quality synthesis/refinement, provenance, markers, repository binding and Contract mapping converge in one `long-task-workflow` lifecycle and need not be completed in one response. Conversation-only material becomes exactly one project-native Markdown Source. Do not create a Source-authoring phase, standalone Contract Draft Skill, Draft Receipt, Authoring State, draft schema/CLI/runtime state, handoff or second plan.
+Every external initial proposal, selected design resource, ordinary planning document or other material input enters the same non-authoritative `delivery-contract.yaml` Draft immediately. Inventory, Source-quality synthesis/refinement, provenance, markers, repository binding and Contract mapping converge in one `long-task-workflow` lifecycle and need not be completed in one response. Conversation-only material becomes exactly one project-native Markdown Source. Do not create a Source-authoring phase, standalone Contract Draft Skill, Draft Receipt, Authoring State, draft schema/CLI/runtime state, handoff or second plan.
 
 A Draft Outcome is an Outcome before Authority Lock, not a new schema field or runtime entity. Decompose only vertical, independently observable, decidable and target-verifiable results whose dependencies and owner boundary can be stated. `depends_on` and Stage gates express acceptance and intermediate-proof readiness, never implementation permission. Do not split for response/YAML/file length, implementation layer, module/file count, Agent capacity, Worker assignment or desired parallelism.
 
@@ -53,14 +55,14 @@ A Draft Outcome is an Outcome before Authority Lock, not a new schema field or r
 1. Read the request, real Source, relevant Context, repository owners and selected design resources. Before formal Compile and the first implementation edit, surface one repository-bound `Architecture Deliberation`: owner/extension point/source of truth, dependencies and lifecycle, selected and rejected alternatives, future-change challenge, debt disposition, forbidden shortcuts, project-owned Checks and triggered quality attributes or concrete preservation. Put durable conclusions in owning Context and material falsifiable delivery conclusions in real marked Source plus existing Contract fields. Decide `Context Delta: none|required`.
 2. Open the one Contract Draft immediately. When inputs need Source repair, read Source authoring and Contract authoring together; preserve at least one real `source_path`, complete all required semantic/design closure and repair every `decision_required` item without inventing product meaning.
 3. Run read-only `ty-context long-task preflight <workdir>`, repair the same Draft, then run formal Compile only when Source, Context, Contract, repository scope and proof bindings are ready. Compile creates the first Authority Lock; Preflight creates no Authority, Progress, Receipt or state.
-4. When the first Compile returns `execution_model_checkpoint.required: true`, always obey its terminal-turn boundary. Do no product implementation, file edit, build or test after that result, regardless of any earlier textual model strategy. End the turn and tell a Chinese-speaking user exactly `处理好模型更换之后，请发送【继续】。`; use `After handling the model change, send [continue].` in English. Harness cannot observe or verify the model change. A later Compile returns `required: false` and never repeats the pause.
-5. After continuation, apply the Delegation Suitability judgment above and begin Goal-owned rolling implementation. Delegate independent bounded packets only through explicit exact `long_task_implementation`; otherwise the parent executes without a generic substitute or retry. Keep non-independent work in the parent. Re-evaluate Context Delta and Architecture Deliberation when durable facts, scope, ownership, dependency direction, selected design, quality applicability or debt disposition materially changes.
+4. On the first Compile result with `execution_model_checkpoint.required: true`, do no product implementation, edit, build or test; end the turn. Tell a Chinese-speaking user exactly `处理好模型更换后，请仅回复：模型切换卡点解除，继续`; in English use `After handling the model change, reply exactly: model checkpoint cleared, continue`. Generic continuation does not satisfy this managed prompt protocol. Harness observes neither the next host message nor the model change, so this is no machine unlock or attestation. Later Compile returns `required: false` without repeating the pause.
+5. After continuation, begin Goal-owned rolling implementation and apply Delegation Suitability above. Qualifying work gets actual multiple exact `long_task_implementation` calls; otherwise record one admitted solo reason. Keep coupled work in the parent. Refresh Context Delta and Architecture Deliberation when durable scope, ownership, dependency, design, quality or debt changes.
 6. Use targeted verification only when its expected localization value exceeds cost. If authority changes, keep the same Draft and follow protected revision; mechanically bounded repairs may auto-adopt, while semantic weakening or unknown change requires the exact user decision. Adoption returns to rolling implementation and is never completion.
 7. Complete Context, implementation and project tests, create the clean candidate required by the lifecycle reference, then run the one source-recompiled current-snapshot Final Gate. Stop/close and any native Goal completion remain subject to the exact lifecycle and veto rules in the Authority reference.
 
 ## Rolling Execution
 
-After Authority Lock and the one-time terminal-turn checkpoint, the parent Goal chooses implementation order, local planning, tools and repair hypotheses, then applies the bounded independence/benefit/coordination test above. Qualifying disjoint packets should be delegated proactively; a packet may cross Outcome or Stage boundaries when its code owner remains coherent, because those boundaries control acceptance readiness rather than edit permission. The profile is optional and can be absent. The parent retains every authority, architecture, Context, integration and formal-verification owner. Delegated reports are advisory, Harness stores no delegation state and all proof-bearing changes converge into the selected verification workspace.
+Apply packet-first above. Outcomes/Stages govern acceptance, not edits; coherent-owner packets may cross them. Parent retains Authority, packet selection, Context, integration and verification; proof-bearing changes converge into the selected verification workspace.
 
