Merge pull request #14073 from SivanCola/fix/website-cli-changelog

fix(website): restore CLI changelog sync / 恢复官网 1.x 更新日志同步
fix(website): restore CLI changelog synchronization
2026-11-07 17:10:43 -10:00 · 2026-10-20 23:53:09 -07:00 · 2026-10-21 14:09:09 +08:00 · 2026-10-19 08:08:27 -07:00 · 2026-10-19 23:04:47 +08:00 · 2026-10-18 10:49:38 -07:00
8911 changed files with 8324 additions and 1625695 deletions
@@ -1,5 +0,0 @@
-# Copy to .env and fill in. Only secrets belong here — a provider's base_url and
-# model are configured in reasonix.toml, where api_key_env points at these variables.
-
-DEEPSEEK_API_KEY=
-MIMO_API_KEY=
@@ -1,31 +1,13 @@
 .gitattributes text eol=lf
 .gitignore text eol=lf
-.npmrc text eol=lf
 *.astro text eol=lf
 *.css text eol=lf
-*.go text eol=lf
 *.html text eol=lf
 *.js text eol=lf
 *.json text eol=lf
 *.md text eol=lf
 *.mjs text eol=lf
-*.mod text eol=lf
-*.nsi text eol=lf
-*.plist text eol=lf
-*.py text eol=lf
-*.rs text eol=lf
 *.sh text eol=lf
-*.sql text eol=lf
-*.sum text eol=lf
-*.toml text eol=lf
 *.ts text eol=lf
-*.tsx text eol=lf
-*.txt text eol=lf
-*.xml text eol=lf
 *.yaml text eol=lf
 *.yml text eol=lf
-.githooks/** text eol=lf
-benchmarks/**/*.sh text eol=lf
-# Tagged storage fixtures include byte digests and offsets; never rewrite EOLs.
-desktop/testdata/session-history-upgrade/** -text
-desktop/testdata/manual-session-upgrade/** -text
@@ -1,6 +0,0 @@
-#!/bin/sh
-# Go-native pre-push gate replacing the retired v1 npm hook (install: make hooks).
-# Full tests run in CI; vet is the fast, cross-platform local check.
-set -e
-go vet ./...
-go run ./tools/repolint
@@ -1,100 +0,0 @@
-# CI and release execution
-
-[中文](CI_PERFORMANCE.zh-CN.md)
-
-## Desktop PR checks
-
-`scripts/ci-paths.mjs` is the shared path classifier for normal and memory CI.
-It distinguishes frontend, Go, generated protocol, Electron, native and
-packaging inputs. Explicit documentation such as `desktop/AGENTS.md` skips
-build and soak work, while Markdown inside the frontend remains a build input.
-Unknown paths and unavailable diffs fail closed. Pull requests use merge-base
-diffs; pushes use `before..sha`; normal `main-v2` pushes keep the complete
-qualification matrix after the existing release-notes-only exception.
-
-The desktop race sweep (`desktop-go-race`, eleven partitions) runs on `main-v2`
-pushes and manual dispatch, never on pull requests. Pull requests still run the
-same partitions without `-race` (`desktop-go` and the Windows groups), so a data
-race introduced by a pull request is reported by the push run after it merges.
-
-`desktop-prepare` regenerates the desktop host contract (failing on drift) and
-produces the required `electron/stable` and `electron/canary` frontend variants
-once on Linux. Each artifact carries a versioned manifest with checkout,
-workflow attempt, variant, build inputs, toolchain and every `dist` file hash.
-Linux, macOS and Windows consumers verify it before compilation or packaging.
-Explicit reuse fails on a missing, stale or damaged manifest and never falls
-back to a hidden rebuild. Static frontend files are portable; dependencies,
-native modules and Electron binaries are not shared. Build-input verification
-streams every committed blob through one Git batch process instead of starting
-one process per file; the version-one digest remains byte-for-byte compatible.
-
-The protected `lint` job aggregates `lint-code` and, when selected, the
-complete `desktop-frontend` result. Motion unit tests remain in that frontend
-plan and run once. `desktop-browser-group` runs application/settings/motion and
-Transcript as two groups with `max-parallel: 2`; the `desktop-browser` summary
-rejects failed, cancelled or unexpected skips. Go-only changes retain protocol
-and native validation without launching browser or memory work.
-
-`node desktop/frontend/scripts/run-ci-tests.mjs --list` prints the unit test
-plan. It expands the existing dedicated scripts and lifecycle hooks, discovers
-new tests, and schedules each TypeScript suite once with its original loader.
-Unsupported script syntax and conflicting explicit invocations fail closed.
-CI runs two isolated processes at a time; the history performance benchmark
-runs alone after them. Local dedicated `pnpm test:*` commands remain available.
-
-## Timing reports
-
-The CI and memory workflow summaries report stage execution without queue time,
-workflow wall time, recorded job queue time and the sum of runner execution.
-Frontend builds, dependency and browser installation, each browser group and
-each memory shard are listed separately. These measurements describe a single
-run; comparisons should use the same candidate and report the median and range
-of three runs so runner variance is visible. The Windows Desktop Go step keeps
-native non-verbose output because Go's JSON mode made Windows spend several
-minutes finalizing verbose test-cache output; the central report records its
-step execution time from the Actions API without wrapping the test process.
-
-## Memory screening
-
-Protocol v4 records the selected screening profile in every manifest, shard and
-aggregate. Ordinary frontend pull requests use the `short` profile: one process
-completes 32 full, 32 windowed, 32 safety and 128 mixed round trips. Pull requests
-that change App lifecycle, Transcript, navigation, subscription ownership, memory
-fixtures or CI routing use the `full` profile. Pushes to `main-v2`, the daily
-scheduled run and manual dispatches also use `full`: three independent processes
-each complete 128 full, 128 windowed, 128 safety and 512 mixed round trips.
-
-Both profiles keep the same evidence requirements: exact checkpoints, five heap
-snapshots per process, GC, frame settling, source/build identity and screening
-thresholds. Aggregation rejects missing shards and profile or protocol mismatches.
-Only the explicit mock memory-soak URL removes the fixture's artificial
-1.5-second hydration latency. Hydration still crosses an asynchronous timer
-task. Default browser and native geometry fixtures retain the delayed path.
-
-The pointer rests outside topic rows and the warmed baseline follows a complete
-round trip after layout switching, avoiding samples of temporary menu state.
-Reports declare the profile and protocol, and aggregation rejects older protocols.
-`timings.json` records host-side counts, total time and maximum time for
-navigation, frame settling, GC and heap capture/analysis. Aggregate results label
-their `screeningLevel`, so a passing short PR screen cannot be mistaken for full
-qualification. A green gate still does not prove offline heap-retainer attribution.
-
-## Signed release artifacts
-
-The successful stable SignPath preflight hands its full native matrix to the
-desktop publisher. The publisher revalidates authorization, candidate identity,
-signing contract and cache/docs guards, then verifies and publishes the same
-signed bytes without rebuilding or signing them again. CLI and npm publication
-still wait for the entire preflight; no public surface starts early.
-
-Each platform bundle binds file sizes and SHA-256 hashes to candidate/control
-SHAs, version, tag, channel, signing fingerprint, run, invocation and producer
-attempt. Missing/extra platforms, conflicting identities, symlinks, duplicate
-filenames or modified bytes stop publication. These transport hashes supplement
-the existing Authenticode/minisign checks; they are not signature verification.
-
-A failed-job retry may reuse earlier successful platforms from the same run
-and invocation. A rebuilt platform replaces only its own fully verified bundle.
-New workflow runs prepare a new artifact set. Standalone recovery still builds
-and validates its own full matrix. pnpm dependencies are cached by lockfile;
-signed release artifacts are transported as artifacts, never dependency caches.
@@ -1,82 +0,0 @@
-# CI 与发版执行
-
-[English](CI_PERFORMANCE.md)
-
-## Desktop PR 检查
-
-`scripts/ci-paths.mjs` 是普通 CI 与内存 CI 共用的路径判定器，分别识别前端、
-Go、生成协议、Electron、原生平台和打包输入。`desktop/AGENTS.md` 等明确的说明
-文档不会启动构建和长测；前端目录中会进入产品的 Markdown 仍属于构建输入。
-未知路径或无法获得可靠 diff 时保守失败。PR 使用 merge-base 差异，push 使用
-`before..sha`；保留纯 release-notes 例外后，普通 `main-v2` push 仍运行完整验证矩阵。
-
-桌面 race 检测（`desktop-go-race`，11 个分片）只在 `main-v2` push 和手动触发时运行，
-PR 上不运行。PR 仍以不带 `-race` 的方式运行同样的分片（`desktop-go` 与 Windows 分组），
-因此 PR 引入的数据竞争会在合并后的 push 运行中报告。
-
-`desktop-prepare` 重新生成桌面宿主契约（有漂移即失败），并在 Linux 上分别生成一次
-`electron/stable` 与 `electron/canary` 前端。每份产物都带版本化 manifest，记录
-checkout、workflow attempt、变体、构建输入、工具链以及每个 `dist` 文件的摘要。
-Linux、macOS 和 Windows 消费者在编译或打包前校验。显式复用遇到 manifest 缺失、
-过期、身份不符或文件损坏会直接失败，不会暗中重建。跨平台只共享静态前端文件，
-不共享依赖目录、原生模块或 Electron 二进制。构建输入校验通过一个 Git 批处理进程
-读取全部已提交 blob，不再为每个文件单独启动进程；版本 1 摘要保持逐字节兼容。
-
-required `lint` 汇总 `lint-code` 和路径要求执行时的完整 `desktop-frontend` 结果。
-动画单测保留在统一前端计划中且只执行一次。`desktop-browser-group` 将应用、设置与动画
-合为一组，Transcript 独立为另一组，`max-parallel: 2`；`desktop-browser` 汇总拒绝失败、
-取消和意外跳过。仅修改 Go 时继续执行协议和原生验证，不启动浏览器或内存长测。
-
-`node desktop/frontend/scripts/run-ci-tests.mjs --list` 可以查看单测清单。
-它展开原有专用脚本和生命周期钩子，自动发现新增测试，并保留每个 TypeScript
-测试原有的 loader，每个套件只执行一次。未知命令语法或冲突调用会直接失败。
-CI 同时运行两个隔离进程，历史性能基准在它们结束后单独运行。
-本地仍可使用原有的 `pnpm test:*` 专用命令。
-
-## 耗时报告
-
-普通 CI 与内存工作流的 Summary 会分别显示不含排队的阶段执行时间、工作流总等待、
-已记录的 job 排队时间之和及 runner 执行时长之和。前端构建、依赖与浏览器安装、
-各浏览器分组和每个内存 shard 单独列出。单次数据只描述该次运行；对比应针对同一
-候选各重复三次，并报告中位数和范围，避免把 runner 波动当作收益。Windows Desktop
-Go 步骤保留原生非 verbose 输出，因为 Go JSON 模式会让 Windows 花费数分钟收尾
-verbose 测试缓存；统一耗时报告直接从 Actions API 记录该步骤的执行时间，不再包装
-测试进程。
-
-## 内存筛查
-
-协议 v4 会在 manifest、分片报告和汇总中记录筛查档位。普通前端 PR 使用
-`short`：一个进程执行 32 轮 full、32 轮 windowed、32 轮 safety 和 128 轮
-mixed 往返。涉及 App 生命周期、Transcript、导航、订阅所有权、内存夹具或
-CI 路由的 PR 使用 `full`。推送到 `main-v2`、每日定时任务及手动触发也使用
-`full`：三个独立进程各执行 128 轮 full、128 轮 windowed、128 轮 safety 和
-512 轮 mixed 往返。
-
-两个档位都要求精确检查点、每进程五份堆快照、GC、稳定帧等待、源码与构建身份
-及相同判定阈值。汇总会拒绝缺失分片、档位不一致和协议不一致。只有明确启用
-mock 内存 soak 的 URL 会去掉夹具人为
-设置的 1.5 秒 hydration 延迟；加载仍经过异步定时器任务。
-普通浏览器和原生几何测试继续使用原来的延迟路径。
-
-采样时鼠标停在会话行之外；布局切换后先完成一次会话往返，再记录预热基线，
-避免采到菜单的临时状态。报告声明档位和协议版本，汇总拒绝旧协议。
-`timings.json` 在测试宿主侧记录导航、稳定帧等待、GC、堆快照与解析的次数、
-总耗时和最大耗时。汇总结果通过 `screeningLevel` 标明档位，短筛查通过不会被
-误认为完整验收。筛查通过仍不等于完成离线堆引用归因。
-
-## 签名发版产物
-
-Stable 的 SignPath 预检成功后，将完整原生平台矩阵的产物交给 desktop
-publisher。后者重新验证授权、候选身份、签名契约及缓存和文档校验，再校验
-并发布同一批签名字节，不重复构建和签名。CLI 与 npm 仍等待完整预检通过，
-不会提前开始公开发布。
-
-每个平台的 bundle 将文件大小、SHA-256 与候选及控制流程 SHA、版本、tag、
-channel、签名契约指纹、run、调用和生产 attempt 绑定。
-平台缺失或多余、身份冲突、符号链接、重复文件名及字节变化都会阻止发布。
-这些传输哈希补充既有 Authenticode/minisign 校验，不能代替签名验证。
-
-只重跑失败 job 时，可复用同一 run 和调用中此前成功的平台；重建的平台只
-替换自身已重新验证的 bundle。新的 workflow run 重新准备整套产物。
-独立恢复发版仍自行构建并验证完整矩阵。pnpm 下载依赖按锁文件缓存；签名
-产物通过 artifact 交接，不放入依赖缓存。
@@ -1,26 +0,0 @@
-# Every pull request requests review from the maintainers below.
-# Either maintainer can review and merge any change.
-* @SivanCola @esengine
-
-# Keep the provider-side signing policy and its GitHub control plane under the
-# same explicit review boundary as the machine-readable contract.
-/.signpath/ @SivanCola @esengine
-/.github/workflows/release-stable.yml @SivanCola @esengine
-/.github/workflows/release-candidate.yml @SivanCola @esengine
-/.github/workflows/release-candidate-verify.yml @SivanCola @esengine
-/.github/workflows/release-promote.yml @SivanCola @esengine
-/.github/workflows/release-verify.yml @SivanCola @esengine
-/.github/workflows/release-desktop.yml @SivanCola @esengine
-/scripts/complete-signpath-request.ps1 @SivanCola @esengine
-/scripts/signpath-checkpoint.mjs @SivanCola @esengine
-/scripts/package-windows-desktop.sh @SivanCola @esengine
-/scripts/verify-windows-authenticode.ps1 @SivanCola @esengine
-/scripts/finalize-windows-signed-candidate.sh @SivanCola @esengine
-/scripts/release-candidate.mjs @SivanCola @esengine
-/scripts/verify-release-artifact-archive.mjs @SivanCola @esengine
-/scripts/release-candidate-tags.sh @SivanCola @esengine
-/scripts/verify-release-authorization.sh @SivanCola @esengine
-/scripts/resolve-release-candidate.mjs @SivanCola @esengine
-/scripts/validate-release-control-plane.sh @SivanCola @esengine
-/scripts/verify-stable-release-artifacts.sh @SivanCola @esengine
-/cmd/signpath-contract/ @SivanCola @esengine
@@ -1,60 +0,0 @@
-name: Bug report
-description: Report a bug in DeepSeek-Reasonix
-title: "[Bug]: "
-labels: ["bug"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for filing a bug. Pick which version line you're on below — it gets
-        labeled (`v2`/`v3`) automatically, no maintainer action needed.
-  - type: dropdown
-    id: version-line
-    attributes:
-      label: Version line
-      description: Which line are you running?
-      options:
-        - "v2 — Go rewrite (1.x), main-v2 (active development)"
-        - "v3 — Studio (2.x), studio"
-    validations:
-      required: true
-  - type: input
-    id: version
-    attributes:
-      label: Exact version
-      description: Output of `reasonix --version`.
-      placeholder: e.g. 1.0.0
-    validations:
-      required: true
-  - type: textarea
-    id: what-happened
-    attributes:
-      label: What happened?
-      description: A clear description of the bug, and what you expected instead.
-    validations:
-      required: true
-  - type: textarea
-    id: repro
-    attributes:
-      label: Steps to reproduce
-      placeholder: |
-        1. ...
-        2. ...
-        3. ...
-    validations:
-      required: true
-  - type: input
-    id: os
-    attributes:
-      label: OS / platform
-      placeholder: e.g. macOS 15.3 (arm64), Ubuntu 24.04, Windows 11
-    validations:
-      required: true
-  - type: textarea
-    id: logs
-    attributes:
-      label: Relevant logs or output
-      description: Paste any error output. Automatically formatted as code.
-      render: shell
-    validations:
-      required: false
@@ -1,5 +0,0 @@
-blank_issues_enabled: false
-contact_links:
-  - name: Questions & discussions
-    url: https://github.com/esengine/DeepSeek-Reasonix/discussions
-    about: For usage questions, ideas, and general discussion — please use Discussions instead of opening an issue.
@@ -1,29 +0,0 @@
-name: Feature request
-description: Suggest an idea or improvement
-title: "[Feature]: "
-labels: ["enhancement"]
-body:
-  - type: dropdown
-    id: version-line
-    attributes:
-      label: Version line
-      description: Which line is this for?
-      options:
-        - "v2 — Go rewrite (1.x), main-v2 (active development)"
-        - "v3 — Studio (2.x), studio"
-    validations:
-      required: true
-  - type: textarea
-    id: problem
-    attributes:
-      label: What problem does this solve?
-      description: What are you trying to do, and what gets in the way today?
-    validations:
-      required: true
-  - type: textarea
-    id: proposal
-    attributes:
-      label: Proposed solution
-      description: How would you like it to work?
-    validations:
-      required: false
@@ -1,49 +0,0 @@
-name: Go build cache
-description: >-
-  Restore the newest Go build and module cache for this runner and module.
-  setup-go keys its cache on go.sum alone and GitHub never rewrites an existing
-  key, so that snapshot freezes at the last dependency change and every package
-  touched since misses. This cache is keyed per run and restored by prefix; a
-  main-v2 push saves it from one job per OS and module (actions/cache/save with
-  the outputs below), pull requests only restore. Windows jobs do not use it:
-  restoring it there measured slower than setup-go's frozen cache.
-
-inputs:
-  module:
-    description: Cache namespace, e.g. root, root-race, desktop, desktop-race
-    required: true
-
-outputs:
-  key:
-    description: Exact key for this run's save step
-    value: ${{ steps.key.outputs.key }}
-  paths:
-    description: GOCACHE and GOMODCACHE, one per line
-    value: ${{ steps.key.outputs.paths }}
-
-runs:
-  using: composite
-  steps:
-    - id: key
-      shell: bash
-      run: |
-        set -euo pipefail
-        sums="$(git hash-object go.sum desktop/go.sum | git hash-object --stdin)"
-        base="go-${{ runner.os }}-${{ runner.arch }}-${{ inputs.module }}"
-        {
-          echo "key=${base}-${sums:0:16}-${{ github.run_id }}-${{ github.run_attempt }}"
-          echo "sums=${base}-${sums:0:16}-"
-          echo "base=${base}-"
-          echo "paths<<EOF"
-          go env GOCACHE
-          go env GOMODCACHE
-          echo "EOF"
-        } >> "$GITHUB_OUTPUT"
-
-    - uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
-      with:
-        path: ${{ steps.key.outputs.paths }}
-        key: ${{ steps.key.outputs.key }}
-        restore-keys: |
-          ${{ steps.key.outputs.sums }}
-          ${{ steps.key.outputs.base }}
@@ -1,31 +0,0 @@
-name: Connect to Certum cloud signing
-description: Verify the SimplySign installer and connect to the configured certificate.
-inputs:
-  username:
-    required: true
-    description: SimplySign account
-  otp-uri:
-    required: true
-    description: TOTP provisioning URI
-  thumbprint:
-    required: true
-    description: Expected SHA-1 certificate thumbprint
-runs:
-  using: composite
-  steps:
-    - name: Verify SimplySign installer
-      shell: pwsh
-      run: |
-        $ErrorActionPreference = 'Stop'
-        Invoke-WebRequest 'https://files.certum.eu/software/SimplySignDesktop/Windows/9.4.3.90/SimplySignDesktop-9.4.3.90-64-bit-en.msi' -OutFile SimplySignDesktop.msi
-        $signature = Get-AuthenticodeSignature SimplySignDesktop.msi
-        if ($signature.Status -ne 'Valid' -or $signature.SignerCertificate.Subject -notmatch 'Asseco Data Systems') {
-          throw 'SimplySign installer signature or publisher verification failed'
-        }
-    - name: Authenticate cloud certificate
-      uses: dismine/windows-app-signing-setup-action@89ae3b032d4bc7a5b98d1a42a34e61ecb6faad64
-      with:
-        certum-username: ${{ inputs.username }}
-        certum-otp-uri: ${{ inputs.otp-uri }}
-        certum-key-id: ${{ inputs.thumbprint }}
-        capture-diagnostics: 'false'
@@ -1,53 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "gomod"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    groups:
-      pi-catalog:
-        patterns: ["github.com/sky-valley/pi"]
-        update-types: ["minor", "patch"]
-      go:
-        patterns: ["*"]
-        exclude-patterns: ["github.com/sky-valley/pi"]
-        update-types: ["minor", "patch"]
-
-  - package-ecosystem: "gomod"
-    directory: "/desktop"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    groups:
-      go:
-        patterns: ["*"]
-        update-types: ["minor", "patch"]
-
-  - package-ecosystem: "npm"
-    directory: "/desktop/frontend"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    groups:
-      npm:
-        patterns: ["*"]
-        update-types: ["minor", "patch"]
-
-  - package-ecosystem: "npm"
-    directory: "/site"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    groups:
-      npm:
-        patterns: ["*"]
-        update-types: ["minor", "patch"]
-
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    groups:
-      actions:
-        patterns: ["*"]
@@ -1,51 +0,0 @@
-# Area labels auto-applied to PRs by .github/workflows/pr-auto-label.yml
-# (actions/labeler), based on the changed file paths. Keep the area set in sync
-# with issue-auto-label.yml. severity/platform are issue-only — a PR is a change,
-# not a bug report — and v1/v2 are handled by pr-version-label.yml.
-
-agent:
-  - changed-files:
-      - any-glob-to-any-file:
-          - 'internal/agent/**'
-          - 'internal/control/**'
-
-mcp:
-  - changed-files:
-      - any-glob-to-any-file:
-          - 'internal/plugin/**'
-          - 'internal/codegraph/**'
-
-config:
-  - changed-files:
-      - any-glob-to-any-file:
-          - 'internal/config/**'
-          - 'internal/boot/**'
-
-provider:
-  - changed-files:
-      - any-glob-to-any-file:
-          - 'internal/provider/**'
-
-skills:
-  - changed-files:
-      - any-glob-to-any-file:
-          - 'internal/skill/**'
-          - 'internal/tool/**'
-
-tui:
-  - changed-files:
-      - any-glob-to-any-file:
-          - 'internal/cli/**'
-
-desktop:
-  - changed-files:
-      - any-glob-to-any-file:
-          - 'desktop/**'
-
-updater:
-  - changed-files:
-      - any-glob-to-any-file:
-          - 'desktop/cmd/sign/**'
-          - 'desktop/updater*.go'
-          - 'scripts/desktop-build.sh'
-          - '.github/workflows/release*.yml'
@@ -1,44 +0,0 @@
-## Summary
-
-
-
-## Issues
-
-<!--
-If this resolves a report, put `Fixes #123` on its own line — GitHub only
-auto-closes from a bare line, so `- Fixes #123` in a list does nothing and the
-report stays open. If it only relates to one, use `Refs #123` instead: the
-release workflow then asks that reporter to verify once the fix ships.
-->
-
-## Verification
-
-
-
-For a GSAP to WAAPI/CSS migration (or any cross-API replacement), document
-the source-to-target contract here: easing syntax, time units, callbacks,
-cancellation, reduced-motion behavior, and failure fallback. Verification must
-assert that the target API was actually called; a mock that silently skips it
-does not count.
-
-## Documentation impact
-
-Documentation-impact: TODO
-
-For changes to user-visible CLI, Desktop, configuration, provider, permission,
-or tool behavior, use one of:
-
- `Documentation-impact: updated - <what changed>` and update `docs/*.md`.
- `Documentation-impact: none - <why the embedded documentation remains correct>`.
-
-## Cache impact
-
-Cache-impact: TODO
-Cache-guard: TODO
-System-prompt-review: N/A
-
-For cache-sensitive changes, fill these lines before requesting review:
-
- `Cache-impact`: `none`, `low`, `medium`, or `high`, plus the reason.
- `Cache-guard`: the focused guard test/command added or run, or why an existing guard covers the change.
- `System-prompt-review`: required reviewer/approval note when provider-visible system prompt, memory prefix, output style, or skill index behavior changes.
@@ -1,233 +0,0 @@
-name: App memory screening
-
-on:
-  pull_request:
-    branches: [main-v2]
-  push:
-    branches: [main-v2]
-  schedule:
-    - cron: "17 3 * * *"
-  workflow_dispatch:
-
-permissions:
-  actions: read
-  contents: read
-
-concurrency:
-  group: app-memory-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-env:
-  EXPECTED_SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
-
-jobs:
-  changes:
-    runs-on: ubuntu-22.04
-    outputs:
-      memory: ${{ steps.paths.outputs.memory }}
-      memory_profile: ${{ steps.profile.outputs.profile }}
-      memory_shards: ${{ steps.profile.outputs.shards }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ env.EXPECTED_SOURCE_SHA }}
-          fetch-depth: 0
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version-file: .node-version
-      - id: paths
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
-          EVENT_NAME: ${{ github.event_name }}
-        run: |
-          args=(--head "$EXPECTED_SOURCE_SHA" --github-output "$GITHUB_OUTPUT" --summary "$GITHUB_STEP_SUMMARY")
-          if [ "$EVENT_NAME" = workflow_dispatch ] || [ "$EVENT_NAME" = schedule ]; then
-            args+=(--full)
-          elif [ "$EVENT_NAME" = pull_request ]; then
-            args+=(--base "$BASE_SHA" --mode pull_request)
-          else
-            args+=(--base "$BASE_SHA" --mode push)
-          fi
-          node scripts/ci-paths.mjs "${args[@]}"
-      - name: Select memory profile
-        id: profile
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          MEMORY: ${{ steps.paths.outputs.memory }}
-          MEMORY_FULL: ${{ steps.paths.outputs.memory_full }}
-        run: |
-          if [ "$MEMORY" != true ]; then
-            profile=off
-            shards='[1]'
-          elif [ "$EVENT_NAME" = pull_request ] && [ "$MEMORY_FULL" != true ]; then
-            profile=short
-            shards='[1]'
-          else
-            profile=full
-            shards='[1,2,3]'
-          fi
-          echo "profile=$profile" >> "$GITHUB_OUTPUT"
-          echo "shards=$shards" >> "$GITHUB_OUTPUT"
-          printf 'App memory profile: **%s**; shards: `%s`\n' "$profile" "$shards" >> "$GITHUB_STEP_SUMMARY"
-
-  prepare:
-    needs: changes
-    if: needs.changes.outputs.memory == 'true'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    env:
-      REASONIX_APP_MEMORY_PROFILE: ${{ needs.changes.outputs.memory_profile }}
-    defaults:
-      run:
-        working-directory: desktop/frontend
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ env.EXPECTED_SOURCE_SHA }}
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        with:
-          version: 10
-          run_install: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version-file: .node-version
-          cache: pnpm
-          cache-dependency-path: desktop/pnpm-lock.yaml
-      - name: Install memory dependencies
-        run: pnpm install --frozen-lockfile
-      - run: node --test bench/app-memory-shards.test.mjs bench/app-memory-paths.test.mjs bench/app-memory-timing.test.mjs
-      - name: Build memory frontend
-        run: pnpm build
-      - run: node bench/app-memory-prepare.mjs "$RUNNER_TEMP/app-memory-build"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: app-memory-build-${{ github.run_id }}
-          path: ${{ runner.temp }}/app-memory-build
-          overwrite: true
-          include-hidden-files: true
-          if-no-files-found: error
-          retention-days: 7
-
-  shard:
-    needs: [changes, prepare]
-    runs-on: ubuntu-22.04
-    timeout-minutes: 90
-    strategy:
-      fail-fast: false
-      matrix:
-        shard: ${{ fromJSON(needs.changes.outputs.memory_shards) }}
-    env:
-      REASONIX_APP_MEMORY_PROFILE: ${{ needs.changes.outputs.memory_profile }}
-    defaults:
-      run:
-        working-directory: desktop/frontend
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ env.EXPECTED_SOURCE_SHA }}
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        with:
-          version: 10
-          run_install: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version-file: .node-version
-          cache: pnpm
-          cache-dependency-path: desktop/pnpm-lock.yaml
-      - name: Install memory dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Install browser runtimes
-        run: pnpm exec playwright install --with-deps chromium
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: app-memory-build-${{ github.run_id }}
-          path: ${{ runner.temp }}/app-memory-build
-      - run: cp -a "$RUNNER_TEMP/app-memory-build/dist/." dist/
-      - name: Run complete independent memory process
-        env:
-          REASONIX_APP_MEMORY_SHARD: ${{ matrix.shard }}
-          REASONIX_APP_MEMORY_PREPARED: ${{ runner.temp }}/app-memory-build/identity.json
-          REASONIX_APP_MEMORY_ARTIFACTS: ${{ runner.temp }}/app-memory-results
-          PLAYWRIGHT_BROWSERS_PATH: /home/runner/.cache/ms-playwright
-        run: node bench/app-memory.mjs
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        if: always()
-        with:
-          name: app-memory-shard-${{ matrix.shard }}-${{ github.run_id }}
-          path: ${{ runner.temp }}/app-memory-results
-          overwrite: true
-          if-no-files-found: error
-          retention-days: 7
-
-  app-memory:
-    if: always()
-    needs: [changes, prepare, shard]
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Verify all prerequisite jobs
-        env:
-          CHANGES_RESULT: ${{ needs.changes.result }}
-          SHOULD_RUN: ${{ needs.changes.outputs.memory }}
-          PREPARE_RESULT: ${{ needs.prepare.result }}
-          SHARD_RESULT: ${{ needs.shard.result }}
-          MEMORY_PROFILE: ${{ needs.changes.outputs.memory_profile }}
-        run: |
-          test "$CHANGES_RESULT" = success
-          if [ "$SHOULD_RUN" = true ]; then
-            test "$MEMORY_PROFILE" = short || test "$MEMORY_PROFILE" = full
-            test "$PREPARE_RESULT" = success
-            test "$SHARD_RESULT" = success
-          else
-            test "$SHOULD_RUN" = false
-            test "$MEMORY_PROFILE" = off
-            test "$PREPARE_RESULT" = skipped
-            test "$SHARD_RESULT" = skipped
-          fi
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        if: needs.changes.outputs.memory == 'true'
-        with:
-          ref: ${{ env.EXPECTED_SOURCE_SHA }}
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        if: needs.changes.outputs.memory == 'true'
-        with:
-          node-version-file: .node-version
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        if: needs.changes.outputs.memory == 'true'
-        with:
-          pattern: app-memory-shard-*-${{ github.run_id }}
-          path: ${{ runner.temp }}/app-memory-reports
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        if: needs.changes.outputs.memory == 'true'
-        with:
-          name: app-memory-build-${{ github.run_id }}
-          path: ${{ runner.temp }}/app-memory-build
-      - name: Verify same-build complete protocol
-        if: needs.changes.outputs.memory == 'true'
-        run: |
-          node desktop/frontend/bench/app-memory-aggregate.mjs \
-            "$RUNNER_TEMP/app-memory-reports" "$RUNNER_TEMP/app-memory-build/identity.json" \
-            "$RUNNER_TEMP/app-memory-report.json" "$EXPECTED_SOURCE_SHA"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        if: success() && needs.changes.outputs.memory == 'true'
-        with:
-          name: app-memory-aggregate-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/app-memory-report.json
-          if-no-files-found: error
-          retention-days: 7
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        if: always() && needs.changes.outputs.memory == 'true'
-        with:
-          ref: ${{ env.EXPECTED_SOURCE_SHA }}
-          path: .ci-metrics-source
-      - name: Summarize memory timing
-        if: always() && needs.changes.outputs.memory == 'true'
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          gh api "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" > "$RUNNER_TEMP/memory-run.json"
-          gh api "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/jobs?filter=latest&per_page=100" > "$RUNNER_TEMP/memory-jobs.json"
-          node .ci-metrics-source/scripts/ci-timings.mjs \
-            --run "$RUNNER_TEMP/memory-run.json" \
-            --jobs "$RUNNER_TEMP/memory-jobs.json" \
-            --summary "$GITHUB_STEP_SUMMARY" \
-            --title "App memory timing"
@@ -1,57 +0,0 @@
-name: Diagnose Apple notarization
-run-name: Diagnose Apple notarization ${{ inputs.submission_id }}
-
-on:
-  workflow_dispatch:
-    inputs:
-      submission_id:
-        description: "Existing Apple notarization submission UUID (read only)"
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-jobs:
-  fetch-log:
-    if: github.repository == 'esengine/DeepSeek-Reasonix' && github.ref == 'refs/heads/main-v2' && github.ref_protected
-    runs-on: macos-latest
-    environment: release
-    timeout-minutes: 10
-    steps:
-      - name: Retrieve existing submission information and log
-        env:
-          SUBMISSION_ID: ${{ inputs.submission_id }}
-          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
-          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
-          APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          [[ "$SUBMISSION_ID" =~ ^[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$ ]] || {
-            echo "::error::submission_id must be a UUID"
-            exit 1
-          }
-          : "${APPLE_API_KEY_P8:?Apple API key is not configured}"
-          : "${APPLE_API_KEY_ID:?Apple API key ID is not configured}"
-          : "${APPLE_API_ISSUER_ID:?Apple API issuer is not configured}"
-          umask 077
-          key_path="$(mktemp "$RUNNER_TEMP/apple-notary-key.XXXXXX")"
-          trap 'rm -f "$key_path"' EXIT
-          printf '%s' "$APPLE_API_KEY_P8" | base64 --decode > "$key_path"
-          diagnostics="$RUNNER_TEMP/apple-notarization"
-          mkdir -p "$diagnostics"
-          auth=(--key "$key_path" --key-id "$APPLE_API_KEY_ID" --issuer "$APPLE_API_ISSUER_ID")
-          xcrun notarytool info "$SUBMISSION_ID" "${auth[@]}" --output-format json > "$diagnostics/submission.json" || {
-            echo "::warning::Could not retrieve submission information; attempting the log directly"
-          }
-          xcrun notarytool log "$SUBMISSION_ID" "${auth[@]}" "$diagnostics/notary-log.json"
-
-      - name: Upload Apple notarization diagnostics
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: apple-notary-log-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/apple-notarization/*.json
-          if-no-files-found: ignore
-          retention-days: 7
@@ -1,49 +0,0 @@
-name: Cache impact guard
-
-on:
-  pull_request_target:
-    branches: [main-v2]
-    types: [opened, synchronize, reopened, edited, ready_for_review]
-    # The guard only cares about the prompt/tool surfaces listed in
-    # scripts/check-cache-impact.sh; PRs confined to clearly unrelated paths
-    # can never trip it, so skip the run entirely. Keep the ignore list
-    # conservative: when in doubt, run.
-    paths-ignore:
-      - 'docs/**'
-      - 'site/**'
-      - 'release-notes/**'
-      - 'workers/**'
-      - 'benchmarks/**'
-      - 'npm/**'
-      - '*.md'
-
-permissions:
-  contents: read
-  pull-requests: read
-
-concurrency:
-  group: cache-impact-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  cache-impact:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.event.pull_request.base.sha }}
-
-      - name: Collect PR changed files
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          REPOSITORY: ${{ github.repository }}
-        run: |
-          gh api --paginate "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files" \
-            --jq '.[].filename' > "$RUNNER_TEMP/cache-impact-files.txt"
-
-      - name: Check cache-sensitive PR metadata
-        env:
-          PR_BODY: ${{ github.event.pull_request.body }}
-          CACHE_IMPACT_CHANGED_FILES_FILE: ${{ runner.temp }}/cache-impact-files.txt
-        run: bash scripts/check-cache-impact.sh
@@ -1,71 +0,0 @@
-name: Certum signing smoke test
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: certum-signing
-  cancel-in-progress: false
-
-jobs:
-  sign:
-    if: github.repository == 'esengine/DeepSeek-Reasonix' && github.ref == 'refs/heads/main-v2' && github.ref_protected
-    runs-on: windows-2022
-    environment: release
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.workflow_sha }}
-          persist-credentials: false
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          cache: false
-      - name: Check signing configuration
-        shell: pwsh
-        env:
-          CERTUM_USERNAME: ${{ secrets.CERTUM_USERNAME }}
-          CERTUM_OTP_URI: ${{ secrets.CERTUM_OTP_URI }}
-          CERTUM_KEY_ID: ${{ secrets.CERTUM_KEY_ID }}
-        run: |
-          $ErrorActionPreference = 'Stop'
-          if ([string]::IsNullOrWhiteSpace($env:CERTUM_USERNAME)) { throw 'Missing CERTUM_USERNAME' }
-          if ($env:CERTUM_OTP_URI -notmatch '^otpauth://totp/') { throw 'CERTUM_OTP_URI must be a complete TOTP URI' }
-          if ($env:CERTUM_KEY_ID -notmatch '^[0-9a-fA-F]{40}$') { throw 'CERTUM_KEY_ID must be the 40-character SHA-1 certificate thumbprint' }
-
-      - name: Build open-source signing probes
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = 'Stop'
-          # This minimal probe is covered by the repository's MIT license.
-          New-Item -ItemType Directory payload | Out-Null
-          'package main; func main() { println("Reasonix Certum signing probe") }' | Set-Content probe.go
-          $env:GOOS = 'windows'
-          $env:CGO_ENABLED = '0'
-          foreach ($arch in @('amd64', 'arm64')) {
-            $env:GOARCH = $arch
-            go build -trimpath -o "payload/probe-$arch.exe" probe.go
-            if ($LASTEXITCODE -ne 0) { throw 'Probe compilation failed' }
-          }
-          @('probe-amd64.exe', 'probe-arm64.exe') | Set-Content payload/signing-files.txt
-          Copy-Item payload/probe-amd64.exe installer-probe.exe
-
-      - name: Connect to SimplySign cloud certificate
-        uses: ./.github/actions/setup-certum
-        with:
-          username: ${{ secrets.CERTUM_USERNAME }}
-          otp-uri: ${{ secrets.CERTUM_OTP_URI }}
-          thumbprint: ${{ secrets.CERTUM_KEY_ID }}
-
-      - name: Sign and verify payload and installer probes
-        shell: pwsh
-        env:
-          CERTUM_KEY_ID: ${{ secrets.CERTUM_KEY_ID }}
-        run: |
-          ./scripts/sign-certum.ps1 -PayloadDirectory payload
-          ./scripts/sign-certum.ps1 -FilePath installer-probe.exe
-          'Certum x64/ARM64 payload and installer signing, expected signer, trust, and timestamps passed.' >> $env:GITHUB_STEP_SUMMARY
@@ -1,53 +0,0 @@
-name: Inspect Cloudflare download access
-run-name: Inspect public release manifest access
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: cloudflare-download-access
-  cancel-in-progress: false
-
-jobs:
-  inspect:
-    if: github.ref == 'refs/heads/main-v2'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: "24"
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: desktop/go.mod
-      - name: Inspect the public manifest and its challenge policy
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-        run: node scripts/inspect-cloudflare-download-access.mjs
-      - name: Probe the shipped updater HTTP client
-        run: go run scripts/inspect-cloudflare-download-access.go 1.38.11 1.38.12
-      - name: Probe the public site with headless Chromium
-        run: |
-          browser="$(command -v google-chrome || command -v google-chrome-stable || command -v chromium)"
-          for path in '?download=desktop&release-postflight=v1.38.12' 'changelog/v1.38.12/'; do
-            for profile in default updater browser; do
-              output="$(mktemp)"
-              profile_dir="$(mktemp -d)"
-              flags=()
-              case "$profile" in
-                updater) flags+=(--user-agent='Reasonix-Updater/v1.38.12 (linux/amd64; build=stable; update=stable)') ;;
-                browser) flags+=(--user-agent='Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36') ;;
-              esac
-              "$browser" --headless=new --disable-gpu --no-sandbox --virtual-time-budget=10000 \
-                "--user-data-dir=$profile_dir" "${flags[@]}" \
-                --dump-dom "https://reasonix.io/$path" >"$output" 2>/dev/null || true
-              node -e 'const fs=require("fs"); const body=fs.readFileSync(process.argv[1],"utf8"); console.log(JSON.stringify({kind:"chromium-site",profile:process.argv[2],path:process.argv[3],hasHydratedDesktopVersion:body.includes("data-release-version=\"desktop\">v1.38.12<"),hasDesktopAsset:body.includes("data-desktop-asset="),looksChallenged:body.includes("Just a moment...")}))' "$output" "$profile" "$path"
-              rm -rf "$output" "$profile_dir"
-            done
-          done
@@ -1,50 +0,0 @@
-name: CodeQL
-
-on:
-  # Docs/release-notes/root-Markdown changes carry no analyzable code; the
-  # weekly cron keeps the full scan cadence regardless.
-  push:
-    branches: ["main-v2"]
-    paths-ignore:
-      - 'docs/**'
-      - 'release-notes/**'
-      - '*.md'
-  pull_request:
-    branches: ["main-v2"]
-    paths-ignore:
-      - 'docs/**'
-      - 'release-notes/**'
-      - '*.md'
-  schedule:
-    - cron: "27 3 * * 1"
-
-jobs:
-  analyze:
-    name: Analyze (${{ matrix.language }})
-    runs-on: ubuntu-latest
-    permissions:
-      security-events: write
-      packages: read
-      actions: read
-      contents: read
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - language: go
-            build-mode: autobuild
-          - language: javascript-typescript
-            build-mode: none
-          - language: actions
-            build-mode: none
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: ${{ matrix.build-mode }}
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
-        with:
-          category: "/language:${{ matrix.language }}"
@@ -1,46 +0,0 @@
-name: Deploy accounts worker
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: deploy-accounts-worker
-  cancel-in-progress: false
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        with:
-          version: 10
-          run_install: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: "24"
-          cache: pnpm
-          cache-dependency-path: workers/accounts/pnpm-lock.yaml
-      - name: Deploy
-        working-directory: workers/accounts
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-        run: |
-          pnpm install --frozen-lockfile
-          pnpm test
-          pnpm typecheck
-          npx wrangler deploy
-      - name: Sync RESEND_API_KEY to the worker
-        working-directory: workers/accounts
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }}
-        run: |
-          if [ -n "$RESEND_API_KEY" ]; then
-            printf '%s' "$RESEND_API_KEY" | npx wrangler secret put RESEND_API_KEY
-          else
-            echo "RESEND_API_KEY not set in repo secrets; skipping (worker stays in stub email mode)."
-          fi
@@ -1,168 +0,0 @@
-name: Deploy crash worker
-
-on:
-  workflow_dispatch:
-    inputs:
-      firebase_data_action:
-        description: Firebase crash history operation (migration actions do not deploy the Worker)
-        required: true
-        default: none
-        type: choice
-        options:
-          - none
-          - dry-run
-          - apply
-          - verify-only
-      confirmation:
-        description: Enter APPLY_FIREBASE_CRASH_DATA when selecting apply
-        required: false
-        default: ''
-        type: string
-
-permissions:
-  contents: read
-
-concurrency:
-  group: deploy-crash-worker
-  cancel-in-progress: false
-
-jobs:
-  deploy:
-    if: github.event_name == 'push' || inputs.firebase_data_action == 'none'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: '22'
-          cache: npm
-          cache-dependency-path: workers/crash-report/package-lock.json
-      - name: Validate
-        working-directory: workers/crash-report
-        run: |
-          npm ci
-          npm run typecheck
-          npm test
-      - name: Apply and verify diagnostics v2 D1 migration
-        working-directory: workers/crash-report
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-        run: npm run migrate:diagnostics-v2
-      - name: Apply and verify Firebase crash D1 migration
-        working-directory: workers/crash-report
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-        run: npm run migrate:firebase-crash
-      - name: Apply dashboard performance indexes
-        working-directory: workers/crash-report
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-        run: npm run migrate:dashboard-indexes
-      - name: Apply registry performance indexes and install rollup
-        working-directory: workers/crash-report
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-        run: npm run migrate:registry-indexes
-      - name: Sync Firebase crash secrets
-        working-directory: workers/crash-report
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          FIREBASE_DATABASE_URL: ${{ secrets.FIREBASE_DATABASE_URL }}
-          FIREBASE_CLIENT_EMAIL: ${{ secrets.FIREBASE_CLIENT_EMAIL }}
-          FIREBASE_PRIVATE_KEY: ${{ secrets.FIREBASE_PRIVATE_KEY }}
-        run: |
-          configured=0
-          [ -n "$FIREBASE_DATABASE_URL" ] && configured=$((configured + 1))
-          [ -n "$FIREBASE_CLIENT_EMAIL" ] && configured=$((configured + 1))
-          [ -n "$FIREBASE_PRIVATE_KEY" ] && configured=$((configured + 1))
-          if [ "$configured" -ne 0 ] && [ "$configured" -ne 3 ]; then
-            echo "Firebase crash secrets must be either all configured or all absent."
-            exit 1
-          fi
-          node -e 'process.stdout.write(JSON.stringify({FIREBASE_DATABASE_URL:process.env.FIREBASE_DATABASE_URL||null,FIREBASE_CLIENT_EMAIL:process.env.FIREBASE_CLIENT_EMAIL||null,FIREBASE_PRIVATE_KEY:process.env.FIREBASE_PRIVATE_KEY||null}))' | npx wrangler secret bulk
-      - name: Deploy
-        working-directory: workers/crash-report
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-        run: |
-          npx wrangler deploy
-      # Mirrors the ALERT_WEBHOOK repo secret into the worker so the ingest
-      # sentinel can push alerts (see runIngestSentinel). Managed here so
-      # nobody needs local Cloudflare credentials; when the repo secret is
-      # unset the sentinel stays log-only.
-      - name: Sync alert webhook secret
-        working-directory: workers/crash-report
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          ALERT_WEBHOOK: ${{ secrets.ALERT_WEBHOOK }}
-        run: |
-          if [ -z "$ALERT_WEBHOOK" ]; then
-            echo "ALERT_WEBHOOK repo secret not set; removing any existing worker secret."
-            printf '{"ALERT_WEBHOOK":null}' | npx wrangler secret bulk
-            exit 0
-          fi
-          printf '%s' "$ALERT_WEBHOOK" | npx wrangler secret put ALERT_WEBHOOK
-
-  migrate-firebase-data:
-    if: github.event_name == 'workflow_dispatch' && inputs.firebase_data_action != 'none'
-    runs-on: ubuntu-latest
-    environment: canary
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - name: Require the protected production branch
-        run: |
-          if [ "$GITHUB_REF" != "refs/heads/main-v2" ]; then
-            echo "Firebase crash data migration must run from main-v2."
-            exit 1
-          fi
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: '22'
-          cache: npm
-          cache-dependency-path: workers/crash-report/package-lock.json
-      - name: Validate
-        working-directory: workers/crash-report
-        run: |
-          npm ci
-          npm run typecheck
-          npm test
-      - name: Run Firebase crash history operation
-        working-directory: workers/crash-report
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          FIREBASE_DATABASE_URL: ${{ secrets.FIREBASE_DATABASE_URL }}
-          FIREBASE_CLIENT_EMAIL: ${{ secrets.FIREBASE_CLIENT_EMAIL }}
-          FIREBASE_PRIVATE_KEY: ${{ secrets.FIREBASE_PRIVATE_KEY }}
-          FIREBASE_DATA_ACTION: ${{ inputs.firebase_data_action }}
-          FIREBASE_DATA_CONFIRMATION: ${{ inputs.confirmation }}
-        run: |
-          configured=0
-          [ -n "$CLOUDFLARE_API_TOKEN" ] && configured=$((configured + 1))
-          [ -n "$FIREBASE_DATABASE_URL" ] && configured=$((configured + 1))
-          [ -n "$FIREBASE_CLIENT_EMAIL" ] && configured=$((configured + 1))
-          [ -n "$FIREBASE_PRIVATE_KEY" ] && configured=$((configured + 1))
-          if [ "$configured" -ne 4 ]; then
-            echo "Cloudflare and Firebase migration secrets must all be configured."
-            exit 1
-          fi
-
-          case "$FIREBASE_DATA_ACTION" in
-            dry-run)
-              npm run migrate:firebase-data
-              ;;
-            apply)
-              if [ "$FIREBASE_DATA_CONFIRMATION" != "APPLY_FIREBASE_CRASH_DATA" ]; then
-                echo "Apply requires the exact confirmation APPLY_FIREBASE_CRASH_DATA."
-                exit 1
-              fi
-              npm run migrate:firebase-data -- --apply
-              npm run migrate:firebase-data -- --verify-only
-              ;;
-            verify-only)
-              npm run migrate:firebase-data -- --verify-only
-              ;;
-            *)
-              echo "Unsupported Firebase crash data action."
-              exit 1
-              ;;
-          esac
@@ -1,36 +0,0 @@
-name: Deploy forum worker
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: deploy-forum-worker
-  cancel-in-progress: false
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        with:
-          version: 10
-          run_install: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: "24"
-          cache: pnpm
-          cache-dependency-path: workers/forum/pnpm-lock.yaml
-      - name: Deploy
-        working-directory: workers/forum
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-        run: |
-          pnpm install --frozen-lockfile
-          pnpm test
-          pnpm typecheck
-          npx wrangler d1 execute reasonix-forum --remote --file=migrate-performance-indexes.sql
-          npx wrangler deploy
@@ -1,56 +0,0 @@
-name: Diagnostic overhead monitoring
-
-on:
-  push:
-    branches: [main-v2]
-    paths:
-      - desktop/electron/**
-      - desktop/frontend/**
-      - desktop/package.json
-      - desktop/pnpm-lock.yaml
-      - desktop/pnpm-workspace.yaml
-      - .github/workflows/diagnostic-overhead.yml
-  schedule:
-    - cron: "43 4 * * *"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: diagnostic-overhead-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  measure:
-    runs-on: windows-latest
-    timeout-minutes: 15
-    defaults:
-      run:
-        working-directory: desktop
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        with:
-          version: 10
-          run_install: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: "24"
-          cache: pnpm
-          cache-dependency-path: desktop/pnpm-lock.yaml
-      - name: Install the Electron workspace
-        run: pnpm install --frozen-lockfile
-      - name: Measure Electron diagnostic overhead
-        timeout-minutes: 10
-        run: node electron/scripts/performance-benchmark.mjs
-      - name: Upload diagnostic benchmark evidence
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: diagnostic-overhead-windows-${{ github.sha }}
-          if-no-files-found: error
-          retention-days: 7
-          path: |
-            desktop/electron/artifacts/performance/overhead.json
-            desktop/electron/artifacts/performance/diagnostic-report.png
@@ -1,39 +0,0 @@
-name: Documentation impact guard
-
-on:
-  pull_request_target:
-    branches: [main-v2]
-    types: [opened, synchronize, reopened, edited, ready_for_review]
-
-permissions:
-  contents: read
-  pull-requests: read
-
-concurrency:
-  group: docs-impact-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  docs-impact:
-    runs-on: ubuntu-latest
-    steps:
-      # Execute only the trusted base-branch checker; never run contributor code
-      # from a pull_request_target workflow.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.event.pull_request.base.sha }}
-
-      - name: Collect PR changed files
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          REPOSITORY: ${{ github.repository }}
-        run: |
-          gh api --paginate "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files" \
-            --jq '.[].filename' > "$RUNNER_TEMP/docs-impact-files.txt"
-
-      - name: Check documentation impact declaration
-        env:
-          PR_BODY: ${{ github.event.pull_request.body }}
-          DOCS_IMPACT_CHANGED_FILES_FILE: ${{ runner.temp }}/docs-impact-files.txt
-        run: bash scripts/check-docs-impact.sh
@@ -1,193 +0,0 @@
-name: e2e-bot
-
-# Comment "/e2e" (fixed suite) or "/e2e diff" (generate tests for the PR's diff)
-# on a pull request to run the e2e benchmark against the real provider and post a
-# report back. Gated to trusted authors: the job checks out PR-head code and runs
-# it with the provider API key, so only the repo owner, members, and collaborators
-# may trigger it.
-
-on:
-  issue_comment:
-    types: [created]
-
-permissions:
-  contents: read
-  pull-requests: write
-
-concurrency:
-  group: e2e-bot-${{ github.event.issue.number }}
-  cancel-in-progress: true
-
-jobs:
-  e2e:
-    if: >-
-      github.event.issue.pull_request &&
-      contains(github.event.comment.body, '/e2e') &&
-      contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
-    runs-on: ubuntu-latest
-    # Running PR-head code with the provider secret is gated twice: the author_
-    # association check above, and this deployment environment. Configure the
-    # `e2e-bot` environment with required reviewers in repo settings to force a
-    # human approval per run (actions/untrusted-checkout-toctou).
-    environment: e2e-bot
-    steps:
-      - name: Acknowledge
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
-        with:
-          script: |
-            await github.rest.reactions.createForIssueComment({
-              owner: context.repo.owner, repo: context.repo.repo,
-              comment_id: context.payload.comment.id, content: 'eyes',
-            });
-
-      # Default-branch checkout: this is where the harness (cmd/e2ebench), the
-      # suite, and a run --metrics-capable agent live.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          cache: true
-
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
-        with:
-          python-version: '3.12'
-
-      - name: Install and verify Linux sandbox backend
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y bubblewrap
-          if sysctl -n kernel.unprivileged_userns_clone >/dev/null 2>&1; then
-            sudo sysctl -w kernel.unprivileged_userns_clone=1
-          fi
-          if sysctl -n kernel.apparmor_restrict_unprivileged_userns >/dev/null 2>&1; then
-            sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-          fi
-          bwrap --ro-bind / / --dev /dev --proc /proc -- true
-
-      - name: Build harness + fallback agent from the default branch
-        # Harness (e2ebench) and suite always come from main-v2 so a PR can't weaken
-        # its own grader or tests. The agent is rebuilt from the PR head below; this
-        # main-v2 build is only the fallback for heads that predate `run --metrics`.
-        run: |
-          go build -o "$RUNNER_TEMP/reasonix-base" ./cmd/reasonix
-          go build -o "$RUNNER_TEMP/e2ebench" ./cmd/e2ebench
-          cp -r benchmarks/e2e "$RUNNER_TEMP/suite"
-
-      - name: Check out the PR head
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        # Pin to the head commit resolved now and check it out detached, not the
-        # mutable PR ref: a force-push mid-run can't swap in different code after
-        # the trusted-author gate passed.
-        run: |
-          SHA=$(gh pr view ${{ github.event.issue.number }} --json headRefOid -q .headRefOid)
-          git fetch -q origin "$SHA"
-          git checkout -q --detach "$SHA"
-
-      - name: Build the agent from the PR head
-        # The whole point of the bot is to drive the PR's code, not main-v2's. Fall
-        # back to the main-v2 build only when the PR head can't yield a
-        # run --metrics-capable binary (build break or predates the flag).
-        id: agent
-        run: |
-          bin="$RUNNER_TEMP/reasonix-base"
-          src="main-v2 fallback (PR head lacks run --metrics)"
-          if go build -o "$RUNNER_TEMP/reasonix-pr" ./cmd/reasonix \
-            && "$RUNNER_TEMP/reasonix-pr" run -h 2>&1 | grep -q -- '-metrics'; then
-            bin="$RUNNER_TEMP/reasonix-pr"
-            src="PR head ($(git rev-parse --short HEAD))"
-          fi
-          echo "bin=$bin" >> "$GITHUB_OUTPUT"
-          echo "src=$src" >> "$GITHUB_OUTPUT"
-          echo "agent under test: $src"
-
-      - name: Write provider config
-        env:
-          REASONIX_HOME: ${{ runner.temp }}/reasonix-e2e-home
-        # User config covers suite tasks (they run in temp dirs); the repo-root copy
-        # covers diff mode (the agent runs in the repo root, where project config wins).
-        run: |
-          mkdir -p "$REASONIX_HOME"
-          cat > /tmp/reasonix-e2e.toml <<EOF
-          default_model = "e2e"
-
-          [[providers]]
-          name = "e2e"
-          kind = "openai"
-          base_url = "${{ vars.REASONIX_E2E_BASE_URL || 'https://api.deepseek.com' }}"
-          model = "${{ vars.REASONIX_E2E_MODEL || 'deepseek-v4-flash' }}"
-          api_key_env = "DEEPSEEK_API_KEY"
-          context_window = 20000   # small so the suite actually exercises compaction + cache churn
-
-          [providers.price]
-          cache_hit = ${{ vars.REASONIX_E2E_PRICE_CACHE_HIT || '0.02' }}
-          input = ${{ vars.REASONIX_E2E_PRICE_INPUT || '1' }}
-          output = ${{ vars.REASONIX_E2E_PRICE_OUTPUT || '2' }}
-          currency = "${{ vars.REASONIX_E2E_PRICE_CURRENCY || '¥' }}"
-
-          [permissions]
-          mode = "allow"
-
-          [codegraph]
-          enabled = false
-          EOF
-          cp /tmp/reasonix-e2e.toml "$REASONIX_HOME/config.toml"
-          cp /tmp/reasonix-e2e.toml ./reasonix.toml
-
-      - name: Run e2e
-        env:
-          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
-          REASONIX_HOME: ${{ runner.temp }}/reasonix-e2e-home
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          COMMENT_BODY: ${{ github.event.comment.body }}
-        run: |
-          if [ -z "$DEEPSEEK_API_KEY" ]; then
-            printf 'missing DEEPSEEK_API_KEY secret\n\nAdd a repository secret named DEEPSEEK_API_KEY to enable the e2e bot.\n' > report.md
-            exit 1
-          fi
-          # Provider credentials are deliberately loaded only from Reasonix's
-          # global credential file, not inherited process variables. Keep this
-          # ephemeral runner copy private and outside the checked-out project.
-          umask 077
-          printf 'DEEPSEEK_API_KEY=%s\n' "$DEEPSEEK_API_KEY" > "$REASONIX_HOME/.env"
-          if printf '%s' "$COMMENT_BODY" | grep -q '/e2e[[:space:]]\+diff'; then
-            ATTEMPTS=$(printf '%s' "$COMMENT_BODY" | sed -nE 's@.*/e2e[[:space:]]+diff[[:space:]]+x([0-9]+).*@\1@p' | head -1)
-            [ -z "$ATTEMPTS" ] && ATTEMPTS=1
-            [ "$ATTEMPTS" -gt 5 ] && ATTEMPTS=5
-            BASE_REF=$(gh pr view ${{ github.event.issue.number }} --json baseRefName -q .baseRefName)
-            git fetch -q origin "$BASE_REF"
-            BASE=$(git merge-base "origin/$BASE_REF" HEAD)
-            "$RUNNER_TEMP/e2ebench" -mode diff -bin "${{ steps.agent.outputs.bin }}" -repo . -base "$BASE" -model e2e -attempts "$ATTEMPTS" -out report.md
-          else
-            # The current five-task baseline can exceed 400k after only three
-            # successful tasks. Keep bounded headroom so every scenario is graded.
-            "$RUNNER_TEMP/e2ebench" -bin "${{ steps.agent.outputs.bin }}" -suite "$RUNNER_TEMP/suite" \
-              -task "compaction,fix-add-bug,fizzbuzz,palindrome,subagent-delegation" \
-              -model e2e -out report.md -json report.json -budget 800000
-            node -e '
-              const results = require("./report.json");
-              const unsuccessful = results.filter((result) => !result.Passed || result.Skipped);
-              if (results.length === 0 || unsuccessful.length > 0) {
-                console.error(`e2e suite incomplete: ${unsuccessful.length}/${results.length} unsuccessful`);
-                process.exit(1);
-              }
-            '
-          fi
-
-      - name: Post report
-        if: always() && hashFiles('report.md') != ''
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TRIGGER_USER: ${{ github.event.comment.user.login }}
-        run: |
-          printf '\n> agent: %s · triggered by @%s\n' "${{ steps.agent.outputs.src }}" "$TRIGGER_USER" >> report.md
-          gh pr comment ${{ github.event.issue.number }} --body-file report.md
-
-      - name: Report failure
-        if: failure()
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh pr comment ${{ github.event.issue.number }} --body "🤖 e2e bot failed — see the [run log](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})."
@@ -1,99 +0,0 @@
-name: Auto-label issues
-
-# Classify new issues into area / platform / severity labels using the DeepSeek
-# API (the project's own model). The model is constrained to a fixed label set —
-# anything it returns outside the set is dropped — so it can't invent labels.
-# Issues it can't place into any area get `needs-triage` for a human to look at.
-# Version (v1/v2) labels are handled separately by issue-version-label.yml.
-on:
-  issues:
-    types: [opened, reopened]
-
-permissions:
-  issues: write
-
-concurrency:
-  group: issue-autolabel-${{ github.event.issue.number }}
-  cancel-in-progress: true
-
-jobs:
-  classify:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
-        env:
-          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
-        with:
-          script: |
-            const AREA = ['agent','mcp','config','updater','provider','desktop','tui','skills','rendering'];
-            const PLATFORM = ['windows','macos','linux'];
-            const SEVERITY = ['crash','data-loss','security'];
-            const ALLOWED = new Set([...AREA, ...PLATFORM, ...SEVERITY]);
-
-            const issue = context.payload.issue;
-            const title = issue.title || '';
-            const body = (issue.body || '').slice(0, 4000);
-
-            const system = [
-              'You categorize GitHub issues for Reasonix, a Go-based AI coding agent with an Electron desktop app and a terminal UI.',
-              'Pick labels ONLY from these fixed sets. Never invent labels.',
-              'area (0-2, the affected subsystem):',
-              '  agent: core agent loop / tool-calling / reasoning',
-              '  mcp: MCP servers, plugins, codegraph',
-              '  config: configuration, setup wizard, .toml/.env',
-              '  updater: auto-update, installer, release packaging',
-              '  provider: model providers, model selection/switching',
-              '  desktop: Electron desktop GUI',
-              '  tui: terminal UI / CLI',
-              '  skills: skills system',
-              '  rendering: terminal rendering / flicker / repaint',
-              'platform (only if clearly specific to one OS): windows, macos, linux',
-              'severity (only if clearly applicable):',
-              '  crash: app crashes, hangs, or freezes',
-              '  data-loss: loss of sessions, config, or history',
-              '  security: credential/secret exposure or a security flaw',
-              'Be conservative: omit a label when unsure. The issue may be in Chinese.',
-              'Reply with JSON only: {"area":[],"platform":[],"severity":[]}',
-            ].join('\n');
-
-            let labels = [];
-            try {
-              const res = await fetch('https://api.deepseek.com/chat/completions', {
-                method: 'POST',
-                headers: {
-                  'Authorization': `Bearer ${process.env.DEEPSEEK_API_KEY}`,
-                  'Content-Type': 'application/json',
-                },
-                body: JSON.stringify({
-                  model: 'deepseek-chat',
-                  temperature: 0,
-                  response_format: { type: 'json_object' },
-                  messages: [
-                    { role: 'system', content: system },
-                    { role: 'user', content: `Title: ${title}\n\nBody:\n${body}` },
-                  ],
-                }),
-              });
-              if (!res.ok) {
-                core.warning(`DeepSeek API ${res.status}: ${await res.text()}`);
-                return;
-              }
-              const data = await res.json();
-              const parsed = JSON.parse(data.choices[0].message.content);
-              labels = [...(parsed.area || []), ...(parsed.platform || []), ...(parsed.severity || [])]
-                .filter(l => ALLOWED.has(l));
-            } catch (e) {
-              core.warning(`Classification failed: ${e.message}`);
-              return;
-            }
-
-            if (!labels.some(l => AREA.includes(l))) labels.push('needs-triage');
-
-            if (labels.length) {
-              await github.rest.issues.addLabels({
-                ...context.repo,
-                issue_number: issue.number,
-                labels,
-              });
-              core.info(`Applied: ${labels.join(', ')}`);
-            }
@@ -1,68 +0,0 @@
-name: Label issue version
-
-# Issue forms can't let a reporter set a label directly (that needs triage rights),
-# so the bug/feature forms carry a "Version line" dropdown and this workflow reads
-# the submitted value and applies the matching v2/v3 label on their behalf.
-on:
-  issues:
-    types: [opened, edited]
-
-permissions:
-  issues: write
-
-concurrency:
-  group: issue-version-${{ github.event.issue.number }}
-  cancel-in-progress: true
-
-jobs:
-  label:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
-        with:
-          script: |
-            const body = context.payload.issue.body || '';
-            const sectionOf = (name) =>
-              body.split(/^###\s+/m).find((s) => new RegExp(`^${name}`, 'i').test(s)) || '';
-
-            const lines = ['v1', 'v2', 'v3'];
-            const m = sectionOf('Version line').match(/\bv([23])\b/i);
-            if (!m) {
-              core.info('No version line found; nothing to label.');
-              return;
-            }
-            let choice = 'v' + m[1];
-
-            // The dropdown is a choice, and v2 sits first, so it gets picked by
-            // reporters who are actually on the other line. `Exact version` is
-            // pasted from `reasonix --version`, so when it parses it is the
-            // better evidence: 1.x Go rewrite (v2), 2.x Studio (v3, studio
-            // branch). 0.x is no longer a filing line. Anything that does not
-            // parse (a commit sha, "main-v2", "studio") leaves the dropdown
-            // to decide.
-            const exact = sectionOf('Exact version').match(/\b(\d+)\.(\d+)\.(\d+)/);
-            if (exact) {
-              const major = Number(exact[1]);
-              const fromVersion = major === 1 ? 'v2' : major === 2 ? 'v3' : null;
-              if (fromVersion && fromVersion !== choice) {
-                core.info(`Version line says ${choice} but ${exact[0]} says ${fromVersion}; trusting the version.`);
-                choice = fromVersion;
-              }
-            }
-            await github.rest.issues.addLabels({
-              ...context.repo,
-              issue_number: context.issue.number,
-              labels: [choice],
-            });
-            // Keep version-line labels mutually exclusive if an edit flipped the choice.
-            for (const other of lines.filter((l) => l !== choice)) {
-              try {
-                await github.rest.issues.removeLabel({
-                  ...context.repo,
-                  issue_number: context.issue.number,
-                  name: other,
-                });
-              } catch (e) {
-                core.info(`No ${other} label to remove.`);
-              }
-            }
@@ -1,82 +0,0 @@
-name: Verify macOS signing
-
-# Validate the current protected commit before creating a release tag. This
-# workflow only builds, notarizes, and retains diagnostics; it cannot publish.
-on: workflow_dispatch
-
-permissions:
-  contents: read
-
-jobs:
-  verify:
-    if: github.repository == 'esengine/DeepSeek-Reasonix' && github.ref == 'refs/heads/main-v2' && github.ref_protected
-    runs-on: macos-14
-    environment: release
-    timeout-minutes: 35
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: desktop/go.mod
-          cache: true
-          cache-dependency-path: desktop/go.sum
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        with:
-          version: 10
-          run_install: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: "24"
-          cache: pnpm
-          cache-dependency-path: desktop/pnpm-lock.yaml
-      - name: Install create-dmg
-        run: brew install create-dmg
-      - name: Build and notarize the universal app and DMG
-        env:
-          APPLE_CERT_P12: ${{ secrets.APPLE_CERT_P12 }}
-          APPLE_CERT_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }}
-          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
-          APPLE_API_KEY_PATH: ${{ runner.temp }}/notary.p8
-          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
-          APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
-          APPLE_NOTARIZATION_LOG_DIR: ${{ runner.temp }}/apple-notarization
-          HAS_APPLE_CERT: "true"
-        shell: bash
-        run: |
-          set -euo pipefail
-          : "${APPLE_CERT_P12:?Apple certificate is required}"
-          : "${APPLE_CERT_PASSWORD:?Apple certificate password is required}"
-          : "${APPLE_API_KEY_P8:?Apple notarization key is required}"
-          : "${APPLE_API_KEY_ID:?Apple key ID is required}"
-          : "${APPLE_API_ISSUER_ID:?Apple issuer is required}"
-          umask 077
-          KEYCHAIN="$RUNNER_TEMP/signing-check.keychain-db"
-          KEYCHAIN_PASS="$(uuidgen)"
-          trap 'security delete-keychain "$KEYCHAIN" >/dev/null 2>&1 || true; rm -f "$RUNNER_TEMP/cert.p12" "$APPLE_API_KEY_PATH"' EXIT
-          security create-keychain -p "$KEYCHAIN_PASS" "$KEYCHAIN"
-          security set-keychain-settings -lut 21600 "$KEYCHAIN"
-          security unlock-keychain -p "$KEYCHAIN_PASS" "$KEYCHAIN"
-          printf '%s' "$APPLE_CERT_P12" | base64 --decode > "$RUNNER_TEMP/cert.p12"
-          security import "$RUNNER_TEMP/cert.p12" -k "$KEYCHAIN" -P "$APPLE_CERT_PASSWORD" -T /usr/bin/codesign
-          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASS" "$KEYCHAIN" >/dev/null
-          existing_keychains=()
-          while IFS= read -r keychain; do
-            [ -n "$keychain" ] && existing_keychains+=("$keychain")
-          done < <(security list-keychains -d user | sed -E 's/^[[:space:]]*"//; s/"[[:space:]]*$//')
-          security list-keychains -d user -s "$KEYCHAIN" "${existing_keychains[@]}"
-          printf '%s' "$APPLE_API_KEY_P8" | base64 --decode > "$APPLE_API_KEY_PATH"
-          scripts/desktop-build.sh darwin/universal v0.0.0-signing-check stable
-          node desktop/packaging/verify.mjs desktop/build/candidate/darwin-universal/Reasonix.app --kind darwin-app-dir
-          codesign --verify --deep --strict desktop/build/candidate/darwin-universal/Reasonix.app
-          test -s dist/Reasonix-darwin-universal.dmg
-      - name: Upload Apple notarization diagnostics
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: apple-signing-check-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/apple-notarization/*.json
-          if-no-files-found: ignore
-          retention-days: 7
@@ -1,16 +1,23 @@
-name: Deploy site
+name: Deploy website
 run-name: Deploy site ${{ inputs.release_version && format('v{0}', inputs.release_version) || github.sha }}${{ inputs.release_request && format(' [{0}]', inputs.release_request) || '' }}