 The derived Frontier is only an acceptance/verification and diagnosis projection. Use `verify --explain [--outcome/--check]` for a read-only cost preview and targeted `verify --outcome/--check` for optional feedback. `progress_stale` is a freshness fact; refresh only before an intermediate decision relies on that Progress. Continuing implementation and entering Final Gate need no targeted refresh because Final Gate ignores Progress and reruns all required Checks. Do not add another model-switch pause, trigger queue, implementation gate, per-edit rebuild rule or per-platform progress state.
 
@@ -70,4 +72,4 @@ When implementation discovers a blocker, classify it under the existing protecte
 
 Final Gate recompiles Source authority, freezes and rechecks the complete protected current snapshot, reruns every declared Check and sensitivity control and rejects any protected-input, workspace/tree or Active Authority drift. It never trusts historical Progress, Receipt, compiled cache, delegated report or Agent judgment. Before invoking native Goal completion, perform the required veto-only comparison of current user/Goal meaning with accepted marked Source; mismatch returns to Source/Contract repair and creates no second Gate or proof.
 
-Report implementation, effective risk, Architecture Deliberation and Engineering Quality/Architecture Conformance status, Claim Coverage, Stage frontier/results, declared target profile and exact `target_state`, Live Gate result, acceptance scope, pending External Confirmations, Context status and blockers. Use verifier terms exactly and state the theorem boundary honestly: undeclared or inaccurate Source and unsound project Oracles cannot be repaired mechanically; Final Gate proves only declared machine authority and its declared project-check-bound quality set; native Goal/model selection belongs to the host/user; official worker-start boundary injection and advisory reports do not make delegation an observed or persisted acceptance input.
+Report implementation/risk, Architecture and Engineering Quality Conformance, Claim Coverage, Stage/target/Gate results, acceptance scope, pending External Confirmations, Context and blockers. Use verifier terms and state boundaries honestly: undeclared/inaccurate Source and unsound project Oracles are not mechanically repaired; Final Gate proves only declared machine authority and its project-check-bound quality set; the host/user owns the native Goal/model; worker injection and reports are not acceptance inputs. The observer remains Level 3; `observed_lifecycle_*` facts cannot replace complete total-cost ROI or the independent audit required for Level 4.

package/assets/skills/long-task-workflow/agents/openai.yaml

@@ -1,6 +1,6 @@
 interface:
   display_name: "Long-Task Workflow"
   short_description: "Run one Delivery Contract in the current native Goal"
-  default_prompt: "Use $long-task-workflow for one Canonical Delivery Contract. After the first-Authority-Lock checkpoint, proactively delegate independent bounded packets only to the exact custom agent long_task_implementation, using multiple instances for disjoint workstreams when beneficial. If the host cannot explicitly select that custom agent, do not spawn a generic substitute; execute in the parent. Keep Source, Contract, Authority, Context, integration and formal verification in the parent Goal."
+  default_prompt: "Use $long-task-workflow for one Canonical Delivery Contract. After the first-Authority-Lock checkpoint, identify qualifying bounded packets before profile/capacity; absent an explicit policy prohibition, make actual calls for multiple exact long_task_implementation workers and let host results determine zero-start or partial fallback. Never infer unavailability, use a generic substitute or fix the count. Keep Source, Contract, Authority, architecture, Context, packet selection, integration and formal verification in the parent Goal."
 policy:
   allow_implicit_invocation: false

package/assets/skills/long-task-workflow/references/authority-lifecycle.md

@@ -14,7 +14,7 @@ Preflight keeps every independently discovered diagnostic. When a structural dup
 
 The first successful `ty-context long-task compile <workdir>` is Authority Lock and freezes the immutable initial base and complete compiled authority snapshot in Git common-dir, bound to the worktree marker by task id, revision and compiled identity.
 
-Its JSON result includes `execution_model_checkpoint.required: true`, `action: change_model_in_host_then_continue`, `resume_token: continue`, `turn_boundary: end_current_turn`, the blocked implementation actions and explicit model non-observability. Always do no product implementation, file edit, build or test after that result, even when an earlier message stated a model strategy. End the turn and tell a Chinese-speaking user exactly `处理好模型更换之后，请发送【继续】。`; use `After handling the model change, send [continue].` in English. Harness cannot observe or verify the host model change, and the continuation is not an acknowledgement record. Later Compile revisions return `required: false`; no checkpoint file, acknowledgement state, model route or automatic model switch is created.
+Its JSON result includes `execution_model_checkpoint.required: true`, `action: change_model_in_host_then_continue`, `resume_token: model checkpoint cleared, continue`, `generic_continue_satisfies: false`, `turn_boundary: end_current_turn`, the blocked implementation actions and explicit model non-observability. Always do no product implementation, file edit, build or test after that result, even when an earlier message stated a model strategy. End the turn and tell a Chinese-speaking user exactly `处理好模型更换后，请仅回复：模型切换卡点解除，继续`; use `After handling the model change, reply exactly: model checkpoint cleared, continue` in English. Do not accept a generic continuation under this package-managed prompt protocol. Harness cannot observe the next host message or verify the host model change, and the continuation is neither a machine-enforced unlock nor an acknowledgement record. Later Compile revisions return `required: false`; no checkpoint file, acknowledgement state, model route or automatic model switch is created.
 
 The optional Codex `long_task_implementation` custom agent is available only as a post-checkpoint rolling implementation affordance. Its fixed package-owned configuration is not a checkpoint option and cannot acknowledge, satisfy or replace the host boundary. It writes no workflow state and owns no Source, Contract, Authority, Context writeback, Progress, Evidence, Receipt or Final Gate; if the exact profile selector or Codex custom-agent support is unavailable, the parent Goal continues directly without a generic substitute and formal acceptance is unchanged. The main Skill owns the complete Delegation Suitability and parent/worker policy.