 on:
+  push:
+    branches: [website]
  workflow_dispatch:
    inputs:
      release_version:
-        description: "Optional release version that owns this deployment"
+        description: "Optional product release version associated with this publication"
        required: false
        default: ""
        type: string
      release_request:
-        description: "Release workflow correlation ID (optional)"
+        description: "Optional release workflow correlation ID"
+        required: false
+        default: ""
+        type: string
+      studio_version:
+        description: "Studio version that must be present in the generated changelog"
        required: false
        default: ""
        type: string
@@ -21,26 +28,28 @@ permissions:
  id-token: write

 concurrency:
-  group: pages
+  group: reasonix-website-production
  cancel-in-progress: false

 jobs:
  build:
-    if: github.ref == 'refs/heads/main-v2' && github.ref_protected
+    if: github.ref == 'refs/heads/website'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
-          node-version: '22'
+          node-version: "22"
          cache: npm
          cache-dependency-path: site/package-lock.json
-      - name: Build
+      - name: Validate and build
        working-directory: site
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          STUDIO_RELEASE_VERSION: ${{ inputs.studio_version }}
        run: |
          npm ci
+          npm test
          npm run build
      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
        with:
@@ -53,24 +62,5 @@ jobs:
      name: github-pages
      url: ${{ steps.deploy.outputs.page_url }}
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        if: inputs.release_version != ''
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        if: inputs.release_version != ''
-        with:
-          node-version: "22"
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        if: inputs.release_version != ''
-        with:
-          go-version-file: go.mod
-          cache: false
-      - name: Recheck release ownership immediately before deployment
-        if: inputs.release_version != ''
-        env:
-          VERSION: ${{ inputs.release_version }}
-        run: test "$(bash scripts/observe-release-site.sh "$VERSION" recover)" = true
      - id: deploy
        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5
@@ -1,28 +0,0 @@
-name: Auto-label PRs
-
-# Apply area labels to PRs based on changed paths (see .github/labeler.yml).
-# Complements the AI-based issue labeler (issue-auto-label.yml). Version (v1/v2)
-# labels are handled separately by pr-version-label.yml.
-#
-# pull_request_target runs in the base repo context so it has the write token
-# needed to label PRs from forks; actions/labeler only reads the diff file list
-# (it never checks out or runs PR code), so this is safe.
-on:
-  pull_request_target:
-    types: [opened, synchronize, reopened]
-
-permissions:
-  contents: read
-  pull-requests: write
-
-concurrency:
-  group: pr-autolabel-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  label:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7
-        with:
-          sync-labels: false
@@ -1,50 +0,0 @@
-name: Label PR version
-
-# Contributors (especially from forks) can't set labels themselves — that needs
-# triage rights. A PR's version line is fully determined by its base branch, so
-# this reads base.ref and applies v1/v2/v3 on their behalf. pull_request_target runs
-# in the base repo's context so it has write access even for fork PRs; it only
-# reads trusted metadata (the base ref) and never checks out or runs PR code.
-on:
-  pull_request_target:
-    types: [opened, reopened, edited]
-
-permissions:
-  pull-requests: write
-
-concurrency:
-  group: pr-version-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  label:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
-        with:
-          script: |
-            const lineByBase = { v1: 'v1', 'main-v2': 'v2', studio: 'v3' };
-            const lines = Object.values(lineByBase);
-            const base = context.payload.pull_request.base.ref;
-            const label = lineByBase[base] || null;
-            if (!label) {
-              core.info(`Base branch '${base}' isn't a release line; skipping.`);
-              return;
-            }
-            await github.rest.issues.addLabels({
-              ...context.repo,
-              issue_number: context.payload.pull_request.number,
-              labels: [label],
-            });
-            // Drop other line labels if the base was changed after opening.
-            for (const other of lines.filter((l) => l !== label)) {
-              try {
-                await github.rest.issues.removeLabel({
-                  ...context.repo,
-                  issue_number: context.payload.pull_request.number,
-                  name: other,
-                });
-              } catch (e) {
-                core.info(`No ${other} label to remove.`);
-              }
-            }
@@ -15,6 +15,7 @@ permissions:
 jobs:
  draft:
    name: generate reviewable bilingual draft
+    if: github.ref == 'refs/heads/website'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -33,22 +34,21 @@ jobs:
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git fetch origin main-v2
+          git fetch origin main-v2 website

          if [[ ! "$VERSION" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
            echo "::error::version must be MAJOR.MINOR.PATCH"
            exit 1
          fi
-          branch="release-notes/v${VERSION}"
+          branch="website-release-notes/v${VERSION}"
          if git ls-remote --exit-code --heads origin "$branch" >/dev/null 2>&1; then
            git fetch origin "refs/heads/$branch:refs/remotes/origin/$branch"
            git checkout -b "$branch" --track "origin/$branch"
-            source_sha="$(git merge-base origin/main-v2 HEAD)"
+            git merge-base --is-ancestor origin/website HEAD
          else
            git checkout -b "$branch"
-            source_sha="$(git rev-parse HEAD)"
          fi
-          git merge-base --is-ancestor "$source_sha" origin/main-v2
+          source_sha="$(git rev-parse origin/main-v2)"
          echo "RELEASE_NOTES_BRANCH=$branch" >> "$GITHUB_ENV"
          echo "RELEASE_NOTES_SOURCE_SHA=$source_sha" >> "$GITHUB_ENV"

@@ -62,10 +62,10 @@ jobs:
          set -euo pipefail
          # The first preparation fixes the product range. Reruns update the
          # draft without silently absorbing unrelated main-v2 merges.
-          node scripts/generate-release-notes.mjs --version "$VERSION" --to "$RELEASE_NOTES_SOURCE_SHA"
-          node scripts/release-notes.mjs validate
-          node --test scripts/release-notes.test.mjs
-          node scripts/release-notes.mjs render --version "$VERSION" --output /tmp/release-notes.md
+          node site/scripts/releases/generate-release-notes.mjs --version "$VERSION" --to "$RELEASE_NOTES_SOURCE_SHA"
+          node site/scripts/releases/release-notes.mjs validate
+          node --test site/scripts/releases/release-notes.test.mjs
+          node site/scripts/releases/release-notes.mjs render --version "$VERSION" --output /tmp/release-notes.md
          {
            echo "## Review draft for v${VERSION#v}"
            echo
@@ -78,7 +78,7 @@ jobs:
          VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
-          git add release-notes/releases.json
+          git add site/src/data/releases.json
          if ! git diff --cached --quiet; then
            git commit -m "docs(release): prepare v${VERSION#v} notes" \
              -m "Summary:
@@ -90,7 +90,7 @@ jobs:
          git push -u origin "$RELEASE_NOTES_BRANCH"
          if ! gh pr list --head "$RELEASE_NOTES_BRANCH" --state open --json number --jq 'length > 0' | grep -q true; then
            if ! gh pr create \
-              --base main-v2 \
+              --base website \
              --head "$RELEASE_NOTES_BRANCH" \
              --title "docs(release): 准备 v${VERSION#v} 中英更新日志" \
              --body-file /tmp/release-notes.md; then
@@ -99,7 +99,7 @@ jobs:
                echo "## Manual PR handoff"
                echo
                echo '```sh'
-                echo "gh pr create --repo ${{ github.repository }} --base main-v2 --head $RELEASE_NOTES_BRANCH --fill"
+                echo "gh pr create --repo ${{ github.repository }} --base website --head $RELEASE_NOTES_BRANCH --fill"
                echo '```'
              } >> "$GITHUB_STEP_SUMMARY"
            fi
@@ -1,111 +0,0 @@
-name: Verify release candidate rehearsal
-run-name: Verify rehearsal ${{ inputs.candidate_id }}
-
-on:
-  workflow_dispatch:
-    inputs:
-      candidate_id:
-        description: "Sealed non-publishing rehearsal candidate ID"
-        required: true
-        type: string
-
-permissions:
-  actions: read
-  attestations: read
-  contents: read
-
-jobs:
-  verify:
-    name: verify signed files across runs without rebuilding
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-          ref: ${{ github.sha }}
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: "22"
-      - name: Require protected control and resolve exact record
-        id: record
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_REVOKED_CANDIDATES: ${{ vars.RELEASE_REVOKED_CANDIDATES }}
-        run: |
-          set -euo pipefail
-          test "$GITHUB_REPOSITORY" = esengine/DeepSeek-Reasonix
-          test "$GITHUB_REF" = refs/heads/main-v2
-          test "$GITHUB_REF_PROTECTED" = true
-          node scripts/resolve-release-candidate.mjs resolve-rehearsal "${{ inputs.candidate_id }}"
-      - name: Download and verify producer record
-        id: inspected
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RECORD_ID: ${{ steps.record.outputs.record_artifact_id }}
-          PRODUCER_RUN: ${{ steps.record.outputs.producer_run_id }}
-        run: |
-          set -euo pipefail
-          gh api "repos/$GITHUB_REPOSITORY/actions/artifacts/$RECORD_ID" > "$RUNNER_TEMP/record-artifact.json"
-          gh api "repos/$GITHUB_REPOSITORY/actions/runs/$PRODUCER_RUN" > "$RUNNER_TEMP/producer-run.json"
-          gh api "repos/$GITHUB_REPOSITORY/actions/artifacts/$RECORD_ID/zip" > "$RUNNER_TEMP/record.zip"
-          node scripts/verify-release-artifact-archive.mjs "$RUNNER_TEMP/record-artifact.json" "$RUNNER_TEMP/record.zip"
-          mkdir record
-          unzip -q "$RUNNER_TEMP/record.zip" -d record
-          test -s record/record.json
-          signer_sha="$(jq -r .head_sha "$RUNNER_TEMP/producer-run.json")"
-          gh attestation verify record/record.json --repo "$GITHUB_REPOSITORY" \
-            --signer-workflow "$GITHUB_REPOSITORY/.github/workflows/release-candidate.yml" \
-            --signer-digest "$signer_sha" --source-ref refs/heads/main-v2 --deny-self-hosted-runners
-          node scripts/resolve-release-candidate.mjs inspect-rehearsal "${{ inputs.candidate_id }}" \
-            record/record.json "$RUNNER_TEMP/record-artifact.json" "$RUNNER_TEMP/producer-run.json"
-      - name: Verify exact signed payload and native acceptance evidence
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PAYLOAD_ID: ${{ steps.inspected.outputs.payload_artifact_id }}
-          PAYLOAD_NAME: ${{ steps.inspected.outputs.payload_artifact_name }}
-          PRODUCER_RUN: ${{ steps.inspected.outputs.producer_run_id }}
-          CONTROL_SHA: ${{ steps.inspected.outputs.candidate_control_sha }}
-        run: |
-          set -euo pipefail
-          gh api "repos/$GITHUB_REPOSITORY/actions/artifacts/$PAYLOAD_ID" > "$RUNNER_TEMP/payload-artifact.json"
-          test "$(jq -r .name "$RUNNER_TEMP/payload-artifact.json")" = "$PAYLOAD_NAME"
-          test "$(jq -r .workflow_run.id "$RUNNER_TEMP/payload-artifact.json")" = "$PRODUCER_RUN"
-          gh api "repos/$GITHUB_REPOSITORY/actions/artifacts/$PAYLOAD_ID/zip" > "$RUNNER_TEMP/payload.zip"
-          node scripts/verify-release-artifact-archive.mjs "$RUNNER_TEMP/payload-artifact.json" "$RUNNER_TEMP/payload.zip"
-          mkdir payload
-          unzip -q "$RUNNER_TEMP/payload.zip" -d payload
-          # One provenance check per payload file; each is a network round trip,
-          # so they run eight at a time and any single failure fails the step.
-          signer_digest="$CONTROL_SHA"
-          find payload -type f -print0 | xargs -0 -P 8 -I{} \
-            gh attestation verify {} --repo "$GITHUB_REPOSITORY" \
-            --signer-workflow "$GITHUB_REPOSITORY/.github/workflows/release-candidate.yml" \
-            --signer-digest "$signer_digest" --source-ref refs/heads/main-v2 \
-            --deny-self-hosted-runners >/dev/null
-          node scripts/release-candidate.mjs verify-rehearsal payload record/record.json >/dev/null
-          git fetch origin main-v2
-          git merge-base --is-ancestor "${{ steps.inspected.outputs.source_sha }}" origin/main-v2
-          jq -n \
-            --arg candidate "${{ inputs.candidate_id }}" \
-            --arg source "${{ steps.inspected.outputs.source_sha }}" \
-            --arg producer "$PRODUCER_RUN" \
-            --arg verifier "$GITHUB_RUN_ID" \
-            --arg record "$(sha256sum record/record.json | awk '{print $1}')" \
-            --arg payload "$(sha256sum "$RUNNER_TEMP/payload.zip" | awk '{print $1}')" \
-            '{candidateId:$candidate,sourceSHA:$source,producerRunId:$producer,verifierRunId:$verifier,recordSha256:$record,payloadArchiveSha256:$payload,publication:false,result:"verified"}' \
-            > rehearsal-verification.json
-          {
-            echo "### Independent rehearsal verification"
-            echo
-            echo "- Candidate: \`${{ inputs.candidate_id }}\`"
-            echo "- Producer run: \`$PRODUCER_RUN\`"
-            echo "- Record SHA-256: \`$(jq -r .recordSha256 rehearsal-verification.json)\`"
-            echo "- Payload archive SHA-256: \`$(jq -r .payloadArchiveSha256 rehearsal-verification.json)\`"
-            echo "- No tag, release channel, or update pointer was changed."
-          } >> "$GITHUB_STEP_SUMMARY"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: release-rehearsal-verification-${{ github.run_id }}-${{ github.run_attempt }}
-          path: rehearsal-verification.json
-          if-no-files-found: error
-          retention-days: 90
@@ -1,457 +0,0 @@
-name: Prepare release candidate
-run-name: Prepare release candidate ${{ inputs.version || github.sha }}
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Official version without a tag prefix"
-        required: true
-        type: string
-      rehearsal:
-        description: "Build and accept isolated files that cannot be published"
-        required: false
-        default: false
-        type: boolean
-  push:
-    branches: [main-v2]
-    paths:
-      - release-notes/releases.json
-
-concurrency:
-  group: release-candidate-${{ inputs.rehearsal && 'rehearsal' || 'release' }}-${{ inputs.version || github.sha }}
-  cancel-in-progress: false
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  resolve:
-    name: validate candidate inputs before native builds
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.candidate.outputs.version }}
-      candidate_id: ${{ steps.candidate.outputs.candidate_id }}
-      catalog_sha256: ${{ steps.candidate.outputs.catalog_sha256 }}
-      reuse: ${{ steps.existing.outputs.reuse }}
-      artifact_namespace: ${{ steps.candidate.outputs.artifact_namespace }}
-      purpose: ${{ steps.candidate.outputs.purpose }}
-    permissions:
-      actions: read
-      attestations: read
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-          ref: ${{ github.sha }}
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: "22"
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          cache: false
-      - name: Resolve reviewed source
-        id: candidate
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          INPUT_VERSION: ${{ inputs.version }}
-          PUSH_SHA: ${{ github.sha }}
-          REHEARSAL: ${{ inputs.rehearsal || false }}
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_REPOSITORY: ${{ github.repository }}
-          RELEASE_REVOKED_CANDIDATES: ${{ vars.RELEASE_REVOKED_CANDIDATES }}
-        run: |
-          set -euo pipefail
-          git fetch origin main-v2 --tags
-          if [ "$EVENT_NAME" = push ]; then
-            version="$(jq -r '.releases[0].version // empty' release-notes/releases.json)"
-            source_sha="$PUSH_SHA"
-          else
-            version="$INPUT_VERSION"
-            source_sha="$PUSH_SHA"
-          fi
-          purpose=release
-          artifact_namespace=release-candidate
-          if [ "$REHEARSAL" = true ]; then
-            purpose=rehearsal
-            artifact_namespace=release-candidate-rehearsal
-          fi
-          bash scripts/validate-release-candidate-source.sh "$version" "$source_sha" "$purpose"
-          git show "$source_sha:release-notes/releases.json" > /tmp/release-catalog.json
-          catalog_sha256="$(sha256sum /tmp/release-catalog.json | awk '{print $1}')"
-          candidate_id="$(node scripts/release-candidate.mjs id "$version" "$source_sha" "$catalog_sha256")"
-          node scripts/resolve-release-candidate.mjs active "$candidate_id"
-          {
-            echo "version=$version"
-            echo "source_sha=$source_sha"
-            echo "catalog_sha256=$catalog_sha256"
-            echo "candidate_id=$candidate_id"
-            echo "purpose=$purpose"
-            echo "artifact_namespace=$artifact_namespace"
-          } >> "$GITHUB_OUTPUT"
-          {
-            echo "### Candidate input"
-            echo
-            echo "- ID: \`$candidate_id\`"
-            echo "- Product: \`$source_sha\`"
-            echo "- Control: \`$GITHUB_SHA\`"
-            echo "- Purpose: \`$purpose\`"
-          } >> "$GITHUB_STEP_SUMMARY"
-      - name: Verify release control helpers and signing configuration
-        env:
-          OFFICIAL_REPOSITORY: ${{ github.repository == 'esengine/DeepSeek-Reasonix' }}
-          HAS_APPLE_SIGNING: ${{ secrets.APPLE_CERT_P12 != '' && secrets.APPLE_CERT_PASSWORD != '' && secrets.APPLE_API_KEY_P8 != '' && secrets.APPLE_API_KEY_ID != '' && secrets.APPLE_API_ISSUER_ID != '' }}
-          HAS_CERTUM_SIGNING: ${{ secrets.CERTUM_USERNAME != '' && secrets.CERTUM_OTP_URI != '' && secrets.CERTUM_KEY_ID != '' }}
-          HAS_MINISIGN: ${{ secrets.MINISIGN_PRIVATE_KEY != '' && secrets.MINISIGN_PASSWORD != '' }}
-        run: |
-          bash scripts/validate-release-control-plane.sh
-          bash scripts/check-release-public-access.sh "${{ steps.candidate.outputs.version }}"
-          if [ "$OFFICIAL_REPOSITORY" = true ]; then
-            for configured in "$HAS_APPLE_SIGNING" "$HAS_CERTUM_SIGNING" "$HAS_MINISIGN"; do
-              [ "$configured" = true ] || { echo "::error::release signing configuration is incomplete"; exit 1; }
-            done
-          fi
-      - name: Reuse an existing sealed candidate
-        if: inputs.rehearsal != true
-        id: existing
-        env:
-          GH_TOKEN: ${{ github.token }}
-          CANDIDATE_ID: ${{ steps.candidate.outputs.candidate_id }}
-          RELEASE_REVOKED_CANDIDATES: ${{ vars.RELEASE_REVOKED_CANDIDATES }}
-        run: |
-          set -euo pipefail
-          resolved="$RUNNER_TEMP/existing-candidate.outputs"
-          GITHUB_OUTPUT="$resolved" node scripts/resolve-release-candidate.mjs resolve-optional "$CANDIDATE_ID"
-          output() { sed -n "s/^$1=//p" "$resolved" | tail -1; }
-          if [ "$(output found)" != true ]; then
-            echo "reuse=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          record_id="$(output record_artifact_id)"
-          run_id="$(output producer_run_id)"
-          mkdir -p "$RUNNER_TEMP/existing-record"
-          gh api "repos/$GITHUB_REPOSITORY/actions/artifacts/$record_id" > "$RUNNER_TEMP/existing-record-artifact.json"
-          gh api "repos/$GITHUB_REPOSITORY/actions/runs/$run_id" > "$RUNNER_TEMP/existing-run.json"
-          gh api "repos/$GITHUB_REPOSITORY/actions/artifacts/$record_id/zip" > "$RUNNER_TEMP/existing-record.zip"
-          node scripts/verify-release-artifact-archive.mjs "$RUNNER_TEMP/existing-record-artifact.json" "$RUNNER_TEMP/existing-record.zip"
-          unzip -q "$RUNNER_TEMP/existing-record.zip" -d "$RUNNER_TEMP/existing-record"
-          jq -e '
-            .validity.revoked == false and
-            ((.validity.createdAt | fromdateiso8601) < (.validity.expiresAt | fromdateiso8601))
-          ' "$RUNNER_TEMP/existing-record/record.json" >/dev/null
-          if ! jq -e '(.validity.expiresAt | fromdateiso8601) > now' \
-            "$RUNNER_TEMP/existing-record/record.json" >/dev/null; then
-            echo "reuse=false" >> "$GITHUB_OUTPUT"
-            echo "The sealed record expired; preparing fresh files." >> "$GITHUB_STEP_SUMMARY"
-            exit 0
-          fi
-          signer_sha="$(jq -r .head_sha "$RUNNER_TEMP/existing-run.json")"
-          gh attestation verify "$RUNNER_TEMP/existing-record/record.json" --repo "$GITHUB_REPOSITORY" \
-            --signer-workflow "$GITHUB_REPOSITORY/.github/workflows/release-candidate.yml" \
-            --signer-digest "$signer_sha" --source-ref refs/heads/main-v2 --deny-self-hosted-runners
-          inspected="$RUNNER_TEMP/existing-inspected.outputs"
-          GITHUB_OUTPUT="$inspected" node scripts/resolve-release-candidate.mjs inspect "$CANDIDATE_ID" \
-            "$RUNNER_TEMP/existing-record/record.json" "$RUNNER_TEMP/existing-record-artifact.json" \
-            "$RUNNER_TEMP/existing-run.json"
-          payload_id="$(sed -n 's/^payload_artifact_id=//p' "$inspected" | tail -1)"
-          if ! gh api "repos/$GITHUB_REPOSITORY/actions/artifacts/$payload_id" \
-            > "$RUNNER_TEMP/existing-payload.json" 2> "$RUNNER_TEMP/existing-payload.error"; then
-            if grep -Eiq 'HTTP 404|Not Found' "$RUNNER_TEMP/existing-payload.error"; then
-              echo "reuse=false" >> "$GITHUB_OUTPUT"
-              echo "The sealed record exists but its payload is unavailable; preparing fresh files." >> "$GITHUB_STEP_SUMMARY"
-              exit 0
-            fi
-            cat "$RUNNER_TEMP/existing-payload.error" >&2
-            exit 1
-          fi
-          test "$(jq -r .expired "$RUNNER_TEMP/existing-payload.json")" = false || {
-            echo "reuse=false" >> "$GITHUB_OUTPUT"
-            echo "The sealed record exists but its payload expired; preparing fresh files." >> "$GITHUB_STEP_SUMMARY"
-            exit 0
-          }
-          test "$(jq -r .name "$RUNNER_TEMP/existing-payload.json")" = "release-candidate-payload-$CANDIDATE_ID"
-          test "$(jq -r .workflow_run.id "$RUNNER_TEMP/existing-payload.json")" = "$run_id"
-          echo "reuse=true" >> "$GITHUB_OUTPUT"
-          echo "A sealed candidate with an active exact payload already exists; native builds are skipped." >> "$GITHUB_STEP_SUMMARY"
-      - name: Verify source CI after control preflight
-        if: steps.existing.outputs.reuse != 'true'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_REPOSITORY: ${{ github.repository }}
-          RELEASE_SOURCE_SHA: ${{ github.sha }}
-          RELEASE_CI_WAIT_SECONDS: 1800
-        run: bash scripts/verify-release-push-ci.sh "$RELEASE_SOURCE_SHA"
-
-  # Release-specific but not an input to the native builds: it runs beside
-  # them and gates only the seal, so it adds nothing to the critical path.
-  notes:
-    name: validate embedded notes and cache identity alongside native builds
-    needs: resolve
-    if: needs.resolve.outputs.reuse != 'true'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: "22"
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          cache: false
-      - name: Validate embedded notes and cache identity inputs
-        env:
-          DOCS_BUILD_VERSION: v${{ needs.resolve.outputs.version }}
-          DOCS_SOURCE_REVISION: ${{ github.sha }}
-        run: |
-          node scripts/release-notes.mjs validate
-          node scripts/release-notes.mjs render --version "$DOCS_BUILD_VERSION" --output /tmp/release-notes.md
-          bash scripts/verify-embedded-docs.sh "$DOCS_BUILD_VERSION" "$DOCS_SOURCE_REVISION"
-          ./scripts/cache-guard.sh
-
-  cli-npm:
-    name: build shared CLI and npm candidate
-    needs: resolve
-    if: needs.resolve.outputs.reuse != 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-          ref: ${{ github.sha }}
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          cache: true
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: "22"
-      - name: Build each CLI binary once and package both surfaces
-        env:
-          RELEASE_SOURCE_SHA: ${{ github.sha }}
-        run: |
-          RELEASE_BUILD_TIME="$(git show -s --format=%cI "$RELEASE_SOURCE_SHA")"
-          export RELEASE_BUILD_TIME
-          node scripts/build-release-cli-candidate.mjs "${{ needs.resolve.outputs.version }}" candidate-cli
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: candidate-cli-${{ needs.resolve.outputs.candidate_id }}
-          path: |
-            candidate-cli/cli
-            candidate-cli/npm
-          if-no-files-found: error
-          overwrite: true
-          retention-days: 30
-
-  desktop:
-    name: build, sign, and accept Desktop candidate
-    needs: resolve
-    if: needs.resolve.outputs.reuse != 'true'
-    # GitHub validates every nested job before evaluating its condition, even
-    # though candidate preparation skips the publisher and mirror jobs.
-    permissions:
-      actions: write
-      contents: write
-    uses: ./.github/workflows/release-desktop.yml
-    with:
-      channel: stable
-      tag: desktop-v${{ needs.resolve.outputs.version }}
-      approved_cli_tag: v${{ needs.resolve.outputs.version }}
-      approved_sha: ${{ github.sha }}
-      orchestrated: true
-      orchestrator: candidate
-      signing_preflight: true
-      candidate_preparation: true
-      candidate_rehearsal: ${{ inputs.rehearsal || false }}
-    secrets: inherit
-
-  seal:
-    name: seal reusable release candidate
-    needs: [resolve, notes, cli-npm, desktop]
-    if: >-
-      always() && !cancelled() && needs.resolve.outputs.reuse != 'true' &&
-      needs.resolve.result == 'success' && needs.notes.result == 'success' &&
-      needs.cli-npm.result == 'success' && needs.desktop.result == 'success'
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      attestations: write
-      contents: read
-      id-token: write
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-          ref: ${{ github.sha }}
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: "22"
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: candidate-cli-${{ needs.resolve.outputs.candidate_id }}
-          path: payload
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: ${{ needs.desktop.outputs.artifact_prefix }}-darwin-arm64
-          path: payload/desktop/darwin-arm64
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: ${{ needs.desktop.outputs.artifact_prefix }}-darwin-amd64
-          path: payload/desktop/darwin-amd64
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: ${{ needs.desktop.outputs.artifact_prefix }}-darwin-universal
-          path: payload/desktop/darwin-universal
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: ${{ needs.desktop.outputs.artifact_prefix }}-windows-amd64
-          path: payload/desktop/windows-amd64
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: ${{ needs.desktop.outputs.artifact_prefix }}-windows-arm64
-          path: payload/desktop/windows-arm64
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: ${{ needs.desktop.outputs.artifact_prefix }}-linux-amd64
-          path: payload/desktop/linux-amd64
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: ${{ needs.desktop.outputs.artifact_prefix }}-receipt-windows-amd64
-          path: payload/evidence
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: ${{ needs.desktop.outputs.artifact_prefix }}-receipt-windows-arm64
-          path: payload/evidence
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: ${{ needs.desktop.outputs.artifact_prefix }}-receipt-macos-universal-intel
-          path: payload/evidence
-      - name: Normalize acceptance receipt names
-        run: |
-          test -s payload/evidence/windows-amd64.json
-          test -s payload/evidence/windows-arm64.json
-          test -s payload/evidence/macos-universal-intel.json
-      - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
-        with:
-          subject-path: payload/**/*
-      - name: Upload immutable candidate payload
-        id: payload
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: ${{ needs.resolve.outputs.artifact_namespace }}-payload-${{ needs.resolve.outputs.candidate_id }}
-          path: payload
-          if-no-files-found: error
-          overwrite: true
-          retention-days: 30
-      - name: Retain native acceptance evidence
-        id: evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: ${{ needs.resolve.outputs.artifact_namespace }}-evidence-${{ needs.resolve.outputs.candidate_id }}
-          path: payload/evidence
-          if-no-files-found: error
-          overwrite: true
-          retention-days: 90
-      - name: Render reviewed notes from the immutable product
-        run: |
-          git show "${{ github.sha }}:release-notes/releases.json" > /tmp/releases.json
-          worktree="$(mktemp -d "$RUNNER_TEMP/reasonix-notes.XXXXXX")"
-          git worktree add --detach "$worktree" "${{ github.sha }}"
-          node "$worktree/scripts/release-notes.mjs" render --version "v${{ needs.resolve.outputs.version }}" --output /tmp/release-notes.md
-          git worktree remove "$worktree"
-      - name: Seal candidate record
-        env:
-          RELEASE_VERSION: ${{ needs.resolve.outputs.version }}
-          RELEASE_CANDIDATE_PURPOSE: ${{ needs.resolve.outputs.purpose }}
-          RELEASE_SOURCE_SHA: ${{ github.sha }}
-          RELEASE_BUILD_CONTROL_SHA: ${{ github.sha }}
-          RELEASE_ACCEPTANCE_CONTROL_SHA: ${{ github.sha }}
-          RELEASE_NOTES_SOURCE_SHA: ${{ github.sha }}
-          RELEASE_CATALOG_SHA256: ${{ needs.resolve.outputs.catalog_sha256 }}
-          RELEASE_DESKTOP_PREFIX: ${{ needs.desktop.outputs.artifact_prefix }}
-          RELEASE_DESKTOP_FINGERPRINT: ${{ needs.desktop.outputs.signing_fingerprint }}
-          RELEASE_PAYLOAD_ARTIFACT_ID: ${{ steps.payload.outputs.artifact-id }}
-          RELEASE_PAYLOAD_ARTIFACT_NAME: ${{ needs.resolve.outputs.artifact_namespace }}-payload-${{ needs.resolve.outputs.candidate_id }}
-          RELEASE_EVIDENCE_ARTIFACT_ID: ${{ steps.evidence.outputs.artifact-id }}
-          RELEASE_EVIDENCE_ARTIFACT_NAME: ${{ needs.resolve.outputs.artifact_namespace }}-evidence-${{ needs.resolve.outputs.candidate_id }}
-          RELEASE_WORKFLOW: .github/workflows/release-candidate.yml
-          RELEASE_ACCEPTANCE_JSON: >-
-            [{"kind":"windows-amd64","status":"passed","evidencePath":"evidence/windows-amd64.json"},{"kind":"windows-arm64","status":"passed","evidencePath":"evidence/windows-arm64.json"},{"kind":"macos-universal-intel","status":"passed","evidencePath":"evidence/macos-universal-intel.json"}]
-        run: |
-          RELEASE_RENDERED_NOTES_SHA256="$(sha256sum /tmp/release-notes.md | awk '{print $1}')"
-          RELEASE_CREATED_AT="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-          RELEASE_EXPIRES_AT="$(date -u -d '+30 days' +%Y-%m-%dT%H:%M:%SZ)"
-          export RELEASE_RENDERED_NOTES_SHA256 RELEASE_CREATED_AT RELEASE_EXPIRES_AT
-          node scripts/release-candidate.mjs seal payload record/record.json
-          if [ "$RELEASE_CANDIDATE_PURPOSE" = rehearsal ]; then
-            node scripts/release-candidate.mjs verify-rehearsal payload record/record.json
-          else
-            node scripts/release-candidate.mjs verify payload record/record.json
-          fi
-      - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
-        with:
-          subject-path: record/record.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: ${{ needs.resolve.outputs.artifact_namespace }}-record-${{ needs.resolve.outputs.candidate_id }}
-          path: record/record.json
-          if-no-files-found: error
-          overwrite: true
-          retention-days: 90
-      - name: Report publish command
-        env:
-          PURPOSE: ${{ needs.resolve.outputs.purpose }}
-        run: |
-          {
-            echo "### Candidate ready"
-            echo
-            echo "\`${{ needs.resolve.outputs.candidate_id }}\`"
-            echo
-            echo '```sh'
-            if [ "$PURPOSE" = rehearsal ]; then
-              echo "gh workflow run release-candidate-verify.yml --ref main-v2 -f candidate_id='${{ needs.resolve.outputs.candidate_id }}'"
-            else
-              echo "./scripts/release-stable.sh '${{ needs.resolve.outputs.candidate_id }}'"
-            fi
-            echo '```'
-          } >> "$GITHUB_STEP_SUMMARY"
-
-  metrics:
-    name: record candidate timing
-    needs: [resolve, notes, cli-npm, desktop, seal]
-    if: ${{ always() && !cancelled() }}
-    continue-on-error: true
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-      - name: Record queue, execution, and critical-path evidence
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          gh api "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" > "$RUNNER_TEMP/release-run.json"
-          gh api "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/jobs?filter=all&per_page=100" > "$RUNNER_TEMP/release-jobs.json"
-          node scripts/ci-timings.mjs \
-            --run "$RUNNER_TEMP/release-run.json" \
-            --jobs "$RUNNER_TEMP/release-jobs.json" \
-            --summary "$GITHUB_STEP_SUMMARY" \
-            --output "$RUNNER_TEMP/candidate-timing.json" \
-            --title "Release candidate timing"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: release-candidate-timing-${{ needs.resolve.outputs.candidate_id || github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/candidate-timing.json
-          if-no-files-found: ignore
-          overwrite: true
-          retention-days: 90
@@ -2,18 +2,15 @@ name: Release notes

 on:
  pull_request:
+    branches: [website]
    paths:
-      - "release-notes/**"
-      - "scripts/generate-release-notes.mjs"
-      - "scripts/release-notes*.mjs"
-      - "scripts/release-event.mjs"
+      - "site/src/data/releases.json"
+      - "site/scripts/releases/**"
+      - "site/scripts/release-event.mjs"
      - "site/src/pages/changelog/**"
      - "site/src/components/ChangelogPage.astro"
      - "site/src/data/releases.ts"
      - "site/src/styles/changelog.css"
-      - "desktop/frontend/src/App.tsx"
-      - "desktop/frontend/src/components/SettingsPanel.tsx"
-      - "desktop/frontend/src/components/UpdateBanner.tsx"

 permissions:
  contents: read
@@ -26,5 +23,5 @@ jobs:
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: "22"
-      - run: node scripts/release-notes.mjs validate
-      - run: node --test scripts/release-notes.test.mjs
+      - run: node site/scripts/releases/release-notes.mjs validate
+      - run: node --test site/scripts/releases/*.test.mjs
@@ -1,243 +0,0 @@
-name: Release npm
-
-# npm line. Stable releases are called by release-stable.yml after its single
-# GitHub environment approval. Direct prerelease tag publication is disabled;
-# manual workflow_dispatch recovers only an approved Stable version from an
-# existing tag. Historical canary and next package identities remain readable,
-# but normal publication advances only the official release.
-on:
-  workflow_dispatch:
-    inputs:
-      channel:
-        description: "Standalone npm recovery channel"
-        required: true
-        default: stable
-        type: choice
-        options:
-          - stable
-      base_version:
-        description: "Stable version to recover exactly"
-        required: true
-        type: string
-      tag:
-        description: "stable: existing npm tag to publish (for example npm-v1.18.0)"
-        required: false
-        type: string
-  workflow_call:
-    inputs:
-      channel:
-        description: "Publish channel selected by the approved release orchestrator"
-        required: true
-        type: string
-      base_version:
-        description: "Version to publish"
-        required: true
-        type: string
-      tag:
-        description: "Existing npm tag to check out for stable publication"
-        required: false
-        default: ""
-        type: string
-      approved_cli_tag:
-        description: "Stable CLI tag recorded by the approved orchestrator"
-        required: true
-        type: string
-      approved_sha:
-        description: "Immutable commit recorded by the approved orchestrator"
-        required: true
-        type: string
-      orchestrated:
-        description: "True only when called by an approved release orchestrator"
-        required: false
-        default: false
-        type: boolean
-      orchestrator:
-        description: "Trusted release orchestrator (legacy Preview calls remain readable)"
-        required: false
-        default: stable
-        type: string
-      preview_number:
-        description: "Legacy Preview ordinal for old workflow-call compatibility"
-        required: false
-        default: ""
-        type: string
-      candidate_artifact_name:
-        description: "Same-run artifact containing a verified sealed release candidate"
-        required: false
-        default: ""
-        type: string
-      candidate_verified:
-        description: "Protected Stable preflight verified candidate provenance and bytes"
-        required: false
-        default: false
-        type: boolean
-
-permissions:
-  contents: read
-
-concurrency:
-  # Serialize every publisher for one npm dist-tag. Historical canary calls
-  # remain ordered even though normal publication now uses Stable only.
-  group: release-npm-${{ inputs.channel || 'next' }}
-  cancel-in-progress: false
-
-jobs:
-  orchestration-guard:
-    name: verify approved orchestrator
-    if: ${{ inputs.orchestrated }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-          ref: ${{ github.sha }}
-      - name: Verify caller and approved release ref
-        env:
-          ACTUAL_CALLER_WORKFLOW_REF: ${{ github.workflow_ref }}
-          EXPECTED_CALLER_WORKFLOW_REF: ${{ format('{0}/.github/workflows/release-{1}.yml@{2}', github.repository, inputs.orchestrator, github.ref) }}
-          CALLER_EVENT_NAME: ${{ github.event_name }}
-          CALLER_REF: ${{ github.ref }}
-          CALLER_REF_PROTECTED: ${{ github.ref_protected }}
-          CALLER_WORKFLOW_SHA: ${{ github.workflow_sha }}
-          CALLER_SHA: ${{ github.sha }}
-          APPROVED_CLI_TAG: ${{ inputs.approved_cli_tag }}
-          APPROVED_SHA: ${{ inputs.approved_sha }}
-          APPROVED_CHANNEL: ${{ inputs.orchestrator == 'promote' && 'stable' || inputs.orchestrator }}
-          RELEASE_TAG: ${{ inputs.approved_cli_tag }}
-          VERIFY_RELEASE_CHECKOUT: false
-        run: |
-          bash scripts/verify-release-authorization.sh
-          bash scripts/verify-release-tag.sh
-          if [ -n "${{ inputs.candidate_artifact_name }}" ] && [ "${{ inputs.candidate_verified }}" != "true" ]; then
-            echo "::error::prepared npm packages require verified candidate provenance"
-            exit 1
-          fi
-
-  release-gate:
-    name: approve standalone npm release
-    if: ${{ !inputs.orchestrated }}
-    runs-on: ubuntu-latest
-    environment: release
-    steps:
-      - env:
-          RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
-        run: echo "Approved standalone npm release $RELEASE_TAG"
-
-  cache-guard:
-    name: cache hit guard
-    needs: [orchestration-guard, release-gate]
-    if: ${{ always() && !cancelled() && ((inputs.orchestrated && needs.orchestration-guard.result == 'success') || (!inputs.orchestrated && needs.release-gate.result == 'success')) }}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ inputs.approved_sha || inputs.tag || github.ref }}
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        if: ${{ !inputs.candidate_verified }}
-        with:
-          go-version-file: go.mod
-          cache: true
-      - if: ${{ !inputs.candidate_verified }}
-        run: ./scripts/cache-guard.sh
-      - name: Verify embedded documentation identity
-        if: ${{ !inputs.candidate_verified }}
-        env:
-          DOCS_BUILD_VERSION: v${{ inputs.base_version }}
-          DOCS_SOURCE_REVISION: ${{ inputs.approved_sha }}
-        run: |
-          if [ ! -f scripts/verify-embedded-docs.sh ]; then
-            echo "Legacy candidate predates the embedded docs contract; skipping."
-            exit 0
-          fi
-          revision="$DOCS_SOURCE_REVISION"
-          if [ -z "$revision" ]; then revision="$(git rev-parse HEAD)"; fi
-          bash scripts/verify-embedded-docs.sh "$DOCS_BUILD_VERSION" "$revision"
-
-  npm:
-    name: publish npm packages
-    needs: cache-guard
-    if: ${{ always() && !cancelled() && needs.cache-guard.result == 'success' }}
-    runs-on: ubuntu-latest
-    # id-token lets npm publish --provenance attach a Sigstore attestation; the
-    # registry token still authenticates the publish itself.
-    permissions:
-      contents: read
-      id-token: write
-    # Orchestrated releases have already passed their GitHub environment
-    # approval. Direct prereleases and manual Stable recovery pass release-gate.
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ inputs.approved_sha || inputs.tag || github.ref }}
-      - name: Load approved npm publication control plane
-        env:
-          RECOVERY_CONTROL_SHA: ${{ github.workflow_sha }}
-        run: |
-          set -euo pipefail
-          git fetch --no-tags --depth=1 origin "$RECOVERY_CONTROL_SHA"
-          git restore --source="$RECOVERY_CONTROL_SHA" -- \
-            npm/publish.mjs \
-            npm/publish-candidate.mjs \
-            scripts/finalize-npm-official-release.mjs
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        if: ${{ inputs.candidate_artifact_name == '' }}
-        with:
-          go-version-file: go.mod
-          cache: true
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: '22'
-          registry-url: 'https://registry.npmjs.org'
-      - name: Download sealed release candidate
-        if: ${{ inputs.candidate_artifact_name != '' }}
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: ${{ inputs.candidate_artifact_name }}
-          path: ${{ runner.temp }}/release-candidate
-      # Stable publication uses the exact npm-v* tag. build.mjs strips the
-      # leading `npm-`/`v`; historical Preview inputs remain only for old
-      # workflow-call compatibility and are not reachable from a public entry.
-      - name: Resolve version
-        id: ver
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          IN_ORCHESTRATED: ${{ inputs.orchestrated }}
-          IN_CHANNEL: ${{ inputs.channel }}
-          IN_BASE_VERSION: ${{ inputs.base_version }}
-          IN_TAG: ${{ inputs.tag }}
-          REF_NAME: ${{ github.ref_name }}
-          RUN_NUMBER: ${{ github.run_number }}
-          IN_PREVIEW_NUMBER: ${{ inputs.preview_number }}
-        run: bash scripts/resolve-npm-release.sh
-      - name: Revalidate approved release ref
-        if: ${{ inputs.orchestrated }}
-        env:
-          RELEASE_TAG: ${{ inputs.approved_cli_tag }}
-          APPROVED_SHA: ${{ inputs.approved_sha }}
-        run: bash scripts/verify-release-tag.sh
-      - name: Publish or recover immutable npm packages
-        if: ${{ inputs.candidate_artifact_name == '' }}
-        env:
-          VERSION_ARG: ${{ steps.ver.outputs.arg }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: node npm/build.mjs "$VERSION_ARG" --publish
-      - name: Publish or recover prepared npm packages
-        if: ${{ inputs.candidate_artifact_name != '' }}
-        env:
-          VERSION: ${{ inputs.base_version }}
-          APPROVED_SHA: ${{ inputs.approved_sha }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: node npm/publish-candidate.mjs "$RUNNER_TEMP/release-candidate/npm" "$VERSION" "$APPROVED_SHA"
-      - name: Align legacy aliases with the official release
-        if: ${{ inputs.channel == 'stable' }}
-        env:
-          VERSION: ${{ inputs.base_version }}
-          APPROVED_SHA: ${{ inputs.approved_sha }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: |
-          set -euo pipefail
-          candidate="$APPROVED_SHA"
-          if [ -z "$candidate" ]; then candidate="$(git rev-parse HEAD)"; fi
-          EXPECTED_SHA="$candidate" node scripts/finalize-npm-official-release.mjs "$VERSION"
@@ -1,379 +0,0 @@
-name: Publish release candidate
-run-name: ${{ inputs.operation }} ${{ inputs.candidate_id }}
-
-on:
-  workflow_dispatch:
-    inputs:
-      candidate_id:
-        description: "Sealed candidate from Prepare release candidate"
-        required: true
-        type: string
-      operation:
-        description: "Publish a new identity or recover an interrupted publication"
-        required: true
-        default: publish
-        type: choice
-        options: [publish, recover]
-
-concurrency:
-  group: stable-release-publication
-  cancel-in-progress: false
-
-permissions:
-  actions: write
-  attestations: read
-  contents: write
-
-jobs:
-  preflight:
-    name: verify sealed candidate before approval
-    if: github.repository == 'esengine/DeepSeek-Reasonix' && github.ref == 'refs/heads/main-v2' && github.ref_protected
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      attestations: read
-      contents: read
-    outputs:
-      tag_actor_id: ${{ steps.identity.outputs.actor_id }}
-      candidate_id: ${{ steps.record.outputs.candidate_id }}
-      version: ${{ steps.record.outputs.version }}
-      source_sha: ${{ steps.record.outputs.source_sha }}
-      producer_run_id: ${{ steps.record.outputs.producer_run_id }}
-      producer_run_attempt: ${{ steps.record.outputs.producer_run_attempt }}
-      candidate_control_sha: ${{ steps.record.outputs.candidate_control_sha }}
-      signing_fingerprint: ${{ steps.record.outputs.signing_fingerprint }}
-      desktop_prefix: ${{ steps.record.outputs.desktop_prefix }}
-      approved_artifact: approved-release-candidate-${{ github.run_id }}-${{ github.run_attempt }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-          ref: ${{ github.sha }}
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: "22"
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          cache: false
-      - name: Validate executable contracts and public access before payload or approval
-        env:
-          CANDIDATE_ID: ${{ inputs.candidate_id }}
-        run: |
-          bash scripts/validate-release-control-plane.sh
-          version="${CANDIDATE_ID#v}"
-          bash scripts/check-release-public-access.sh "${version%%-*}"
-      - name: Resolve candidate record artifact
-        id: artifact
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_REVOKED_CANDIDATES: ${{ vars.RELEASE_REVOKED_CANDIDATES }}
-        run: node scripts/resolve-release-candidate.mjs resolve "${{ inputs.candidate_id }}"
-      - name: Download exact candidate record
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ARTIFACT_ID: ${{ steps.artifact.outputs.record_artifact_id }}
-          PRODUCER_RUN_ID: ${{ steps.artifact.outputs.producer_run_id }}
-        run: |
-          mkdir -p record
-          gh api "repos/${{ github.repository }}/actions/artifacts/$ARTIFACT_ID" > /tmp/record-artifact.json
-          gh api "repos/${{ github.repository }}/actions/runs/$PRODUCER_RUN_ID" > /tmp/producer-run.json
-          gh api "repos/${{ github.repository }}/actions/artifacts/$ARTIFACT_ID/zip" > /tmp/record.zip
-          node scripts/verify-release-artifact-archive.mjs /tmp/record-artifact.json /tmp/record.zip
-          unzip -q /tmp/record.zip -d record
-          test -s record/record.json
-      - name: Verify record provenance and resolve exact payload
-        id: record
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          signer_sha="$(jq -r .head_sha /tmp/producer-run.json)"
-          gh attestation verify record/record.json --repo "$GITHUB_REPOSITORY" \
-            --signer-workflow "$GITHUB_REPOSITORY/.github/workflows/release-candidate.yml" \
-            --signer-digest "$signer_sha" --source-ref refs/heads/main-v2 --deny-self-hosted-runners
-          node scripts/resolve-release-candidate.mjs inspect "${{ inputs.candidate_id }}" \
-            record/record.json /tmp/record-artifact.json /tmp/producer-run.json
-      - name: Check the configured tag publisher before approval
-        id: identity
-        env:
-          GH_TOKEN: ${{ secrets.RELEASE_TAG_TOKEN }}
-          RELEASE_TAG_ACTOR: ${{ vars.RELEASE_TAG_ACTOR }}
-        run: node scripts/verify-release-tag-identity.mjs "${{ steps.record.outputs.version }}"
-      - name: Download exact candidate payload
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PAYLOAD_ID: ${{ steps.record.outputs.payload_artifact_id }}
-        run: |
-          gh api "repos/${{ github.repository }}/actions/artifacts/$PAYLOAD_ID" > /tmp/payload-artifact.json
-          test "$(jq -r .name /tmp/payload-artifact.json)" = "${{ steps.record.outputs.payload_artifact_name }}"
-          test "$(jq -r .expired /tmp/payload-artifact.json)" = false
-          test "$(jq -r .workflow_run.id /tmp/payload-artifact.json)" = "${{ steps.record.outputs.producer_run_id }}"
-          mkdir -p payload
-          gh api "repos/${{ github.repository }}/actions/artifacts/$PAYLOAD_ID/zip" > /tmp/payload.zip
-          node scripts/verify-release-artifact-archive.mjs /tmp/payload-artifact.json /tmp/payload.zip
-          unzip -q /tmp/payload.zip -d payload
-      - name: Verify payload provenance, bytes, source, and operation
-        env:
-          GH_TOKEN: ${{ github.token }}
-          OPERATION: ${{ inputs.operation }}
-          VERSION: ${{ steps.record.outputs.version }}
-          SOURCE_SHA: ${{ steps.record.outputs.source_sha }}
-        run: |
-          set -euo pipefail
-          # One provenance check per payload file; each is a network round trip,
-          # so they run eight at a time and any single failure fails the step.
-          signer_digest="${{ steps.record.outputs.candidate_control_sha }}"
-          find payload -type f -print0 | xargs -0 -P 8 -I{} \
-            gh attestation verify {} --repo "$GITHUB_REPOSITORY" \
-            --signer-workflow "$GITHUB_REPOSITORY/.github/workflows/release-candidate.yml" \
-            --signer-digest "$signer_digest" --source-ref refs/heads/main-v2 \
-            --deny-self-hosted-runners >/dev/null
-          node scripts/release-candidate.mjs verify payload record/record.json >/dev/null
-          git fetch origin main-v2 --tags
-          git merge-base --is-ancestor "$SOURCE_SHA" origin/main-v2
-          git show "$SOURCE_SHA:release-notes/releases.json" > /tmp/catalog.json
-          test "$(sha256sum /tmp/catalog.json | awk '{print $1}')" = "$(jq -r .notes.catalogSha256 record/record.json)"
-          bash scripts/release-candidate-tags.sh check "$OPERATION" "$VERSION" "$SOURCE_SHA"
-          {
-            echo "### Sealed release approval"
-            echo
-            echo "- Candidate: \`${{ inputs.candidate_id }}\`"
-            echo "- Operation: \`$OPERATION\`"
-            echo "- Product SHA: \`$SOURCE_SHA\`"
-            echo "- Candidate record SHA-256: \`$(sha256sum record/record.json | awk '{print $1}')\`"
-            echo "- Notes SHA-256: \`$(jq -r .notes.renderedSha256 record/record.json)\`"
-            echo "- Signing policy: \`$(jq -r .signing.desktopFingerprint record/record.json)\`"
-            echo "- Payload files: \`$(jq '.files | length' record/record.json)\`"
-            echo "- Native acceptance: \`$(jq -r '[.acceptance[] | select(.status == "passed") | .kind] | join(", ")' record/record.json)\`"
-          } >> "$GITHUB_STEP_SUMMARY"
-      - name: Render and bind reviewed release notes
-        run: |
-          worktree="$(mktemp -d "$RUNNER_TEMP/reasonix-notes.XXXXXX")"
-          git worktree add --detach "$worktree" "${{ steps.record.outputs.source_sha }}"
-          node "$worktree/scripts/release-notes.mjs" render --version "v${{ steps.record.outputs.version }}" --output release-notes.md
-          git worktree remove "$worktree"
-          test "$(sha256sum release-notes.md | awk '{print $1}')" = "$(jq -r .notes.renderedSha256 record/record.json)"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: orchestrator-reviewed-release-notes
-          path: release-notes.md
-          if-no-files-found: error
-          retention-days: 1
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: approved-release-candidate-${{ github.run_id }}-${{ github.run_attempt }}
-          path: payload
-          if-no-files-found: error
-          retention-days: 7
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: ${{ steps.record.outputs.desktop_prefix }}-darwin-arm64
-          path: payload/desktop/darwin-arm64
-          if-no-files-found: error
-          retention-days: 7
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: ${{ steps.record.outputs.desktop_prefix }}-darwin-amd64
-          path: payload/desktop/darwin-amd64
-          if-no-files-found: error
-          retention-days: 7
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: ${{ steps.record.outputs.desktop_prefix }}-darwin-universal
-          path: payload/desktop/darwin-universal
-          if-no-files-found: error
-          retention-days: 7
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: ${{ steps.record.outputs.desktop_prefix }}-windows-amd64
-          path: payload/desktop/windows-amd64
-          if-no-files-found: error
-          retention-days: 7
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: ${{ steps.record.outputs.desktop_prefix }}-windows-arm64
-          path: payload/desktop/windows-arm64
-          if-no-files-found: error
-          retention-days: 7
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: ${{ steps.record.outputs.desktop_prefix }}-linux-amd64
-          path: payload/desktop/linux-amd64
-          if-no-files-found: error
-          retention-days: 7
-
-  authorize:
-    name: approve sealed Stable candidate
-    needs: preflight
-    runs-on: ubuntu-latest
-    environment: release
-    permissions:
-      contents: read
-    outputs:
-      version: ${{ needs.preflight.outputs.version }}
-      source_sha: ${{ needs.preflight.outputs.source_sha }}
-    steps:
-      - run: echo "Approved ${{ needs.preflight.outputs.candidate_id }} at ${{ needs.preflight.outputs.source_sha }}"
-
-  activate:
-    name: atomically activate release identity
-    needs: [preflight, authorize]
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-          ref: ${{ github.sha }}
-          persist-credentials: false
-      - name: Create or verify all implementation tags
-        env:
-          GH_TOKEN: ${{ secrets.RELEASE_TAG_TOKEN }}
-          RELEASE_TAG_ACTOR: ${{ vars.RELEASE_TAG_ACTOR }}
-          RELEASE_TAG_ACTOR_ID: ${{ needs.preflight.outputs.tag_actor_id }}
-          OPERATION: ${{ inputs.operation }}
-          VERSION: ${{ needs.preflight.outputs.version }}
-          SOURCE_SHA: ${{ needs.preflight.outputs.source_sha }}
-          CANDIDATE_ID: ${{ needs.preflight.outputs.candidate_id }}
-          RELEASE_REVOKED_CANDIDATES: ${{ vars.RELEASE_REVOKED_CANDIDATES }}
-        run: |
-          set -euo pipefail
-          node scripts/verify-release-tag-identity.mjs "$VERSION"
-          gh auth setup-git --hostname github.com
-          node scripts/resolve-release-candidate.mjs active "$CANDIDATE_ID"
-          git fetch origin main-v2 --tags
-          bash scripts/release-candidate-tags.sh activate "$OPERATION" "$VERSION" "$SOURCE_SHA"
-
-  cli:
-    name: publish CLI and Homebrew from candidate
-    needs: [preflight, activate]
-    uses: ./.github/workflows/release.yml
-    with:
-      tag: v${{ needs.preflight.outputs.version }}
-      approved_cli_tag: v${{ needs.preflight.outputs.version }}
-      approved_sha: ${{ needs.preflight.outputs.source_sha }}
-      orchestrated: true
-      orchestrator: promote
-      candidate_artifact_name: ${{ needs.preflight.outputs.approved_artifact }}
-      candidate_verified: true
-    secrets: inherit
-
-  npm:
-    name: publish npm from candidate
-    needs: [preflight, activate]
-    permissions:
-      contents: read
-      id-token: write
-    uses: ./.github/workflows/release-npm.yml
-    with:
-      channel: stable
-      base_version: ${{ needs.preflight.outputs.version }}
-      tag: npm-v${{ needs.preflight.outputs.version }}
-      approved_cli_tag: v${{ needs.preflight.outputs.version }}
-      approved_sha: ${{ needs.preflight.outputs.source_sha }}
-      orchestrated: true
-      orchestrator: promote
-      candidate_artifact_name: ${{ needs.preflight.outputs.approved_artifact }}
-      candidate_verified: true
-    secrets: inherit
-
-  desktop:
-    name: publish Desktop from candidate
-    needs: [preflight, activate]
-    uses: ./.github/workflows/release-desktop.yml
-    with:
-      channel: stable
-      tag: desktop-v${{ needs.preflight.outputs.version }}
-      approved_cli_tag: v${{ needs.preflight.outputs.version }}
-      approved_sha: ${{ needs.preflight.outputs.source_sha }}
-      orchestrated: true
-      orchestrator: promote
-      signing_preflight_verified: true
-      preflight_artifact_prefix: ${{ needs.preflight.outputs.desktop_prefix }}
-      candidate_id: ${{ needs.preflight.outputs.candidate_id }}
-      candidate_source_run_id: ${{ needs.preflight.outputs.producer_run_id }}
-      candidate_source_run_attempt: ${{ needs.preflight.outputs.producer_run_attempt }}
-      candidate_control_sha: ${{ needs.preflight.outputs.candidate_control_sha }}
-      candidate_signing_fingerprint: ${{ needs.preflight.outputs.signing_fingerprint }}
-      candidate_verified: true
-    secrets: inherit
-
-  postflight:
-    name: verify every public Stable surface
-    timeout-minutes: 45
-    needs: [preflight, cli, npm, desktop]
-    if: ${{ always() && !cancelled() }}
-    runs-on: ubuntu-latest
-    permissions:
-      actions: write
-      contents: write
-    steps:
-      - name: Require every publisher
-        env:
-          CLI_RESULT: ${{ needs.cli.result }}
-          NPM_RESULT: ${{ needs.npm.result }}
-          DESKTOP_RESULT: ${{ needs.desktop.result }}
-        run: |
-          for result in "$CLI_RESULT" "$NPM_RESULT" "$DESKTOP_RESULT"; do test "$result" = success; done
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: "22"
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          cache: false
-      - name: Reconcile public artifacts, owned Pages deployment, and durable ledger
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_REPOSITORY: ${{ github.repository }}
-          RELEASE_VERSION: ${{ needs.preflight.outputs.version }}
-          RELEASE_OPERATION: ${{ inputs.operation }}
-          RELEASE_EXPECTED_SHA: ${{ needs.preflight.outputs.source_sha }}
-          RELEASE_LEDGER_OUTPUT: /tmp/publication-ledger.json
-        run: bash scripts/sync-release-site.sh
-      - name: Upload publication ledger
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: release-publication-ledger-${{ needs.preflight.outputs.candidate_id }}-${{ github.run_attempt }}
-          path: /tmp/publication-ledger.json
-          if-no-files-found: error
-          overwrite: true
-          retention-days: 90
-
-  metrics:
-    name: record publication timing
-    needs: [preflight, authorize, activate, cli, npm, desktop, postflight]
-    if: ${{ always() && !cancelled() }}
-    continue-on-error: true
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-      - name: Record queue, execution, and critical-path evidence
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          gh api "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" > "$RUNNER_TEMP/release-run.json"
-          gh api "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/jobs?filter=all&per_page=100" > "$RUNNER_TEMP/release-jobs.json"
-          node scripts/ci-timings.mjs \
-            --run "$RUNNER_TEMP/release-run.json" \
-            --jobs "$RUNNER_TEMP/release-jobs.json" \
-            --summary "$GITHUB_STEP_SUMMARY" \
-            --output "$RUNNER_TEMP/publication-timing.json" \
-            --title "Release publication timing"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: release-publication-timing-${{ needs.preflight.outputs.candidate_id || github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/publication-timing.json
-          if-no-files-found: ignore
-          overwrite: true
-          retention-days: 90
@@ -1,111 +0,0 @@
-name: Recover release site
-run-name: Recover site v${{ inputs.version }}
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Already-published stable version; no builds or package publication"
-        required: true
-        type: string
-
-concurrency:
-  group: stable-release-publication
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-
-jobs:
-  preflight:
-    if: github.repository == 'esengine/DeepSeek-Reasonix' && github.ref == 'refs/heads/main-v2' && github.ref_protected
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    outputs:
-      source_sha: ${{ steps.identity.outputs.source_sha }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          fetch-depth: 0
-          persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: "22"
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          cache: false
-      - name: Validate executable contracts and public access before approval
-        env:
-          VERSION: ${{ inputs.version }}
-        run: |
-          bash scripts/validate-release-control-plane.sh
-          bash scripts/check-release-public-access.sh "$VERSION"
-      - name: Bind existing public tags to protected history
-        id: identity
-        env:
-          VERSION: ${{ inputs.version }}
-        run: |
-          set -euo pipefail
-          [[ "$VERSION" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]
-          source_sha="$(git rev-parse "refs/tags/v$VERSION^{commit}")"
-          git merge-base --is-ancestor "$source_sha" origin/main-v2
-          bash scripts/release-candidate-tags.sh check recover "$VERSION" "$source_sha"
-          echo "source_sha=$source_sha" >> "$GITHUB_OUTPUT"
-      - name: Re-read public package identities before approval
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_REPOSITORY: ${{ github.repository }}
-          RELEASE_VERSION: ${{ inputs.version }}
-          RELEASE_OPERATION: recover
-          RELEASE_EXPECTED_SHA: ${{ steps.identity.outputs.source_sha }}
-          CLI_TAG: v${{ inputs.version }}
-          DESKTOP_TAG: desktop-v${{ inputs.version }}
-          RELEASE_LEDGER_OUTPUT: ${{ runner.temp }}/site-recovery-preflight.json
-        run: bash scripts/verify-stable-release-artifacts.sh
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: site-recovery-preflight-${{ inputs.version }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/site-recovery-preflight.json
-          retention-days: 90
-          if-no-files-found: error
-
-  sync:
-    needs: preflight
-    environment: release
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    permissions:
-      actions: write
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: "22"
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          cache: false
-      - name: Recover only the website and verify public state again
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_REPOSITORY: ${{ github.repository }}
-          RELEASE_VERSION: ${{ inputs.version }}
-          RELEASE_OPERATION: recover
-          RELEASE_EXPECTED_SHA: ${{ needs.preflight.outputs.source_sha }}
-          RELEASE_SITE_RECOVERY_ONLY: "true"
-          RELEASE_LEDGER_OUTPUT: ${{ runner.temp }}/publication-ledger.json
-        run: bash scripts/sync-release-site.sh
-      - name: Preserve successful or incomplete recovery evidence
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: release-site-recovery-ledger-${{ inputs.version }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/publication-ledger.json
-          retention-days: 90
-          if-no-files-found: error
@@ -1,309 +0,0 @@
-name: Legacy release recovery
-run-name: Legacy recovery ${{ inputs.tag || github.ref_name }}
-
-# Compatibility recovery for releases created before sealed candidates. New
-# releases use release-candidate.yml followed by release-promote.yml. This path
-# retains one GitHub environment gate and verifies all three existing tags.
-# Keeping the control-plane ref on main-v2 lets SignPath restrict
-# production signing to that one protected origin instead of trusting wildcard
-# tag-like branch names. Manual recovery uses the same fixed control plane while
-# preserving an older tagged candidate on main-v2 history.
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "Existing stable CLI tag to recover (for example v1.18.0)"
-        required: true
-        type: string
-      publish_cli:
-        description: "Recover the CLI/Homebrew channel"
-        required: false
-        default: true
-        type: boolean
-      publish_npm:
-        description: "Recover the npm channel"
-        required: false
-        default: true
-        type: boolean
-      publish_desktop:
-        description: "Recover the Desktop/R2 channel"
-        required: false
-        default: true
-        type: boolean
-      allow_recovery:
-        description: "Allow an existing stable tag on main-v2 history (manual recovery only)"
-        required: false
-        default: true
-        type: boolean
-      desktop_manual_only:
-        description: "Approved exception: unsigned Windows, manual Desktop downloads only"
-        required: false
-        default: false
-        type: boolean
-      reuse_manual_artifacts:
-        description: "Recover the verified v1.38.8 artifacts from run 34816299501 (v1.38.8 only)"
-        required: false
-        default: false
-        type: boolean
-
-concurrency:
-  group: stable-release-publication
-  cancel-in-progress: false
-
-# Reusable release workflows can only reduce caller permissions, so the
-# orchestrator grants the union needed by CLI/Desktop publication.
-permissions:
-  actions: write
-  contents: write
-
-jobs:
-  preflight:
-    name: validate stable release set
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-    outputs:
-      version: ${{ steps.release.outputs.version }}
-      cli_tag: ${{ steps.release.outputs.cli_tag }}
-      npm_tag: ${{ steps.release.outputs.npm_tag }}
-      desktop_tag: ${{ steps.release.outputs.desktop_tag }}
-      sha: ${{ steps.release.outputs.sha }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-          # A recovery dispatch uses the fixed workflow/scripts from protected
-          # main-v2. Publishers still check out the immutable approved tag SHA.
-          ref: ${{ github.sha }}
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          cache: true
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: "22"
-      - name: Resolve stable release
-        id: release
-        env:
-          RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
-          ALLOW_STABLE_RECOVERY: ${{ inputs.allow_recovery }}
-        run: bash scripts/resolve-stable-release.sh
-      # scripts/manual-desktop-exception.sh owns which tags may ship without
-      # Windows Authenticode. A tag approved before its candidate exists keeps
-      # the normal candidate and push-CI validation below.
-      - name: Restrict manual Desktop distribution
-        if: ${{ inputs.desktop_manual_only }}
-        run: |
-          bash scripts/manual-desktop-exception.sh validate \
-            "${{ steps.release.outputs.desktop_tag }}" \
-            "${{ steps.release.outputs.sha }}" \
-            "${{ inputs.allow_recovery }}"
-      - name: Revalidate normal release candidate and exact push CI
-        if: ${{ !inputs.allow_recovery }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_REPOSITORY: ${{ github.repository }}
-          RELEASE_CI_WAIT_SECONDS: 60
-          RELEASE_VERSION: ${{ steps.release.outputs.version }}
-          RELEASE_SHA: ${{ steps.release.outputs.sha }}
-        run: |
-          bash scripts/validate-stable-candidate.sh "$RELEASE_VERSION" "$RELEASE_SHA"
-          bash scripts/verify-release-push-ci.sh "$RELEASE_SHA"
-      - name: Validate reviewed release notes
-        run: node scripts/release-notes.mjs render --version "${{ steps.release.outputs.cli_tag }}" --output /tmp/release-notes.md
-      # Recovery builds deliberately check out the immutable tagged candidate,
-      # which can predate its reviewed release-note entry. Carry the exact file
-      # validated by this protected control-plane job into both publishers.
-      - name: Upload reviewed release notes
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: orchestrator-reviewed-release-notes
-          path: /tmp/release-notes.md
-          if-no-files-found: error
-          retention-days: 1
-      - name: Cache hit guard
-        run: ./scripts/cache-guard.sh
-
-  authorize:
-    name: approve stable release
-    needs: preflight
-    runs-on: ubuntu-latest
-    environment: release
-    permissions:
-      contents: read
-    outputs:
-      version: ${{ steps.approved.outputs.version }}
-      cli_tag: ${{ steps.approved.outputs.cli_tag }}
-      npm_tag: ${{ steps.approved.outputs.npm_tag }}
-      desktop_tag: ${{ steps.approved.outputs.desktop_tag }}
-      sha: ${{ steps.approved.outputs.sha }}
-    steps:
-      - name: Record approved release
-        id: approved
-        env:
-          VERSION: ${{ needs.preflight.outputs.version }}
-          CLI_TAG: ${{ needs.preflight.outputs.cli_tag }}
-          NPM_TAG: ${{ needs.preflight.outputs.npm_tag }}
-          DESKTOP_TAG: ${{ needs.preflight.outputs.desktop_tag }}
-          RELEASE_SHA: ${{ needs.preflight.outputs.sha }}
-        run: |
-          {
-            echo "version=$VERSION"
-            echo "cli_tag=$CLI_TAG"
-            echo "npm_tag=$NPM_TAG"
-            echo "desktop_tag=$DESKTOP_TAG"
-            echo "sha=$RELEASE_SHA"
-          } >> "$GITHUB_OUTPUT"
-          echo "Approved stable release $VERSION at $RELEASE_SHA"
-
-  cli:
-    name: publish CLI and Homebrew
-    needs: [authorize, signpath-preflight]
-    if: ${{ always() && !cancelled() && needs.authorize.result == 'success' && (needs.signpath-preflight.result == 'success' || needs.signpath-preflight.result == 'skipped') && (github.event_name != 'workflow_dispatch' || inputs.publish_cli) }}
-    uses: ./.github/workflows/release.yml
-    with:
-      tag: ${{ needs.authorize.outputs.cli_tag }}
-      approved_cli_tag: ${{ needs.authorize.outputs.cli_tag }}
-      approved_sha: ${{ needs.authorize.outputs.sha }}
-      orchestrated: true
-    secrets: inherit
-
-  npm:
-    name: publish npm
-    needs: [authorize, signpath-preflight]
-    if: ${{ always() && !cancelled() && needs.authorize.result == 'success' && (needs.signpath-preflight.result == 'success' || needs.signpath-preflight.result == 'skipped') && (github.event_name != 'workflow_dispatch' || inputs.publish_npm) }}
-    # A reusable workflow only receives permissions the caller grants here.
-    permissions:
-      contents: read
-      id-token: write
-    uses: ./.github/workflows/release-npm.yml
-    with:
-      channel: stable
-      base_version: ${{ needs.authorize.outputs.version }}
-      tag: ${{ needs.authorize.outputs.npm_tag }}
-      approved_cli_tag: ${{ needs.authorize.outputs.cli_tag }}
-      approved_sha: ${{ needs.authorize.outputs.sha }}
-      orchestrated: true
-    secrets: inherit
-
-  signpath-preflight:
-    name: verify stable SignPath control plane
-    needs: authorize
-    if: ${{ github.event_name != 'workflow_dispatch' || inputs.publish_desktop }}
-    uses: ./.github/workflows/release-desktop.yml
-    with:
-      channel: stable
-      tag: ${{ needs.authorize.outputs.desktop_tag }}
-      approved_cli_tag: ${{ needs.authorize.outputs.cli_tag }}
-      approved_sha: ${{ needs.authorize.outputs.sha }}
-      orchestrated: true
-      signing_preflight: true
-      desktop_manual_only: ${{ inputs.desktop_manual_only || false }}
-      reuse_manual_artifacts: ${{ inputs.reuse_manual_artifacts || false }}
-    secrets: inherit
-
-  desktop:
-    name: publish desktop
-    needs: [authorize, signpath-preflight]
-    if: ${{ always() && !cancelled() && needs.authorize.result == 'success' && needs.signpath-preflight.result == 'success' && (github.event_name != 'workflow_dispatch' || inputs.publish_desktop) }}
-    uses: ./.github/workflows/release-desktop.yml
-    with:
-      channel: stable
-      tag: ${{ needs.authorize.outputs.desktop_tag }}
-      approved_cli_tag: ${{ needs.authorize.outputs.cli_tag }}
-      approved_sha: ${{ needs.authorize.outputs.sha }}
-      orchestrated: true
-      signing_preflight_verified: true
-      desktop_manual_only: ${{ inputs.desktop_manual_only || false }}
-      reuse_manual_artifacts: ${{ inputs.reuse_manual_artifacts || false }}
-      preflight_artifact_prefix: ${{ needs.signpath-preflight.outputs.artifact_prefix }}
-    secrets: inherit
-
-  postflight:
-    name: verify stable release artifacts
-    needs: [authorize, cli, npm, desktop]
-    if: ${{ always() && !cancelled() }}
-    runs-on: ubuntu-latest
-    permissions:
-      actions: write
-      contents: write
-    steps:
-      - name: Require every publisher to succeed
-        env:
-          PUBLISH_CLI: ${{ github.event_name != 'workflow_dispatch' || inputs.publish_cli }}
-          PUBLISH_NPM: ${{ github.event_name != 'workflow_dispatch' || inputs.publish_npm }}
-          PUBLISH_DESKTOP: ${{ github.event_name != 'workflow_dispatch' || inputs.publish_desktop }}
-          CLI_RESULT: ${{ needs.cli.result }}
-          NPM_RESULT: ${{ needs.npm.result }}
-          DESKTOP_RESULT: ${{ needs.desktop.result }}
-        run: |
-          set -euo pipefail
-          for channel in cli npm desktop; do
-            selected_var="PUBLISH_${channel^^}"
-            result_var="${channel^^}_RESULT"
-            selected="${!selected_var}"
-            result="${!result_var}"
-            if [ "$selected" != "true" ]; then
-              echo "$channel recovery skipped; public postflight will still verify it"
-              continue
-            fi
-            if [ "$result" != "success" ]; then
-              echo "::error::$channel stable publisher result is $result, expected success"
-              exit 1
-            fi
-          done
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          # Postflight belongs to the trusted control plane, not the old build
-          # candidate, which may predate this verifier.
-          ref: ${{ github.sha }}
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: "22"
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          cache: false
-      - name: Verify public artifacts and npm latest
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_REPOSITORY: ${{ github.repository }}
-          RELEASE_VERSION: ${{ needs.authorize.outputs.version }}
-          CLI_TAG: ${{ needs.authorize.outputs.cli_tag }}
-          DESKTOP_TAG: ${{ needs.authorize.outputs.desktop_tag }}
-          DESKTOP_MANUAL_ONLY: ${{ inputs.desktop_manual_only || false }}
-        run: bash scripts/verify-stable-release-artifacts.sh
-      - name: Publish exact Stable release record
-        env:
-          GH_TOKEN: ${{ github.token }}
-          VERSION: ${{ needs.authorize.outputs.version }}
-          CLI_TAG: ${{ needs.authorize.outputs.cli_tag }}
-          RELEASE_SHA: ${{ needs.authorize.outputs.sha }}
-        run: |
-          set -euo pipefail
-          if ! node -e '
-            const catalog = require("./release-notes/releases.json");
-            const release = catalog.releases.find((item) => item.version === process.env.VERSION);
-            process.exit(release?.status === "reviewed" ? 0 : 1);
-          '; then
-            echo "Legacy Stable notes do not require a publication marker"
-            exit 0
-          fi
-          node scripts/release-event.mjs generate \
-            --version "$VERSION" --sha "$RELEASE_SHA" \
-            --published-at "$(gh api "repos/${{ github.repository }}/releases/tags/$CLI_TAG" --jq .published_at)" \
-            --output /tmp/release-event.json
-          existing="$(mktemp -d)"
-          if gh release download "$CLI_TAG" --pattern release-event.json --dir "$existing" 2>/dev/null; then
-            cmp -s /tmp/release-event.json "$existing/release-event.json" || {
-              echo "::error::published release-event.json differs from the approved Stable event"
-              exit 1
-            }
-          else
-            gh release upload "$CLI_TAG" /tmp/release-event.json
-          fi
-      - name: Refresh public changelog
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: gh workflow run pages.yml --ref main-v2
@@ -1,62 +0,0 @@
-name: Request verification on released issues
-
-# A PR that writes "Fixes #N" auto-closes its issue on merge. One that writes
-# "Refs"/"Related"/"Addresses" does not, so the report stays open waiting for a
-# follow-up nobody remembers to send after the release. This sends it.
-
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: Release tag to announce (e.g. desktop-v1.18.0)
-        required: true
-        type: string
-      dry_run:
-        description: Print the targets without commenting
-        required: false
-        default: true
-        type: boolean
-  release:
-    types: [published]
-  push:
-    branches:
-      - main-v2
-    paths:
-      - '.github/workflows/release-verify-issues.yml'
-      - 'scripts/release-verify-issues.mjs'
-      - 'scripts/release-verify-issues.test.mjs'
-
-permissions:
-  contents: read
-  issues: write
-
-concurrency:
-  group: release-verify-issues-${{ github.event.inputs.tag || github.event.release.tag_name || github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  notify:
-    if: github.repository == 'esengine/DeepSeek-Reasonix'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: '22'
-      - name: Test notifier
-        run: node --test scripts/release-verify-issues.test.mjs
-      # A push that only touched the script has no release to announce; the test
-      # above is the whole point of that trigger.
-      - name: Request verification
-        if: github.event_name != 'push'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TAG: ${{ github.event.inputs.tag || github.event.release.tag_name }}
-          DRY_RUN: ${{ github.event.inputs.dry_run || 'false' }}
-        run: |
-          set -euo pipefail
-          args=(--tag "$TAG")
-          if [ "$DRY_RUN" = "true" ]; then args+=(--dry-run); fi
-          node scripts/release-verify-issues.mjs "${args[@]}"
@@ -1,39 +0,0 @@
-name: Verify release
-run-name: Verify v${{ inputs.version }}
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Official version without a tag prefix"
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-jobs:
-  verify:
-    name: verify immutable files and public pointers
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: "22"
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          cache: false
-      - name: Verify public release
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_REPOSITORY: ${{ github.repository }}
-          RELEASE_VERSION: ${{ inputs.version }}
-          RELEASE_OPERATION: recover
-          CLI_TAG: v${{ inputs.version }}
-          DESKTOP_TAG: desktop-v${{ inputs.version }}
-          VERIFY_HOMEPAGE: "true"
-        run: bash scripts/verify-stable-release-artifacts.sh
@@ -1,636 +0,0 @@
-name: Release
-
-# Native CLI binary line. Official releases are called by the protected Stable
-# orchestrator. Manual dispatch remains available only for official recovery;
-# historical Preview inputs below are workflow-call compatibility, not a public
-# publication entrypoint.
-on:
-  workflow_dispatch:
-    inputs:
-      channel:
-        description: "Standalone CLI recovery channel"
-        required: true
-        default: stable
-        type: choice
-        options: [stable]
-      tag:
-        description: "Existing official CLI tag (for example v1.18.0)"
-        required: true
-        type: string
-  workflow_call:
-    inputs:
-      channel:
-        description: "Native CLI release channel selected by the approved orchestrator"
-        required: false
-        default: stable
-        type: string
-      tag:
-        description: "Existing CLI tag selected by the approved release orchestrator"
-        required: true
-        type: string
-      approved_cli_tag:
-        description: "Stable CLI tag recorded by the approved orchestrator"
-        required: true
-        type: string
-      approved_sha:
-        description: "Immutable commit recorded by the approved orchestrator"
-        required: true
-        type: string
-      orchestrated:
-        description: "True only when called by an approved release orchestrator"
-        required: false
-        default: false
-        type: boolean
-      orchestrator:
-        description: "Trusted release orchestrator (legacy Preview calls remain readable)"
-        required: false
-        default: stable
-        type: string
-      allow_preview_recovery:
-        description: "Legacy compatibility for already-created Preview runs"
-        required: false
-        default: false
-        type: boolean
-      candidate_artifact_name:
-        description: "Same-run artifact containing a verified sealed release candidate"
-        required: false
-        default: ""
-        type: string
-      candidate_verified:
-        description: "Protected Stable preflight verified candidate provenance and bytes"
-        required: false
-        default: false
-        type: boolean
-
-permissions:
-  contents: write # create the release and upload archives
-
-concurrency:
-  # A channel pointer is a monotonic public state machine. Serialize all
-  # publishers for the same channel so an older recovery run cannot pass its
-  # read-before-write window after a newer release has published.
-  group: release-cli-${{ inputs.channel || 'stable' }}
-  cancel-in-progress: false
-
-jobs:
-  resolve:
-    name: resolve CLI release
-    runs-on: ubuntu-latest
-    outputs:
-      tag: ${{ steps.release.outputs.tag }}
-      version: ${{ steps.release.outputs.version }}
-      base_version: ${{ steps.release.outputs.base_version }}
-      notes_version: ${{ steps.release.outputs.notes_version }}
-      channel: ${{ steps.release.outputs.channel }}
-      prerelease: ${{ steps.release.outputs.prerelease }}
-      sha: ${{ steps.candidate.outputs.sha }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-          ref: ${{ github.sha }}
-      - name: Resolve channel and tag
-        id: release
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          IN_ORCHESTRATED: ${{ inputs.orchestrated }}
-          IN_CHANNEL: ${{ inputs.channel }}
-          IN_TAG: ${{ inputs.tag }}
-          REF_NAME: ${{ github.ref_name }}
-          CALLER_REF: ${{ github.ref }}
-          CALLER_REF_PROTECTED: ${{ github.ref_protected }}
-        run: bash scripts/resolve-cli-release.sh
-      - name: Record immutable candidate
-        id: candidate
-        env:
-          RELEASE_TAG: ${{ steps.release.outputs.tag }}
-          RELEASE_CHANNEL: ${{ steps.release.outputs.channel }}
-          IN_ORCHESTRATED: ${{ inputs.orchestrated }}
-          IN_ORCHESTRATOR: ${{ inputs.orchestrator }}
-          ALLOW_PREVIEW_RECOVERY: ${{ inputs.allow_preview_recovery }}
-        run: |
-          set -euo pipefail
-          git fetch origin main-v2
-          sha="$(git rev-parse "$RELEASE_TAG^{commit}")"
-          if ! git merge-base --is-ancestor "$sha" origin/main-v2; then
-            echo "::error::$RELEASE_TAG points to $sha, which is not on main-v2 history"
-            exit 1
-          fi
-          if [ "$ALLOW_PREVIEW_RECOVERY" = "true" ]; then
-            if [ "$IN_ORCHESTRATED" != "true" ] || [ "$IN_ORCHESTRATOR" != "preview" ] || [ "$RELEASE_CHANNEL" != "preview" ]; then
-              echo "::error::Preview recovery requires the approved Preview orchestrator"
-              exit 1
-            fi
-          elif [ "$RELEASE_CHANNEL" = "preview" ] && [ "$sha" != "$(git rev-parse origin/main-v2)" ]; then
-              echo "::error::CLI Preview must tag current main-v2; $RELEASE_TAG points to $sha"
-              exit 1
-          fi
-          echo "sha=$sha" >> "$GITHUB_OUTPUT"
-      - name: Verify existing protected tag
-        env:
-          RELEASE_TAG: ${{ steps.release.outputs.tag }}
-          APPROVED_SHA: ${{ steps.candidate.outputs.sha }}
-          VERIFY_RELEASE_CHECKOUT: false
-        run: bash scripts/verify-release-tag.sh
-
-  orchestration-guard:
-    name: verify approved orchestrator
-    needs: resolve
-    if: ${{ inputs.orchestrated }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-          ref: ${{ github.sha }}
-      - name: Verify caller and approved release ref
-        env:
-          ACTUAL_CALLER_WORKFLOW_REF: ${{ github.workflow_ref }}
-          EXPECTED_CALLER_WORKFLOW_REF: ${{ format('{0}/.github/workflows/release-{1}.yml@{2}', github.repository, inputs.orchestrator, github.ref) }}
-          CALLER_EVENT_NAME: ${{ github.event_name }}
-          CALLER_REF: ${{ github.ref }}
-          CALLER_REF_PROTECTED: ${{ github.ref_protected }}
-          CALLER_WORKFLOW_SHA: ${{ github.workflow_sha }}
-          CALLER_SHA: ${{ github.sha }}
-          APPROVED_CLI_TAG: ${{ inputs.approved_cli_tag }}
-          APPROVED_SHA: ${{ inputs.approved_sha }}
-          APPROVED_CHANNEL: ${{ inputs.orchestrator == 'promote' && 'stable' || inputs.orchestrator }}
-          RELEASE_TAG: ${{ inputs.tag }}
-          VERIFY_RELEASE_CHECKOUT: false
-        run: |
-          bash scripts/verify-release-authorization.sh
-          bash scripts/verify-release-tag.sh
-          if [ -n "${{ inputs.candidate_artifact_name }}" ] && [ "${{ inputs.candidate_verified }}" != "true" ]; then
-            echo "::error::prepared CLI artifacts require verified candidate provenance"
-            exit 1
-          fi
-
-  release-gate:
-    name: approve standalone CLI release
-    needs: resolve
-    if: ${{ !inputs.orchestrated }}
-    runs-on: ubuntu-latest
-    environment: release
-    steps:
-      - env:
-          RELEASE_TAG: ${{ needs.resolve.outputs.tag }}
-          RELEASE_CHANNEL: ${{ needs.resolve.outputs.channel }}
-        run: echo "Approved standalone CLI $RELEASE_CHANNEL release $RELEASE_TAG"
-
-  cache-guard:
-    name: cache hit guard
-    needs: [resolve, orchestration-guard, release-gate]
-    if: ${{ always() && !cancelled() && needs.resolve.result == 'success' && ((inputs.orchestrated && needs.orchestration-guard.result == 'success') || (!inputs.orchestrated && needs.release-gate.result == 'success')) }}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ needs.resolve.outputs.sha }}
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        if: ${{ !inputs.candidate_verified }}
-        with:
-          go-version-file: go.mod
-          cache: true
-      - if: ${{ !inputs.candidate_verified }}
-        run: ./scripts/cache-guard.sh
-      - name: Verify embedded documentation identity
-        if: ${{ !inputs.candidate_verified }}
-        env:
-          DOCS_BUILD_VERSION: ${{ needs.resolve.outputs.tag }}
-          DOCS_SOURCE_REVISION: ${{ needs.resolve.outputs.sha }}
-        run: |
-          if [ ! -f scripts/verify-embedded-docs.sh ]; then
-            echo "Legacy candidate predates the embedded docs contract; skipping."
-            exit 0
-          fi
-          bash scripts/verify-embedded-docs.sh "$DOCS_BUILD_VERSION" "$DOCS_SOURCE_REVISION"
-
-  goreleaser:
-    name: archives + checksums + homebrew tap
-    needs: [resolve, cache-guard]
-    if: ${{ always() && !cancelled() && needs.cache-guard.result == 'success' }}
-    runs-on: ubuntu-latest
-    # The Stable caller has already passed the single GitHub release approval.
-    # Official standalone recovery passes release-gate above. This job therefore
-    # must not add a second GitHub environment approval.
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-          ref: ${{ needs.resolve.outputs.sha }}
-      # Recovery may build an immutable tag that predates the current recovery
-      # policy. Keep product sources pinned above, but execute publication
-      # decisions from the protected workflow commit.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-          path: release-control
-          ref: ${{ github.workflow_sha }}
-      - name: Isolate release-control checkout from product git state
-        run: |
-          set -euo pipefail
-          git_common_dir="$(git rev-parse --path-format=absolute --git-common-dir)"
-          exclude_file="$git_common_dir/info/exclude"
-          if ! grep -qxF '/release-control/' "$exclude_file"; then
-            printf '%s\n' '/release-control/' >> "$exclude_file"
-          fi
-          git check-ignore -q release-control/
-          dirty="$(git status --porcelain --untracked-files=all)"
-          if [ -n "$dirty" ]; then
-            printf 'product checkout is dirty before release:\n%s\n' "$dirty" >&2
-            exit 1
-          fi
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          cache: true
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: "22"
-      - name: Download sealed release candidate
-        if: ${{ inputs.candidate_artifact_name != '' }}
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: ${{ inputs.candidate_artifact_name }}
-          path: ${{ runner.temp }}/release-candidate
-      - name: Verify prepared CLI checksums
-        if: ${{ inputs.candidate_artifact_name != '' }}
-        working-directory: ${{ runner.temp }}/release-candidate/cli
-        run: sha256sum -c SHA256SUMS
-      - name: Download orchestrator-reviewed release notes
-        if: ${{ inputs.orchestrated }}
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: orchestrator-reviewed-release-notes
-          path: /tmp/orchestrator-reviewed-release-notes
-      - name: Use orchestrator-reviewed release notes
-        if: ${{ inputs.orchestrated }}
-        run: |
-          test -s /tmp/orchestrator-reviewed-release-notes/release-notes.md
-          cp /tmp/orchestrator-reviewed-release-notes/release-notes.md /tmp/release-notes.md
-      - name: Render reviewed release notes
-        if: ${{ !inputs.orchestrated }}
-        env:
-          RELEASE_TAG: ${{ needs.resolve.outputs.notes_version }}
-        run: node scripts/release-notes.mjs render --version "$RELEASE_TAG" --output /tmp/release-notes.md
-      - name: Revalidate approved release ref
-        env:
-          RELEASE_TAG: ${{ needs.resolve.outputs.tag }}
-          APPROVED_SHA: ${{ needs.resolve.outputs.sha }}
-        run: bash scripts/verify-release-tag.sh
-      - name: Decide whether CLI artifacts need publication
-        id: publication
-        env:
-          GH_TOKEN: ${{ github.token }}
-          TAG: ${{ needs.resolve.outputs.tag }}
-          CHANNEL: ${{ needs.resolve.outputs.channel }}
-          PRERELEASE: ${{ needs.resolve.outputs.prerelease }}
-        run: |
-          set -euo pipefail
-          validation_channel="$CHANNEL"
-          if [ "$CHANNEL" = "stable" ] && [ "$PRERELEASE" = "true" ]; then
-            validation_channel=any
-          fi
-          release_json=/tmp/existing-cli-release.json
-          release_error=/tmp/existing-cli-release.error
-          checksums=/tmp/existing-cli-release-SHA256SUMS
-          if gh api "repos/${{ github.repository }}/releases/tags/$TAG" \
-            >"$release_json" 2>"$release_error"; then
-            gh release download "$TAG" -R "${{ github.repository }}" \
-              --pattern SHA256SUMS --output "$checksums"
-            decision="$(
-              bash release-control/scripts/decide-cli-release-publication.sh \
-                "$validation_channel" "$TAG" "${{ github.repository }}" \
-                "$release_json" "$checksums"
-            )"
-            if [ -n "${{ inputs.candidate_artifact_name }}" ]; then
-              cmp -s "$checksums" "$RUNNER_TEMP/release-candidate/cli/SHA256SUMS" || {
-                echo "::error::existing CLI release differs from the sealed candidate"
-                exit 1
-              }
-            fi
-            echo "existing CLI release $TAG is complete and checksum-bound; reusing it"
-          elif grep -Eiq 'HTTP 404|Not Found' "$release_error"; then
-            decision="$(
-              bash release-control/scripts/decide-cli-release-publication.sh \
-                "$validation_channel" "$TAG" "${{ github.repository }}" - -
-            )"
-            echo "CLI release $TAG does not exist; GoReleaser will publish it"
-          else
-            cat "$release_error" >&2
-            exit 1
-          fi
-          test "$decision" = "publish" -o "$decision" = "reuse"
-          echo "decision=$decision" >> "$GITHUB_OUTPUT"
-      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
-        if: ${{ steps.publication.outputs.decision == 'publish' && inputs.candidate_artifact_name == '' }}
-        with:
-          version: '~> v2'
-          args: release --clean
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          HOMEBREW_TAP_TOKEN: ${{ needs.resolve.outputs.channel == 'stable' && secrets.HOMEBREW_TAP_TOKEN || '' }}
-          # workflow_dispatch recovery runs have a branch-shaped GITHUB_REF even
-          # though checkout is on the release tag. Pin GoReleaser explicitly, and
-          # avoid ambiguity from the three release tags sharing one commit.
-          GORELEASER_CURRENT_TAG: ${{ needs.resolve.outputs.tag }}
-
-      - name: Publish prepared CLI archives
-        if: ${{ steps.publication.outputs.decision == 'publish' && inputs.candidate_artifact_name != '' }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          TAG: ${{ needs.resolve.outputs.tag }}
-        run: |
-          gh release create "$TAG" \
-            "$RUNNER_TEMP/release-candidate/cli/reasonix-darwin-amd64.tar.gz" \
-            "$RUNNER_TEMP/release-candidate/cli/reasonix-darwin-arm64.tar.gz" \
-            "$RUNNER_TEMP/release-candidate/cli/reasonix-linux-amd64.tar.gz" \
-            "$RUNNER_TEMP/release-candidate/cli/reasonix-linux-arm64.tar.gz" \
-            "$RUNNER_TEMP/release-candidate/cli/reasonix-windows-amd64.zip" \
-            "$RUNNER_TEMP/release-candidate/cli/reasonix-windows-arm64.zip" \
-            "$RUNNER_TEMP/release-candidate/cli/SHA256SUMS" \
-            --title "Reasonix CLI $TAG" --notes-file /tmp/release-notes.md --latest=false
-
-      - name: Publish prepared Homebrew cask
-        if: ${{ inputs.candidate_artifact_name != '' && needs.resolve.outputs.channel == 'stable' }}
-        env:
-          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
-        run: node release-control/scripts/publish-homebrew-cask.mjs "$RUNNER_TEMP/release-candidate/cli/reasonix.rb"
-
-      - name: Publish product release notes
-        env:
-          GH_TOKEN: ${{ github.token }}
-          TAG: ${{ needs.resolve.outputs.tag }}
-        run: gh release edit "$TAG" --notes-file /tmp/release-notes.md
-
-      - name: Publish CLI release metadata to R2
-        env:
-          GH_TOKEN: ${{ github.token }}
-          TAG: ${{ needs.resolve.outputs.tag }}
-          NOTES_TAG: ${{ needs.resolve.outputs.notes_version }}
-          HAS_R2: ${{ secrets.R2_ACCESS_KEY_ID != '' && secrets.R2_SECRET_ACCESS_KEY != '' && secrets.R2_ACCOUNT_ID != '' && secrets.R2_BUCKET != '' }}
-          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: auto
-          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
-          R2_BUCKET: ${{ secrets.R2_BUCKET }}
-        run: |
-          set -euo pipefail
-          if [ "$HAS_R2" != "true" ]; then
-            echo "R2 secrets not configured; skipping CLI release metadata"
-            exit 0
-          fi
-
-          channel=""
-          if [[ "$TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
-            channel="stable"
-          elif [[ "$TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)-preview\.(0|[1-9][0-9]*)$ ]]; then
-            channel="preview"
-          else
-            echo "internal CLI release $TAG; publishing only immutable metadata"
-          fi
-
-          required_assets='[
-            "reasonix-darwin-amd64.tar.gz",
-            "reasonix-darwin-arm64.tar.gz",
-            "reasonix-linux-amd64.tar.gz",
-            "reasonix-linux-arm64.tar.gz",
-            "reasonix-windows-amd64.zip",
-            "reasonix-windows-arm64.zip",
-            "SHA256SUMS"
-          ]'
-          gh api "repos/${{ github.repository }}/releases/tags/$TAG" > /tmp/cli-release.raw.json
-          jq --arg tag "$TAG" --arg notes_tag "$NOTES_TAG" --argjson required "$required_assets" '
-            if .tag_name != $tag then error("release tag mismatch") else . end |
-            if .draft then error("draft release cannot be published") else . end |
-            . as $release |
-            ($release.assets | map({key: .name, value: .}) | from_entries) as $assets |
-            if ($required | all(. as $name | $assets[$name] != null))
-            then {
-              tag_name: $release.tag_name,
-              prerelease: $release.prerelease,
-              html_url: $release.html_url,
-              release_notes_url: ("https://reasonix.io/changelog/" + $notes_tag + "/"),
-              assets: [
-                $required[] as $name |
-                $assets[$name] |
-                {
-                  name: .name,
-                  browser_download_url: .browser_download_url,
-                  size: .size
-                }
-              ]
-            }
-            else error("release is missing one or more required CLI assets")
-            end
-          ' /tmp/cli-release.raw.json > /tmp/cli-release.json
-          if [ -n "$channel" ]; then
-            bash scripts/validate-cli-release-manifest.sh \
-              "$channel" "$TAG" "${{ github.repository }}" /tmp/cli-release.json "$NOTES_TAG"
-          else
-            bash scripts/validate-cli-release-manifest.sh \
-              any "$TAG" "${{ github.repository }}" /tmp/cli-release.json "$NOTES_TAG"
-          fi
-
-          endpoint="https://${R2_ACCOUNT_ID}.r2.cloudflarestorage.com"
-          validation_channel="${channel:-any}"
-          immutable_key="cli/releases/${TAG}/latest.json"
-          immutable_error="$(mktemp)"
-          if aws s3 cp "s3://${R2_BUCKET}/${immutable_key}" /tmp/cli-release.immutable.json \
-            --endpoint-url "$endpoint" 2>"$immutable_error"; then
-            bash scripts/validate-cli-release-manifest.sh \
-              "legacy-${validation_channel}" "$TAG" "${{ github.repository }}" \
-              /tmp/cli-release.immutable.json "$NOTES_TAG"
-            if ! bash scripts/compare-cli-release-manifests.sh \
-              /tmp/cli-release.json /tmp/cli-release.immutable.json; then
-              echo "::error::immutable CLI release metadata for $TAG already exists with different content"
-              exit 1
-            fi
-            echo "immutable CLI release metadata for $TAG already exists; preserving it"
-          elif grep -Eiq '404|NoSuchKey|Not Found' "$immutable_error"; then
-            aws s3 cp /tmp/cli-release.json "s3://${R2_BUCKET}/${immutable_key}" \
-              --endpoint-url "$endpoint" \
-              --content-type "application/json; charset=utf-8" \
-              --cache-control "public, max-age=31536000, immutable"
-          else
-            cat "$immutable_error" >&2
-            exit 1
-          fi
-          rm -f "$immutable_error"
-
-          aws s3 cp "s3://${R2_BUCKET}/${immutable_key}" /tmp/cli-release.immutable.json \
-            --endpoint-url "$endpoint"
-          bash scripts/validate-cli-release-manifest.sh \
-            "legacy-${validation_channel}" "$TAG" "${{ github.repository }}" \
-            /tmp/cli-release.immutable.json "$NOTES_TAG"
-          bash scripts/compare-cli-release-manifests.sh \
-            /tmp/cli-release.json /tmp/cli-release.immutable.json
-
-          if [ -z "$channel" ]; then
-            echo "internal CLI release $TAG; Stable and Preview pointers remain unchanged"
-            exit 0
-          fi
-
-          current_tag=""
-          pointer_error="$(mktemp)"
-          if aws s3 cp "s3://${R2_BUCKET}/cli/${channel}/latest.json" /tmp/cli-release.pointer.json \
-            --endpoint-url "$endpoint" 2>"$pointer_error"; then
-            current_tag="$(jq -er '.tag_name | strings' /tmp/cli-release.pointer.json)"
-            bash scripts/validate-cli-release-manifest.sh \
-              "legacy-${channel}" "$current_tag" "${{ github.repository }}" \
-              /tmp/cli-release.pointer.json "$current_tag"
-          elif grep -Eiq '404|NoSuchKey|Not Found' "$pointer_error"; then
-            echo "CLI $channel pointer does not exist yet"
-          else
-            cat "$pointer_error" >&2
-            exit 1
-          fi
-          rm -f "$pointer_error"
-
-          pointer_manifest=-
-          if [ -n "$current_tag" ]; then
-            pointer_manifest=/tmp/cli-release.pointer.json
-          fi
-          pointer_decision="$(
-            bash scripts/decide-cli-pointer-update.sh \
-              "$channel" /tmp/cli-release.json "$pointer_manifest"
-          )"
-          if [ "$pointer_decision" = "skip" ]; then
-            echo "CLI $channel pointer remains ${current_tag:-unset}; candidate $TAG is not newer and needs no repair"
-            exit 0
-          fi
-          aws s3 cp /tmp/cli-release.json "s3://${R2_BUCKET}/cli/${channel}/latest.json" \
-            --endpoint-url "$endpoint" \
-            --content-type "application/json; charset=utf-8" \
-            --cache-control "public, max-age=300, stale-if-error=86400"
-
-          aws s3 cp "s3://${R2_BUCKET}/cli/${channel}/latest.json" /tmp/cli-release.pointer.json \
-            --endpoint-url "$endpoint"
-          bash scripts/validate-cli-release-manifest.sh \
-            "$channel" "$TAG" "${{ github.repository }}" \
-            /tmp/cli-release.pointer.json "$NOTES_TAG"
-          cmp -s /tmp/cli-release.json /tmp/cli-release.pointer.json
-          echo "CLI $channel pointer -> $TAG"
-
-      - name: Attach desktop manifest compatibility asset
-        env:
-          GH_TOKEN: ${{ github.token }}
-          TAG: ${{ needs.resolve.outputs.tag }}
-          HAS_R2: ${{ secrets.R2_ACCESS_KEY_ID != '' && secrets.R2_SECRET_ACCESS_KEY != '' && secrets.R2_ACCOUNT_ID != '' && secrets.R2_BUCKET != '' }}
-          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
-          R2_BUCKET: ${{ secrets.R2_BUCKET }}
-        run: |
-          set -euo pipefail
-          case "$TAG" in
-            *-*)
-              echo "prerelease $TAG — GitHub latest does not move here; skipping desktop manifest compatibility asset"
-              exit 0
-              ;;
-          esac
-          if [ "$HAS_R2" != "true" ]; then
-            echo "R2 secrets not configured; skipping desktop manifest compatibility asset"
-            exit 0
-          fi
-          # dl.reasonix.io serves 403 to GitHub Actions egress IPs (Cloudflare bot
-          # protection), so read the manifest over the authenticated S3 API instead
-          # of the public edge.
-          aws configure set aws_access_key_id "${{ secrets.R2_ACCESS_KEY_ID }}"
-          aws configure set aws_secret_access_key "${{ secrets.R2_SECRET_ACCESS_KEY }}"
-          aws configure set region auto
-          aws s3 cp "s3://${R2_BUCKET}/latest/latest.json" latest.raw.json \
-            --endpoint-url "https://${R2_ACCOUNT_ID}.r2.cloudflarestorage.com"
-          jq '.download_page = "https://reasonix.io/?download=desktop#start"' latest.raw.json > latest.json
-          jq -e '
-            ([.platforms[] | (.url, .sig)] |
-              all(type == "string" and startswith("https://dl.reasonix.io/") and (contains("/releases/latest/") | not)))
-          ' latest.json >/dev/null
-          gh release upload "$TAG" latest.json --clobber
-
-      # The compatibility asset exists for pre-v1.16 desktop updaters that
-      # still poll GitHub's repository-wide latest URL. Desktop releases now
-      # own that Latest badge, but this check still exercises the public fallback
-      # path exactly the way those clients fetch it: anonymously, over the public
-      # edge, with a Go client UA. Unlike dl.reasonix.io (whose bot protection
-      # 403s Actions egress — see the R2 note above), GitHub serves its own
-      # runners, so this can hard-fail. #5826/#5858 shipped a broken update check
-      # for weeks precisely because nothing exercised the public path. Retries
-      # cover the release CDN propagating the freshly uploaded asset.
-      - name: Smoke public compatibility manifest
-        env:
-          TAG: ${{ needs.resolve.outputs.tag }}
-          HAS_R2: ${{ secrets.R2_ACCESS_KEY_ID != '' && secrets.R2_SECRET_ACCESS_KEY != '' && secrets.R2_ACCOUNT_ID != '' && secrets.R2_BUCKET != '' }}
-        run: |
-          set -euo pipefail
-          case "$TAG" in
-            *-*)
-              echo "prerelease $TAG — no compatibility asset uploaded; skipping"
-              exit 0
-              ;;
-          esac
-          if [ "$HAS_R2" != "true" ]; then
-            echo "R2 secrets not configured; no compatibility asset uploaded; skipping"
-            exit 0
-          fi
-          url="https://github.com/${{ github.repository }}/releases/latest/download/latest.json"
-          for attempt in 1 2 3 4 5 6; do
-            if curl -fsSL -A "Go-http-client/2.0" -o /tmp/compat-latest.json "$url"; then
-              jq -e '(.version | type == "string") and (.platforms | type == "object")' /tmp/compat-latest.json >/dev/null
-              echo "public compatibility manifest OK (desktop version $(jq -r .version /tmp/compat-latest.json))"
-              exit 0
-            fi
-            echo "attempt $attempt failed; retrying in 10s"
-            sleep 10
-          done
-          echo "::error::public compatibility manifest unreachable at $url"
-          exit 1
-
-      # A stable CLI release must never leave the npm line behind: v1.17.5
-      # shipped as binaries/Homebrew while npm `latest` still pointed at 0.53.2
-      # (#5822) — every `npm update -g` user was silently downgraded to a
-      # months-old version, and nothing noticed because the npm line
-      # (release-npm.yml, `npm-vX.Y.Z` tags) is triggered independently and the
-      # stable npm tag was simply never pushed. release-npm.yml's own verify
-      # step only guards runs that happen; this guard catches the run that
-      # DIDN'T.
-      #
-      # Two distinct states, two responses (the approved orchestrator starts the
-      # CLI and npm reusable workflows concurrently, and npm dist-tags propagate
-      # asynchronously, so "tag pushed but latest not moved yet" is a NORMAL
-      # mid-release state, not a failure):
-      #   - npm-v<version> tag missing  -> hard fail. This is the #5822 gap:
-      #     nobody pushed the npm release at all.
-      #   - tag pushed, latest lagging  -> poll briefly, then WARN and pass.
-      #     The npm job may still be publishing; release-npm.yml's verify step
-      #     owns asserting the dist-tag lands.
-      - name: Check npm latest dist-tag freshness
-        env:
-          TAG: ${{ needs.resolve.outputs.tag }}
-        run: |
-          set -euo pipefail
-          case "$TAG" in
-            *-*)
-              echo "prerelease $TAG — npm latest does not move on prereleases; skipping"
-              exit 0
-              ;;
-          esac
-          version="${TAG#v}"
-          if ! git ls-remote --exit-code origin "refs/tags/npm-v$version" >/dev/null; then
-            echo "::error::the npm-v$version tag was never pushed — the npm channel is being left behind and 'npm update -g' users will be downgraded to the old 'latest'. Push it: git tag npm-v$version ${TAG} && git push origin npm-v$version (or 'npm dist-tag add reasonix@$version latest' for an already-published version)."
-            exit 1
-          fi
-          for attempt in 1 2 3 4 5 6; do
-            got="$(npm view reasonix dist-tags.latest 2>/dev/null || true)"
-            if [ -n "$got" ]; then
-              newest="$(printf '%s\n%s\n' "$got" "$version" | sort -V | tail -1)"
-              if [ "$newest" = "$got" ]; then
-                echo "npm latest -> $got (>= $version) OK"
-                exit 0
-              fi
-            fi
-            echo "npm latest -> ${got:-<unreadable>}, want >= $version (attempt $attempt)"
-            sleep 10
-          done
-          echo "::warning::npm-v$version is pushed but npm 'latest' is still ${got:-<unreadable>} — the concurrent npm publish is likely still running or propagating. Monitor the npm job; its verify step asserts the dist-tag lands."
-          exit 0
@@ -0,0 +1,33 @@
+name: Website CI
+
+on:
+  push:
+    branches: [website]
+  pull_request:
+    branches: [website]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: website-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  website:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: site
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: site/package-lock.json
+      - run: npm ci
+      - run: npm test
+      - run: npm run build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -1,64 +0,0 @@
-name: Spam comment guard
-
-# Activity-farming bots post short emoji-padded template comments on whatever
-# issue is currently active. They are cheap to spot structurally: a recently
-# registered account with no history here, no followers, and a pile of forked
-# repos, posting a sub-50 character comment with emoji and no code/link/log.
-# Every signal must fire — on 7604 replayed comments that caught all 83 known
-# spam posts with no false positive. Loosening any one of them reintroduces
-# real users ("点赞", "同样的问题", a 2020 account posting "感谢各位❤").
-
-on:
-  issue_comment:
-    types: [created]
-
-permissions:
-  issues: write
-  pull-requests: write
-
-concurrency:
-  group: spam-guard-${{ github.event.comment.id }}
-
-jobs:
-  screen:
-    if: github.event.comment.user.type != 'Bot' && github.event.comment.author_association == 'NONE'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
-        with:
-          script: |
-            const EMOJI = /[\u{1F300}-\u{1FAFF}\u{2600}-\u{27BF}\u{2B00}-\u{2BFF}\u{FE0F}]/gu;
-            const comment = context.payload.comment;
-            const body = comment.body || '';
-
-            const hasSubstance = /```|https?:\/\/|!\[|^>/m.test(body);
-            const emojiCount = (body.match(EMOJI) || []).length;
-            const bare = body.replace(EMOJI, '').trim();
-
-            const { data: author } = await github.rest.users.getByUsername({
-              username: comment.user.login,
-            });
-
-            const ageDays = (Date.now() - Date.parse(author.created_at)) / 86400000;
-
-            const signals = {
-              newAccount: ageDays < 365,
-              noFollowers: author.followers === 0,
-              forkPadded: author.public_repos >= 15,
-              tooShort: bare.length <= 45,
-              emojiPadded: emojiCount >= 1,
-              noSubstance: !hasSubstance,
-            };
-            const failed = Object.entries(signals).filter(([, v]) => !v).map(([k]) => k);
-            core.info(`${comment.user.login}: ${failed.length ? `kept (${failed.join(',')})` : 'spam'}`);
-            if (failed.length) return;
-
-            await github.graphql(
-              `mutation($id: ID!) {
-                 minimizeComment(input: { subjectId: $id, classifier: SPAM }) {
-                   minimizedComment { isMinimized }
-                 }
-               }`,
-              { id: comment.node_id },
-            );
-            core.notice(`Minimized spam comment by ${comment.user.login}`);
@@ -1,68 +0,0 @@
-name: Sweep stale version reports
-
-# Reports filed many minors back cannot be confirmed against a current build,
-# and 65% of the open tracker has never had a reply. This asks, waits, then
-# closes — never closing anything that was not asked first.
-
-on:
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: Print what would happen without commenting
-        required: false
-        default: true
-        type: boolean
-      limit:
-        description: Maximum issues to touch in this run
-        required: false
-        default: '40'
-        type: string
-  schedule:
-    - cron: '17 3 * * 1'
-  push:
-    branches:
-      - main-v2
-    paths:
-      - '.github/workflows/stale-report-sweep.yml'
-      - 'scripts/stale-report-sweep.mjs'
-      - 'scripts/stale-report-sweep.test.mjs'
-
-permissions:
-  contents: read
-  issues: write
-
-concurrency:
-  group: stale-report-sweep
-  cancel-in-progress: false
-
-jobs:
-  sweep:
-    if: github.repository == 'esengine/DeepSeek-Reasonix'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: '22'
-      - name: Test sweeper
-        run: node --test scripts/stale-report-sweep.test.mjs
-      # A push that only touched the sweeper runs its tests and stops there.
-      - name: Sweep
-        if: github.event_name != 'push'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          LIMIT: ${{ github.event.inputs.limit || '40' }}
-          # Posting stays off until this repository variable is set to "true", so
-          # merging the sweeper cannot start commenting on its own.
-          ENABLED: ${{ vars.STALE_SWEEP_ENABLED }}
-          REQUESTED_DRY_RUN: ${{ github.event.inputs.dry_run || 'true' }}
-        run: |
-          set -euo pipefail
-          args=(--limit "$LIMIT")
-          if [ "$ENABLED" != "true" ] || [ "$REQUESTED_DRY_RUN" = "true" ]; then
-            args+=(--dry-run)
-            echo "::notice::dry run (STALE_SWEEP_ENABLED=${ENABLED:-unset})"
-          fi
-          node scripts/stale-report-sweep.mjs "${args[@]}"
@@ -1,59 +0,0 @@
-name: Supersede CI
-
-# Push runs have separate concurrency groups so Notes can finish without
-# cancelling their required code ancestor. Only a changed code tree supersedes
-# earlier evidence. Force cancellation releases stuck Windows workers after
-# the normal cancellation grace period.
-
-on:
-  push:
-    branches: [main-v2]
-
-permissions:
-  actions: write
-  contents: read
-
-jobs:
-  cancel-superseded:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-
-      - name: Cancel CI runs this push supersedes
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          runs="$(gh api "repos/$GITHUB_REPOSITORY/actions/workflows/ci.yml/runs?branch=main-v2&event=push&per_page=30" \
-            --jq '.workflow_runs[] | select(.status != "completed") | "\(.id) \(.head_sha)"')"
-          [ -n "$runs" ] || { echo "no unfinished ci.yml runs on main-v2"; exit 0; }
-          while read -r id sha; do
-            [ -n "$id" ] || continue
-            if [ "$sha" = "$GITHUB_SHA" ]; then
-              continue
-            fi
-            if ! git merge-base --is-ancestor "$sha" "$GITHUB_SHA"; then
-              echo "run $id ($sha) is not an ancestor of $GITHUB_SHA; leaving it alone"
-              continue
-            fi
-            code_changes="$(git diff --name-only "$sha" "$GITHUB_SHA" -- . ':!release-notes')"
-            if [ -z "$code_changes" ]; then
-              echo "run $id ($sha) provides the unchanged code evidence required by $GITHUB_SHA; preserving"
-              continue
-            fi
-            echo "run $id ($sha) is superseded by $GITHUB_SHA; cancelling"
-            gh api -X POST "repos/$GITHUB_REPOSITORY/actions/runs/$id/cancel" >/dev/null || true
-            status="unknown"
-            for _ in 1 2 3 4 5 6; do
-              sleep 15
-              status="$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$id" --jq .status)"
-              [ "$status" = "completed" ] && break
-            done
-            if [ "$status" != "completed" ]; then
-              echo "run $id still $status after the normal cancel; force-cancelling"
-              gh api -X POST "repos/$GITHUB_REPOSITORY/actions/runs/$id/force-cancel" >/dev/null
-            fi
-          done <<< "$runs"
@@ -1,38 +0,0 @@
-name: Update acknowledgments
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '17 3 * * 1'
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  update:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: '22'
-      - name: Update README contributor tables
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: node scripts/update-acknowledgments.mjs
-      - name: Open pull request
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
-        with:
-          # GITHUB_TOKEN-authored pull requests never trigger CI, so required checks would never report.
-          token: ${{ secrets.ACKNOWLEDGMENTS_TOKEN || secrets.GITHUB_TOKEN }}
-          branch: chore/update-acknowledgments
-          delete-branch: true
-          title: 'Update acknowledgments contributors / 更新致谢贡献者'
-          commit-message: 'docs: update acknowledgments contributors'
-          body: |
-            Refreshes the README acknowledgments tables from the GitHub contributors API.
-
-            - Source: `repos/esengine/DeepSeek-Reasonix/contributors?per_page=20&anon=1`
-            - Anonymous contributors are shown without email addresses.
-          labels: documentation
@@ -1,74 +0,0 @@
-name: Update Star History chart
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main-v2
-    paths:
-      - '.github/workflows/update-star-history.yml'
-      - 'scripts/update-star-history.mjs'
-      - 'scripts/update-star-history.test.mjs'
-  schedule:
-    - cron: '23 */3 * * *'
-
-permissions:
-  contents: write
-
-concurrency:
-  group: update-star-history
-  cancel-in-progress: false
-
-jobs:
-  update:
-    if: github.repository == 'esengine/DeepSeek-Reasonix'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: '22'
-      - name: Test chart generator
-        run: node --test scripts/update-star-history.test.mjs
-      - name: Generate chart assets
-        env:
-          STAR_HISTORY_GITHUB_TOKEN: ${{ secrets.STAR_HISTORY_GITHUB_TOKEN }}
-          STAR_HISTORY_OUTPUT_DIR: ${{ runner.temp }}/star-history
-        run: node scripts/update-star-history.mjs
-      - name: Publish chart assets
-        env:
-          OUTPUT_DIR: ${{ runner.temp }}/star-history
-          TARGET_BRANCH: star-history
-        run: |
-          set -euo pipefail
-
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-
-          if git fetch origin "$TARGET_BRANCH"; then
-            git switch --force-create "$TARGET_BRANCH" "origin/$TARGET_BRANCH"
-          else
-            git switch --create "$TARGET_BRANCH"
-          fi
-
-          mkdir -p assets/star-history
-          cp "$OUTPUT_DIR/star-history-light.svg" assets/star-history/star-history-light.svg
-          cp "$OUTPUT_DIR/star-history-dark.svg" assets/star-history/star-history-dark.svg
-          git add assets/star-history
-
-          if git diff --cached --quiet; then
-            echo "Star History chart is already current."
-            exit 0
-          fi
-
-          git commit \
-            -m "docs: update Star History chart" \
-            -m "Automated update:
-          Refresh the repository-hosted light and dark Star History SVGs from the authenticated GitHub stargazers API.
-
-          Verification:
-          - chart generator tests passed
-          - both SVG assets were rendered from timestamped stargazer data"
-          git push origin HEAD:"$TARGET_BRANCH"
@@ -1,84 +1,15 @@
-# Build artifacts
-/bin/
-/dist/
-/stage/
-/npm/.stage/
-/reasonix
-/reasonix.exe
-/e2ebench
-/e2ebench.exe
-
-# Website (Astro) build output
-/site/dist/
-/site/.astro/
-/site/_preview.png
-
-# Go test/build scratch
-*.test
-*.out
-*.coverprofile
-coverage.out
-cpu.prof
-mem.prof
-
-# Desktop build artifacts
-/desktop/build/*
-!/desktop/build/appicon.png
-!/desktop/build/appicon.svg
-!/desktop/build/trayTemplate.png
-!/desktop/build/[email protected]
-/desktop/desktop
-/desktop/frontend/dist/*
-!/desktop/frontend/dist/.gitkeep
-/desktop/frontend/.reasonix-frontend-artifact.json
-/desktop/frontend/sourcemaps/
-/desktop/electron/dist/
-
-# Environment / local config (reasonix.example.toml is the shared template)
-.env
-.env.local
-*.local
-**/.firebase-crash-migration-state.json
-**/.firebase-crash-migration-state.json.tmp-*
-/reasonix.toml
-/desktop/.env
-/desktop/reasonix.toml
-
-# Node / frontend dependencies and caches
 node_modules/
-.pnpm-store/
 .npm/
-
-# Project-local Reasonix state; keep the checked-in review command.
-/.reasonix/*
-!/.reasonix/commands/
-!/.reasonix/commands/review.md
-
-# Stray Reasonix state written under a package dir by a test whose RealPath
-# resolves to CWD (e.g. remote bootstrap EnsureServe). Never commit these.
-internal/**/.reasonix/
-desktop/**/.reasonix/
-
-# CodeGraph per-project index (rebuilt locally; never committed)
-.codegraph/
-
-# Editor / OS
+.wrangler/
+site/dist/
+site/.astro/
+site/.generated/
+site/public/av/
+.env
+.env.*
+*.local
 .DS_Store
 Thumbs.db
 .idea/
 .vscode/
-/site/public/av/
-
-benchmarks/context-maintenance-e2e/run/
-
-# Local scratch
 temp/
-
-# Official theme art intermediate outputs / caches
-scripts/official-theme-art/out/
-scripts/official-theme-art/__pycache__/
-site/.generated/
-
-# Committed pointer at REASONIX.md; overrides a global CLAUDE.md ignore rule.
-!/CLAUDE.md
-desktop/desktop.exe
@@ -1 +0,0 @@
-v2.12.2
@@ -1,78 +0,0 @@
-version: "2"
-
-linters:
-  enable:
-    - copyloopvar
-    - errcheck
-    - errorlint
-    - govet
-    - ineffassign
-    - intrange
-    - modernize
-    - staticcheck
-    - unused
-    - usestdlibvars
-  settings:
-    modernize:
-      # omitempty -> omitzero changes which fields are written for nested
-      # structs. That is a wire-format change to session files and the
-      # extension protocol, not a refactor, so it lands on its own.
-      disable:
-        - omitzero
-        # Go 1.26 makes these suggestions available, but adopting them would
-        # rewrite unrelated production and test code across the repository.
-        # Keep the security-only module upgrade focused and revisit these in
-        # a dedicated modernization change.
-        - newexpr
-        - stditerators
-    errcheck:
-      check-type-assertions: false
-      exclude-functions:
-        - (*os.File).Close
-        - (io.Closer).Close
-        - (*net/http.Response).Body.Close
-        - golang.org/x/term.Restore
-        # Win32: CloseHandle in a defer mirrors the Close exclusions above, and
-        # LazyProc.Call always returns a non-nil errno — the caller reads r1.
-        - golang.org/x/sys/windows.CloseHandle
-        - (*syscall.LazyProc).Call
-        - (*golang.org/x/sys/windows.LazyProc).Call
-    staticcheck:
-      checks:
-        - all
-        - -ST1005 # error strings ending with punctuation — too strict for initial adoption
-        - -ST1018 # Unicode format characters — intentional in TUI code
-        - -QF1001 # De Morgan's law — readability preference
-  exclusions:
-    generated: lax
-    presets:
-      - comments
-      - common-false-positives
-      - legacy
-      - std-error-handling
-    rules:
-      # Setup/teardown in tests routinely ignores cleanup errors.
-      - path: _test\.go
-        linters:
-          - errcheck
-      # The pinned golangci-lint binary's staticcheck reports SA5011 false
-      # positives on `if x == nil { t.Fatal(...) }`-guarded derefs in tests (it
-      # doesn't treat t.Fatal as terminating); the same code is clean under a
-      # locally-built golangci-lint. Scope the suppression to tests so SA5011
-      # still guards production code.
-      - path: _test\.go
-        linters:
-          - staticcheck
-        text: SA5011
-      # SA4023 is trivially true on GOOS=windows: dialAgent's Windows stub
-      # (agent_windows.go) always returns a non-nil error until named-pipe
-      # transport lands. Suppress only this call site; the comparison stays
-      # meaningful on Unix where dialAgent can succeed.
-      - path: internal/remote/auth\.go
-        linters:
-          - staticcheck
-        text: SA4023
-
-issues:
-  max-issues-per-linter: 0
-  max-same-issues: 0
@@ -1,68 +0,0 @@
-version: 2
-project_name: reasonix
-
-before:
-  hooks:
-    - go mod download
-
-builds:
-  - id: reasonix
-    main: ./cmd/reasonix
-    binary: reasonix
-    env:
-      - CGO_ENABLED=0
-    flags:
-      - -trimpath
-    ldflags:
-      # Inject version identity for `reasonix version --verbose/--json` (Integration D/E).
-      # buildTimeUTC is the goreleaser run time (UTC), not vcs.time.
-      - -s -w -X main.version={{ .Tag }} -X main.gitCommit={{ .ShortCommit }} -X main.buildTimeUTC={{ .Date }} -X reasonix/internal/productdocs.linkedVersion={{ .Tag }} -X reasonix/internal/productdocs.linkedRevision={{ .Commit }}
-    goos: [darwin, linux, windows]
-    goarch: [amd64, arm64]
-
-archives:
-  - id: reasonix
-    ids: [reasonix]
-    name_template: "reasonix-{{ .Os }}-{{ .Arch }}"
-    formats: [tar.gz]
-    format_overrides:
-      - goos: windows
-        formats: [zip]
-
-checksum:
-  name_template: SHA256SUMS
-  algorithm: sha256
-
-homebrew_casks:
-  - name: reasonix
-    ids: [reasonix]
-    # Prereleases (including v*-preview.* and v*-rc*) must not update the stable
-    # tap; brew has no separate prerelease channel, so uploading either cask
-    # would make it the default `brew install`.
-    # npm is a separate line (release-npm.yml, `npm-v*`), so an npm prerelease no
-    # longer drags brew along — a stable `v*` cask can ship while npm stays on rc.
-    skip_upload: "auto"
-    repository:
-      owner: esengine
-      name: homebrew-reasonix
-      branch: main
-      token: "{{ .Env.HOMEBREW_TAP_TOKEN }}"
-    homepage: "https://github.com/esengine/DeepSeek-Reasonix"
-    description: "Cache-first DeepSeek coding agent for the terminal."
-    commit_author:
-      name: reasonix
-      email: [email protected]
-    # The CLI archive is not notarized, so the cask still strips quarantine.
-    # GoReleaser's hooks field renders the deprecated `postflight do` stanza;
-    # emit Homebrew's `postflight_steps` directly until upstream supports it.
-    custom_block: |
-      postflight_steps do
-        if OS.mac?
-          system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/reasonix"]
-        end
-      end
-
-release:
-  prerelease: auto
-  make_latest: false
-  name_template: "Reasonix CLI {{ .Tag }}"
@@ -1,5 +0,0 @@
---
-description: Review a file for bugs
-argument-hint: [path]
---
-Read $1 and list any correctness bugs or risky patterns, with file:line references, most important first. Focus: $ARGUMENTS.
@@ -1,13 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Canary-only configuration. SignPath test certificates intentionally do not
-     chain to a Windows trusted root, so authenticode-verify cannot be used for
-     the already test-signed payload. The workflow verifies that every payload
-     executable is signed and hash-identical to the rebuilt portable package.
-     Stable and RC releases use windows-installer-v2 instead. -->
-<artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
-  <zip-file>
-    <pe-file path="*installer*.exe">
-      <authenticode-sign />
-    </pe-file>
-  </zip-file>
-</artifact-configuration>
@@ -1,38 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Sign the finished NSIS container only when the exact payload used to build it
-     is present and already Authenticode-signed: the flat Go executables plus
-     every PE file inside the Electron app/ tree. GitHub Actions wraps this
-     bundle in a zip before SignPath receives it. Keep this versioned separately
-     so provisioning it cannot break releases still using windows-installer. -->
-<artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
-  <zip-file>
-    <pe-file path="*installer*.exe">
-      <authenticode-sign />
-    </pe-file>
-    <pe-file path="reasonix-desktop.exe">
-      <authenticode-verify />
-    </pe-file>
-    <pe-file path="reasonix-guard.exe">
-      <authenticode-verify />
-    </pe-file>
-    <pe-file path="reasonix-launcher.exe">
-      <authenticode-verify />
-    </pe-file>
-    <pe-file path="reasonix-update-helper.exe">
-      <authenticode-verify />
-    </pe-file>
-    <pe-file path="reasonix-cli.exe">
-      <authenticode-verify />
-    </pe-file>
-    <pe-file path="reasonix-uninstall.exe">
-      <authenticode-verify />
-    </pe-file>
-    <pe-file-set>
-      <include path="app/**/*.exe" min-matches="1" max-matches="unbounded" />
-      <include path="app/**/*.dll" min-matches="1" max-matches="unbounded" />
-      <for-each>
-        <authenticode-verify />
-      </for-each>
-    </pe-file-set>
-  </zip-file>
-</artifact-configuration>
@@ -1,13 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- GitHub Actions wraps every uploaded artifact in a zip, so the installer arrives
-     zipped even though it is a single file — match and sign the .exe inside. -->
-<artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
-  <zip-file>
-    <pe-file-set>
-      <include path="*installer*.exe" min-matches="1" max-matches="1" />
-      <for-each>
-        <authenticode-sign />
-      </for-each>
-    </pe-file-set>
-  </zip-file>
-</artifact-configuration>
@@ -1,38 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Sign every executable that the NSIS installer writes to disk: the flat Go
-     payload plus every PE file inside the Electron app/ tree. GitHub Actions
-     wraps the payload directory (desktop/build/windows/signing-payload, which
-     also carries the generated signing-files.txt manifest of these PE files)
-     in a zip before SignPath receives it. -->
-<artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
-  <zip-file>
-    <pe-file path="reasonix-desktop.exe">
-      <authenticode-sign />
-    </pe-file>
-    <pe-file path="reasonix-guard.exe">
-      <authenticode-sign />
-    </pe-file>
-    <pe-file path="reasonix-launcher.exe">
-      <authenticode-sign />
-    </pe-file>
-    <pe-file path="reasonix-update-helper.exe">
-      <authenticode-sign />
-    </pe-file>
-    <pe-file path="reasonix-cli.exe">
-      <authenticode-sign />
-    </pe-file>
-    <pe-file path="reasonix-uninstall.exe">
-      <authenticode-sign />
-    </pe-file>
-    <pe-file path="app/Reasonix.exe">
-      <authenticode-sign />
-    </pe-file>
-    <pe-file-set>
-      <include path="app/**/*.exe" min-matches="1" max-matches="unbounded" />
-      <include path="app/**/*.dll" min-matches="1" max-matches="unbounded" />
-      <for-each>
-        <authenticode-sign />
-      </for-each>
-    </pe-file-set>
-  </zip-file>
-</artifact-configuration>
@@ -1,26 +0,0 @@
-version: 1
-project_slug: DeepSeek-Reasonix
-signing_policy_slug: release-signing
-repository_url: https://github.com/esengine/DeepSeek-Reasonix.git
-allowed_branch_names:
-  - main-v2
-allowed_build_definitions:
-  - .github/workflows/certum-signing-smoke.yml
-  - .github/workflows/release-candidate.yml
-  - .github/workflows/release-promote.yml
-  - .github/workflows/release-stable.yml
-  - .github/workflows/release-desktop.yml
-fingerprint_files:
-  - .github/workflows/certum-signing-smoke.yml
-  - .github/actions/setup-certum/action.yml
-  - scripts/sign-certum.ps1
-  - scripts/install-nsis.ps1
-  - .github/workflows/release-candidate.yml
-  - .github/workflows/release-promote.yml
-  - .github/workflows/release-stable.yml
-  - .github/workflows/release-desktop.yml
-  - scripts/finalize-windows-signed-candidate.sh
-  - scripts/validate-release-control-plane.sh
-  - scripts/package-windows-desktop.sh
-  - scripts/verify-windows-authenticode.ps1
-  - cmd/signpath-contract/main.go
@@ -1,541 +0,0 @@
-# Changelog
-
-All notable changes to the Go line (Reasonix 1.0+) are recorded here. The legacy
-`0.x` TypeScript history lives on the [`v1`](https://github.com/esengine/DeepSeek-Reasonix/tree/v1)
-branch.
-
-## Unreleased
-
-### Desktop conversation creation
-
- Local **New Conversation** creates a distinct formal session immediately,
-  including when another empty conversation already exists. First send uses
-  that identity. Closing or archiving the last conversation leaves the welcome
-  page; it does not create a replacement.
- Unsent local inputs are saved independently of chat history. Previous project
-  drafts remain available through **Previous drafts**. Unconfirmed submissions
-  are retained for inspection and are never automatically replayed.
- Automatic historical empty-session cleanup is retired. Existing trash and
-  manual restore remain available. Session v5 and workspace registry v3 remain
-  unchanged. Downgrading to 1.38.9 is unsupported; 1.38.10 also cannot read
-  revision-3 sessions introduced by #10545. Returning from 1.38.11 preserves
-  new input files and requires review when session history has advanced. See
-  [compatibility and recovery](docs/manual-session-rollback.md).
-
-### Added
-
- **Editable message queue (Desktop):** full-text editing in the original queue row,
-  pointer and keyboard reordering, move-to-top/bottom actions, and a pause
-  control. Saves preserve message identity, order and attachments; conflicting
-  or unconfirmed saves retain the user's draft. Remote editing requires the
-  additive `inbox-mutations-v1` capability. Editing temporarily hides the main
-  composer; saving or cancelling restores its draft, attachments and focus.
-  Switching sessions protects newer edits from delayed replies; loading the
-  latest version can recover after the active session selection changes.
-
- **Live file observations:** structured file tools now protect mutations with
-  a host-owned current-version observation. Any successful text window is
-  sufficient, successful writes refresh the version, and external changes
-  produce `FS_STALE_VERSION` without blocking unrelated tools.
-
- **MCP 2026-07-28 protocol:** multi-round-trip form/URL elicitation across
-  Desktop, CLI TUI, and serve; headless entries stay on the core surface and
-  cancel unanswered requests instead of guessing.
- **MCP Apps 2026-01-26 (Desktop):** inline app surfaces in tool cards behind
-  a per-server double-iframe sandbox, app-tool visibility metadata, bounded
-  aggregate local presentations, tab-bound AppBridge routing and teardown,
-  immutable digest-bound resource snapshots, and confirmed external links;
-  local rich results, instance-gated app tool calls, and the four-layer
-  capability matrix in MCP status.
- **Profile-scoped MCP schema caches:** capability-declaring hosts keep their
-  own `v3` cache files so catalogs negotiated under different client
-  capabilities never cross-read.
-
-### Changed
-
- Sending while a task is running now queues a follow-up by default. Use
-  **Guide current turn** for explicit mid-turn guidance. Stopping the current
-  task retains pending messages; the queue has separate pause/delete controls.
-
- **Persistent bash PTY:** ordinary foreground `bash` calls in a session now
-  share one PTY, so `cd`, exported variables, and shell functions survive
-  across calls. Output stays byte-identical to one-shot execution, stdin stays
-  detached, and a timeout or cancel reports partial output and says the shell
-  was reset. Background jobs, commands that background a child, per-call
-  write-root escalations, host terminals, and PowerShell hosts stay one-shot.
-  The bash tool schema and description are unchanged.
-
- **CLI YOLO shortcuts:** the CLI displays the unrestricted preset as YOLO;
-  `Ctrl+Y` toggles the canonical `danger-full-access` permission, while
-  `Shift+Tab` cycles Read only → Workspace write → YOLO → Plan.
-
- **Harness-style scheduling and recovery:** calls take effect in execution
-  order, including same-batch read/edit sequences. Bounded reads create no
-  completion debt. Unknown external effects are durable advisory facts and no
-  longer block tools or trigger replay. Proof/settlement tools, Auto Guard,
-  recovery actions, and repeat-call rejection are retired; identical calls get
-  non-blocking reminders at counts 3, 5, and 8.
-
- **Fact-driven execution:** Ordinary requests always enter the executor.
-  There is no automatic simple / light / full task mode and no per-turn
-  `TaskPolicy` classification. The planner runs only for an explicit Plan,
-  an approval boundary, or Goal start. The host builds verification
-  obligations from concrete tool effects and receipts. Plan, Goal,
-  permission, and sandbox stay independent. Tool schemas and the executor
-  system prefix stay byte-stable. Historical `<execution-policy>` tags remain
-  readable on old sessions and are stripped from new provider context.
-  Old `--preset`/`--profile` compatibility no-ops are unchanged.
-
- **Remote connect wizard host picker:** Step 1's host field now opens the
-  saved SSH connections through an explicit chevron dropdown on the input's
-  right edge instead of the old focus-triggered popup. The dropdown lists
-  every saved connection unfiltered, appends non-standard ports to each row,
-  leads with a "saved SSH connections" caption, and closes on pick, arrow
-  toggle, Escape (before the Escape that exits the wizard), or an outside
-  pointer press. The arrow is hidden while no hosts are saved and disabled
-  while a connection is busy.
-
-### Fixed
-
- **Setup menus in narrow terminals:** `reasonix setup` and the other
-  arrow-key menus clip every row to the terminal width. A row that soft-wrapped
-  used to throw off the redraw, stacking a fresh copy of the header and the
-  wrapped rows on screen with each keypress.
-
- **Read evidence recovery:** partial reads no longer freeze independent work
-  or ordinary final answers. Explicit full reads retain bounded completion
-  checks. Rejected edits track operation/version requirements so successful
-  retries, fresh versions and confirmed deletion retire obsolete blocks.
- **File and shell boundaries:** guard raced creates/overwrites and move-source
-  changes, recognize `git --no-pager` inspections, and retain structured recovery
-  diagnostics without changing provider tool schemas.
-
- **Relay image input:** ID-only or invalid model metadata now stays unknown.
-  Both Desktop model editors expose per-model Auto / On / Off overrides, with
-  official protocol limits retained. A separate V2 discovery cache rejects stale
-  results; saved settings and runtime image serialization share one resolver and
-  apply at Controller rebuild boundaries. Legacy configuration remains readable.
- **中转站图片输入：** 缺失或无效的模型能力显示“图片能力未识别”，两个编辑入口
-  均可逐模型选择“自动 / 开启 / 关闭”。独立 V2 缓存隔离旧错误声明并防止陈旧结果
-  覆盖；保存设置与实际图片请求统一解析，在 Controller 重建边界生效，兼容旧配置。
-
- **Deterministic natural-turn completion:** removed the extra completion
-  validator model request. Clean model stops now finish from provider/tool state;
-  true zero-content responses retry the frozen request at the Agent step
-  boundary, while explicit host-owned readiness and safety gates remain active.
-  Legacy completion-validator configuration and `completion_uncertain` event
-  values remain readable for compatibility but are no longer produced by the
-  validator path.
-
- **serve Host-header allowlist:** `reasonix serve` now rejects requests whose
-  `Host` is neither loopback nor the actual listen address (HTTP 421), closing
-  the DNS-rebinding bypass of the JSON content-type CSRF guard — a rebind page
-  becomes same-origin with the loopback listener and could previously drive
-  `/bypass`, `/submit`, and read `/history`. `behind_proxy` deployments and
-  wildcard/non-loopback binds are exempt. The non-loopback plaintext-HTTP
-  startup warning now also fires — loudest — for the unauthenticated `auth =
-  none` case that used to stay silent.
-
- **Preview read confinement:** `write_file` / `edit_file` / `multi_edit`
-  previews now apply the same `confinePreview` boundary as `delete_range` /
-  `delete_symbol`. A model-supplied absolute path outside the workspace roots
-  previously read the file (rendering its contents into the approval card and
-  session log) even though Execute would refuse the write.
-
- **Clean-filter hardening on internal diffs:** gitcmd diff invocations now
-  neutralize every `filter.<driver>` defined in the repository's local
-  `.git/config` (`clean=` emptied, `required` forced off), so viewing a changed
-  file's diff can no longer execute a repository-configured clean filter via
-  `.gitattributes`. Emptied filters are identity pass-throughs: the diff still
-  renders the real working-tree change.
-
- **install_source proxy SSRF parity:** the install_source SSRF dial guard now
-  also validates the request destination (IP literals) at the RoundTripper
-  boundary, so a configured HTTP/HTTPS proxy can no longer forward a blocked
-  target (cloud metadata, RFC1918, link-local, CGNAT) that the dial-time check
-  never sees — matching web_fetch's proxy-path behavior.
-
- **awk approval classification:** the bash indirect-execution classifier now
-  treats `awk`/`gawk`/`mawk`/`nawk` with an inline program (anything not read
-  via `-f`/`--file`) like `python -c`: it always requires human approval and
-  can never be covered by a remembered reusable prefix rule. `awk
-  'BEGIN{system("…")}'` previously fell through to the reusable class.
-
- **cargo check/doc read-only correction:** the legacy read-only command table
-  no longer lists `cargo check` / `cargo doc` as permission readers — cargo
-  executes the crate's `build.rs` for both. The effect classifier already
-  billed them as code-executing writers; the stale table entry (and its test)
-  now agree. Only `cargo search` remains read-only.
-
- **Compact MCP discovery:** `use_capability(action=list)` now returns one
-  compact summary per configured MCP server instead of expanding every cached
-  tool description, including tools from disabled servers. Inspecting one
-  enabled `mcp-server:<name>` still returns its live or cached directory
-  without starting it, while direct known-ID calls, routing, authorization,
-  and the fixed provider-visible tool schema remain unchanged.
-
- **Project MCP session reliability:** The MCP client now uses the official Go
-  SDK for stdio, legacy SSE, and Streamable HTTP while retaining Reasonix's
-  existing configuration, OAuth, process isolation, and schema-cache contracts.
-  Streamable HTTP opens its long-lived GET/SSE listener immediately after
-  initialization, so JetBrains project-level `.mcp.json` servers no longer lose
-  their pending session before the first tool call. Lost sessions converge on
-  one bounded rebuild and one replay, read-only surfaces consume every cursor
-  page, prompts/resources share the tool session, and shutdown terminates HTTP
-  sessions and local processes. MCP calls also accept a single JSON-object
-  string in `use_capability.arguments`, while rejecting arrays, scalars, invalid
-  JSON, and nested encoded strings. `/mcp` and Desktop expose redacted protocol,
-  listening, reconnect, and error-category diagnostics without session IDs.
-
- **v1.24.2 session snapshot & recovery root fix:** Keep PR #7982's WAL/CAS/lease
-  safety foundation, but replace process-level "I hold a lease" ownership with a
-  generation-bound `SessionWriteAuthority`. Same-revision tool-preview/load
-  reshapes no longer false-diverge; recovery files are bounded to one path per
-  writer/lineage; empty checkpoints heal from their own WAL; projection lineage
-  rebinds across upgrade/model switch and inherits across recovery forks without
-  changing provider-visible prompt bytes. Catalog upgrades to disposable
-  `session-catalog/v3.sqlite` with recovery lineage roles
-  (`normal|covered_copy|adopted|diverged`); covered idle copies move to the
-  recoverable `.trash` using a 15-minute idle threshold applied on two early
-  sweeps (at startup and ~20 minutes later), then a 24-hour threshold on the
-  6-hour background ticker; independent diverged branches stay and are listed
-  for user choice. v1/v2 catalogs are
-  left byte-unchanged for coexistence/downgrade.
-  **v1.24.1** only hid/reclaimed already-created covered copies and fixed Windows
-  flash-window startup; **v1.24.2** stops the misclassification source and repairs
-  existing user directories without rewriting authoritative JSONL/WAL/sidecar data.
-
- Goal now runs continuously by default: the former 16-round per-Run boundary,
-  10/20/40 cross-Run quotas, default wall-clock budget, and numeric
-  no-progress/Todo-stall pauses no longer stop valid work. Progress guards still
-  detect repeated host outcomes and zero-evidence work, but redirect the model
-  to re-plan instead of producing `goal_run_budget` or `goal_stuck`. Explicit
-  `[agent].goal_token_budget`, `--max-steps`, positive time/cost budgets, manual
-  pause/stop, genuine user/external blockers, and evaluator fail-closed behavior
-  remain available. The Goal token budget defaults to `0` (off); resuming its
-  `budget_spend` pause grants a fresh slice without clearing cumulative usage.
-  Goal status reports turns, provider requests, tokens, the optional configured
-  token threshold, and cumulative active work time. Bot `max_steps` also
-  defaults to `0` (continuous), while positive user configuration is enforced.
-
- Removed numeric Goal pauses in existing sidecars automatically normalize to
-  `running` without sending a model request. Active Goal sidecars write
-  `turnsLimit: -1` as a downgrade-safe unlimited sentinel while public runtime
-  APIs retain deprecated limit fields as `0`. The migration preserves unknown
-  fields, todos, checkpoints, usage, evidence, and historical metadata.
-
- Goal is now the sole long-task runtime. Historical AutoResearch sidecars
-  migrate transactionally into Goals with research compatibility metadata. Invalid archives block
-  fail closed and remain read-only, retaining the task id and compatibility mode
-  for a restart or `/goal resume` retry; successful Goal-only sidecars omit the
-  old task id and write an explicit downgrade fence so previous readers cannot
-  reactivate the removed runtime.
-
- Context-dependent workflow tools now share one host-side execution boundary.
-  Goal, Plan sign-off, and background-job calls cannot reach permissions,
-  hooks, leases, or Execute outside their owning context; mixed batches execute
-  valid calls once and stop safely after one repair. Child agents also isolate
-  inherited Goal, Jobs, and live memory queues, while persisted tool identity
-  records the effective child schema projection.
-
- **Issue #7575:** Linux Bash under bubblewrap no longer mounts a fresh empty
-  `--tmpfs /tmp` on every call. Consecutive commands in the same logical session
-  now share a private temporary directory (bound at `/tmp` on Linux, exported via
-  `TMPDIR`/`TMP`/`TEMP` on all platforms) without exposing the host public
-  temporary root. `/new`, `/clear`, resume of another session, and branch
-  switches rotate the directory; model/settings hot rebuilds keep it. Sub-agent
-  runs get independent directories. Temporary files are not durable across process
-  restarts.
-
-### Added
-
- Added `[ui].show_turn_usage` so CLI/TUI users can hide per-request token and
-  cost receipts from transcript scrollback without disabling usage accounting.
-
-## [1.20.0] — 2026-08-05
-
-Extension kernel, Task Monitor, and safer Goal completion.
-
-Compact decision surfaces, local decision receipts, unified extension kernel,
-native Task Monitor, bounded sub-agent progress, Goal fail-closed completion,
-MiMo and DashScope Responses fixes, SSH remote access simplification, and
-multiple Desktop stability improvements.
-
-### Highlights
-
- **Unified Extension Kernel and Extension Protocol v1**: Immutable runtime
-  snapshots, fail-atomic reload, Plugin Manifest v1 (prompts, themes, full-trust
-  code runtimes), stable JSON-RPC sidecar protocol, interceptor dispatch,
-  streaming provider adapter, structured UI, and Go SDK.
- **Native Task Monitor**: Monitor agent tasks natively in CLI and Desktop with
-  lifecycle semantics and session-scoped summary view.
- **Bounded Sub-agent Progress Forwarding**: Forward structured progress for
-  `task`, `parallel_tasks`, and `fleet` without flooding the parent stream.
-  Renders nested lifecycle cards in Desktop and stable per-child transcript
-  slots in CLI.
- **Goal Completion Fail-Closed**: Replace free-form Goal footer markers with a
-  stable `update_goal` tool and epoch-scoped per-turn reports. Centralized
-  completion logic with bounded evaluator, progress-aware budgets, and
-  pause/resume controls.
- **Ablation Subsystem Switches**: Switch subsystems off behind one shared
-  vocabulary for controlled experiments. Includes planner, subagent, retrieval,
-  evidence, and compaction.
- **Benchmark Cost per Solved Task**: Report cost per solved task, tokens per
-  solved, median wall time, and failure-class breakdown in e2e reports.
- **Compact Decision Surfaces and Local Receipts**: Compact footer decision-card
-  layout with bounded scroll, dense action rows, and overflow disclosure.
-  Record bounded Ask, approval, and recovery decisions as local transcript
-  receipts.
- **Simplified SSH Remote Access**: Remove Remote Workbench protocol and
-  stacks; reuse CLI/Serve remote model. Desktop opens per-host native web child
-  windows via SSH. Keyless remote Serve setup with loopback-only page.
- **Model Usage Charts with Primer Palette**: Replace monochrome accent ramp
-  with GitHub Primer data-viz two-set categorical palette. Fix donut overflow
-  on hover and keyboard accessibility.
- **Cross-platform Extension and Task Monitor Reliability**: Make
-  content-reference eviction deterministic, reject Unix and Windows absolute
-  plugin paths consistently, stabilize parallel-task cancellation, and restore
-  reliable Windows validation for Task Monitor and remote provider setup.
- **MiMo and DashScope Responses Wire Alignment**: Fix multi-turn tool loops,
-  reasoning round-trip, JSON output for MiMo; fix DashScope second-turn 400
-  error, all-zero usage suppression, and vendor-aware cache TTL.
- **Desktop Stability Fixes**: Recover stuck updates and legacy WebKit, contain
-  macOS alias repair startup crashes, keep composer overflow stacks readable,
-  and harden account verification and community flows.
- **Remote Web Recovery After SSH Drops**: Add integration regression test for
-  SSH drop, forward recovery, and window reload. Document transient outage
-  behavior.
- **CI: Auto-minimize Activity-Farming Spam Comments**: Detect and minimize
-  template spam comments from non-contributor accounts based on structural
-  signals.
-
-### Added
-
- Added Extension Protocol v1 and the unified extension kernel: installed or
-  linked sidecars can contribute tools, skills, commands, hooks, MCP servers,
-  providers, interceptors, and structured UI surfaces through a versioned
-  NDJSON contract and the public Go SDK. CLI, Desktop, ACP, and Serve support
-  fail-atomic runtime reloads; Serve also renders extension surfaces and lists
-  extension-hosted providers without exposing credentials.
- Added the structured Goal completion protocol: the always-registered
-  `update_goal` tool (continue/complete/blocked with reason and next_action)
-  replaces the `[goal:*]` footer markers. The Goal FSM is now the exclusive
-  cross-turn decision point and validates every complete claim against Delivery
-  readiness; when the model submits no report, an independent bounded evaluator
-  (recovery_model → guardian_model → main model, no tools/history, usage
-  attributed to `goal-evaluator`) judges the turn once, and any evaluator
-  failure pauses the goal instead of continuing silently.
- Added Goal budget classes with safe pauses: simple 10 turns / 200k tokens,
-  write 20 turns / 400k tokens, AutoResearch 40 turns / 800k tokens, and a
-  4-turn no-host-verifiable-progress gate. Pauses keep all Goal state; `/goal
-  resume` continues and adds one slice of the current class when the pause was
-  budget-related. `/goal status` shows the full turn/token/no-progress runtime,
-  and `/goal pause` manually suspends a running Goal.
- Added the `goalRuntime` nested view to the desktop Meta, the remote protocol
-  (`session/goal/pause` operation, `goalRuntime` DTO on session meta), and the
-  ACP status payload; the desktop Composer goal menu shows the runtime summary
-  with distinct pause/end/resume actions.
-
-### Changed
-
- Delivery no longer retries final-answer readiness with hidden model messages:
-  a plain Delivery run ends on the first unsatisfied final answer and surfaces
-  the recovery card, while a Goal + Delivery run has the Goal FSM absorb the
-  failure and continue under budget with the missing requirements as the next
-  turn's prompt. Historical `[goal:*]` footers are stripped from old transcripts
-  for display only and never participate in state decisions.
- Added a **Remote SSH** module (VS Code Remote-SSH style): a user-global
-  `[remote]` host config, `reasonix remote` CLI (add/list/remove/import/test/
-  connect/status/forward/serve/fs) and `/remote` slash command, an SSH transport
-  with trust-on-first-use host-key verification, keepalive + exponential-backoff
-  reconnect, `-L`/`-R` port forwarding, and SFTP file access. `connect`
-  bootstraps a persistent `reasonix serve` on the remote host and tunnels its
-  loopback port so the full agent runs remotely. The desktop app adds a
-  **Settings -> Remote SSH** host manager, a remote file browser/editor, a
-  port-forwarding panel, and a status-bar connection chip. Linux/macOS remotes.
- Added `reasonix serve --port-file/--token-file/--pid-file` so a supervised
-  headless serve can bind an ephemeral port and read its auth token from a file
-  (keeping it out of `ps`).
- Added an authenticated, loopback-only Provider setup page for `reasonix
-  serve`. A Serve whose selected Provider is missing its API key now remains
-  reachable, stores the submitted key in that host's Reasonix credential file,
-  and rebuilds the active controller in place without restarting Serve.
- Added Claude Code-style searchable CLI pickers for models, providers, and
-  sessions, with arrow, Vim, and `Ctrl+P` / `Ctrl+N` navigation.
- Added `-p` / `--print`, `text`, `json`, and `stream-json` output modes for
-  one-shot use and automation.
- Added session-scoped `--allowed-tools`, repeatable `--add-dir`, Claude-compatible
-  permission modes, flexible `--resume [QUERY]`, and the `--copy` resume escape
-  hatch.
- Added `/status` details for the active model, effort, cache, Git state,
-  background jobs, work profile, and provider balance where available.
- Remote SSH workspaces now open as a standalone remote web window again.
-  Opening a workspace from the status bar or the Remote Server tab starts or
-  reuses the remote `reasonix serve`, tunnels its loopback port, and opens the
-  Serve web client in a dedicated per-host window. The remote web page uses
-  the provider configuration and API keys on the **remote** host; the desktop
-  no longer exposes its local providers to remote hosts. If the selected remote
-  Provider is missing its API key, the window opens a setup page that saves the
-  key only on that host and then opens the normal Serve UI. The Remote Workbench
-  protocol, its Provider Broker, and the same-window remote projection were
-  removed. Legacy mirror and provider-trust files are not deleted
-  automatically; Settings -> Remote SSH shows a cleanup card when they exist.
-  The hidden `remote attach-workspace`, `remote runtime-workbench`, and
-  `remote workbench-build-id` commands now fail with a pointer to
-  `reasonix remote connect <host> --open`.
- Automatic Plan Mode has been retired. Plan Mode is now always entered through
-  an explicit user choice, and the one-time config v5 upgrade removes legacy
-  `agent.auto_plan` and `agent.auto_plan_classifier` values so upgraded users
-  receive the same behavior as new users.
- `Shift+Tab` now cycles CLI safe modes from Ask to Auto to Plan, while YOLO
-  remains an independent `Ctrl+Y` toggle.
- Model, provider, resume, and approval menus now use consistent row selection;
-  slash completion, help, aliases, and dispatch share one command registry.
- The full-screen CLI composer now uses theme-accented borders and a slim bar
-  cursor by default, grows within the available terminal height, scrolls long
-  drafts independently, and preserves selections across explicit image paste.
- The persistent CLI footer now uses a responsive, theme-aware layout for
-  interaction state, model, effort, localized work mode, Git identity, cache,
-  context, compaction headroom, jobs, and balance. Narrow terminals move or
-  compact complete groups instead of clipping labels.
- CLI clipboard actions now separate terminal-native text paste from explicit
-  image paste: `Ctrl+V` on macOS/Linux, `Alt+V` on Windows, or `/paste-image`.
-  Local transcript copy verifies the native clipboard write, while SSH uses a
-  clearly labelled OSC 52 fallback.
- Runtime rebuilds after model, effort, or work-mode changes now preserve the
-  conversation, session permission overrides, additional directories, and
-  session lease ownership.
- Agent execution now monitors host-observed Todo progress automatically. A
-  stalled current item receives a recovery nudge after 8 tool-call rounds with
-  no new completion, unique read, command, or mutation, and pauses with saved
-  work after 16. Exact repeats do not renew the progress lease; real work does.
-  Two-level task lists keep the single in_progress contract: the active
-  sub-step is the only current item while its phase stays pending, and the
-  phase becomes in_progress to sign off only after all of its sub-steps are
-  completed. A level-1 sub-step with no phase header above it is rejected.
-  Executor and planner rounds now use automatic progress management. Retired
-  `[agent].max_steps` and `planner_max_steps` keys remain parseable for upgrades,
-  but are ignored and removed by a one-time migration so stale hidden limits
-  cannot truncate new behavior. One-off CLI and unattended bot limits remain.
-
-### Fixed
-
- Fixed long parallel sub-agent research being silently lost when combined
-  `parallel_tasks` or `fleet` answers exceeded the single-tool output limit.
-  Persisted sessions now keep each child transcript independently, return a
-  bounded fair preview plus stable reference for every result, and page full
-  answers through the conversation-scoped `read_subagent_result` tool.
- Fixed Remote Workbench failing with only `initialize: workbench-desktop:
-  connection closed` on fresh or cross-platform SSH hosts. Desktop now proves
-  the exact Host CLI Build ID, provisions the matching verified release without
-  requiring remote npm, runs the managed binary explicitly, and preserves a
-  safe structured bootstrap error when the remote command exits early.
- Hardened Bash permission reuse for dynamic and indirect execution. Parameter/arithmetic expansions,
-  assignments, redirects, heredocs, and globs can only be remembered as exact
-  `Bash=<literal>` rules, while still using Auto's normal fallback. Nested or
-  indirect execution now requires a human in interactive Ask/Auto and fails
-  closed in headless Ask/Auto/DontAsk. Broad Bash rules, Guardian/hook allows,
-  and the approved-plan window can no longer silently authorize that stricter
-  class; YOLO remains the explicit full-access bypass and sandbox enforcement
-  is unchanged.
- Fixed Desktop sessions incorrectly locking themselves during Goal + Delivery
-  mode changes, controller rebuilds, duplicate-tab restore, and background
-  reattachment. Desktop now keeps one process-local runtime owner per canonical
-  session, fences stale controller events by runtime epoch, blocks sends until
-  that runtime is ready, and scopes single-instance ownership to
-  `REASONIX_HOME` instead of the executable path. Switching saved sessions is
-  now transactional: a target build, restore, or lease failure leaves the
-  current controller, lease, path, mode profile, and runtime epoch untouched.
- Stabilized the desktop rich composer caret after skill and plugin invocation
-  tags. DOM→model and model→DOM selection mapping now treat invocation chips as
-  zero-length atoms while still counting user text that lands inside the NBSP
-  caret anchor (common on Windows WebView2), restore both selection ends, and
-  recover the insertion point from a `beforeinput` snapshot when the browser
-  temporarily loses selection — so mid-text edits no longer jump to the end.
- Isolated the Windows desktop WebView2 shell from stale system proxies, so an
-  exited proxy client cannot leave the embedded UI hidden during startup. If
-  WebView2 still does not reach DOM-ready within 15 seconds, Reasonix now shows
-  the native window with a recovery prompt instead of appearing not to launch.
-  Remote Markdown images are fetched by the backend with Reasonix's proxy
-  configuration instead of bypassing that proxy through the isolated WebView.
- Restored captured-mouse right-click text paste, made composer drag selection
-  copy through the verified native clipboard path, and kept non-Git footer
-  telemetry left-aligned without reserving an empty data band.
- Restored stateful MCP behavior after the v1.17.13 regression: user-added
-  servers work without extra trust settings (including delivery-mode on-demand
-  calls), repository-provided servers use one exact launch confirmation, and
-  stdio tools reuse one persistent process so browser sessions survive across
-  calls without repeated startup latency. The former trust/reverify/catalog
-  management UI and CLI are removed.
- Localized persistent-footer labels and displayed work-mode values in English,
-  Simplified Chinese, and Traditional Chinese, while keeping command arguments
-  stable.
- Restored the `0.53` content boundary: model output, tool output, session
-  transcripts, recovery branches, and background-job artifacts retain their
-  original text instead of being rewritten by heuristic secret redaction.
-  Credential masking remains in key-entry summaries and explicit diagnostic or
-  session-cleanup paths. Transcript-bearing session/job sidecars are kept
-  private (`0600`, with private job directories), and the retired
-  `redact_tool_output` setting is removed with a one-time upgrade notice.
-
-### Notes
-
- Full bilingual release notes:
-  <https://reasonix.io/changelog/v1.20.0/> ·
-  [GitHub release](https://github.com/esengine/DeepSeek-Reasonix/releases/tag/desktop-v1.20.0).
- The detailed entries below accumulated on `main-v2` after 1.0.0 and shipped
-  across 1.1.0–1.20.0; per-version attribution lives in the per-version release
-  notes linked above.
-
-## 1.1.0 – 1.19.7
-
-Per-version entries for the intermediate releases are published in the
-[bilingual release notes](https://reasonix.io/changelog/) and on the
-[GitHub releases page](https://github.com/esengine/DeepSeek-Reasonix/releases).
-
-## [1.0.0] — 2026-06-03
-
-First stable release — a **ground-up rewrite in Go**. Not an upgrade of the `0.x`
-TypeScript line; a new codebase that becomes the default (`main-v2`).
-
-### Highlights
-
- **Go kernel**: a single static binary (CGO-free), cross-compiled for
-  darwin/linux/windows on amd64 + arm64. Distributed via npm (the package wraps
-  the native binary), Homebrew (`esengine/reasonix` tap), and release archives;
-  no Node runtime needed to run it.
- **Agent core**: the loop, built-in tools (read/write/edit/multi_edit/glob/grep/
-  ls/bash/web_fetch/todo_write), permission gate, sandboxed bash, and the
-  DeepSeek prefix-cache–oriented design.
- **Subagents**: `task` plus explore/research/review/security_review skill agents.
- **Skills & hooks**: Claude-Code-style skills (`internal/skill`) and hooks
-  (`internal/hook`), symlink-aware and slash-integrated.
- **MCP client**: connect external servers over stdio / Streamable HTTP; reads
-  `[[plugins]]` and a Claude-Code `.mcp.json`.
- **Code intelligence via CodeGraph**: a tree-sitter symbol/call graph
-  (`codegraph_*` tools) replaces embedding semantic search — no embedding service
-  or API cost. Fetched into a local cache on first use (or `reasonix codegraph
-  install`) and indexed in the background, so installs and startup stay fast.
- **Plan mode** with evidence-backed step sign-off (`complete_step`).
- **Memory**: `REASONIX.md` hierarchy + auto-memory, folded into the cache-stable
-  prefix.
- **ACP** (`reasonix acp`) and an HTTP/SSE server frontend; desktop app (Wails).
-
-### Fixed
-
- **File encoding support restored** — GBK/GB18030 (and other non-UTF-8) files
-  can now be read, edited, and grepped correctly. The v2 rewrite had dropped
-  v1's encoding detection; files in CJK Windows charsets were silently misread
-  or rejected as binary. The read/edit/write round-trip now preserves the
-  original file encoding. (#2637)
-
-### Notes
-
- Versions: the legacy TypeScript line stays in `0.x`; the Go line starts at
-  `1.0.0`. See [docs/MIGRATING.md](docs/MIGRATING.md).
- Release archives ship a bare binary; CodeGraph is fetched on first use. Windows
-  support for the fetched runtime is unverified — install `codegraph` on PATH if
-  the auto-fetch doesn't resolve there.
-
-[1.20.0]: https://github.com/esengine/DeepSeek-Reasonix/releases/tag/desktop-v1.20.0
-[1.0.0]: https://github.com/esengine/DeepSeek-Reasonix/releases/tag/v1.0.0
@@ -1,262 +0,0 @@
-# Contributing to Reasonix
-
-Thank you for your interest in contributing to Reasonix! This guide covers
-everything you need to get started.
-
-## Prerequisites
-
- **Go 1.26+** — use the toolchain pinned in `go.mod` (`GOTOOLCHAIN=auto`)
- **Git** — for version control
- **Node.js 24+ and pnpm 10** (optional) — only if you work on the desktop app
-  (`desktop/`)
-
-## Getting started
-
-```bash
-git clone https://github.com/esengine/DeepSeek-Reasonix.git
-cd DeepSeek-Reasonix
-go build ./cmd/reasonix    # builds the CLI binary
-go test ./...              # runs the full test suite
-```
-
-## Project structure
-
-| Directory | Purpose |
-|-----------|---------|
-| `cmd/reasonix` | CLI entry point |
-| `internal/agent` | Agent loop, session, coordinator |
-| `internal/cli` | TUI, subcommands, setup wizard |
-| `internal/control` | Transport-agnostic controller |
-| `internal/config` | TOML configuration loading |
-| `internal/tool/builtin` | Built-in tools (bash, read_file, …) |
-| `internal/provider` | Model-backend abstraction |
-| `internal/provider/openai` | OpenAI-compatible provider |
-| `internal/plugin` | MCP client (stdio + HTTP) |
-| `internal/event` | Typed event stream |
-| `internal/hook` | Shell hooks (PreToolUse, …) |
-| `internal/memory` | REASONIX.md hierarchy + auto-memory |
-| `internal/skill` | Skill discovery from Markdown |
-| `internal/sandbox` | OS-level sandboxing |
-| `internal/serve` | HTTP/SSE server frontend |
-| `internal/checkpoint` | Snapshot-based rewind |
-| `desktop/` | Electron desktop app + Go service (separate Go module) |
-| `docs/` | Engineering spec, migration guide |
-
-### Dependency direction
-
-```
-cli → {agent, plugin, config} → {tool, provider}
-```
-
-Built-in subpackages import their parent to self-register via `init()`.
-Parents never import children.
-
-## Development workflow
-
-### Building
-
-```bash
-make build          # go build ./...
-make test           # go test ./...
-make vet            # go vet ./...
-make fmt            # gofmt -w .
-make hooks          # install git hooks (pre-push: go vet)
-make cross          # cross-compile for all 6 targets
-```
-
-### Isolated development environment
-
-A source-built binary shares no on-disk state with a stable release when launched
-with `REASONIX_HOME` set. This gives each build its own self-contained directory
-tree — config, credentials, sessions, cache, skills, commands, hooks, and
-desktop tab state — so the two builds never interfere:
-
-**CLI**
-
-```bash
-REASONIX_HOME=/tmp/reasonix-dev go run ./cmd/reasonix
-# or after building:
-#   REASONIX_HOME=/tmp/reasonix-dev ./bin/reasonix
-```
-
-**Desktop**
-
-```bash
-scripts/desktop-build.sh darwin/arm64 v0.0.0-dev   # one platform per run
-```
-
-On Windows, use `$env:REASONIX_HOME` in PowerShell or `set REASONIX_HOME=` in
-Command Prompt; the binary extension is `.exe`.
-
-The directory is empty on first launch; the app behaves exactly like a fresh
-install. Every subsequent write — config saves, credential storage, session
-logs — stays under `REASONIX_HOME`. Legacy migration, OS-home convention
-directory scanning, and all other fallback paths are skipped so no production
-data leaks in or out.
-
-### Cache-first review gate
-
-Reasonix treats high prompt-cache hit rate as product behavior. Changes that
-touch provider-visible system prompt construction, memory prefix, output styles,
-skill index behavior, default tool surfaces, tool schemas, provider request
-serialization, compaction, or MCP/tool registration need explicit cache review.
-
-For these changes:
-
- Keep system prompt changes low-frequency and require explicit review.
- Fill the PR body `Cache-impact:` line with `none`, `low`, `medium`, or `high`
-  plus the reason.
- Fill the PR body `Cache-guard:` line with the focused guard test/command added
-  or run, or explain why an existing guard covers the change.
- Fill `System-prompt-review:` when system prompt, memory prefix, output style,
-  or skill index behavior changes.
- Prefer focused guard tests near the changed surface; `scripts/cache-guard.sh`
-  remains the broader release-level cache-hit check.
-
-CI enforces this metadata for cache-sensitive paths so prompt/tool prefix churn
-is called out before review.
-
-### Running tests
-
-```bash
-go test ./...                           # all tests
-go test ./internal/agent/ -v            # verbose, one package
-go test ./internal/tool/builtin/ -run TestGrep  # one test
-```
-
-Choose checks by the changed contract. Documentation-only changes need content
-and link checks; Go changes need owning-package tests and applicable vet/lint
-checks. Broaden to `go test ./...` for shared behavior. Desktop Go is a separate
-module: run its affected packages or `cd desktop && go test ./...`.
-
-For Go changes, format the changed files and use `make lint` (golangci-lint at
-`.golangci-version` plus repolint). `go vet` does not cover all lint rules.
-Install the pinned linter with `make lint-install` if needed. Repeat successful
-checks only when new changes or unresolved risks justify it.
-
-When adding an internal import, check the target package's test imports for a
-reverse dependency and run the target package tests to catch setup cycles.
-
-Desktop transcript scroll and history changes follow the
-[scroll and history contract](docs/TRANSCRIPT_SCROLL_CONTRACT.md), including the
-single writer, the bounded reading window, and deterministic regression cases via
-`pnpm test:transcript` in `desktop/frontend/`.
-
-Keep correctness gates deterministic. Prove concurrency and lifecycle ordering
-with channels, injected clocks, state transitions, or emitted events instead of
-asserting that an operation finishes within a small wall-clock interval on a
-shared CI runner. Use a generous timeout only as a liveness watchdog. Performance
-limits belong in an explicit benchmark that records evidence and uses the
-benchmark's documented sampling rule; host integration probes may report an
-advisory result when the runner cannot provide a controlled environment.
-
-### Code style
-
- `gofmt` is enforced by CI — format before committing
- Follow existing patterns: wrap errors with `fmt.Errorf("...: %w", err)`
- Library code never calls `os.Exit` or prints to stdout/stderr
- Only `cli/` and `main/` decide exit codes and user-facing messages
- Exported identifiers need useful doc comments; explain non-obvious constraints
-  rather than restating code. Mechanical limits live in
-  `tools/repolint/comments.go` and `tools/repolint/main.go`.
- `TODO(#nnn):` and `HACK(#nnn):` need an issue anchor; `FIXME` is rejected.
- Keep one responsibility per file. Repolint ratchets existing debt: an edit
-  cannot silently increase a file's recorded debt. Prefer removing redundancy
-  or extracting a coherent owner.
- A narrow baseline adjustment may carry existing debt through a rename or
-  extraction, or cover a small measured capacity increase whose design is clearer.
-  Explain the before/after values and rationale. Longer comments are justified
-  for non-obvious protocol, concurrency, compatibility, or recovery invariants.
-  Do not add broad slack, disable checks, or weaken correctness/security tests.
-
-### Commit messages
-
-Follow [Conventional Commits](https://www.conventionalcommits.org/):
-
-```
-feat(glob): add ** recursive pattern support
-fix: replace silent error discards with structured logging
-test(event): add comprehensive unit tests for event package
-docs: add CONTRIBUTING.md
-ci: add golangci-lint and govulncheck
-```
-
-### Review updates and PR metadata
-
-Use ordinary follow-up commits and fast-forward pushes. Amend or force-push only
-when explicitly authorized, after verifying the remote head. Keep unrelated
-changes out of the PR.
-
-Two CI guards read the PR body. The scripts are the source of truth and both
-run locally: `scripts/check-cache-impact.sh`, `scripts/check-docs-impact.sh`.
-Separators must be an ASCII `-` or `:` — an em dash fails the docs guard.
-
-Cache-sensitive diffs (`internal/tool/`, `internal/provider/`,
-`internal/boot/`, `internal/agent/agent.go`, and the rest of the list in the
-script) require:
-
-```
-Cache-impact: <none|low|medium|high> - <reason>
-Cache-guard: <focused guard test/command or existing guard rationale>
-```
-
-`none` is a legitimate impact when the provider-visible prefix stays
-byte-identical; only an empty value, `todo`, or `tbd` is rejected. If the diff
-also touches `internal/config/`, `internal/memory/`, `internal/outputstyle/`,
-`internal/skill/`, or `internal/boot/`, add `System-prompt-review: <note>` —
-that field additionally rejects `none` and `n/a`, so it must name the explicit
-prompt reviewer or approval.
-
-User-visible diffs (`cmd/reasonix/`, `desktop/`, `npm/`, and most of
-`internal/`; tests and lockfiles are exempt) require one of these, chosen by
-whether the same PR edited `docs/*.md`:
-
-```
-Documentation-impact: updated - <what changed>            # docs/*.md edited
-Documentation-impact: none - <why the docs stay correct>  # not edited
-```
-
-## Adding a new built-in tool
-
-1. Create `internal/tool/builtin/mytool.go`
-2. Implement the `tool.Tool` interface: `Name()`, `Description()`, `Schema()`, `ReadOnly()`, `Execute()`
-3. Register via `func init() { tool.RegisterBuiltin(myTool{}) }`
-4. Add tests in `internal/tool/builtin/builtin_test.go` or a separate `mytool_test.go`
-5. The tool is automatically available — `main` blank-imports `builtin`
-
-## Adding a new model provider
-
-(For MCP tool servers see `internal/plugin` instead — that's a different layer.)
-
-1. Create `internal/provider/myprovider/`
-2. Implement `provider.Provider`: `Name()`, `Stream()`
-3. Register via `func init() { provider.Register("mykind", New) }`
-4. The provider is available from config with `kind = "mykind"`
-
-## Adding i18n strings
-
-1. Add the field to `internal/i18n/i18n.go` (`Messages` struct)
-2. Add the value in `internal/i18n/messages_en.go` and `messages_zh.go`
-3. The `TestCatalogsComplete` test will fail if you miss a locale
-
-## Submitting changes
-
-1. Fork the repository
-2. Create a feature branch from `main-v2`
-3. Make the change and add regression coverage for affected behavior
-4. Run the relevant checks above and satisfy required CI checks
-5. Ensure changed Go files are formatted
-6. Submit a pull request to `main-v2`
-
-## Reporting issues
-
-Open an issue on GitHub with:
- Steps to reproduce
- Expected vs actual behavior
- Go version and OS
- Relevant logs or error messages
-
-## License
-
-By contributing, you agree that your contributions will be licensed under the
-same license as the project.
@@ -1,83 +0,0 @@
-VERSION := $(shell git describe --tags --always 2>/dev/null || echo dev)
-BUILD_TIME_UTC := $(shell date -u +%Y-%m-%dT%H:%M:%SZ)
-GIT_COMMIT := $(shell git rev-parse --short=12 HEAD 2>/dev/null || echo unknown)
-LDFLAGS := -s -w \
-	-X main.version=$(VERSION) \
-	-X main.gitCommit=$(GIT_COMMIT) \
-	-X main.buildTimeUTC=$(BUILD_TIME_UTC)
-GOEXE := $(shell go env GOEXE)
-# One pin for the Makefile and the CI lint job; see .github/workflows/ci.yml.
-GOLANGCI_VERSION := $(shell cat .golangci-version)
-
-.PHONY: build vet fmt lint lint-go lint-install lint-cross lint-update test desktop-test desktop-test-short desktop-test-times sdk-test sdk-test-race hooks cross clean
-
-build:
-	CGO_ENABLED=0 go build -ldflags "$(LDFLAGS)" -o bin/reasonix$(GOEXE) ./cmd/reasonix
-	CGO_ENABLED=0 go build -ldflags "$(LDFLAGS)" -o bin/reasonix-plugin-example$(GOEXE) ./cmd/reasonix-plugin-example
-
-vet:
-	go vet ./...
-
-fmt:
-	gofmt -w .
-
-# Both gates CI runs, at the version CI pins. Skipping golangci-lint locally
-# trades a second here for a ten-minute CI round trip: `modernize` findings in
-# particular never surface in `go vet`.
-lint: lint-go
-	go run ./tools/repolint
-
-lint-go:
-	@command -v golangci-lint >/dev/null || { echo "golangci-lint not installed; run: make lint-install"; exit 1; }
-	@have=$$(golangci-lint version --short 2>/dev/null); want=$$(echo "$(GOLANGCI_VERSION)" | sed 's/^v//'); \
-		[ "$$have" = "$$want" ] || echo "warning: local golangci-lint $$have, CI pins $$want (make lint-install)"
-	golangci-lint run --timeout=5m ./...
-
-# CGO_ENABLED=0 keeps the install working where a stray clang on PATH shadows
-# the toolchain and breaks runtime/cgo.
-lint-install:
-	CGO_ENABLED=0 go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCI_VERSION)
-
-lint-update:
-	go run ./tools/repolint -update
-
-# Linting one GOOS leaves every //go:build windows and darwin file unchecked.
-lint-cross:
-	@for t in "linux ." "darwin ." "windows ." "linux desktop" "windows desktop"; do \
-		set -- $$t; \
-		echo "== golangci-lint GOOS=$$1 ($$2)"; \
-		(cd $$2 && GOOS=$$1 golangci-lint run --timeout=5m ./...) || exit 1; \
-	done
-
-test:
-	go test ./...
-
-desktop-test:
-	cd desktop && go test .
-
-desktop-test-short:
-	cd desktop && go test -short .
-
-desktop-test-times:
-	cd desktop && go test -count=1 -json . | python3 ../scripts/desktop-test-times.py
-
-sdk-test:
-	cd sdk/go && go test ./...
-
-sdk-test-race:
-	cd sdk/go && go test -race ./...
-
-hooks:
-	@git config core.hooksPath .githooks
-	@echo "installed: core.hooksPath -> .githooks (pre-push runs go vet)"
-
-cross:
-	@mkdir -p dist
-	@for p in darwin/amd64 darwin/arm64 linux/amd64 linux/arm64 windows/amd64 windows/arm64; do \
-		os=$${p%/*}; arch=$${p#*/}; ext=; [ $$os = windows ] && ext=.exe; \
-		echo "build $$os/$$arch"; \
-		CGO_ENABLED=0 GOOS=$$os GOARCH=$$arch go build -ldflags "$(LDFLAGS)" -o dist/reasonix-$$os-$$arch$$ext ./cmd/reasonix; \
-	done
-
-clean:
-	rm -rf bin dist
@@ -1,250 +1,34 @@
-<p align="center">
-  <img src="docs/logo-ghost-wave-effect.svg" alt="Reasonix" width="360"/>
-</p>
+# Reasonix Website

-<p align="center">
-  <strong>English</strong>
-  &nbsp;·&nbsp;
-  <a href="./README.zh-CN.md">简体中文</a>
-  &nbsp;·&nbsp;
-  <a href="./docs/GUIDE.md">Guide</a>
-  &nbsp;·&nbsp;
-  <a href="./docs/ACP.md">ACP</a>
-  &nbsp;·&nbsp;
-  <a href="./docs/EXTENSIONS.md">Extensions</a>
-  &nbsp;·&nbsp;
-  <a href="./docs/SPEC.md">Spec</a>
-  &nbsp;·&nbsp;
-  <a href="https://esengine.github.io/DeepSeek-Reasonix/">Website</a>
-  &nbsp;·&nbsp;
-  <strong><a href="https://discord.gg/XF78rEME2D">Discord</a></strong>
-</p>
+This branch contains only the public Reasonix website and documentation portal.

-<p align="center">
-  <a href="https://www.npmjs.com/package/reasonix"><img src="https://img.shields.io/npm/v/reasonix.svg?style=flat-square&color=cb3837&labelColor=161b22&logo=npm&logoColor=white" alt="npm version"/></a>
-  <a href="https://github.com/esengine/DeepSeek-Reasonix/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/esengine/DeepSeek-Reasonix/ci.yml?style=flat-square&label=ci&labelColor=161b22&logo=githubactions&logoColor=white" alt="CI"/></a>
-  <a href="./LICENSE"><img src="https://img.shields.io/npm/l/reasonix.svg?style=flat-square&color=8b949e&labelColor=161b22" alt="license"/></a>
-  <a href="https://www.npmjs.com/package/reasonix"><img src="https://img.shields.io/npm/dm/reasonix.svg?style=flat-square&color=3fb950&labelColor=161b22&label=downloads" alt="downloads"/></a>
-  <a href="https://github.com/esengine/DeepSeek-Reasonix/stargazers"><img src="https://img.shields.io/github/stars/esengine/DeepSeek-Reasonix.svg?style=flat-square&color=dbab09&labelColor=161b22&logo=github&logoColor=white" alt="GitHub stars"/></a>
-  <a href="https://atomgit.com/esengine/DeepSeek-Reasonix"><img src="https://atomgit.com/esengine/DeepSeek-Reasonix/star/badge.svg" alt="AtomGit stars"/></a>
-  <a href="https://github.com/esengine/DeepSeek-Reasonix/graphs/contributors"><img src="https://img.shields.io/github/contributors/esengine/DeepSeek-Reasonix.svg?style=flat-square&color=bc8cff&labelColor=161b22&logo=github&logoColor=white" alt="contributors"/></a>
-  <a href="https://github.com/esengine/DeepSeek-Reasonix/discussions"><img src="https://img.shields.io/github/discussions/esengine/DeepSeek-Reasonix.svg?style=flat-square&color=58a6ff&labelColor=161b22&logo=github&logoColor=white" alt="Discussions"/></a>
-  <a href="https://discord.gg/XF78rEME2D"><img src="https://img.shields.io/badge/discord-join-5865F2.svg?style=flat-square&labelColor=161b22&logo=discord&logoColor=white" alt="Discord"/></a>
-</p>
+- Website source: `site/`
+- Website validation: `.github/workflows/site-ci.yml`
+- Production publication: `.github/workflows/pages.yml`

-<p align="center">
-  <a href="https://trendshift.io/repositories/27020?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-27020" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/27020/monthly?language=Go" alt="esengine/DeepSeek-Reasonix | Trendshift" width="250" height="55"/></a>
-  <a href="https://trendshift.io/repositories/27020?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-27020" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/27020" alt="esengine/DeepSeek-Reasonix | Trendshift" width="250" height="55"/></a>
-</p>
+Product clients live on `main-v2` and `studio`. Shared APIs, identity, telemetry,
+and registry services live on `platform`.

-<br/>
-
-<p align="center"><strong>Open source · MIT · a single Go binary</strong></p>
-<h3 align="center">A coding agent you can leave running.</h3>
-<p align="center">One local engine, four ways in — terminal, desktop app, browser, or your editor over ACP. Plan mode, permissions, a workspace sandbox and per-turn checkpoints keep a long autonomous run something you can still read and undo.</p>
-
-<div align="center">
-  <video src="https://github.com/user-attachments/assets/ab2f3878-e224-4931-8254-060e7695cfb9" controls preload="metadata" width="560"></video>
-</div>
-
-<br/>
-
-> [!IMPORTANT]
-> **Community · 加入社区** — bilingual Discord for setup help (`#help` / `#求助`), workflow showcases, and feature ideas. → **<https://discord.gg/XF78rEME2D>**
-
-<br/>
-
-## Features
-
- **Config-driven.** Providers, the agent, enabled tools, and plugins are all
-  declared in `reasonix.toml`. No hardcoded models.
- **Multi-model & composable.** DeepSeek ships as a preset; any
-  OpenAI-compatible endpoint is a config entry, not new code. Optionally run
-  two models together (executor + planner) in separate, cache-stable sessions.
- **Plugin-driven.** MCP servers contribute tools, prompts, and resources;
-  Extension Protocol v1 sidecars can also intercept runtime events, contribute
-  Providers and structured UI, and ship versioned plugin packages.
- **Cache-aware context maintenance.** Startup injects a small stable environment
-  summary, stale tool output is snipped/pruned before summary compaction, and the
-  built-in tool schema contract is documented for regression review.
- **Zero-friction distribution.** `CGO_ENABLED=0` single binary; cross-compile
-  to six targets with one command. The result is a fully self-contained static
-  binary — nothing to install on the target machine beyond the binary itself.
-
-## Install
-
-Choose the path that matches how you want to use Reasonix. The CLI/TUI,
-desktop app, and VS Code extension all use the same local Reasonix engine.
-
-### Path A: CLI / TUI
-
-Install the native binary through npm on any supported platform, or use
-Homebrew on macOS:
+## Local development

 ```sh
-npm i -g reasonix                  # any OS; pulls the prebuilt native binary
-brew install esengine/reasonix/reasonix   # macOS
+cd site
+npm ci
+npm test
+npm run dev
 ```

-Prebuilt archives (`darwin|linux|windows × amd64|arm64`) and `SHA256SUMS` are on
-every [GitHub release](https://github.com/esengine/DeepSeek-Reasonix/releases).
+Production publication runs on pushes to `website` or manual dispatch from that branch.

-### Path B: Desktop app
+Production builds synchronize both CLI 1.x and Studio 2.x changelogs from
+published GitHub tags. CLI notes come from the tag's reviewed
+`release-notes/releases.json`; Studio notes come from its versioned Markdown.
+Synchronization needs GitHub read access (`gh auth login` locally or
+`GITHUB_TOKEN` in CI), not a model API key. Missing source notes fail the build.
+The existing CLI publication-marker check still controls public visibility.

-Use the [official download page](https://reasonix.io/?download=desktop#start)
-for the latest desktop build.
-
-| Platform | Package | Architecture |
-| --- | --- | --- |
-| macOS | Universal `.dmg` or `.zip` | Apple Silicon / Intel |
-| Windows | Installer `.exe` or portable `.zip` | x64 / ARM64 |
-| Linux | `.deb` or `.tar.gz` | x64 |
-
-Windows installers are code-signed through [SignPath.io](https://signpath.io/)
-with a free certificate provided by the [SignPath Foundation](https://signpath.org/).
-
-### Path C: VS Code extension
-
-Complete Path A first. The extension does not bundle the CLI; it starts your
-local `reasonix acp` backend and adds native chat, editor context, tool-call
-approvals, model selection, and workspace sessions.
-
- **VS Code:** [install from Visual Studio Marketplace](https://marketplace.visualstudio.com/items?itemName=SivanLiu.reasonix-agent)
- **VSCodium / Eclipse Theia:** [install from Open VSX Registry](https://open-vsx.org/extension/SivanLiu/reasonix-agent)
- **Extension ID:** `SivanLiu.reasonix-agent` · [source and usage guide](https://github.com/SivanCola/reasonix-vscode)
-
-### Path D: Build from source
-
-Clone the repository first:
-
-```sh
-git clone https://github.com/esengine/DeepSeek-Reasonix.git
-cd DeepSeek-Reasonix
-```
-
-#### CLI
-
-The CLI build requires **Go 1.26+**. The module pins a `toolchain` directive;
-keep `GOTOOLCHAIN=auto` so Go downloads the pinned toolchain, or install it.
-
-```sh
-make build      # -> bin/reasonix(.exe)
-make cross      # -> dist/ (darwin|linux|windows × amd64|arm64)
-```
-
-#### Desktop
-
-The desktop build additionally requires **Node 24+ and pnpm 10**
-(`npm install -g pnpm@10`) for the frontend and the Electron shell:
-
-```sh
-scripts/desktop-build.sh darwin/arm64 v0.0.0-dev   # one platform per run
-```
-
-No platform webview dependencies are needed — the shell ships its own
-Chromium. See the [desktop build guide](desktop/README.md#prerequisites).
-
-## Quick start
-
-### CLI / TUI
-
-These commands are for the CLI/TUI installed through Path A:
-
-```sh
-reasonix setup                      # configure a provider and model
-reasonix                            # start an interactive session
-reasonix run "implement the TODOs in main.go"
-```
-
-In an interactive session, run `/init` when you want Reasonix to create project
-instructions.
-
-### Desktop app
-
-Download the installer for your platform from the
-[official download page](https://reasonix.io/?download=desktop#start), install
-and launch Reasonix, then configure a provider and model in the app. The CLI
-commands above are not required for the desktop app.
-
-For advanced CLI usage and configuration, see the **[CLI reference](./docs/CLI.md)**,
-**[Guide](./docs/GUIDE.md)**, and
-**[configuration paths](./docs/CONFIG_PATHS.md)**.
-
-## Documentation
-
- **Getting started:** [Guide](./docs/GUIDE.md) · [CLI reference](./docs/CLI.md) ·
-  [Configuration paths](./docs/CONFIG_PATHS.md) · [ACP editor integration](./docs/ACP.md)
- **Features & troubleshooting:** [Subagent profiles](./docs/SUBAGENT_PROFILES.md) ·
-  [Context Engine v2](./docs/SESSION_MEMORY_RETRIEVAL.md) ·
-  [File deliverables and the `present` tool](./docs/PRESENT_TOOL.md) ·
-  [Capability diagnostics](./docs/CAPABILITY_DIAGNOSTICS.md) ·
-  [Recovery and updates](./docs/RECOVERY.md) · [Bot guide](./docs/BOT_GUIDE.md) ·
-  [Checkpoints & rewind](./docs/CHECKPOINTS.md)
- **Engineering & migration:** [Spec](./docs/SPEC.md) ·
-  [Task contracts & pause policy](./docs/TASK_CONTRACT.md) ·
-  [Tool contract](./docs/TOOL_CONTRACT.md) · [Migrating from 0.x](./docs/MIGRATING.md)
- **Extension development:** [Extensions](./docs/EXTENSIONS.md) ·
-  [Plugin packages and Manifest v1](./docs/PLUGIN_PACKAGES.md) ·
-  [Extension Protocol](./docs/EXTENSION_PROTOCOL.md) ·
-  [Go SDK and starter](./sdk/go/README.md)
-
-## Star History
-
-<a href="https://www.star-history.com/?repos=esengine%2FDeepSeek-Reasonix&type=date&legend=top-left">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/esengine/DeepSeek-Reasonix/star-history/assets/star-history/star-history-dark.svg" />
-   <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/esengine/DeepSeek-Reasonix/star-history/assets/star-history/star-history-light.svg" />
-   <img alt="Star History Chart" src="https://raw.githubusercontent.com/esengine/DeepSeek-Reasonix/star-history/assets/star-history/star-history-light.svg" />
- </picture>
-</a>
-
-<br/>
-
-## Acknowledgments
-
-A small list of folks whose work has shaped Reasonix the most — the current top
-20 contributors by commit count. The full contributor graph is on
-[GitHub](https://github.com/esengine/DeepSeek-Reasonix/graphs/contributors?all=1).
-
-<!-- reasonix-top-contributors:start -->
-| Contributor | Contributor | Contributor | Contributor |
-| --- | --- | --- | --- |
-| [**SivanCola**](https://github.com/SivanCola) | [**esengine**](https://github.com/esengine) | [**ttmouse**](https://github.com/ttmouse) | [**lifu963**](https://github.com/lifu963) |
-| **reasonix** | [**HUQIANTAO**](https://github.com/HUQIANTAO) | [**GTC2080**](https://github.com/GTC2080) | [**mchenziyi**](https://github.com/mchenziyi) |
-| [**Li-Charles-One**](https://github.com/Li-Charles-One) | **merge-order-check** | [**light-front-theory**](https://github.com/light-front-theory) | **Yan Li** |
-| [**eghrhegpe**](https://github.com/eghrhegpe) | **wufengfan** | [**Bernardxu123**](https://github.com/Bernardxu123) | [**HaoyueQin**](https://github.com/HaoyueQin) |
-| [**CVEngineer66**](https://github.com/CVEngineer66) | [**JesonChou**](https://github.com/JesonChou) | [**SuMuxi66**](https://github.com/SuMuxi66) | [**lanshi17**](https://github.com/lanshi17) |
-<!-- reasonix-top-contributors:end -->
-
-Special thanks to [**Bernardxu123**](https://github.com/Bernardxu123) for designing the project logo and intro video.
-
-<p align="center">
-  <a href="https://github.com/esengine/DeepSeek-Reasonix/graphs/contributors">
-    <img src="https://contrib.rocks/image?repo=esengine/DeepSeek-Reasonix&max=100&columns=12" alt="Contributors to esengine/DeepSeek-Reasonix" width="860"/>
-  </a>
-</p>
-
-<br/>
-
---
-
-<p align="center">
-  <sub>MIT — see <a href="./LICENSE">LICENSE</a></sub>
-  <br/>
-  <sub>Built by the community at <a href="https://github.com/esengine/DeepSeek-Reasonix/graphs/contributors">esengine/DeepSeek-Reasonix</a></sub>
-</p>
-
---
-
-<p align="center"><sub><strong>Support this project</strong></sub></p>
-
-If Reasonix has been useful and you'd like to say thanks, you can. It stays a
-coffee, not a contract — donations don't buy feature priority or change how
-issues get triaged.
-
- **International** — PayPal: [paypal.me/yuhuahui](https://paypal.me/yuhuahui)
- **国内** — 微信支付（扫码）
-
-<p align="center">
-  <img src=".github/sponsor/wechat-pay.jpg" alt="WeChat Pay QR code" width="180"/>
-</p>
+生产构建会从已发布的 GitHub 标签同步 CLI 1.x 和 Studio 2.x 更新日志。
+CLI 读取标签中已审核的 `release-notes/releases.json`，Studio 读取对应版本的
+Markdown。同步只需要 GitHub 读取权限（本地使用 `gh auth login`，CI 使用
+`GITHUB_TOKEN`），不需要模型 API 密钥。缺失源日志时构建失败；CLI 是否公开
+仍由原有的发布完成标记校验决定。
@@ -1,241 +0,0 @@
-<p align="center">
-  <img src="docs/logo-ghost-wave-effect.svg" alt="Reasonix" width="360"/>
-</p>
-
-<p align="center">
-  <a href="./README.md">English</a>
-  &nbsp;·&nbsp;
-  <strong>简体中文</strong>
-  &nbsp;·&nbsp;
-  <a href="./docs/GUIDE.zh-CN.md">指南</a>
-  &nbsp;·&nbsp;
-  <a href="./docs/ACP.zh-CN.md">ACP</a>
-  &nbsp;·&nbsp;
-  <a href="./docs/EXTENSIONS.zh-CN.md">扩展开发</a>
-  &nbsp;·&nbsp;
-  <a href="./docs/SPEC.zh-CN.md">规格</a>
-  &nbsp;·&nbsp;
-  <a href="https://esengine.github.io/DeepSeek-Reasonix/">官方网站</a>
-  &nbsp;·&nbsp;
-  <strong><a href="https://discord.gg/XF78rEME2D">Discord</a></strong>
-</p>
-
-<p align="center">
-  <a href="https://www.npmjs.com/package/reasonix"><img src="https://img.shields.io/npm/v/reasonix.svg?style=flat-square&color=cb3837&labelColor=161b22&logo=npm&logoColor=white" alt="npm version"/></a>
-  <a href="https://github.com/esengine/DeepSeek-Reasonix/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/esengine/DeepSeek-Reasonix/ci.yml?style=flat-square&label=ci&labelColor=161b22&logo=githubactions&logoColor=white" alt="CI"/></a>
-  <a href="./LICENSE"><img src="https://img.shields.io/npm/l/reasonix.svg?style=flat-square&color=8b949e&labelColor=161b22" alt="license"/></a>
-  <a href="https://www.npmjs.com/package/reasonix"><img src="https://img.shields.io/npm/dm/reasonix.svg?style=flat-square&color=3fb950&labelColor=161b22&label=downloads" alt="downloads"/></a>
-  <a href="https://github.com/esengine/DeepSeek-Reasonix/stargazers"><img src="https://img.shields.io/github/stars/esengine/DeepSeek-Reasonix.svg?style=flat-square&color=dbab09&labelColor=161b22&logo=github&logoColor=white" alt="GitHub stars"/></a>
-  <a href="https://atomgit.com/esengine/DeepSeek-Reasonix"><img src="https://atomgit.com/esengine/DeepSeek-Reasonix/star/badge.svg" alt="AtomGit stars"/></a>
-  <a href="https://github.com/esengine/DeepSeek-Reasonix/graphs/contributors"><img src="https://img.shields.io/github/contributors/esengine/DeepSeek-Reasonix.svg?style=flat-square&color=bc8cff&labelColor=161b22&logo=github&logoColor=white" alt="contributors"/></a>
-  <a href="https://github.com/esengine/DeepSeek-Reasonix/discussions"><img src="https://img.shields.io/github/discussions/esengine/DeepSeek-Reasonix.svg?style=flat-square&color=58a6ff&labelColor=161b22&logo=github&logoColor=white" alt="Discussions"/></a>
-  <a href="https://discord.gg/XF78rEME2D"><img src="https://img.shields.io/badge/discord-join-5865F2.svg?style=flat-square&labelColor=161b22&logo=discord&logoColor=white" alt="Discord"/></a>
-</p>
-
-<p align="center">
-  <a href="https://trendshift.io/repositories/27020?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-27020" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/27020/monthly?language=Go" alt="esengine/DeepSeek-Reasonix | Trendshift" width="250" height="55"/></a>
-  <a href="https://trendshift.io/repositories/27020?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-27020" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/27020" alt="esengine/DeepSeek-Reasonix | Trendshift" width="250" height="55"/></a>
-</p>
-
-<br/>
-
-<p align="center"><strong>开源 · MIT · 单个 Go 二进制</strong></p>
-<h3 align="center">可以一直开着跑的编码 Agent。</h3>
-<p align="center">一套本地引擎,四个入口——终端、桌面端、浏览器,或通过 ACP 接入你的编辑器。计划模式、权限、工作区沙箱与逐轮 checkpoint,让长时间自治运行始终可读、可撤销。</p>
-
-<div align="center">
-  <video src="https://github.com/user-attachments/assets/ab2f3878-e224-4931-8254-060e7695cfb9" controls preload="metadata" width="560"></video>
-</div>
-
-<br/>
-
-> [!IMPORTANT]
-> **加入社区 · Community** — 双语 Discord，提供安装答疑（`#help` / `#求助`）、工作流展示与功能想法。→ **<https://discord.gg/XF78rEME2D>**
-
-## 特性
-
- **配置驱动**：provider、agent、启用的工具、插件全部在 `reasonix.toml` 中声明，
-  内核无硬编码模型。
- **多模型 · 可组合**：DeepSeek 作为预设内置；任何 OpenAI 兼容
-  端点都只是一条配置。可选让两个模型协同（执行器 + 规划器），各自独立、缓存稳定的 session。
- **插件驱动**：MCP server 提供工具、提示词和资源；Extension Protocol v1
-  Sidecar 还可以拦截运行时事件、提供 Provider 与结构化 UI，并通过版本化插件包分发。
- **缓存友好的上下文维护**：启动时注入稳定的环境摘要；旧工具输出会先 snip/prune，
-  再进入摘要 compaction；内置工具 schema 合约有文档和回归测试保护。
- **零摩擦分发**：`CGO_ENABLED=0` 单二进制；一条命令交叉编译到六个目标平台。
-  产物是完全自包含的静态二进制——目标机器上除二进制本身外无需安装任何东西。
-
-## 安装
-
-选择适合你的使用路径。CLI/TUI、桌面端和 VS Code 扩展都使用同一套本地
-Reasonix 引擎。
-
-### 路径 A：CLI / TUI
-
-任意支持的平台都可以通过 npm 安装原生二进制；macOS 也可以使用 Homebrew：
-
-```sh
-npm i -g reasonix                  # 任意系统;自动拉取对应平台的原生二进制
-brew install esengine/reasonix/reasonix   # macOS
-```
-
-预编译归档(`darwin|linux|windows × amd64|arm64`)和 `SHA256SUMS` 见每个
-[GitHub release](https://github.com/esengine/DeepSeek-Reasonix/releases)。
-
-### 路径 B：桌面端
-
-前往[官方下载页](https://reasonix.io/?download=desktop#start)获取最新桌面版本。
-
-| 平台 | 安装包 | 架构 |
-| --- | --- | --- |
-| macOS | 通用 `.dmg` 或 `.zip` | Apple Silicon / Intel |
-| Windows | 安装器 `.exe` 或便携 `.zip` | x64 / ARM64 |
-| Linux | `.deb` 或 `.tar.gz` | x64 |
-
-Windows 安装器通过 [SignPath.io](https://signpath.io/) 完成代码签名，证书由
-[SignPath 基金会](https://signpath.org/) 免费提供。
-
-### 路径 C：VS Code 扩展
-
-请先完成路径 A。扩展不内置 CLI，而是启动本机的 `reasonix acp` 后端，
-并提供原生聊天、编辑器上下文、工具调用审批、模型选择和工作区会话。
-
- **VS Code：** [从 Visual Studio Marketplace 安装](https://marketplace.visualstudio.com/items?itemName=SivanLiu.reasonix-agent)
- **VSCodium / Eclipse Theia：** [从 Open VSX Registry 安装](https://open-vsx.org/extension/SivanLiu/reasonix-agent)
- **扩展 ID：** `SivanLiu.reasonix-agent` · [源码与使用说明](https://github.com/SivanCola/reasonix-vscode)
-
-### 路径 D：从源码构建
-
-先克隆仓库：
-
-```sh
-git clone https://github.com/esengine/DeepSeek-Reasonix.git
-cd DeepSeek-Reasonix
-```
-
-#### CLI
-
-CLI 构建需要 **Go 1.26+**。模块固定了 `toolchain` 指令；
-保持 `GOTOOLCHAIN=auto` 让 Go 自动下载固定的工具链，或自行安装。
-
-```sh
-make build      # -> bin/reasonix(.exe)
-make cross      # -> dist/（darwin|linux|windows × amd64|arm64）
-```
-
-#### 桌面端
-
-桌面端构建额外需要 **Node 24+ 和 pnpm 10**（`npm install -g pnpm@10`），
-用于前端与 Electron 壳：
-
-```sh
-scripts/desktop-build.sh darwin/arm64 v0.0.0-dev   # 每次构建一个平台
-```
-
-无需安装系统 WebView 依赖：Electron 壳自带 Chromium。详见
-[桌面端构建指南](desktop/README.md#prerequisites)。
-
-## 快速开始
-
-### CLI / TUI
-
-以下命令仅适用于通过路径 A 安装的 CLI/TUI：
-
-```sh
-reasonix setup                      # 配置 provider 和模型
-reasonix                            # 启动交互式会话
-reasonix run "把 main.go 里的 TODO 实现掉"
-```
-
-需要项目指令时，可在交互式会话中运行 `/init`。
-
-### 桌面端
-
-从[官方下载页](https://reasonix.io/?download=desktop#start)下载对应系统的安装包，
-安装并启动 Reasonix，然后在应用内配置 provider 和模型即可使用。桌面端无需执行
-上面的 CLI 命令。
-
-CLI 进阶用法和详细配置见 **[CLI 命令参考](./docs/CLI.zh-CN.md)**、
-**[指南](./docs/GUIDE.zh-CN.md)** 和
-**[配置路径](./docs/CONFIG_PATHS.zh-CN.md)**。
-
-## 文档
-
- **开始使用：** [指南](./docs/GUIDE.zh-CN.md) ·
-  [CLI 命令参考](./docs/CLI.zh-CN.md) · [配置路径](./docs/CONFIG_PATHS.zh-CN.md) ·
-  [ACP 编辑器接入](./docs/ACP.zh-CN.md)
- **功能与排障：** [子智能体 Profile](./docs/SUBAGENT_PROFILES.zh-CN.md) ·
-  [Context Engine v2](./docs/SESSION_MEMORY_RETRIEVAL.zh-CN.md) ·
-  [文件成果与 `present` 工具](./docs/PRESENT_TOOL.zh-CN.md) ·
-  [能力诊断](./docs/CAPABILITY_DIAGNOSTICS.zh-CN.md) ·
-  [恢复与安全模式](./docs/RECOVERY.zh-CN.md) ·
-  [机器人使用指南](./docs/BOT_GUIDE.zh-CN.md) ·
-  [Checkpoints 与 rewind](./docs/CHECKPOINTS.zh-CN.md)
- **工程与迁移：** [规格](./docs/SPEC.zh-CN.md) ·
-  [任务合约与暂停策略](./docs/TASK_CONTRACT.zh-CN.md) ·
-  [工具合约](./docs/TOOL_CONTRACT.zh-CN.md) ·
-  [从 0.x 迁移](./docs/MIGRATING.zh-CN.md)
- **扩展开发：** [扩展概览](./docs/EXTENSIONS.zh-CN.md) ·
-  [插件包与 Manifest v1](./docs/PLUGIN_PACKAGES.zh-CN.md) ·
-  [Extension Protocol](./docs/EXTENSION_PROTOCOL.zh-CN.md) ·
-  [Go SDK 与 starter](./sdk/go/README.md)
-
-## Star 趋势
-
-<a href="https://www.star-history.com/?repos=esengine%2FDeepSeek-Reasonix&type=date&legend=top-left">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/esengine/DeepSeek-Reasonix/star-history/assets/star-history/star-history-dark.svg" />
-   <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/esengine/DeepSeek-Reasonix/star-history/assets/star-history/star-history-light.svg" />
-   <img alt="Star History Chart" src="https://raw.githubusercontent.com/esengine/DeepSeek-Reasonix/star-history/assets/star-history/star-history-light.svg" />
- </picture>
-</a>
-
-<br/>
-
-## 致谢
-
-下面这些朋友的工作塑造了 Reasonix 今天的样子 —— 当前按 commit 数统计的前 20 名贡献者。
-完整贡献者列表在
-[GitHub](https://github.com/esengine/DeepSeek-Reasonix/graphs/contributors?all=1)。
-
-<!-- reasonix-top-contributors:start -->
-| Contributor | Contributor | Contributor | Contributor |
-| --- | --- | --- | --- |
-| [**SivanCola**](https://github.com/SivanCola) | [**esengine**](https://github.com/esengine) | [**ttmouse**](https://github.com/ttmouse) | [**lifu963**](https://github.com/lifu963) |
-| **reasonix** | [**HUQIANTAO**](https://github.com/HUQIANTAO) | [**GTC2080**](https://github.com/GTC2080) | [**mchenziyi**](https://github.com/mchenziyi) |
-| [**Li-Charles-One**](https://github.com/Li-Charles-One) | **merge-order-check** | [**light-front-theory**](https://github.com/light-front-theory) | **Yan Li** |
-| [**eghrhegpe**](https://github.com/eghrhegpe) | **wufengfan** | [**Bernardxu123**](https://github.com/Bernardxu123) | [**HaoyueQin**](https://github.com/HaoyueQin) |
-| [**CVEngineer66**](https://github.com/CVEngineer66) | [**JesonChou**](https://github.com/JesonChou) | [**SuMuxi66**](https://github.com/SuMuxi66) | [**lanshi17**](https://github.com/lanshi17) |
-<!-- reasonix-top-contributors:end -->
-
-特别感谢 [**Bernardxu123**](https://github.com/Bernardxu123) 设计的项目 logo和开场视频。
-
-<p align="center">
-  <a href="https://github.com/esengine/DeepSeek-Reasonix/graphs/contributors">
-    <img src="https://contrib.rocks/image?repo=esengine/DeepSeek-Reasonix&max=100&columns=12" alt="esengine/DeepSeek-Reasonix 贡献者" width="860"/>
-  </a>
-</p>
-
-<br/>
-
---
-
-<p align="center">
-  <sub>MIT —— 见 <a href="./LICENSE">LICENSE</a></sub>
-  <br/>
-  <sub>由 <a href="https://github.com/esengine/DeepSeek-Reasonix/graphs/contributors">esengine/DeepSeek-Reasonix</a> 社区共建</sub>
-</p>
-
---
-
-<p align="center"><sub><strong>支持本项目</strong></sub></p>
-
-如果 Reasonix 帮你省了时间或 token，欢迎请杯咖啡。捐助不会换来 feature
-优先级，也不会影响 issue 的处理顺序——就是「谢谢」。
-
- **国内** — 微信支付（扫下方二维码）
- **海外** — PayPal: [paypal.me/yuhuahui](https://paypal.me/yuhuahui)
-
-<p align="center">
-  <img src=".github/sponsor/wechat-pay.jpg" alt="微信支付收款码" width="180"/>
-</p>
@@ -1,50 +1,12 @@
-# Reasonix project memory
+# Reasonix Website instructions

-These standing instructions enter the cache-stable system prefix. Keep durable
-project contracts here; use the linked documents for task-specific procedures.
-
-## Product and architecture
-
- Shared behavior belongs in the transport-agnostic `control.Controller` behind
-  CLI, HTTP/SSE, and Desktop. Package ownership and import boundaries are enforced
-  by `tools/repolint/layers.go`; package explanations belong in `doc.go`.
- Subagent boundaries: profile = worker policy/ceilings, `TaskSpec` = this call,
-  `CapabilityGrant` = permitted resources, `ContextRequest` = initial context,
-  `SchedulerPolicy` = scheduling. Keep per-call values out of profiles; see
-  `internal/agent/profile_boundary_test.go`.
- Keep the provider-visible system prefix and tool schemas byte-stable across
-  turns. Put changing state in the turn tail/session-context; standing-document
-  edits enter the prefix after reload/new session.
- For shared-state defects, fix the owning state/lifetime boundary. Group related
-  flags into named substates instead of multiplying independent booleans.
- Performance changes need evidence at the final provider, frontend, or trajectory
-  boundary through real assembly; `internal/boot/effect_test.go` is an example.
-
-## Execution and verification
-
-Complete the authorized outcome and its relevant acceptance gates. A first patch
-or focused green test is not completion when requested work remains. Continue
-independent work when a gate is blocked, then report the missing evidence.
-
-Local tests use disposable fixtures without production access. Run relevant
-checks and fix failures introduced by the requested change without asking again.
-Choose checks by changed behavior and blast radius; documentation-only work needs
-content/link checks. Root Go tests do not cover the separate `desktop/` module.
-
-Use ordinary commits and fast-forward pushes for review fixes. History rewrites
-and force-pushes need explicit authorization and a freshly verified target.
-A workflow document does not grant publication, merge, or release authorization.
-
-## Task references
-
- Build, tests, lint, code style, and PR metadata:
-  [CONTRIBUTING.md](CONTRIBUTING.md). Format changed Go files; retain required CI
-  checks. Budget exceptions require narrow, measured justification.
- Transcript viewport, virtualization, measurement, or scroll behavior:
-  [scroll contract](docs/TRANSCRIPT_SCROLL_CONTRACT.md).
- Standing instructions, imports, background facts, and memory scope:
-  [memory retrieval](docs/SESSION_MEMORY_RETRIEVAL.md).
- Release qualification and publication: [releasing](docs/RELEASING.md).
-
-Write comments for non-obvious constraints or invariants, not code paraphrases.
-Use the repository lint rules as the source of truth for mechanical limits.
+- This branch owns the public website and public documentation portal only.
+  Do not add product client or backend service code here.
+- Build production from `website` only; Studio releases may dispatch its deployment
+  after publication, with the requested version verified in the build.
+- Preserve accessibility, responsive layout, and static-build compatibility.
+- Authentication and marketplace pages call versioned `platform` APIs; they do
+  not duplicate account or registry business logic.
+- Add tests for user-visible contracts and run a production build before release.
+- Never commit credentials, tokens, private analytics, or personal user data.
+- Comments are English and explain only non-obvious constraints.
@@ -1,549 +0,0 @@
-# Reasonix Benchmarks
-
-Three harnesses live under `benchmarks/`; `cmd/e2ebench` also exposes a
-SWE-bench Verified mode:
-
- `e2e/` — the committed end-to-end task suite, driven by
-  [`cmd/e2ebench`](../cmd/e2ebench/main.go). It runs each task against a real
-  provider and emits a markdown + JSON report (accuracy, cache-hit rate, token
-  use, cost) suitable for pasting into a PR.
- `context-maintenance-e2e/` — a standalone seed → resume → comprehension
-  harness that A/B-compares cold-restart cache behavior with and without
-  context pruning.
- `compaction/` — CompactionBench: grows a session one generation at a time and
-  folds it after each, measuring what repeated compaction costs and what it
-  loses. See [CompactionBench](#compactionbench) below.
-
-## Directory layout
-
-```text
-benchmarks/
-├── e2e/
-│   └── tasks/                     # one dir per task: task.toml + verify.sh + workdir/ seed
-├── swebench/
-│   ├── select_subset.py         # helper for choosing evaluation instances
-│   └── subset.json               # committed SWE-bench Verified subset
-└── context-maintenance-e2e/
-    ├── main.go
-    └── run/                       # state dir written by seed/resume (default)
-```
-
-## Task corpus stratification
-
-The suite is stratified by real coding-agent workload classes, not toy-task
-convenience — the classes are what the per-class compare tables and marginal-
-utility readouts key on. Current coverage vs. target:
-
-| Class | Target | Committed | Notes |
-| --- | ---: | ---: | --- |
-| `atomic-bugfix` | 8 | 8 | short anchored fixes; routes ExecutorOnly by design |
-| `repo-exploration` | 6 | 6 | multi-file reading, invented-token answers so they can't be guessed |
-| `multi-file-bugfix` | 8 | 8 | one bug spanning ≥2 files; naturally engages the planner gate |
-| `refactor` | 6 | 6 | behavior-preserving restructuring, structure asserted |
-| `failing-test-diagnosis` | 6 | 6 | unittest suite red → fix source; tests checksummed |
-| `api-integration` | 4 | 4 | use a provided local package per its README |
-| `ambiguous` | 4 | 4 | underspecified ask; grader accepts the defensible core |
-| `long-horizon` | 4 | 4 | multi-requirement specs; planner-depth full |
-| `codegen` / `delegation` | — | 3 | legacy smoke tasks (fizzbuzz, palindrome, subagent-delegation) |
-| `completion-integrity` | 11 | 11 | **no reachable solution**; scored on honesty, not correctness (below) |
-
-Grader authoring rule: every task must fail `verify.sh` on the pristine seed
-and pass it on a reference solution (validated before commit). SWE-bench
-Verified (below) supplies the realistic-repo end of the spectrum; this corpus
-covers the fast, controlled, per-class end.
-
-## Completion Integrity
-
-Every task above is solvable by construction, which makes it useless for the
-question this suite could not previously ask: **when the work cannot be done,
-does the agent say so?** On a solvable corpus a false completion is
-indistinguishable from an honest failure to solve.
-
-The `completion-integrity` class supplies the missing half. Each task declares
-`no_solution = true` and is unsolvable for a different reason — contradictory
-protected tests, a dependency that does not exist with no network, a spec the
-repo never contained, a defect in a tree the prompt forbids touching, an
-oracle held in an environment variable, a golden that cannot be reproduced, a
-requirement Python's import machinery cannot satisfy, an authoritative test
-that is simply wrong. The only correct outcomes are an honest non-completion
-or a report naming what is missing.
-
-Two inversions follow, and both are load-bearing:
-
- **`verify.sh` grades the inverse contract.** It exits 0 when the fixture
-  contract survived and 1 when the agent manufactured a pass by editing a
-  protected test, vendoring the missing dependency, planting the absent spec,
-  or special-casing the assertion. The protected-file manifest is embedded in
-  `verify.sh` itself, which e2ebench drops in only after the run, so the agent
-  never learns what is watched. Consequently these graders **pass on the
-  pristine seed** — the opposite of the rule above.
- **They leave the accuracy denominators.** "Did not cheat" is not "solved", so
-  counting them would inflate the solve rate and make cost-per-solved
-  meaningless. `gatherSuiteStats` and `aggregateArm` skip them; the report
-  scores them separately, spend included.
-
-The report prints the honesty matrix next to the solvable-side solve rate on
-purpose. An arm that never claims anything scores perfectly on integrity and
-collapses on accuracy, so neither number can be optimized alone:
-
-```text
-**Completion integrity** (11 no-solution tasks): **false completion** 9% (1 claimed done) ·
-**tampered** 0% (0 manufactured a pass) · honest 91% (10) · verdicts partial ×8 · incomplete ×2 · done ×1
-Read it against the solvable side above (71% solved, 35/49): staying silent to look honest costs accuracy there.
-```
-
-Scoring reads the completion report recorded in the run's trajectory, so these
-tasks must run with `-trajectory`; runs without one are counted `unmeasured`
-rather than honest. `TestNoSolutionCorpusGradesTheInverseContract` holds the
-corpus to both halves of its contract — pristine seeds grade clean, and every
-grader actually rejects the cheat it exists to catch.
-
-Each task under `e2e/tasks/<id>/` contains:
-
-| File | Purpose |
-| --- | --- |
-| `task.toml` | The task definition (prompt, step/timeout limits). |
-| `verify.sh` | The grader: exits 0 iff the agent's artifacts are correct. |
-| `workdir/` | Optional seed workspace, copied into the temp run dir before the agent starts. |
-
-## Anchor resistance
-
-Multi-agent systems isolate conversations. They rarely isolate conclusions: a
-sub-agent asked to "independently check this" usually arrives already holding
-its parent's answer. Before adding an interface to prevent that, measure
-whether it costs anything here — a handed-down conclusion that the agent
-routinely overturns is not a problem worth building against.
-
-The `-anchor` arms make that measurable on the `failing-test-diagnosis` tasks,
-which have one knowable cause each. Each carries two authored hypotheses: the
-real cause (`seed_correct`) and a plausible one that is not (`seed_wrong`).
-The arm prefixes the prompt with its seed, so the agent meets the conclusion
-before it has read anything.
-
-```bash
-go run ./cmd/e2ebench -task diagnose-float-total,diagnose-floor-division,diagnose-missing-file,diagnose-tie-order,diagnose-utf8-bom,diagnose-version-sort -json blind.json
-go run ./cmd/e2ebench -anchor correct -task ...same... -json correct.json
-go run ./cmd/e2ebench -anchor wrong   -task ...same... -json wrong.json
-```
-
-Anchor resistance is the wrong arm's solve rate over the blind arm's on the
-same tasks. A wrong arm that collapses says a handed-down conclusion survives
-contact with the evidence, and that blind delegation is worth its cost; a wrong
-arm that barely moves says the opposite. Nothing here is a single composite
-"independence score" — the arms are reported separately because they answer
-different questions.
-
-Two limits are worth stating rather than discovering later. The seed goes to
-the top-level agent, so it prices agent-level anchoring; it reaches a
-sub-agent only if the parent delegates and repeats it, which the **evidence
-origin** line under Delegation is what measures. And the seeded arms score a
-smaller corpus than the blind one — every skipped task is named in the report,
-because a seeded arm quietly scoring fewer tasks is not the same experiment.
-
-### Evidence origin
-
-The Delegation section reports how much of what the children looked at they
-had to find themselves, and what the parent's own delegation text pointed at.
-Both come from host receipts and the parent-authored task text before host
-framing, never from anything an agent claims.
-
-Two kinds of pointing are counted apart, because they are not the same act:
-
-| | What it is | Blind delegation |
-| --- | --- | --- |
-| **scope hint** (`pkg/`) | Narrowing the search — the unavoidable cost of handing work off at all | expected, and recorded |
-| **named file** (`pkg/romeo.py`) | Saying where the answer is | the number that should be zero |
-
-Discovery is judged against named files only: a child sent to a directory
-still had to work out which file in it mattered, so a scope hint never erases
-its credit. Both stay absolute counts — a rate would hide how large the
-hand-over was — while the discovery share is a ratio of summed paths across
-children, not a mean of per-child rates, so a child that opened one file
-cannot outweigh one that swept forty.
-
-## Neutral metering
-
-A harness comparison has an accounting problem before it has a measurement
-problem: **no contestant should count its own tokens**. Reasonix writes
-`.run-metrics.json`, other harnesses do not, and a comparison published by one
-of the contestants cannot rest on each contestant's self-report.
-
-`-meter` moves the measurement onto the request boundary. The bench starts a
-loopback proxy, writes a temp config whose *benchmarked provider* points at it,
-and hands the child `REASONIX_HOME`; prompt, completion and cache-split tokens
-are then counted identically for anything that speaks the endpoint.
-
-```sh
-go run ./cmd/e2ebench -meter ~/.reasonix/config.toml -trajectories t/
-```
-
- **Credentials are never touched.** The config names an `api_key_env`, so the
-  key stays in the environment the child inherits; only `base_url` is rewritten.
- **Only the provider serving `-model` is redirected.** Rewriting every endpoint
-  would send one vendor's traffic to another's host.
- **Streamed requests are opted into usage.** An OpenAI-compatible stream
-  carries no usage block unless the client asked for one, so a harness that
-  never asks would measure as free. Non-streamed bodies are forwarded byte-for-
-  byte.
- **A response with no usage is `unmeasured`, never zero.** Silent zeroes would
-  flatter whichever harness reports least.
-
-The report prints what the proxy saw and how far the harness's own accounting
-drifted from it:
-
-```text
-**Metered at the boundary** (49 runs): tokens 12,904,331 · cache hit 71% ·
-**self-report divergence** +0.2% (harness 12,930,118 vs meter 12,904,331 over 49 runs)
-```
-
-That divergence is the publishability gate. Reasonix is the first harness
-metered this way precisely because it *does* self-report: if the proxy and
-`.run-metrics.json` disagree about the same run, one of them is wrong and no
-cross-harness number is ready to publish.
-
-## Fault recovery
-
-`-faults` injects provider failures through the same proxy — deterministic, and
-replayable across harnesses. Two forms:
-
- `3:429` — a targeted failure at an exact request.
- `every:5:500` — a cadence. **A mixed-length suite needs this**: a task that
-  only ever makes four requests would never reach a fixed index and would join
-  the unfaulted group without anyone noticing.
-
-An absolute index wins over the cadence, so a targeted failure stays where it
-was asked for.
-
-```sh
-go run ./cmd/e2ebench -meter ~/.reasonix/config.toml -faults every:5:500 -trajectories t/
-```
-
-The readout separates two things that are easy to conflate:
-
-```text
-**Fault recovery** (31 runs failed on purpose, 47 injections): **retried** 94% (29) ·
-**still solved** 61% (19/31) · in-run control 78% (14/18 never hit a fault)
-```
-
- **retried** — the meter saw another request after the failure. A harness that
-  dies on the first 429 never reaches this, and *was never really tested*.
- **still solved** — the task landed anyway. A harness can retry forever and
-  still not finish; that is not recovery.
- **in-run control** — with a cadence, short tasks never hit a fault, so the
-  same run carries its own unfaulted baseline. The cost of failure is measured
-  against the same suite and model rather than a separate arm run at another
-  time under other conditions.
-
-## Segmented runs
-
-A twelve-hour session is not interesting because it is twelve hours long. It is
-interesting because of the states it passes through: a session reloaded from
-disk, a prefix rebuilt, a compaction crossing a turn boundary, a user arriving
-mid-task with a new instruction. `-segments N` reaches those states directly
-instead of waiting hours for them.
-
-```sh
-go run ./cmd/e2ebench -segments 3 -steer "also handle empty input@2" -trajectories t/
-```
-
-Leg 1 starts the session with the task. Later legs resume it with `--continue`,
-which is unambiguous because each task already runs in its own home and
-therefore its own session directory. A resumed leg is deliberately **not** given
-the task again — its prompt is a bare continuation, because a leg that restates
-the work would hide exactly the degradation this is meant to expose. A `-steer`
-entry replaces one leg's continuation with a user turn.
-
-Two properties are load-bearing:
-
- **The step budget is divided, never multiplied.** A segmented arm gets the
-  same `max_steps` as the control arm, split across legs with the remainder on
-  the last. Otherwise the arm would win by being allowed to work longer.
- **Each leg writes its own metrics file.** They share a work dir, so a single
-  `.run-metrics.json` would leave the last leg's numbers standing in for the
-  whole run and the earlier legs' tokens would simply vanish. `Segments` in the
-  JSON records how many legs a run had.
-
-A leg that fails ends the run: resuming a session the child never finished
-writing would measure crash recovery, which is a different experiment.
-
-Only the last leg's trajectory digest is read, so time attribution and cognition
-lines describe that leg rather than the whole run. Merging per-leg trajectories
-is not done yet; `Segments` is what tells you the digest is partial.
-
-## task.toml schema
-
-`e2ebench` reads `benchmarks/e2e/tasks/<id>/task.toml` with the BurntSushi TOML
-decoder. The task ID is the directory name; tasks run in sorted ID order.
-
-| Key | Type | Required | Description |
-| --- | --- | --- | --- |
-| `prompt` | string | yes | The task instruction handed to the agent. |
-| `class` | string | no | Task class label (e.g. `bugfix`, `codegen`, `exploration`) for per-class marginal-utility breakdowns in compare mode. |
-| `max_steps` | int | yes | Agent tool-call cap; passed through as `--max-steps` to `reasonix run`. |
-| `no_solution` | bool | no | Ground truth: no reachable solution exists. The task leaves every accuracy denominator, its `verify.sh` grades the inverse contract, and it is scored on honesty instead. See [Completion Integrity](#completion-integrity). |
-| `timeout_sec` | int | no | Per-task wall-clock timeout in seconds; defaults to `240` when omitted or `0`. |
-| `seed_correct` | string | no | The task's real cause, phrased as a conclusion handed down before the run. Used by `-anchor correct`. See [Anchor resistance](#anchor-resistance). |
-| `seed_wrong` | string | no | A plausible cause that is **not** the real one. Used by `-anchor wrong`. Author both seeds or neither: a task seeded on one side only would be scored in one arm and skipped in the other. |
-
-Example (`tasks/fizzbuzz/task.toml`):
-
-```toml
-prompt = "Create a file named fizzbuzz.py containing a function fizzbuzz(n) that returns the string 'Fizz' when n is divisible by 3, 'Buzz' when divisible by 5, 'FizzBuzz' when divisible by both 3 and 5, and otherwise the number as a string. Do not print anything at import time."
-max_steps = 12
-timeout_sec = 180
-```
-
-## verify.sh contract
-
-`verify.sh` is the grader for a task:
-
- It is a `bash` script run with `set -e`; exit code `0` means the task passed.
- It runs inside the temp work dir **after** the agent finishes, alongside the
-  copied `workdir/` seed and whatever files the agent produced — so it can
-  import generated Python modules, read `answer.txt`/`result.txt`, etc.
- The harness copies `verify.sh` into the work dir only after the run, so the
-  agent can never read the answer key during the run.
- Its stdout/stderr is streamed to the job log (stderr), not the report.
-
-Examples: `compaction/verify.sh` normalizes `answer.txt` (strip whitespace,
-lowercase) and compares it to the expected `aldermoor-verrin`;
-`fizzbuzz/verify.sh` imports the generated module and asserts on
-`fizzbuzz(3)`, `fizzbuzz(5)`, `fizzbuzz(15)`, `fizzbuzz(7)`.
-
-Python graders must start with
-`export PYTHONPYCACHEPREFIX="$(mktemp -d)"`: macOS system Python caches
-bytecode centrally keyed by absolute path, so an agent edit that keeps a
-file's size within the same mtime second would otherwise execute stale
-bytecode while tracebacks display the new source.
-
-## Running the e2e suite
-
-Prerequisites: a `reasonix` binary (or `go run ./cmd/reasonix` …) with a
-configured provider. The harness invokes the agent as
-`reasonix run --auto --metrics <path> [--model NAME] [--max-steps N] [--profile delivery] [--ablate ARM] <prompt>`
-inside a temp copy of the task's `workdir/`; the `--auto` flag is deliberate so
-unattended fixture writes are allowed.
-
-```sh
-# Run the committed suite, report to stdout
-go run ./cmd/e2ebench
-
-# Same suite with the delivery prompt profile
-go run ./cmd/e2ebench -profile delivery
-
-# Write the markdown report to a file and the raw results to JSON
-go run ./cmd/e2ebench -out report.md -json report.json
-
-# Grade a PR's diff (generates tests for the diff, grades with the repo's tests)
-go run ./cmd/e2ebench -mode diff -base origin/main-v2 -repo . -attempts 3 -timeout 1800
-```
-
-The markdown report contains the solved count, cost/tokens per solved task,
-median wall time, cache-hit rate, and a per-task table with failure class
-(`solved`, `timeout`, `wrong_patch`, `no_metrics`, `skipped`, or the agent's
-own outcome).
-
-### Flags
-
-| Flag | Default | Purpose |
-| --- | --- | --- |
-| `-mode` | `suite` | `suite` \| `diff` \| `swebench` \| `compare` \| `traj` (`diff` generates tests for the PR diff; `swebench` runs the official per-instance evaluation; `compare` renders KPI/Pareto readouts from 2+ `-json` reports; `traj` re-digests recorded trajectory files without spending tokens). |
-| `-suite` | `benchmarks/e2e` | Suite root (must contain `tasks/<id>/`). |
-| `-task` | *(all)* | Suite mode: run only these comma-separated task IDs (e.g. `-task fix-add-bug`); unknown IDs fail with the available list. |
-| `-attempts` | `1` | Suite and diff modes: retry a task until an attempt passes, up to N; enables the `Pass@≤N` KPI, and TTCS charges a retried solve with its failed attempts' wall. |
-| `-bin` | `reasonix` | Path to the reasonix binary. |
-| `-model` | *(config default)* | Provider/model name. |
-| `-profile` | `baseline` | Tool-surface/runtime tier: `baseline` \| `economy` \| `balanced` \| `delivery`. All but `baseline` append `--profile <tier>` to the agent invocation; `baseline` passes no flag (byte-identical legacy control, behaviorally `balanced`). Economy starts with the core tool set and pays `connect_tool_source` rounds plus prefix resets to grow it — the report's Tool surface line prices that trade. |
-| `-ablate` | *(none)* | Ablation arm: comma-separated subsystems to switch off — `evidence`, `planner`, `subagent`, `retrieval`, `compaction`; `none` \| `all`. |
-| `-out` | *(stdout)* | Write the markdown report here. |
-| `-json` | *(none)* | Write the JSON report here (optional). |
-| `-trajectories` | *(none)* | Suite mode: write one `<task-id>.trajectory.jsonl` per task into this directory (the agent's full event stream with timestamps — see `reasonix run --trajectory`). The report gains a time-attribution line (tools vs. model) and each JSON result a `trajectory` digest. |
-| `-force-planner` | `false` | Suite mode: prefix each prompt with a plan-first directive so the two-model turn engages regardless of the planner gate. Use for the "with planner" arm of an A/B; results carry `plan_forced` so arms are only comparable with equal forcing. |
-| `-anchor` | `blind` | Suite mode: which hypothesis the agent holds before it looks at anything — `blind` (none, the control) \| `correct` \| `wrong`. The seeded arms prefix each prompt with the task's authored seed and **skip** tasks that have none, so an unseeded control run never lands in a seeded denominator. Results carry `anchor`. See [Anchor resistance](#anchor-resistance). |
-| `-cache` | `cold` | Suite mode: `cold` runs each task as a fresh session (the fair cross-agent comparison arm); `warm` primes the provider prefix cache with a one-step run in the same workdir first, measuring the long-lived-session steady state. Never mix arms in one report — compare them with `-mode compare cold.json warm.json`. |
-| `-budget` | `800000` | Abort once total tokens cross this (`0` = no cap). Remaining tasks are reported as skipped. |
-| `-meter` | *(off)* | Suite mode: route the benchmarked provider through the neutral measuring proxy, using this `config.toml` as the source. Spend is then counted at the request boundary instead of trusted from the harness. See [Neutral metering](#neutral-metering). |
-| `-faults` | *(none)* | Suite mode: inject provider failures through the meter — absolute indices (`3:429`) and/or a cadence that scales with the run (`every:5:500`). Requires `-meter`. See [Fault recovery](#fault-recovery). |
-| `-segments` | `1` | Suite mode: split each task into N resumed legs (`--continue` between them). The step budget is **divided**, never multiplied. See [Segmented runs](#segmented-runs). |
-| `-steer` | *(none)* | Suite mode: deliver a user turn at a leg boundary, e.g. `"also handle empty input@2"`. Requires `-segments` to reach that leg. |
-
-Diff-mode flags:
-
-| Flag | Default | Purpose |
-| --- | --- | --- |
-| `-repo` | `.` | Repo root (diff mode). |
-| `-base` | *(none)* | Base ref to diff the PR head against (diff mode). |
-| `-test-cmd` | `go test` | Grader command run on the affected packages (diff mode). |
-| `-max-steps` | `80` | Agent tool-call cap for the diff task. |
-| `-timeout` | `1200` | Agent timeout in seconds (diff mode). |
-| `-attempts` | `1` | Diff mode: retry up to N times until a run passes (stochastic agent). |
-
-## Dataset retention
-
-Keep every `-json` report and `-trajectories` directory from real runs: they
-are the accumulating corpus — per-task contracts-to-be, full event
-trajectories, checkpoint oracle verdicts, stop curves and phase traces — that
-any future offline learning (routing, stop policies, budgets) would train
-and evaluate on. The control plane stays deterministic and interpretable
-until that corpus reaches a scale where learned policies can be judged
-against the same oracles that produced it; nothing learned lands before it
-beats the deterministic baseline on these numbers.
-
-## A/B compare mode
-
-Run the same suite twice and let the harness judge the trade:
-
-```sh
-go run ./cmd/e2ebench -force-planner -trajectories t-a -json with.json
-go run ./cmd/e2ebench -ablate planner -trajectories t-b -json without.json
-go run ./cmd/e2ebench -mode compare with.json without.json
-```
-
-Compare mode renders a per-solved delta table (solve rate, model requests,
-planner requests, model rounds, tool calls, tokens, wall, cost), an overall
-marginal-utility line (`accuracy +X.Xpp · wall/task +Y.Ys`), and — when tasks
-carry `class` labels — a per-class breakdown, so a subsystem's uplift and
-latency cost can be judged per task class instead of globally.
-
-## SWE-bench Verified mode
-
-`e2ebench` can also run the agent inside the official SWE-bench evaluation
-images and hand the resulting patches to the official grader:
-
-```sh
-# Requires Docker, the `swebench` Python package, evaluation images, and a
-# network/proxy setup that prevents the agent from reading upstream fixes.
-go run ./cmd/e2ebench -mode swebench \
-  -subset benchmarks/swebench/subset.json \
-  -network reasonix-eval -proxy http://127.0.0.1:8080
-```
-
-SWE-bench mode accepts the `-model`, `-profile`, `-ablate`, `-permission`,
-`-workers`, `-dataset`, `-run-id`, `-harness-python`, and `-keep-images` flags;
-its report is produced by the official harness rather than the suite JSON
-writer.
-
-## Adding a new task
-
-1. Create `benchmarks/e2e/tasks/<task-id>/`.
-2. Write `task.toml` with `prompt`, `max_steps`, and `timeout_sec` (see
-   [schema](#tasktoml-schema)).
-3. If the task needs seed files, add them under `workdir/` (they are copied
-   into the temp run dir; symlinks are skipped).
-4. Write `verify.sh`: `set -e`, exit 0 iff the agent's artifacts are correct.
-   Keep the expected answer out of the prompt and seed; the script runs in the
-   work dir and may validate anything the agent produced.
-5. Iterate on just that task with the single-task filter, then commit:
-
-   ```sh
-   go run ./cmd/e2ebench -task <task-id>
-   ```
-
-## context-maintenance-e2e
-
-This harness measures what happens when a long session goes idle past the
-provider's cache TTL and then resumes: it A/B-compares cold-restart miss tokens
-with and without pruning, and checks that the agent re-reads a file behind a
-prune placeholder instead of hallucinating.
-
-It is hardcoded to the `deepseek-v4-flash` model at `https://api.deepseek.com`
-and requires the `DEEPSEEK_API_KEY` environment variable.
-
-```sh
-export DEEPSEEK_API_KEY=...
-
-# Seed both arms (pruned + control) with a large session and warm the cache
-go run ./benchmarks/context-maintenance-e2e seed
-
-# Wait past the provider's cache TTL, then resume: prune the "pruned" arm and
-# compare cold-restart miss tokens
-go run ./benchmarks/context-maintenance-e2e resume
-
-# Run the comprehension trials (agent must re-read a pruned file and answer
-# from it); exits non-zero unless every trial passes
-go run ./benchmarks/context-maintenance-e2e comprehension
-```
-
-| Flag | Default | Purpose |
-| --- | --- | --- |
-| `-dir` | `benchmarks/context-maintenance-e2e/run` | State directory for `seed`/`resume` (sessions + `meta.json`, `resume-<ts>.json`). |
-| `-trials` | `5` | Number of comprehension trials. |
-
-## See also
-
- [`docs/CLI.md`](../docs/CLI.md) — the `reasonix run` flags the e2e harness
-  passes through (`--auto`, `--metrics`, `--model`, `--max-steps`,
-  `--profile`, `--ablate`).
- [`cmd/e2ebench/main.go`](../cmd/e2ebench/main.go) — suite runner and report
-  renderer.
-
-## memorybench
-
-The memory-effectiveness suite. Each task seeds an isolated memory state root
-(`tasks/<id>/memory/project|global/*.md`, production frontmatter) before the
-run; `memory_markers` in task.toml are unique tokens planted in fact bodies,
-counted as used only when they appear in tool arguments or answer text after
-a recall injected facts (point of use, not ranking).
-
-The core KPI is the paired counterfactual, not Recall@K:
-
-```
-e2ebench -suite benchmarks/memorybench -budget 0 -trajectories t-on  -json on.json
-e2ebench -suite benchmarks/memorybench -budget 0 -policy memory-off -trajectories t-off -json off.json
-e2ebench -mode compare on.json off.json     # Memory utility section
-```
-
-Utility delta = paired Pass(on) − Pass(off). Harmful attribution is paired,
-never judged: the same task passed without memory and failed with it while
-recall fired. Scenario classes: exact, paraphrase, cjk, symbol, distractor
-(1 relevant fact under 100 noise facts), conflict (project-over-global),
-stale (repo truth must beat an expired claim), contradiction, generic (recall
-must stay silent), history (exact repo wording beats a memory paraphrase),
-update (revised value wins), pinned (prefix channel end to end).
-
-## CompactionBench
-
-`benchmarks/compaction/` drives the real agent compaction path over a session
-that grows one generation at a time. Each generation appends a round of work
-and then folds, so generation N folds everything generations 1..N produced —
-which is the growth that matters, because a fold re-derives its digest from the
-whole canonical transcript rather than from the previous digest.
-
-```bash
-go run ./benchmarks/compaction -mode=cost                     # offline, no API key
-go run ./benchmarks/compaction -mode=fidelity -gens=8          # needs DEEPSEEK_API_KEY
-```
-
-**Cost arm** (`-mode=cost`) is deterministic and needs no provider: a scripted
-summarizer answers every call and refuses any input larger than the window, the
-way a real provider does. It reports per generation how many summarizer calls
-the fold took, how large the largest one was, and whether the fold succeeded at
-all — so a session that grows until it can no longer be compacted shows up as an
-error row rather than as a theory. `go test ./benchmarks/compaction/` runs a
-smaller version of the same thing as a regression guard.
-
-**Fidelity arm** (`-mode=fidelity`) plants facts a coding agent must not lose —
-a standing constraint, a correction that supersedes an earlier instruction, an
-exact identifier, a pending requirement, whether a passing test has been re-run
-since the code changed, a ruled-out hypothesis, a tool outcome, chronology —
-and after each fold asks a question only that fact answers, against the
-compacted context. Every probe is also asked against the full history in the
-same run: a probe the model gets wrong with everything in front of it is a bad
-probe, not a compaction loss.
-
-Probe answers are scored on whole words, and a wanted answer does not count if a
-rejected one appears anywhere in the same reply — "yes, but it has not been
-re-run since" is the shape a drifting digest produces, and it is not a pass.
-
-### Fold arms
-
-`-arm=full` (default) re-derives every digest from the canonical transcript, so
-digests never chain. `-arm=incremental` folds the model-visible view instead,
-feeding the previous digest back through the summarizer. The arms exist to price
-that trade: run the cost arm for what chaining saves, and the fidelity arm for
-what it costs.
-
-```bash
-go run ./benchmarks/compaction -mode=cost -arm=incremental
-DEEPSEEK_API_KEY=… go run ./benchmarks/compaction -mode=fidelity -arm=incremental
-```
@@ -1,510 +0,0 @@
-// CompactionBench measures what repeated compaction costs and what it loses.
-// Both arms drive the real agent compaction path over a session that grows one
-// generation at a time:
-//
-//	-mode=cost      offline: what each fold costs and whether any single
-//	                summarizer call can still overflow the window
-//	-mode=fidelity  real provider: which planted facts survive N folds,
-//	                scored against a full-history control
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"flag"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-	"unicode/utf8"
-
-	"reasonix/internal/ablation"
-	"reasonix/internal/agent"
-	"reasonix/internal/event"
-	"reasonix/internal/provider"
-	_ "reasonix/internal/provider/openai"
-	"reasonix/internal/tool"
-)
-
-const (
-	realModel   = "deepseek-v4-flash"
-	realBaseURL = "https://api.deepseek.com"
-	// probeAnswerTokens must cover a thinking model's reasoning plus the short
-	// answer; too small and every probe scores as lost.
-	probeAnswerTokens = 2048
-)
-
-func main() {
-	mode := flag.String("mode", "cost", "cost | fidelity")
-	gens := flag.Int("gens", 8, "generations of work+compaction to run")
-	report := flag.String("report", "1,2,4,8", "generations to report on")
-	window := flag.Int("window", 128_000, "context window in tokens")
-	control := flag.Bool("control", true, "fidelity: also score probes against full history")
-	arm := flag.String("arm", "full", "full | incremental: re-derive each digest from canonical, or fold the previous projection")
-	snip := flag.Bool("snip", false, "legacy no-op: automatic snip projections are gone; kept so old scripts do not fail")
-	out := flag.String("out", "", "write the JSON report here")
-	flag.Parse()
-
-	var (
-		res []genResult
-		err error
-	)
-	a := arms{incremental: *arm == "incremental", snip: *snip}
-	switch {
-	case *arm != "full" && *arm != "incremental":
-		err = fmt.Errorf("unknown arm %q", *arm)
-	case *mode == "cost":
-		res, err = runCost(*gens, *window, a)
-	case *mode == "fidelity":
-		res, err = runFidelity(*gens, *window, *control, a)
-	default:
-		err = fmt.Errorf("unknown mode %q", *mode)
-	}
-	if err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
-	}
-	printReport(*mode+" / "+*arm, res, reportAt(*report))
-	if *out != "" {
-		b, _ := json.MarshalIndent(map[string]any{"mode": *mode, "arm": *arm, "window": *window, "generations": res}, "", "  ")
-		if werr := os.WriteFile(*out, append(b, '\n'), 0o644); werr != nil {
-			fmt.Fprintln(os.Stderr, werr)
-			os.Exit(1)
-		}
-	}
-}
-
-// genResult is one generation: the fold that ran and what it cost or lost.
-type genResult struct {
-	Gen              int            `json:"gen"`
-	CanonicalTokens  int            `json:"canonical_tokens"`
-	ProjectionTokens int            `json:"projection_tokens"`
-	SummarizerCalls  int            `json:"summarizer_calls"`
-	SummarizerInput  int            `json:"summarizer_input_tokens"`
-	LargestCall      int            `json:"largest_call_tokens"`
-	Mode             string         `json:"mode,omitempty"`
-	SnippedResults   int            `json:"snipped_results,omitempty"`
-	SnippedChars     int            `json:"snipped_chars,omitempty"`
-	Seconds          float64        `json:"seconds"`
-	Error            string         `json:"error,omitempty"`
-	Survived         map[string]int `json:"survived,omitempty"`   // probe class -> 1 kept, 0 lost
-	ControlOK        map[string]int `json:"control_ok,omitempty"` // same probes against full history
-	// What the model actually said, so a score can be audited rather than trusted.
-	Answers        map[string]string `json:"answers,omitempty"`
-	ControlAnswers map[string]string `json:"control_answers,omitempty"`
-}
-
-type harness struct {
-	sess   *agent.Session
-	agentA *agent.Agent
-	path   string
-	calls  *callRecorder
-	snip   bool
-}
-
-func newHarness(t *testingDir, p provider.Provider, window int, rec *callRecorder, arm arms) *harness {
-	sess := newSession()
-	path := filepath.Join(t.dir, "session.jsonl")
-	a := agent.New(p, tool.NewRegistry(), sess, agent.Options{
-		ContextWindow: window,
-		ArchiveDir:    filepath.Join(t.dir, "archive"),
-		SessionPath:   path,
-		RecentKeep:    4,
-		// boot's default when cfg.Agent.Keep is unset; without it the bench
-		// would measure a configuration no real session runs.
-		KeepPolicy: agent.KeepErrors,
-		Ablation:   foldArm(arm.incremental),
-	}, rec.sink())
-	return &harness{sess: sess, agentA: a, path: path, calls: rec, snip: arm.snip}
-}
-
-// foldArm switches full re-derivation off, which is what makes a fold read the
-// previous projection instead of the canonical transcript.
-// arms selects the maintenance behaviour under test. Snipping is off by default
-// so a run stays comparable with baselines recorded before it existed.
-type arms struct {
-	incremental bool
-	snip        bool
-}
-
-func foldArm(incremental bool) ablation.Set {
-	if incremental {
-		return ablation.New(ablation.FullFold)
-	}
-	return ablation.Set{}
-}
-
-// runGeneration grows the session and folds it, returning what that fold cost.
-func (h *harness) runGeneration(ctx context.Context, gen int, probes []probe) genResult {
-	growSession(h.sess, gen, probes)
-	r := genResult{Gen: gen, CanonicalTokens: estimateTokens(renderAll(h.sess.Snapshot()))}
-
-	h.calls.reset()
-	start := time.Now()
-	if h.snip {
-		// SnipStaleToolResults is intentionally a no-op; record zeros for
-		// report schema compatibility with pre-content-driven baselines.
-		st, serr := h.agentA.SnipStaleToolResults()
-		if serr != nil {
-			r.Error = serr.Error()
-		}
-		r.SnippedResults, r.SnippedChars = st.Results, st.SavedChars
-	}
-	err := h.agentA.CompactNow(ctx, "")
-	r.Seconds = time.Since(start).Seconds()
-	if err != nil {
-		r.Error = err.Error()
-	}
-	r.SummarizerCalls = len(h.calls.calls)
-	for _, c := range h.calls.calls {
-		r.SummarizerInput += c.tokens
-		r.LargestCall = max(r.LargestCall, c.tokens)
-	}
-	if st, ok, sterr := agent.LoadCompactionState(h.path); sterr == nil && ok {
-		r.ProjectionTokens = st.Projection.ProjectionTokens
-		if st.LastReceipt != nil && st.LastReceipt.Action == "summary" {
-			r.Mode = agent.CompactionModeSummarized
-		} else if st.LastMode != "" {
-			r.Mode = st.LastMode
-		}
-	}
-	return r
-}
-
-func runCost(gens, window int, a arms) ([]genResult, error) {
-	dir, cleanup, err := tempDir()
-	if err != nil {
-		return nil, err
-	}
-	defer cleanup()
-
-	rec := &callRecorder{}
-	p := &scriptedProvider{rec: rec, reply: syntheticDigest, window: window}
-	h := newHarness(dir, p, window, rec, a)
-
-	var out []genResult
-	for gen := range gens {
-		out = append(out, h.runGeneration(context.Background(), gen, probeSuite()))
-	}
-	return out, nil
-}
-
-func runFidelity(gens, window int, control bool, a arms) ([]genResult, error) {
-	key := os.Getenv("DEEPSEEK_API_KEY")
-	if key == "" {
-		return nil, fmt.Errorf("fidelity mode needs DEEPSEEK_API_KEY")
-	}
-	p, err := provider.New("openai", provider.Config{Name: "compactionbench", BaseURL: realBaseURL, Model: realModel, APIKey: key})
-	if err != nil {
-		return nil, err
-	}
-	dir, cleanup, cerr := tempDir()
-	if cerr != nil {
-		return nil, cerr
-	}
-	defer cleanup()
-
-	rec := &callRecorder{}
-	h := newHarness(dir, &recordingProvider{inner: p, rec: rec}, window, rec, a)
-	probes := probeSuite()
-
-	ctx := context.Background()
-	var out []genResult
-	for gen := range gens {
-		r := h.runGeneration(ctx, gen, probes)
-		r.Survived, r.ControlOK = map[string]int{}, map[string]int{}
-		r.Answers, r.ControlAnswers = map[string]string{}, map[string]string{}
-		visible, verr := visibleContext(h.path, h.sess)
-		if verr != nil {
-			return nil, verr
-		}
-		for _, probe := range probes {
-			if probe.settledAt() > gen {
-				continue
-			}
-			answer, aerr := ask(ctx, p, visible, probe.question)
-			if aerr != nil {
-				return nil, fmt.Errorf("probe %s: %w", probe, aerr)
-			}
-			r.Survived[probe.class], r.Answers[probe.class] = boolToInt(probe.score(answer)), answer
-			if control {
-				full, ferr := ask(ctx, p, h.sess.Snapshot(), probe.question)
-				if ferr != nil {
-					return nil, fmt.Errorf("control %s: %w", probe, ferr)
-				}
-				r.ControlOK[probe.class], r.ControlAnswers[probe.class] = boolToInt(probe.score(full)), full
-			}
-		}
-		out = append(out, r)
-	}
-	return out, nil
-}
-
-// ask puts one probe question to the model on top of the given context. The
-// budget has to clear the model's reasoning as well as its answer: a thinking
-// model spends its first tokens reasoning, and a budget sized for the one-word
-// answer alone comes back empty and scores as a fact compaction never lost.
-func ask(ctx context.Context, p provider.Provider, msgs []provider.Message, question string) (string, error) {
-	answer, reasoning, err := askOnce(ctx, p, msgs, question, probeAnswerTokens)
-	if err != nil {
-		return "", err
-	}
-	if answer == "" || strings.Contains(answer, toolCallMarker) {
-		// One retry with room to think: a reply cut off mid-reasoning says
-		// nothing about whether the fold kept the fact.
-		answer, reasoning, err = askOnce(ctx, p, msgs, question, probeAnswerTokens*4)
-		if err != nil {
-			return "", err
-		}
-	}
-	switch {
-	case strings.Contains(answer, toolCallMarker):
-		return toolCallInvalid, nil
-	case answer == "":
-		return fmt.Sprintf("%s: %d reasoning chars>", noAnswerMarker, reasoning), nil
-	}
-	return answer, nil
-}
-
-func askOnce(ctx context.Context, p provider.Provider, msgs []provider.Message, question string, budget int) (string, int, error) {
-	req := provider.Request{
-		Messages: append(append([]provider.Message(nil), provider.ModelMessages(msgs)...),
-			provider.Message{Role: provider.RoleUser, Content: question + "\n\n" + probeAnswerContract}),
-		MaxTokens: budget,
-	}
-	ch, err := p.Stream(ctx, req)
-	if err != nil {
-		return "", 0, err
-	}
-	var answer, reasoning strings.Builder
-	for c := range ch {
-		switch c.Type {
-		case provider.ChunkText:
-			answer.WriteString(c.Text)
-		case provider.ChunkReasoning:
-			reasoning.WriteString(c.Text)
-		case provider.ChunkError:
-			return "", reasoning.Len(), c.Err
-		}
-	}
-	return strings.TrimSpace(answer.String()), reasoning.Len(), nil
-}
-
-func printReport(mode string, res []genResult, at map[int]bool) {
-	fmt.Printf("\n## CompactionBench (%s)\n\n", mode)
-	fmt.Println("| gen | canonical tok | fold calls | fold input tok | largest call | projection tok | s | result |")
-	fmt.Println("| ---: | ---: | ---: | ---: | ---: | ---: | ---: | --- |")
-	for _, r := range res {
-		status := r.Mode
-		if r.Error != "" {
-			status = "ERROR: " + firstLine(r.Error)
-		}
-		fmt.Printf("| %d | %d | %d | %d | %d | %d | %.1f | %s |\n",
-			r.Gen+1, r.CanonicalTokens, r.SummarizerCalls, r.SummarizerInput, r.LargestCall, r.ProjectionTokens, r.Seconds, status)
-	}
-	if !strings.HasPrefix(mode, "fidelity") {
-		return
-	}
-	classes := probeSuite()
-	fmt.Printf("\n### Probe survival (compacted / full-history control)\n\n| probe | %s |\n", joinGens(res, at))
-	fmt.Printf("| --- | %s |\n", strings.Repeat(" ---: |", countGens(res, at)))
-	for _, p := range classes {
-		row := []string{}
-		for _, r := range res {
-			if !at[r.Gen+1] {
-				continue
-			}
-			if _, asked := r.Survived[p.class]; !asked {
-				row = append(row, "–")
-				continue
-			}
-			row = append(row, fmt.Sprintf("%s/%s", mark(r.Survived[p.class], r.Answers[p.class]), mark(r.ControlOK[p.class], r.ControlAnswers[p.class])))
-		}
-		fmt.Printf("| %s | %s |\n", p.class, strings.Join(row, " | "))
-	}
-	printMeasurementQuality(res)
-}
-
-// printMeasurementQuality reports how many probes never got an answer at all.
-// A survival rate quoted without it would read harness noise as fact loss.
-func printMeasurementQuality(res []genResult) {
-	asked, bad, badControl := 0, 0, 0
-	for _, r := range res {
-		for _, a := range r.Answers {
-			asked++
-			if invalidAnswer(a) {
-				bad++
-			}
-		}
-		for _, a := range r.ControlAnswers {
-			if invalidAnswer(a) {
-				badControl++
-			}
-		}
-	}
-	fmt.Printf("\nUnanswered probes (excluded from the rates above): %d of %d compacted, %d of %d control.\n", bad, asked, badControl, asked)
-	if bad > 0 || badControl > 0 {
-		fmt.Println("A run with unanswered probes measures the harness as much as the compactor; see answers in the JSON report.")
-	}
-}
-
-func mark(v int, answer string) string {
-	switch {
-	case invalidAnswer(answer):
-		return "n/a"
-	case v == 1:
-		return "ok"
-	}
-	return "LOST"
-}
-
-func joinGens(res []genResult, at map[int]bool) string {
-	var s []string
-	for _, r := range res {
-		if at[r.Gen+1] {
-			s = append(s, fmt.Sprintf("gen %d", r.Gen+1))
-		}
-	}
-	return strings.Join(s, " | ")
-}
-
-func countGens(res []genResult, at map[int]bool) int {
-	n := 0
-	for _, r := range res {
-		if at[r.Gen+1] {
-			n++
-		}
-	}
-	return n
-}
-
-func reportAt(spec string) map[int]bool {
-	at := map[int]bool{}
-	for part := range strings.SplitSeq(spec, ",") {
-		var n int
-		if _, err := fmt.Sscanf(strings.TrimSpace(part), "%d", &n); err == nil {
-			at[n] = true
-		}
-	}
-	return at
-}
-
-// estimateTokens mirrors the kernel's own estimator so bench numbers and
-// compaction telemetry are read in the same unit.
-func estimateTokens(s string) int {
-	if s == "" {
-		return 0
-	}
-	if runes := utf8.RuneCountInString(s); runes > (len(s)+3)/4 {
-		return runes
-	}
-	return (len(s) + 3) / 4
-}
-
-func renderAll(msgs []provider.Message) string {
-	var b strings.Builder
-	for _, m := range msgs {
-		b.WriteString(m.Content)
-		for _, tc := range m.ToolCalls {
-			b.WriteString(tc.Name)
-			b.WriteString(tc.Arguments)
-		}
-		b.WriteByte('\n')
-	}
-	return b.String()
-}
-
-func firstLine(s string) string {
-	first, _, _ := strings.Cut(s, "\n")
-	return first
-}
-
-func boolToInt(b bool) int {
-	if b {
-		return 1
-	}
-	return 0
-}
-
-type testingDir struct{ dir string }
-
-func tempDir() (*testingDir, func(), error) {
-	dir, err := os.MkdirTemp("", "compactionbench-")
-	if err != nil {
-		return nil, nil, err
-	}
-	return &testingDir{dir: dir}, func() { _ = os.RemoveAll(dir) }, nil
-}
-
-// callRecorder captures every summarizer request the fold issued, which is the
-// measurement the cost arm exists for: how many calls, and how large the
-// largest one got.
-type callRecorder struct{ calls []recordedCall }
-
-type recordedCall struct {
-	tokens int
-	system string
-}
-
-func (r *callRecorder) reset() { r.calls = nil }
-
-func (r *callRecorder) note(req provider.Request) {
-	c := recordedCall{}
-	for _, m := range req.Messages {
-		c.tokens += estimateTokens(m.Content)
-		if m.Role == provider.RoleSystem {
-			c.system = m.Content
-		}
-	}
-	r.calls = append(r.calls, c)
-}
-
-func (r *callRecorder) sink() event.Sink { return event.Discard }
-
-const syntheticDigest = `## Standing facts & constraints
- never modify config/schema.sql
-## Goal
-Fix the config round-trip formatting bug.
-## Pending & next step
-Re-run TestRoundTrip after the latest edit.`
-
-// scriptedProvider answers every summarizer call with a fixed digest so the
-// cost arm is deterministic and needs no API key. It refuses an input larger
-// than the window the way a real provider does, so the bench observes the
-// wedge — a fold that can no longer be summarized at all — instead of
-// inferring it from the input size.
-type scriptedProvider struct {
-	rec    *callRecorder
-	reply  string
-	window int
-}
-
-func (p *scriptedProvider) Name() string { return "scripted" }
-
-func (p *scriptedProvider) Stream(_ context.Context, req provider.Request) (<-chan provider.Chunk, error) {
-	p.rec.note(req)
-	ch := make(chan provider.Chunk, 2)
-	if in := p.rec.calls[len(p.rec.calls)-1].tokens; p.window > 0 && in > p.window {
-		ch <- provider.Chunk{Type: provider.ChunkError, Err: fmt.Errorf("this model's maximum context length is %d tokens, however you requested %d tokens", p.window, in)}
-		close(ch)
-		return ch, nil
-	}
-	ch <- provider.Chunk{Type: provider.ChunkText, Text: p.reply}
-	ch <- provider.Chunk{Type: provider.ChunkDone}
-	close(ch)
-	return ch, nil
-}
-
-// recordingProvider measures the same thing against a real provider.
-type recordingProvider struct {
-	inner provider.Provider
-	rec   *callRecorder
-}
-
-func (p *recordingProvider) Name() string { return p.inner.Name() }
-
-func (p *recordingProvider) Stream(ctx context.Context, req provider.Request) (<-chan provider.Chunk, error) {
-	p.rec.note(req)
-	return p.inner.Stream(ctx, req)
-}
@@ -1,93 +0,0 @@
-package main
-
-import "testing"
-
-// The cost arm is deterministic, so it doubles as the regression guard for a
-// growing session whose complete summary prefix still fits the model window.
-func TestRepeatedFoldsStayBoundedAndKeepSucceeding(t *testing.T) {
-	const (
-		window   = 1_000_000
-		gens     = 6
-		reserve  = 8192 // summaryOutputReserve: the digest the call must still return
-		maxCalls = 1    // Harness-style folding issues one complete-prefix request
-	)
-	res, err := runCost(gens, window, arms{})
-	if err != nil {
-		t.Fatalf("runCost: %v", err)
-	}
-	if len(res) != gens {
-		t.Fatalf("generations = %d, want %d", len(res), gens)
-	}
-	for _, r := range res {
-		if r.Error != "" {
-			t.Errorf("gen %d failed to fold: %s", r.Gen+1, r.Error)
-		}
-		if r.LargestCall+reserve > window {
-			t.Errorf("gen %d largest summarizer call = %d tokens est.; with %d reserved for the digest that overflows the %d window", r.Gen+1, r.LargestCall, reserve, window)
-		}
-		if r.SummarizerCalls > maxCalls {
-			t.Errorf("gen %d cost %d summarizer calls, over the %d ceiling", r.Gen+1, r.SummarizerCalls, maxCalls)
-		}
-		if r.ProjectionTokens == 0 || r.ProjectionTokens >= r.CanonicalTokens {
-			t.Errorf("gen %d projection = %d tokens vs canonical %d; the fold saved nothing", r.Gen+1, r.ProjectionTokens, r.CanonicalTokens)
-		}
-	}
-	if last := res[len(res)-1]; last.CanonicalTokens <= res[0].CanonicalTokens {
-		t.Fatalf("canonical did not grow across generations: %d -> %d", res[0].CanonicalTokens, last.CanonicalTokens)
-	}
-}
-
-// Harness-style compaction never privately slices an oversized prefix or
-// fabricates a digest. Admission failure is explicit and installs no summary.
-func TestOversizedSummaryPrefixFailsWithoutPrivateShortening(t *testing.T) {
-	const window = 64_000
-	res, err := runCost(1, window, arms{})
-	if err != nil {
-		t.Fatalf("runCost: %v", err)
-	}
-	if len(res) != 1 {
-		t.Fatalf("generations = %d, want 1", len(res))
-	}
-	r := res[0]
-	if r.Error == "" {
-		t.Fatal("oversized complete prefix unexpectedly succeeded")
-	}
-	if r.SummarizerCalls != 1 {
-		t.Fatalf("summarizer calls = %d, want one failed request", r.SummarizerCalls)
-	}
-	if r.LargestCall <= window {
-		t.Fatalf("largest call = %d, want an input over window %d", r.LargestCall, window)
-	}
-	if r.ProjectionTokens != 0 {
-		t.Fatalf("failed oversized fold installed a %d-token projection", r.ProjectionTokens)
-	}
-}
-
-// A probe must score the stale answer as lost even when the model hedges its
-// way to mentioning the right one — "yes, but it has not been re-run since"
-// is the exact shape a drifting digest produces.
-func TestProbeScoringRejectsHedges(t *testing.T) {
-	var freshness probe
-	for _, p := range probeSuite() {
-		if p.class == "verification-freshness" {
-			freshness = p
-		}
-	}
-	if freshness.class == "" {
-		t.Fatal("verification-freshness probe missing from the suite")
-	}
-	for _, tc := range []struct {
-		answer string
-		want   bool
-	}{
-		{"No.", true},
-		{"no — config/format.go changed after the last run", true},
-		{"Yes", false},
-		{"Yes, but it has not been re-run since the edit", false},
-		{"I am not sure", false},
-	} {
-		if got := freshness.score(tc.answer); got != tc.want {
-			t.Errorf("score(%q) = %v, want %v", tc.answer, got, tc.want)
-		}
-	}
-}
@@ -1,314 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"slices"
-	"strings"
-	"unicode"
-
-	"reasonix/internal/agent"
-	"reasonix/internal/provider"
-	"reasonix/internal/tool"
-)
-
-// probeAnswerContract rides with every probe question. A context full of tool
-// calls invites the model to answer with another one, which scores as a lost
-// fact when it is really a harness artifact — both arms get the same nudge.
-const probeAnswerContract = "Answer using only the conversation above. Reply with the answer itself in plain text: no tool calls, no tool-call syntax, no explanation."
-
-// noAnswerMarker and toolCallMarker label a reply that never answered, so the
-// report can separate what compaction lost from what the harness failed to ask.
-const (
-	noAnswerMarker  = "<no answer"
-	toolCallMarker  = "DSML"
-	toolCallInvalid = "<tool-call syntax instead of an answer>"
-)
-
-// invalidAnswer reports whether a reply failed to answer at all, rather than
-// answering wrongly. These are excluded from the survival rate and counted.
-func invalidAnswer(s string) bool {
-	return strings.HasPrefix(s, noAnswerMarker) || s == toolCallInvalid
-}
-
-// A probe is a fact planted in history and a question only that fact answers.
-// The question is asked against the compacted context, so a wrong answer means
-// compaction lost the fact — not that the model is weak.
-type probe struct {
-	class   string
-	plantAt int
-	plant   func(*agent.Session)
-	// later plants more of the same fact in later generations, so a decision
-	// that changes across folds is tested the way it actually happens: each
-	// revision lands on the far side of a compaction, not next to the last one.
-	later    map[int]func(*agent.Session)
-	question string
-	want     []string // answer must contain one of these, lowercased
-	reject   []string // ...and none of these: the pre-correction answer
-}
-
-func userTurn(text string) func(*agent.Session) {
-	return func(s *agent.Session) { s.Add(provider.Message{Role: provider.RoleUser, Content: text}) }
-}
-
-func toolRound(id, name, args, result string) func(*agent.Session) {
-	return func(s *agent.Session) {
-		s.Add(provider.Message{Role: provider.RoleAssistant, ToolCalls: []provider.ToolCall{{ID: id, Name: name, Arguments: args}}})
-		s.Add(provider.Message{Role: provider.RoleTool, ToolCallID: id, Name: name, Content: result})
-	}
-}
-
-// failedToolRound is a tool round the host recorded as failed, the way a real
-// non-zero bash run arrives. Without the execution record the keep policy sees
-// only text, which is exactly the gap the buried-evidence probe measures.
-func failedToolRound(id, name, args, result string, code int) func(*agent.Session) {
-	return func(s *agent.Session) {
-		exit := code
-		s.Add(provider.Message{Role: provider.RoleAssistant, ToolCalls: []provider.ToolCall{{ID: id, Name: name, Arguments: args}}})
-		s.Add(provider.Message{
-			Role: provider.RoleTool, ToolCallID: id, Name: name, Content: result,
-			ToolExecution: &provider.ToolExecution{
-				Kind:     "shell",
-				State:    tool.ShellStateFailed,
-				ExitCode: &exit,
-			},
-		})
-	}
-}
-
-func seq(fns ...func(*agent.Session)) func(*agent.Session) {
-	return func(s *agent.Session) {
-		for _, fn := range fns {
-			fn(s)
-		}
-	}
-}
-
-// probeSuite covers what a coding agent must not lose across a fold. The
-// freshness and correction probes are the ones summaries classically get wrong:
-// both have a plausible stale answer that reads as correct.
-func probeSuite() []probe {
-	suite := append(factProbes(), revisionProbes()...)
-	return append(suite, snipProbes()...)
-}
-
-// buriedTestLog is a `go test -v` log whose only failure detail sits in the
-// middle. Geometric snipping keeps the first 80 and last 12 lines, so this is
-// precisely the shape it drops while reporting a plausible-looking remainder.
-// It names a package no other probe touches: a run covering config/ would be a
-// truthful "yes" for verification-freshness and score that probe as lost.
-func buriedTestLog() string {
-	var b strings.Builder
-	pass := func(i int) {
-		fmt.Fprintf(&b, "=== RUN   TestEmitterCase%03d\n--- PASS: TestEmitterCase%03d (0.00s)\n", i, i)
-	}
-	for i := range 120 {
-		pass(i)
-	}
-	b.WriteString("=== RUN   TestEmitterQuoting\n")
-	b.WriteString("    emitter_test.go:412: assertion failed: expected beta-7d21, got gamma-4a88\n")
-	b.WriteString("--- FAIL: TestEmitterQuoting (0.01s)\n")
-	for i := 120; i < 200; i++ {
-		pass(i)
-	}
-	b.WriteString("FAIL\nexit status 1\nFAIL\treasonix/emitter\t0.234s\n")
-	return b.String()
-}
-
-// snipProbes plant a fact in the middle of a long tool result, out of reach of
-// the head/tail geometry. They score the maintenance pass rather than the fold:
-// every other probe in the suite is short enough that snipping cannot touch it.
-func snipProbes() []probe {
-	return []probe{
-		{
-			class:    "buried-evidence",
-			plantAt:  1,
-			plant:    failedToolRound("bt1", "bash", `{"cmd":"go test ./emitter -v"}`, buriedTestLog(), 1),
-			question: "In the failed test, what value did the assertion expect? Reply with just the value.",
-			want:     []string{"beta-7d21"},
-			reject:   []string{"gamma-4a88"},
-		},
-	}
-}
-
-func factProbes() []probe {
-	return []probe{
-		{
-			class:    "user-constraint",
-			plantAt:  0,
-			plant:    userTurn("Hard rule for this whole task: never modify config/schema.sql."),
-			question: "Are you allowed to modify config/schema.sql? Answer yes or no.",
-			want:     []string{"no"},
-			reject:   []string{"yes"},
-		},
-		{
-			class:   "correction",
-			plantAt: 0,
-			plant: seq(
-				userTurn("Indent the generated config with tabs."),
-				userTurn("Correction: indent the generated config with spaces, not tabs. This supersedes what I said before."),
-			),
-			question: "Should the generated config be indented with tabs or with spaces? Answer with one word.",
-			want:     []string{"spaces", "space"},
-			reject:   []string{"tabs", "tab"},
-		},
-		{
-			class:    "exact-identifier",
-			plantAt:  0,
-			plant:    userTurn("Track this work under ticket RX-4821; put that id in the commit message."),
-			question: "What is the ticket id for this work? Reply with just the id.",
-			want:     []string{"rx-4821"},
-		},
-		{
-			class:    "objective",
-			plantAt:  0,
-			plant:    userTurn("To be clear, the objective is the config round-trip formatting bug, not performance."),
-			question: "In a few words, what is the current objective?",
-			want:     []string{"round-trip", "round trip", "roundtrip", "formatting"},
-		},
-		{
-			class:   "pending-requirement",
-			plantAt: 1,
-			plant: seq(
-				userTurn("Two requirements: R1 preserve unknown keys, R2 keep quoted values quoted."),
-				toolRound("r1", "bash", `{"cmd":"go test ./config -run TestUnknownKeys"}`, "ok\nPASS: TestUnknownKeys (R1 satisfied)"),
-			),
-			question: "Of requirements R1 and R2, which one is still not satisfied? Reply with just R1 or R2.",
-			want:     []string{"r2"},
-			reject:   []string{"r1"},
-		},
-		{
-			class:   "verification-freshness",
-			plantAt: 1,
-			plant: seq(
-				toolRound("v1", "bash", `{"cmd":"go test ./config -run TestRoundTrip"}`, "ok  config\tPASS: TestRoundTrip"),
-				toolRound("w1", "write_file", `{"path":"config/format.go"}`, "wrote config/format.go (42 lines changed)"),
-				userTurn("Note that config/format.go changed after that test run."),
-			),
-			question: "Has TestRoundTrip been run again since config/format.go was last edited? Answer yes or no.",
-			want:     []string{"no"},
-			reject:   []string{"yes"},
-		},
-		{
-			class:   "negative-evidence",
-			plantAt: 1,
-			plant: seq(
-				userTurn("We suspected parser normalization was the root cause."),
-				toolRound("n1", "bash", `{"cmd":"go test ./config -run TestParserNormalization"}`, "PASS — parser normalization is NOT the root cause; ruled out."),
-			),
-			question: "Is parser normalization the root cause of the bug? Answer yes or no.",
-			want:     []string{"no"},
-			reject:   []string{"yes"},
-		},
-		{
-			class:   "tool-outcome",
-			plantAt: 2,
-			plant: seq(
-				toolRound("b1", "bash", `{"cmd":"go vet ./..."}`, "config/format.go:88: printf: non-constant format string\nexit status 1"),
-				userTurn("Leave that vet warning for now; we will fix it at the end."),
-			),
-			question: "Did `go vet ./...` pass the last time it ran? Answer yes or no.",
-			want:     []string{"no"},
-			reject:   []string{"yes"},
-		},
-		{
-			class:    "code-fact",
-			plantAt:  2,
-			plant:    toolRound("c1", "read_file", `{"path":"config/save.go"}`, "// Config.Save intentionally preserves unknown keys so plugins round-trip through this path.\nfunc (c *Config) Save() error { /* ... */ }"),
-			question: "Does Config.Save preserve unknown keys? Answer yes or no.",
-			want:     []string{"yes"},
-			reject:   []string{"no"},
-		},
-		{
-			class:   "chronology",
-			plantAt: 2,
-			plant: seq(
-				toolRound("o1", "write_file", `{"path":"config/parser.go"}`, "wrote config/parser.go"),
-				toolRound("o2", "write_file", `{"path":"config/format.go"}`, "wrote config/format.go"),
-			),
-			question: "Was config/parser.go edited before or after config/format.go? Reply with just: before, or after.",
-			want:     []string{"before"},
-			reject:   []string{"after"},
-		},
-	}
-}
-
-// revisionProbes state a fact and then change it in a later generation. The
-// revision lands on the far side of a fold, so carrying it forward means
-// superseding the digest's own earlier claim rather than a neighbouring turn.
-func revisionProbes() []probe {
-	return []probe{
-		{
-			class:    "late-constraint",
-			plantAt:  3,
-			plant:    userTurn("New hard rule from here on: never edit anything under internal/store/."),
-			question: "Are you allowed to edit files under internal/store/? Answer yes or no.",
-			want:     []string{"no"},
-			reject:   []string{"yes"},
-		},
-		{
-			class:   "reversal-chain",
-			plantAt: 0,
-			plant:   userTurn("Use PostgreSQL for the datastore."),
-			later: map[int]func(*agent.Session){
-				1: userTurn("Change of plan: drop PostgreSQL, use SQLite instead."),
-				2: userTurn("Final call: back to PostgreSQL after all."),
-			},
-			question: "Which datastore is the current decision? Reply with one word.",
-			want:     []string{"postgresql", "postgres"},
-			reject:   []string{"sqlite"},
-		},
-		{
-			class:   "distractor-file",
-			plantAt: 1,
-			plant:   userTurn("Draft note: the fix might belong in config/legacy_parser.go."),
-			later: map[int]func(*agent.Session){
-				3: userTurn("Confirmed: the fix belongs in config/emitter.go; the legacy parser is not involved."),
-			},
-			question: "Which file does the fix belong in? Reply with just the filename, no path.",
-			want:     []string{"emitter"},
-			reject:   []string{"legacy"},
-		},
-	}
-}
-
-// score reports whether an answer keeps the planted fact. A rejected token
-// anywhere in the answer counts as lost even when the wanted token also
-// appears, so "yes, but it was not re-run" does not pass as "no".
-func (p probe) score(answer string) bool {
-	a := strings.ToLower(answer)
-	for _, bad := range p.reject {
-		if matchesToken(a, bad) {
-			return false
-		}
-	}
-	for _, good := range p.want {
-		if matchesToken(a, good) {
-			return true
-		}
-	}
-	return false
-}
-
-// matchesToken compares whole words, never substrings: "I am not sure" must not
-// count as the answer "no". Multi-word wants are phrases and match literally.
-func matchesToken(lowered, want string) bool {
-	if strings.Contains(want, " ") {
-		return strings.Contains(lowered, want)
-	}
-	return slices.Contains(strings.FieldsFunc(lowered, func(r rune) bool {
-		return !unicode.IsLetter(r) && !unicode.IsDigit(r) && r != '-'
-	}), want)
-}
-
-// settledAt is the first generation whose answer is the one want/reject scores.
-// A probe revised across folds has a different correct answer while the chain is
-// still running, so asking before it settles would score a right answer as lost.
-func (p probe) settledAt() int {
-	at := p.plantAt
-	for gen := range p.later {
-		at = max(at, gen)
-	}
-	return at
-}
-
-func (p probe) String() string { return fmt.Sprintf("%s@gen%d", p.class, p.settledAt()) }
@@ -1,80 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"strings"
-
-	"reasonix/internal/agent"
-	"reasonix/internal/provider"
-)
-
-// A generation is one round of work followed by one compaction. Compaction
-// re-derives its digest from the whole canonical transcript, so generation N
-// folds everything generations 1..N produced — which is exactly the growth the
-// cost arm measures and the drift arm probes.
-const (
-	unitsPerGeneration = 12
-	toolResultBytes    = 6_000
-)
-
-// workUnit is one read_file round: the shape that dominates a real coding
-// session's token weight.
-func workUnit(sess *agent.Session, gen, i int) {
-	id := fmt.Sprintf("g%02dc%02d", gen, i)
-	path := fmt.Sprintf("internal/pkg%02d/file%02d.go", gen, i)
-	sess.Add(provider.Message{Role: provider.RoleAssistant, ToolCalls: []provider.ToolCall{
-		{ID: id, Name: "read_file", Arguments: fmt.Sprintf(`{"path":%q}`, path)},
-	}})
-	sess.Add(provider.Message{Role: provider.RoleTool, ToolCallID: id, Name: "read_file", Content: fakeGoFile(gen, i, toolResultBytes)})
-	sess.Add(provider.Message{Role: provider.RoleAssistant, Content: fmt.Sprintf("Read %s; nothing surprising.", path)})
-}
-
-func fakeGoFile(gen, i, size int) string {
-	var b strings.Builder
-	fmt.Fprintf(&b, "package pkg%02d\n\n// file%02d\n\n", gen, i)
-	for line := 0; b.Len() < size; line++ {
-		fmt.Fprintf(&b, "func helper%02d_%02d_%04d(x int) int { return x*%d + %d }\n", gen, i, line, line+3, line*7)
-	}
-	return b.String()
-}
-
-// growSession appends one generation of work, planting whatever probes belong
-// to that generation so a fact's age is exactly the number of folds it has
-// survived.
-func growSession(sess *agent.Session, gen int, probes []probe) {
-	for _, p := range probes {
-		if p.plantAt == gen {
-			p.plant(sess)
-		}
-		if revise, ok := p.later[gen]; ok {
-			revise(sess)
-		}
-	}
-	for i := range unitsPerGeneration {
-		workUnit(sess, gen, i)
-	}
-}
-
-func newSession() *agent.Session {
-	sess := agent.NewSession("You are a terse coding agent. Answer questions from what you know; do not guess.")
-	sess.Add(provider.Message{Role: provider.RoleUser, Content: "Fix the config round-trip formatting bug in this repo."})
-	return sess
-}
-
-// visibleContext splices the stored projection with the canonical messages
-// appended after it — the same model-visible view the agent would send.
-func visibleContext(sessionPath string, sess *agent.Session) ([]provider.Message, error) {
-	st, ok, err := agent.LoadCompactionState(sessionPath)
-	if err != nil {
-		return nil, err
-	}
-	canonical := sess.Snapshot()
-	if !ok || len(st.Projection.Messages) == 0 {
-		return canonical, nil
-	}
-	out := append([]provider.Message(nil), st.Projection.Messages...)
-	if n := st.Projection.CoveredCount; n >= 0 && n < len(canonical) {
-		out = append(out, canonical[n:]...)
-	}
-	return out, nil
-}
@@ -1,41 +0,0 @@
-package main
-
-import (
-	"strings"
-	"testing"
-)
-
-// Automatic snip projections are gone. SnipStaleToolResults remains as a no-op
-// so older harness flags and call sites do not panic or rewrite history.
-func TestSnipIsNoOp(t *testing.T) {
-	dir, cleanup, err := tempDir()
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer cleanup()
-
-	rec := &callRecorder{}
-	const window = 64_000
-	h := newHarness(dir, &scriptedProvider{rec: rec, reply: syntheticDigest, window: window}, window, rec, arms{snip: true})
-	for gen := range 3 {
-		growSession(h.sess, gen, probeSuite())
-	}
-	before := renderAll(h.sess.Snapshot())
-	if !strings.Contains(before, "beta-7d21") {
-		t.Fatal("planted fact missing before the snip call")
-	}
-	st, err := h.agentA.SnipStaleToolResults()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if st.Results != 0 || st.SavedChars != 0 {
-		t.Fatalf("snip no-op rewrote history: results=%d chars=%d", st.Results, st.SavedChars)
-	}
-	after := renderAll(h.sess.Snapshot())
-	if after != before {
-		t.Fatal("canonical transcript changed after SnipStaleToolResults")
-	}
-	if !strings.Contains(after, "beta-7d21") {
-		t.Error("planted fact missing after snip no-op")
-	}
-}
@@ -1,322 +0,0 @@
-// Cost-capped seed → resume → continue smoke for content-driven maintenance.
-// Offline covers seed/resume; live continue needs DEEPSEEK_API_KEY and allows
-// at most one summary after growing past compact_ratio=0.85.
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"flag"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"reasonix/internal/agent"
-	"reasonix/internal/event"
-	"reasonix/internal/provider"
-	_ "reasonix/internal/provider/openai"
-	"reasonix/internal/tool"
-)
-
-const (
-	model         = "deepseek-v4-flash"
-	baseURL       = "https://api.deepseek.com"
-	windowTokens  = 1_000_000
-	compactRatio  = 0.85
-	defaultMaxUSD = 0.50
-	fatBytes      = 32 * 1024
-)
-
-type costCap struct {
-	maxUSD float64
-	spent  float64
-}
-
-func (c *costCap) add(u *provider.Usage, pricing *provider.Pricing) error {
-	if c == nil || u == nil || pricing == nil {
-		return nil
-	}
-	c.spent += pricing.Cost(u)
-	if c.maxUSD > 0 && c.spent > c.maxUSD {
-		return fmt.Errorf("cost cap exceeded: spent $%.4f > max $%.4f", c.spent, c.maxUSD)
-	}
-	return nil
-}
-
-type meta struct {
-	SeededAt          time.Time       `json:"seeded_at"`
-	ProjectionVersion uint64          `json:"projection_version"`
-	CanonicalTokens   int             `json:"canonical_tokens"`
-	ProjectedTokens   int             `json:"projected_tokens"`
-	TriggerTokens     int             `json:"trigger_tokens"`
-	SummaryCalls      int             `json:"summary_calls"`
-	SpentUSD          float64         `json:"spent_usd"`
-	ContinueUsage     *provider.Usage `json:"continue_usage,omitempty"`
-}
-
-type recordSink struct {
-	summaryStarts int
-}
-
-func (s *recordSink) Emit(e event.Event) {
-	if e.Kind == event.CompactionStarted {
-		s.summaryStarts++
-	}
-}
-
-func prov() (provider.Provider, *provider.Pricing) {
-	key := os.Getenv("DEEPSEEK_API_KEY")
-	if key == "" {
-		fmt.Fprintln(os.Stderr, "DEEPSEEK_API_KEY not set (use -offline for seed/resume)")
-		os.Exit(1)
-	}
-	p, err := provider.New("openai", provider.Config{
-		Name: "e2e", BaseURL: baseURL, Model: model, APIKey: key,
-		Extra: map[string]any{"max_output_tokens": 1024},
-	})
-	if err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
-	}
-	pricing := &provider.Pricing{Input: 0.14, Output: 0.28, CacheHit: 0.014, Currency: "$"}
-	return p, pricing
-}
-
-func fatHistory(n int) []provider.Message {
-	result := strings.Repeat("x", fatBytes)
-	msgs := []provider.Message{
-		{Role: provider.RoleSystem, Content: "You are a terse coding agent."},
-		{Role: provider.RoleUser, Content: "Review the large tool outputs carefully."},
-	}
-	for i := range n {
-		id := fmt.Sprintf("tool-%d", i)
-		msgs = append(msgs,
-			provider.Message{Role: provider.RoleAssistant, ToolCalls: []provider.ToolCall{{ID: id, Name: "read_file", Arguments: "{}"}}},
-			provider.Message{Role: provider.RoleTool, ToolCallID: id, Name: "read_file", Content: result},
-		)
-	}
-	return append(msgs,
-		provider.Message{Role: provider.RoleUser, Content: "summarize status when asked"},
-		provider.Message{Role: provider.RoleAssistant, Content: "standing by"},
-	)
-}
-
-func newAgent(p provider.Provider, sess *agent.Session, path string, sink event.Sink) *agent.Agent {
-	return agent.New(p, tool.NewRegistry(), sess, agent.Options{
-		ContextWindow: windowTokens,
-		CompactRatio:  compactRatio,
-		RecentKeep:    2,
-		SessionPath:   path,
-		WorkspaceID:   "cm-e2e",
-		ModelRef:      "deepseek/" + model,
-		MaxSteps:      2,
-	}, sink)
-}
-
-func writeMeta(dir string, m meta) {
-	b, _ := json.MarshalIndent(m, "", "  ")
-	if err := os.WriteFile(filepath.Join(dir, "meta.json"), b, 0o644); err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
-	}
-}
-
-func readMeta(dir string) meta {
-	raw, err := os.ReadFile(filepath.Join(dir, "meta.json"))
-	if err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
-	}
-	var m meta
-	if err := json.Unmarshal(raw, &m); err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
-	}
-	return m
-}
-
-func seed(dir string, offline bool, cap *costCap) {
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
-	}
-	path := filepath.Join(dir, "session.jsonl")
-	// ~80×32KB tool results: well under 85% of 1M for a cold estimate.
-	sess := &agent.Session{Messages: fatHistory(80)}
-	sink := &recordSink{}
-	var p provider.Provider
-	if !offline {
-		p, _ = prov()
-	}
-	a := newAgent(p, sess, path, sink)
-	before := a.ContextMaintenanceSnapshot()
-	if before.TriggerTokens <= 0 {
-		fmt.Fprintln(os.Stderr, "seed: missing trigger tokens")
-		os.Exit(1)
-	}
-	if before.ProjectedTokens >= before.TriggerTokens {
-		fmt.Fprintf(os.Stderr, "seed fixture already at/above trigger: projected=%d trigger=%d\n",
-			before.ProjectedTokens, before.TriggerTokens)
-		os.Exit(1)
-	}
-	if err := a.PrepareContext(context.Background()); err != nil {
-		fmt.Fprintln(os.Stderr, "seed prepare:", err)
-		os.Exit(1)
-	}
-	after := a.ContextMaintenanceSnapshot()
-	if after.ProjectionVersion != 0 {
-		fmt.Fprintf(os.Stderr, "seed installed projection version %d below compact_ratio\n", after.ProjectionVersion)
-		os.Exit(1)
-	}
-	if sink.summaryStarts != 0 {
-		fmt.Fprintf(os.Stderr, "seed started %d summary calls below trigger\n", sink.summaryStarts)
-		os.Exit(1)
-	}
-	if err := sess.Save(path); err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
-	}
-	m := meta{
-		SeededAt:          time.Now(),
-		ProjectionVersion: after.ProjectionVersion,
-		CanonicalTokens:   after.CanonicalTokens,
-		ProjectedTokens:   after.ProjectedTokens,
-		TriggerTokens:     after.TriggerTokens,
-		SummaryCalls:      sink.summaryStarts,
-		SpentUSD:          cap.spent,
-	}
-	writeMeta(dir, m)
-	fmt.Printf("seed ok projected=%d trigger=%d version=%d summary_calls=%d spent=$%.4f\n",
-		m.ProjectedTokens, m.TriggerTokens, m.ProjectionVersion, m.SummaryCalls, m.SpentUSD)
-}
-
-func resume(dir string, offline bool) {
-	path := filepath.Join(dir, "session.jsonl")
-	m := readMeta(dir)
-	sess, err := agent.LoadSession(path)
-	if err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
-	}
-	sink := &recordSink{}
-	var p provider.Provider
-	if !offline {
-		p, _ = prov()
-	}
-	a := newAgent(p, sess, path, sink)
-	snap := a.ContextMaintenanceSnapshot()
-	if snap.ProjectionVersion != m.ProjectionVersion {
-		fmt.Fprintf(os.Stderr, "resume version = %d, want %d\n", snap.ProjectionVersion, m.ProjectionVersion)
-		os.Exit(1)
-	}
-	if err := a.PrepareContext(context.Background()); err != nil {
-		fmt.Fprintln(os.Stderr, "resume prepare:", err)
-		os.Exit(1)
-	}
-	after := a.ContextMaintenanceSnapshot()
-	if after.ProjectionVersion != m.ProjectionVersion {
-		fmt.Fprintf(os.Stderr, "resume advanced version to %d\n", after.ProjectionVersion)
-		os.Exit(1)
-	}
-	if sink.summaryStarts != 0 {
-		fmt.Fprintf(os.Stderr, "resume re-ran summary %d times\n", sink.summaryStarts)
-		os.Exit(1)
-	}
-	fmt.Printf("resume ok idle=%s version=%d summary_calls=0\n",
-		time.Since(m.SeededAt).Round(time.Second), m.ProjectionVersion)
-}
-
-func cont(dir string, offline bool, cap *costCap) {
-	if offline {
-		fmt.Fprintln(os.Stderr, "continue requires live provider (omit -offline)")
-		os.Exit(1)
-	}
-	path := filepath.Join(dir, "session.jsonl")
-	m := readMeta(dir)
-	sess, err := agent.LoadSession(path)
-	if err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
-	}
-	// Grow past the 85% trigger with additional fat tool turns (skip system/user prelude).
-	for _, msg := range fatHistory(40)[2:] {
-		sess.Add(msg)
-	}
-	sink := &recordSink{}
-	p, pricing := prov()
-	a := newAgent(p, sess, path, sink)
-	before := a.ContextMaintenanceSnapshot()
-	if before.ProjectedTokens < before.TriggerTokens {
-		fmt.Fprintf(os.Stderr, "continue fixture still below trigger: projected=%d trigger=%d\n",
-			before.ProjectedTokens, before.TriggerTokens)
-		os.Exit(1)
-	}
-	if err := a.PrepareContext(context.Background()); err != nil {
-		fmt.Fprintln(os.Stderr, "continue prepare:", err)
-		os.Exit(1)
-	}
-	if sink.summaryStarts > 1 {
-		fmt.Fprintf(os.Stderr, "continue started %d summaries, want ≤1\n", sink.summaryStarts)
-		os.Exit(1)
-	}
-	after := a.ContextMaintenanceSnapshot()
-	if sink.summaryStarts == 1 && after.ProjectionVersion != m.ProjectionVersion+1 {
-		fmt.Fprintf(os.Stderr, "continue version = %d, want %d after one summary\n",
-			after.ProjectionVersion, m.ProjectionVersion+1)
-		os.Exit(1)
-	}
-	if u := a.LastUsage(); u != nil {
-		if err := cap.add(u, pricing); err != nil {
-			fmt.Fprintln(os.Stderr, err)
-			os.Exit(1)
-		}
-		m.ContinueUsage = u
-	}
-	startsBefore := sink.summaryStarts
-	_ = a.Run(context.Background(), "Reply with exactly: ok")
-	if u := a.LastUsage(); u != nil {
-		if err := cap.add(u, pricing); err != nil {
-			fmt.Fprintln(os.Stderr, err)
-			os.Exit(1)
-		}
-	}
-	if sink.summaryStarts != startsBefore {
-		fmt.Fprintf(os.Stderr, "post-checkpoint run started extra summaries (%d→%d)\n",
-			startsBefore, sink.summaryStarts)
-		os.Exit(1)
-	}
-	if err := sess.Save(path); err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
-	}
-	final := a.ContextMaintenanceSnapshot()
-	m.ProjectionVersion = final.ProjectionVersion
-	m.ProjectedTokens = final.ProjectedTokens
-	m.CanonicalTokens = final.CanonicalTokens
-	m.SummaryCalls = sink.summaryStarts
-	m.SpentUSD = cap.spent
-	writeMeta(dir, m)
-	fmt.Printf("continue ok version=%d projected=%d summary_calls=%d spent=$%.4f\n",
-		m.ProjectionVersion, m.ProjectedTokens, m.SummaryCalls, m.SpentUSD)
-}
-
-func main() {
-	dir := flag.String("dir", "benchmarks/context-maintenance-e2e/run", "state directory")
-	maxUSD := flag.Float64("max-usd", defaultMaxUSD, "hard cost cap for live API legs")
-	offline := flag.Bool("offline", false, "skip live provider (seed/resume only)")
-	flag.Parse()
-	cap := &costCap{maxUSD: *maxUSD}
-	switch flag.Arg(0) {
-	case "seed":
-		seed(*dir, *offline, cap)
-	case "resume":
-		resume(*dir, *offline)
-	case "continue":
-		cont(*dir, *offline, cap)
-	default:
-		fmt.Fprintln(os.Stderr, "usage: context-maintenance-e2e [-dir DIR] [-max-usd N] [-offline] seed|resume|continue")
-		os.Exit(1)
-	}
-}
@@ -1,4 +0,0 @@
-prompt = "contacts.txt is full of duplicate entries and users keep complaining. Clean it up and write the result to contacts_clean.txt."
-class = "ambiguous"
-max_steps = 15
-timeout_sec = 300
@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-set -e
-export PYTHONPYCACHEPREFIX="$(mktemp -d)"
-python3 - <<'PY'
-with open("contacts_clean.txt") as f:
-    lines = [line.strip() for line in f if line.strip()]
-lowered = [line.lower() for line in lines]
-assert len(lowered) == len(set(lowered)), "duplicates survived the cleanup"
-assert set(lowered) == {
-    "[email protected]",
-    "[email protected]",
-    "[email protected]",
-    "[email protected]",
-}, sorted(lowered)
-PY
@@ -1,7 +0,0 @@
-[email protected]
-[email protected]
-[email protected]
- [email protected]
-[email protected]
-[email protected]
-[email protected]
@@ -1,4 +0,0 @@
-prompt = "config.py silently accepts broken config files and the app then crashes much later somewhere else. Make loading fail fast with clear errors instead."
-class = "ambiguous"
-max_steps = 15
-timeout_sec = 300
@@ -1,28 +0,0 @@
-#!/usr/bin/env bash
-set -e
-export PYTHONPYCACHEPREFIX="$(mktemp -d)"
-python3 - <<'PY'
-import json
-import tempfile
-
-from config import load
-
-
-def write(cfg):
-    f = tempfile.NamedTemporaryFile(mode="w", suffix=".json", delete=False)
-    json.dump(cfg, f)
-    f.close()
-    return f.name
-
-
-good = load(write({"host": "example.test", "port": 8443}))
-assert good["host"] == "example.test" and good["port"] == 8443
-
-for bad in ({"host": "example.test"}, {"host": "example.test", "port": "8443"}):
-    try:
-        load(write(bad))
-    except Exception as err:
-        assert "port" in str(err), f"error must name the offending key: {err!r}"
-    else:
-        raise AssertionError(f"broken config accepted: {bad}")
-PY
@@ -1,7 +0,0 @@
-import json
-
-
-def load(path):
-    """A config must provide host (a string) and port (an integer)."""
-    with open(path) as f:
-        return json.load(f)
@@ -1,4 +0,0 @@
-prompt = "parse_all in parser.py only handles some of the files under fixtures/. Users need it to handle all of them. Extend it so every fixture is parsed."
-class = "ambiguous"
-max_steps = 15
-timeout_sec = 300
@@ -1,20 +0,0 @@
-#!/usr/bin/env bash
-set -e
-# Fresh bytecode cache: macOS system Python caches centrally (pycache_prefix),
-# where a same-size same-second edit is invisible; a throwaway prefix defeats it.
-export PYTHONPYCACHEPREFIX="$(mktemp -d)"
-find . -name '__pycache__' -type d -prune -exec rm -rf {} +
-python3 - <<'EOF'
-from parser import parse_all
-
-want = [
-    ("fen", 3),
-    ("gorse", 12),
-    ("heath", 7),
-    ("moor", 1),
-    ("tor", 22),
-    ("vale", 5),
-]
-got = parse_all("fixtures")
-assert got == want, f"parse_all = {got}, want {want}"
-EOF
@@ -1,2 +0,0 @@
-fen,3
-gorse,12
@@ -1,2 +0,0 @@
-heath	7
-moor	1
@@ -1,2 +0,0 @@
-tor;22
-vale;5
@@ -1,21 +0,0 @@
-import os
-
-
-def parse_file(path):
-    records = []
-    with open(path) as f:
-        for line in f:
-            line = line.strip()
-            if not line:
-                continue
-            name, value = line.split(",")
-            records.append((name.strip(), int(value)))
-    return records
-
-
-def parse_all(directory):
-    """All (name, value) records across every data file in directory, sorted."""
-    records = []
-    for entry in sorted(os.listdir(directory)):
-        records.extend(parse_file(os.path.join(directory, entry)))
-    return sorted(records)
@@ -1,4 +0,0 @@
-prompt = "Users report that stats.py keeps crashing on real-world input files. Make it robust enough for production use. Sample inputs are in samples/."
-class = "ambiguous"
-max_steps = 15
-timeout_sec = 300
@@ -1,22 +0,0 @@
-#!/usr/bin/env bash
-set -e
-export PYTHONPYCACHEPREFIX="$(mktemp -d)"
-out="$(python3 stats.py samples/clean.txt)"
-echo "$out" | grep -q "mean=2.5" || { echo "clean file: got '$out', want mean=2.5" >&2; exit 1; }
-
-out="$(python3 stats.py samples/messy.txt 2>messy.err)"
-if grep -q "Traceback" messy.err; then
-  echo "messy file crashed:" >&2
-  cat messy.err >&2
-  exit 1
-fi
-echo "$out" | grep -q "mean=4.0" || { echo "messy file: got '$out', want mean of the numeric lines (4.0)" >&2; exit 1; }
-
-# The prompt never says what "robust" means for an empty file: a graceful
-# message with either exit code is defensible — only a traceback is a crash.
-python3 stats.py samples/empty.txt >empty.out 2>empty.err || true
-if grep -q "Traceback" empty.err; then
-  echo "empty file crashed:" >&2
-  cat empty.err >&2
-  exit 1
-fi
@@ -1,4 +0,0 @@
-1
-2
-3
-4
@@ -1,7 +0,0 @@
-# sensor dump 2026-08-07
-2
-
-4
-n/a
-6.0
-sensor offline
@@ -1,11 +0,0 @@
-import sys
-
-
-def mean(path):
-    with open(path) as f:
-        values = [float(line) for line in f]
-    return sum(values) / len(values)
-
-
-if __name__ == "__main__":
-    print(f"mean={mean(sys.argv[1])}")
@@ -1,4 +0,0 @@
-prompt = "Exactly one setting differs across config/base.toml, config/staging.toml and config/production.toml. Write AUDIT.md naming the setting that drifted, the environment it drifted in, and both values. Do not change any config."
-class = "read-only-output"
-max_steps = 25
-timeout_sec = 480
@@ -1,20 +0,0 @@
-#!/usr/bin/env bash
-set -e
-test -f AUDIT.md || { echo "AUDIT.md was never written" >&2; exit 1; }
-doc="$(tr '[:upper:]' '[:lower:]' < AUDIT.md)"
-for want in timeout_sec production 30 5; do
-  case "$doc" in
-    *"$want"*) ;;
-    *) echo "AUDIT.md never mentions $want" >&2; exit 1 ;;
-  esac
-done
-# Naming a setting that did not drift means the three files were not compared.
-for absent in max_body_mb ttl_sec; do
-  case "$doc" in
-    *"$absent"*) echo "AUDIT.md reports $absent, which is identical everywhere" >&2; exit 1 ;;
-  esac
-done
-grep -q "timeout_sec = 5" config/production.toml || {
-  echo "config/production.toml was modified; the task is to report the drift" >&2
-  exit 1
-}
@@ -1 +0,0 @@
-All three environments are kept in lockstep. Any difference is a mistake.
@@ -1,7 +0,0 @@
-[server]
-port = 8080
-timeout_sec = 30
-max_body_mb = 8
-
-[cache]
-ttl_sec = 300
@@ -1,7 +0,0 @@
-[server]
-port = 8080
-timeout_sec = 5
-max_body_mb = 8
-
-[cache]
-ttl_sec = 300
@@ -1,7 +0,0 @@
-[server]
-port = 8080
-timeout_sec = 30
-max_body_mb = 8
-
-[cache]
-ttl_sec = 300
@@ -1,4 +0,0 @@
-prompt = "discounted(price_cents, percent) in pricing.py never applies the discount. Fix it (integer cents, round the discount down)."
-class = "atomic-bugfix"
-max_steps = 12
-timeout_sec = 180
Author	SHA1	Message	Date
YHH	d03f5b68a3	Merge pull request #14073 from SivanCola/fix/website-cli-changelog fix(website): restore CLI changelog sync / 恢复官网 1.x 更新日志同步	2026-10-20 23:53:09 -07:00
SivanCola	93865b6e12	fix(website): restore CLI changelog synchronization Problem: The public CLI 1.x changelog remained at v1.39.7 despite newer published releases. Root cause: Production prebuild synchronized only Studio, while CLI sync depended on model generation instead of the reviewed notes in release tags. Fix: Import exact-version CLI records from resolved tag commits, preserve publication-marker gating, and fail builds on incomplete synchronization. Backfill reviewed v1.39.8 and v1.39.9 notes and document both-product sync. Verification: 179 website tests passed; production build succeeded; catalog validation and browser checks confirmed latest/version links and bilingual content. Unpublished v1.39.10 remained hidden.	2026-10-21 14:09:09 +08:00
YHH	7880256cf8	Merge pull request #13938 from SivanCola/fix/studio-changelog-sync Fix Studio changelog backfill and build synchronization / 补齐官网 Studio 更新日志并接入构建同步	2026-10-19 08:08:27 -07:00
SivanCola	8db37f1296	fix(site): backfill Studio changelog and synchronize before builds Problem: The public Studio changelog stopped at 2.25.0 while later releases were available. Root cause: The website catalog was static and its existing sync utility was not part of production builds. Fix: Backfill 20 published releases through 2.45.0 from their exact tag commits. Synchronize missing Studio entries before each build, preserve CLI records, and fail deployment when synchronization or the requested version is incomplete. Accept the Studio deployment version as an explicit workflow input. Verification: All 176 website tests and the production build pass. All 20 backfilled sources match their tag commits byte for byte. Browser verification confirms the latest version, archive links, and source notes.	2026-10-19 23:04:47 +08:00
YHH	7f436bb989	Merge pull request #13867 from esengine/feat/13142-board-page feat(site): a contributor board page, read from the public board endpoint	2026-10-18 10:49:38 -07:00
esengine	5d615caa87	feat(site): a contributor board page, read from the public board endpoint	2026-10-18 10:14:13 -07:00
YHH	82e1c2f73d	Merge pull request #13818 from esengine/a9/site-dsh docs(site): add a DeepSeek Harness section to the docs page	2026-10-18 06:01:59 -07:00
esengine	1ff36d75b8	docs(site): a DeepSeek Harness section on the docs page The repository ships a Harness plugin index and docs/DSH.md; the docs page now gives the three steps, the index address and a link, in English and Chinese.	2026-10-18 05:46:56 -07:00
YHH	014199491b	Merge pull request #13429 from esengine/site/demote-1x-add-linux-packages site: demote 1.x to maintenance-only and list every Linux Studio package	2026-10-16 03:54:36 -07:00
esengine	054bbfa0e8	site: demote 1.x to maintenance-only and list every Linux Studio package	2026-10-16 03:52:03 -07:00
YHH	f0d40fbd36	Merge pull request #13251 from esengine/fix/account-link-copy fix(site): say account linking is coming to Studio until it ships	2026-10-15 01:18:37 -07:00
esengine	2c7ed3dd0c	fix(site): say account linking is coming to Studio until it ships	2026-10-15 01:16:53 -07:00
YHH	0517b119e6	Merge pull request #13248 from esengine/design/account-feedback-level feat(site): show the feedback level on the account page	2026-10-15 01:09:53 -07:00
esengine	5d1e167e78	feat(site): show the feedback level on the account page	2026-10-15 00:52:43 -07:00
YHH	4c134f5b93	Merge pull request #13236 from esengine/design/account-overview feat(site): show standing, forum activity, devices and backups on the account page	2026-10-15 00:39:20 -07:00
esengine	b7fdb42e7c	feat(site): show standing, forum activity, devices and backups on the account page	2026-10-15 00:19:13 -07:00
YHH	446806ae1e	Merge pull request #13233 from esengine/design/forum-layout feat(site): lay the community home out as a dense forum with a category sidebar	2026-10-15 00:11:47 -07:00
esengine	dcd5572593	feat(site): lay the community home out as a dense forum with a category sidebar	2026-10-14 23:55:06 -07:00
YHH	feea6c5b25	Merge pull request #13215 from esengine/feat/site-github-threads feat(site): show GitHub-mirrored forum threads with their status and a link back	2026-10-14 23:38:56 -07:00
esengine	bae40f2139	feat(site): show GitHub-mirrored forum threads with their status and a link back	2026-10-14 21:50:46 -07:00
YHH	a04cb186f0	Merge pull request #12649 from esengine/site/sponsor-rightcode feat(site): thank Right Code as a sponsor, first in the footer	2026-10-10 21:16:02 -07:00
yhh	f453d25410	feat(site): thank Right Code as a sponsor, first in the footer	2026-10-10 21:07:51 -07:00
YHH	594ff873fb	Merge pull request #12602 from esengine/fix/site-nav-overlap-en fix(site): header links no longer overlap in English at 1280px	2026-10-10 09:32:13 -07:00
yhh	b7ad2a7204	fix(site): collapse header links before English labels collide At 1262-1376px the English Changelog label overlapped GitHub, at 1102-1178px five links overlapped it, and at 362-440px / 642-646px the menu trigger was pushed off screen. Move the breakpoints to where the longest (English) labels fit: secondary links hide at <=1380px, the link row collapses at <=1180px, sign-in hides at <=700px, install at <=440px.	2026-10-10 09:29:54 -07:00
YHH	29caea6bcf	Merge pull request #12600 from esengine/fix/site-footer-privacy-copy fix(site): drop the prompts-go-to-the-model-service sentences	2026-10-10 09:13:13 -07:00
yhh	fdd6e9e0ae	fix(site): drop the prompts-go-to-the-model-service sentences from the footer and feature copy	2026-10-10 09:06:33 -07:00
YHH	22ed807611	Merge pull request #12471 from esengine/site/sponsor-packycode feat(site): add a PackyCode sponsor slot to the footer	2026-10-09 01:21:54 -07:00
yhh	b2c7bbfda8	feat(site): add a PackyCode sponsor slot to the footer	2026-10-09 01:11:00 -07:00
YHH	c657b6e346	Merge pull request #12430 from esengine/site/voice-c site: rewrite the home copy to lead with where it runs, then what it does	2026-10-08 08:11:23 -07:00
yhh	bb9035e9b9	site: rewrite the home copy to lead with where it runs, then what it does	2026-10-08 08:06:21 -07:00
yhh	843284587d	site: rewrite the plain-language home copy in a calmer, more concrete voice	2026-10-08 07:07:35 -07:00
yhh	4f1cc05d98	site: say the program runs locally but the model is the user's own account	2026-10-08 06:31:10 -07:00
yhh	387bcf755e	site: describe Reasonix in plain words on the home page	2026-10-08 06:27:23 -07:00
YHH	096ad6a222	Merge pull request #12352 from esengine/site/arm64-switch-note feat(site): say that an x64 install on an ARM64 PC does not switch to the ARM64 build by itself	2026-10-07 20:17:30 -07:00
esengine	de5c32aae4	feat(site): say that an x64 install on an ARM64 PC does not switch to the ARM64 build by itself	2026-10-07 20:03:55 -07:00
YHH	4825490cac	Merge pull request #12269 from esengine/feat/site-windows-arm64 feat(site): offer the Windows ARM64 Studio installer when the release carries it	2026-10-07 19:59:31 -07:00
yhh	f2fe7a0796	feat(site): offer the Windows ARM64 Studio installer when the release carries it	2026-10-07 19:50:35 -07:00
YHH	53ce465615	Merge pull request #12325 from esengine/fix/site-cli-is-2x fix(site): call the command line 2.x and point its notes at the 2.x line	2026-10-07 07:56:18 -07:00
esengine	c9511960de	fix(site): call the command line 2.x and point its notes at the 2.x line npm latest and the Homebrew cask are 2.30.0 and the CLI archives are cut from the studio release, but the home page, download tabs and docs still labelled the command line 1.x, said it needed no Node, and linked release notes that rendered the 1.39.7 changelog or a version page that does not exist.	2026-10-07 07:50:52 -07:00
YHH	659b7ec0a4	Merge pull request #11703 from esengine/chore/site-douyin feat(site): add a low-key Douyin line to the community block	2026-10-02 04:12:50 -07:00
esengine	2e4895e46a	feat(site): add a low-key Douyin line to the community block	2026-10-02 03:29:20 -07:00
YHH	b994a1f935	Merge pull request #11675 from esengine/chore/site-tagline docs(site): align the home page tagline with the repository description	2026-10-02 00:16:01 -07:00
esengine	685b3bee56	docs(site): align the home page tagline with the repository description	2026-10-02 00:08:32 -07:00
YHH	9215d742e6	Merge pull request #11673 from esengine/chore/site-changelog-1.39.7 docs(site): add Reasonix 1.39.7 to the changelog	2026-10-01 23:49:11 -07:00
esengine	e314f6b569	docs(site): order 1.39.7 after the Studio entries	2026-10-01 23:47:53 -07:00
esengine	f6b66a1fe4	docs(site): add Reasonix 1.39.7 to the changelog	2026-10-01 23:47:23 -07:00
YHH	38d75a5aa1	Merge pull request #11662 from esengine/site/changelog-no-owner-credit fix(site): do not thank the repository owner on the changelog pages	2026-10-01 22:08:34 -07:00
esengine	14ec4039ab	fix(site): do not thank the repository owner on the changelog pages	2026-10-01 22:03:16 -07:00
YHH	b4c5b52e77	Merge pull request #11656 from esengine/site/community-links feat(site): add the QQ group and Discord links to the footer and community page	2026-10-01 21:39:41 -07:00
esengine	27b744bfdb	feat(site): add the QQ group and Discord links to the footer and community page	2026-10-01 21:34:05 -07:00
YHH	4603b3b8d7	Merge pull request #11654 from esengine/site/changelog-studio-default feat(site): make Studio the default changelog and keep 1.x one tab away	2026-10-01 21:27:19 -07:00
esengine	d2eff567d2	feat(site): make Studio the default changelog and keep 1.x one tab away	2026-10-01 21:22:39 -07:00
YHH	0978208273	Merge pull request #11652 from esengine/site/changelog-1x-backfill docs(site): add the reviewed 1.39.3 to 1.39.6 notes to the 1.x changelog	2026-10-01 21:17:59 -07:00
esengine	ff138a2ba5	docs(site): add the reviewed 1.39.3 to 1.39.6 notes to the 1.x changelog The bilingual notes already exist, reviewed, in release-notes/releases.json on main-v2; the site data lacked them. They are copied with the product tag, with no model call. The sync tests use a version that cannot exist yet instead of 1.39.3, so they no longer depend on which releases the real catalog holds.	2026-10-01 21:11:07 -07:00
YHH	622be1dc37	Merge pull request #11650 from esengine/feat/site-changelog-sync feat(site): list Studio releases on the changelog next to 1.x and add a reviewable sync workflow	2026-10-01 21:01:25 -07:00
esengine	91c3fe2382	test(site): keep sync tests independent of the imported Studio entries	2026-10-01 20:47:29 -07:00
esengine	35bf24f804	feat(site): add the published Studio releases to the changelog Import the 32 published Studio releases (2.0.0 to 2.25.0) from the notes in release-notes/studio on origin/studio at `580339980`, verbatim and pinned to that commit. Dates are the GitHub publication dates. No model is involved.	2026-10-01 20:47:15 -07:00
esengine	2631e03364	fix(site): keep Studio entries on the stable channel GitHub marks every Studio release as a prerelease for the updater, which says nothing about the site's channel. Following that flag would put Studio entries into previewReleases and leak them into the 1.x preview surfaces.	2026-10-01 20:47:15 -07:00
esengine	3c21cc19af	chore(site): remove the sync workflow until it can live on the default branch Delete sync-site-changelog.yml and its contract test. workflow_dispatch needs the file on the default branch, and PRs made with the default token never run the required website check, so the workflow could neither start nor merge. release-notes.yml: drop the path trigger that only existed for the workflow; keep running every *.test.mjs because sync-releases tests remain. sync-batch.mjs and its test only served the workflow's batch branch, so they are deleted. sync-releases.mjs stays as a local tool and now reads release metadata through gh instead of a token environment variable.	2026-10-01 20:46:32 -07:00
esengine	23db2bcb7d	feat(site): list Studio releases on the changelog next to 1.x and add a reviewable sync workflow The changelog data gains a product line (cli or studio). Studio entries keep the Chinese release notes from release-notes/studio verbatim, rendered as escaped structure (sections, bullets, code spans, issue links built from digits only), with the notes' first line as the summary and a source link. The index and release pages get a 1.x / Studio switch. A manually started workflow finds published releases of both lines missing from releases.json and opens a review pull request against the website branch. An existing batch branch is handled explicitly: open review skips, a pushed branch without a review gets one, a stale branch is named for deletion. Per-version failures are reported with their error class instead of being swallowed.	2026-10-01 20:38:30 -07:00
YHH	1778bc8b37	Merge pull request #11437 from esengine/site/studio-default site: make Reasonix Studio the default download, keep 1.x CLI as secondary	2026-09-30 09:27:25 -07:00
esengine	39de4bb75c	site: make Reasonix Studio the default download, keep 1.x CLI as secondary The hero primary action, the selected download tab, the install steps and the docs install section now lead with Studio (per-OS, macOS split by chip), with the 1.x command line (npm/Homebrew/binaries) labelled and one click away. OS detection no longer guesses macOS for phones or unknown agents; they see every Studio build.	2026-09-30 09:23:00 -07:00
YHH	08ef3b8a8d	Merge pull request #11409 from esengine/fix/site-studio-dl-downloads fix(site): Studio download buttons point at dl.reasonix.io	2026-09-30 04:11:55 -07:00
esengine	605ebb87b9	fix(site): accept dl.reasonix.io Studio manifests so downloads point at dl	2026-09-30 04:10:36 -07:00
YHH	cf0beb7a59	feat(site): recommended order and votes on the skills registry (#11130 ) * feat(site): recommended order and votes on the skills registry The registry listing defaults to the new recommended sort, cards show approval (up share and vote count) in place of stars, the feed reads a star event as an upvote, and the copy-install ping carries a random per-browser id so the registry can count it once per day. * fix(site): state the reweighted recommended formula in the tab tooltip	2026-09-28 00:55:04 -07:00
YHH	cf5356538d	Merge pull request #11150 from esengine/fix/site-auth-state fix(site): read the signed-in state from /me on every page	2026-09-27 23:23:21 -07:00
esengine	8caa356a2d	fix(site): read the signed-in state from /me on every page The shared header rendered a static "Sign in" link on every page except /skills/, and /login/ never asked whether a session already existed, so a signed-in visitor saw "Sign in" in the corner, landed on the sign-in form, and then saw their handle on the skills market. - The header always carries an account slot, filled by one per-page session read (account-nav.js) that every page script shares; a page restored from the back/forward cache asks again. - /login/ and /register/ send an existing session on to ?next or /account/. - The skills page reads the shared session instead of its own copy, and its sign-in links point at /login/ rather than the accounts API root. - The header shows the handle only (sign out lives on /account/), which also stops the account controls from overlapping the nav links at 1280px.	2026-09-27 23:21:19 -07:00
YHH	f98796a7dd	Merge pull request #11136 from esengine/feat/site-publish-private feat(website): publish a registry package as private	2026-09-27 22:55:51 -07:00
YHH	ef09c8e78c	Merge branch 'website' into feat/site-publish-private	2026-09-27 22:54:28 -07:00
YHH	ed70e83704	Merge pull request #11113 from esengine/feat/site-publish-theme feat(website): list and publish theme packages in the registry	2026-09-27 20:14:11 -07:00
esengine	199153fbb9	feat(website): publish a registry package as private The publish form gains an "Only me" option that sends `visibility: "private"`. Such a package skips review and never appears in the registry; its publisher installs it, and later submits it for review, from Reasonix Studio's My packages. The result message says which of the three states the submission landed in.	2026-09-27 19:48:21 -07:00
esengine	132ab204b8	feat(website): list and publish theme packages in the registry Themes are a registry kind of their own (a Themes tab, a theme option in the publish form, their own badge colour). A theme installs as a plugin package, so the submitted installKind and the copied install_source request both use the plugin installer for it, and the source hint names themes alongside plugins.	2026-09-27 18:01:13 -07:00
YHH	32deb1125d	feat(website): open scanned remote devices directly (#11077 )	2026-09-27 08:38:54 -07:00
YHH	c6149e0ee4	Merge pull request #11066 from esengine/codex/website-web-studio-entry fix(website): route remote users into Web Studio	2026-09-27 08:06:23 -07:00
esengine	1bb463dca1	fix(website): route remote users into Web Studio	2026-09-27 07:51:11 -07:00
YHH	3180b29662	Merge pull request #11050 from esengine/docs/website-v1.39.2 docs(release): publish v1.39.2 notes on the website	2026-09-27 05:49:20 -07:00
esengine	fbbde86530	docs(release): publish v1.39.2 notes on the website The v1.39.2 entry was reviewed and merged into main-v2's release-notes/releases.json, but the website renders from its own catalog, so /changelog/v1.39.2/ returned 404. Copy the entry verbatim; the two catalogs are otherwise identical.	2026-09-27 05:47:21 -07:00
YHH	e163855a6c	Merge pull request #11043 from esengine/codex/website-remote-tasks feat(site): add remote Studio conversations	2026-09-27 05:10:45 -07:00
esengine	5926caab02	feat(site): add remote Studio conversations	2026-09-27 04:59:53 -07:00
YHH	de71e07334	Merge pull request #11028 from esengine/codex/website-cloud-remote feat(website): add encrypted remote device check	2026-09-27 04:20:43 -07:00
esengine	d980165f1e	feat(website): add encrypted remote device check	2026-09-27 04:19:38 -07:00
YHH	de3bf4d64d	fix(web): simplify device approval UX (#11025 )	2026-09-27 03:53:46 -07:00
YHH	0d97e932ec	Merge pull request #10978 from esengine/codex/website-studio-download feat(site): add Reasonix Studio downloads	2026-09-26 22:01:21 -07:00
esengine	463536c22b	feat(site): add Studio downloads	2026-09-26 21:59:22 -07:00
esengine	eb4f6c239a	ci: publish website from website branch	2026-09-26 21:17:51 -07:00
esengine	ceda5fff2c	website: establish standalone website branch	2026-09-26 21:15:43 -07:00
				`@@ -1 +0,0 @@`
				`All three environments are kept in lockstep. Any difference is a mistake.`