cli-channels runs in the studio-cli-channels environment and is the only job
with id-token: write. Its registry tokens are environment-only secrets
(STUDIO_NPM_TOKEN, STUDIO_HOMEBREW_TAP_TOKEN), and its first step fails unless
the environment has a required reviewer. npm publish passes --provenance,
matching the 1.x release line. A contract test parses every workflow and pins
the permissions, the secret references and the id-token grant. npm/ changes now
trigger the CI job that runs npm/publish.test.mjs.
neterr.IsConnReset fell back to any net.Error, so a *net.DNSError read as a
dropped stream and users saw "disconnected before completion after retry
attempts" for a host that never resolved and was never retried. DNS errors are
now excluded from the reset judgement, and explainError gives them their own
typed branch that names the host and separates a nonexistent name from a
temporary resolver failure.
Refs #11391
The storage panel showed "Measuring..." forever when one root (a huge or
slow directory, common on Windows) never finished, because GET /storage
walked all five roots synchronously with no limit and the client had no
timeout.
- Survey walks each root under a 10s budget and reports a lower bound with
Truncated set when it runs out, even if a filesystem call never returns.
- GET /storage?layout=1 answers at once with unmeasured roots and
GET /storage?root=<id> measures one root, so a slow root no longer holds
back the others.
- The panel draws rows immediately, fills each root in as it arrives, marks
a truncated count as a lower bound and shows "timed out" for a root the
kernel never answers.
Port of #11386 (main-v2). The recovery block now ends with a sentence
stating that the user's new message takes precedence, so an unrelated
message no longer makes the model resume the interrupted task.
Refs #11381
The docked workbench hides its canvas while the file list is open, and the
browser page and its address bar are drawn in that canvas. Selecting a tab or
opening a new browser tab left the list open, so the browser never appeared.
Every selection now goes through one helper that also closes the list.
The authoring guard skips any task without a solution/, so all twenty
verification-stress graders have only ever been checked against the pristine
seed - never against an answer that should pass. Ten now carry one.
The reference-solution test holds graders to both halves of the authoring rule
but skips memorybench, which ships no solution/ - the half #11329 fell through.
`-policy` is the MemoryBench experiment arm: `memory-off` hides the memory
store so a run can be compared against itself, and the only switch that
separates the two arms of that counterfactual. It is defined at
`cmd/e2ebench/main.go:268` and used in the recipe further down this README, but
the flag table never listed it.
Placed with the other suite-mode experiment arms (`-anchor`, `-cache`) rather
than beside `-ablate`, so it does not collide with the open #11364 that edits
that row.
ablation.Modules() has seven modules; the sentence documenting --ablate stops at
upstream. #11360 edited the same sentence to drop full-fold but left this one.
The bar named a field that does not exist (`PostSufficientSearches`) and a mode
that cannot produce counts (`-mode=calibrate`). The gate is the run's
`stopping_class` from the `-mode=run-index` report: a task qualifies when it is
neither `PostSufficientRetrieval` nor `PostSufficientRunaway`, so `SnippetStop`,
`SnippetThenRead` and `DefensiveRead` all qualify, and a defensive read is
deliberately not counted as waste. Also records that calibrate is not a
screening tool, which is why its cue-visibility profile is the same for every
task.
CloudDesktop only set Content-Type when the request had a body, so a
bodyless POST such as /runtimes/{id}/close reached csrfGuard without a
JSON type and was refused with 415 request.bad_content_type. Deleting a
project or session closes its panel first, so the delete failed in the
web Studio. csrfGuard is unchanged.
The benchmarks README still described this harness as the pre-#8244
comprehension/TTL/prune A/B, and taught a subcommand and flags the code has not
had since that rewrite.
A full-screen repaint draws every settled block, so when a background
[cli].diff_formatter run landed and the re-render hook was keyless, the
repaint dropped every diff block's cached rows and re-consulted the memo
for each. Once the transcript held more diff keys than the memo, the repaint
always re-missed at least one block, spawned a run for it, and that run
landed and repainted again — an endless loop of formatter runs and full
repaints.
Carry the landed DiffKey on the hook and remember, per block, the keys its
last render consulted, so a landed run drops only the blocks that asked for
its key. Gate the drop on the memo still holding the key: re-rendering a
block whose key was evicted would re-run the formatter and evict another
live key, so an evicted block keeps the rows it already shows.
The memo is raised to 128 so a normal transcript does not reach the eviction
path, and keyed by a 128-bit hash of the diff text rather than the text
itself, so an entry retains only the formatted output (~33-41% less
retained heap). Also record the formatter's 1 MiB size cap as a fallback
reason in the CLI reference.
ablation.FullFold has had no reader since #8244 (397ed30ec) replaced the
multi-threshold path with the single checkpoint design: foldSource and
carryPriorDigests lost their Off(FullFold) checks together with their test, so
-arm=incremental was identical to the default, and the default already folds the
model-visible projection. The checkpoint design is the intended one, so retire
the dead axis rather than restore the old re-read.
- ablation: drop the FullFold module (constant, comment, module list entry)
- compaction bench: drop the -arm flag, the arms struct, foldArm, and the arm
label from the report title and the JSON report
- benchmarks/README.md: drop the "Fold arms" section, and correct the paragraph
that claimed a fold re-derives its digest from the canonical transcript
- docs/CLI.md: drop full-fold from the --ablate list
Verified: go build ./...; go vet; go test ./benchmarks/compaction/
./internal/contract/ablation/; go run ./tools/repolint clean; golangci-lint
v2.12.2 (the version CI pins) 0 issues. -mode=cost still reports the same eight
generations, -arm is now an unknown flag, and the JSON report no longer carries
an arm label.
Fixes#11358.
studio's config.go sits exactly at its file-size budget, so the diff-fences
feature's added [cli] fields tipped it over repolint's ratchet. Extract the
CLIConfig type into cli.go, alongside the existing render_cli.go, to keep the
budget.
A shell tool result whose whole output is a unified diff — bash running
`git diff`, or `git show` in its default format — is tagged and rendered as a
diff: the TUI draws it through the same rows a ```diff fence produces, ACP
fences it for its client, and the desktop card renders it with DiffView.
The tag is computed once, at the one sink every emitter shares, and is gated by
the opt-in [agent].embedded_diff_detection (default false). Detection is
whole-text and conservative (diff.IsUnifiedDiff): every line must belong to the
diff grammar — including a `git show` / `git log -p` commit header and its
indented message — and a lossy Bound is never tagged, so a diff followed by
prose, a build log, or a truncation note stays prose. The tag is re-derived when
a session is rebuilt from /history, so a reopened session renders the same diff
the live one did.
The desktop DiffView splits a multi-file diff into per-file sections by the same
rule the CLI uses (git's "diff --git", else the "--- "/"+++ " pair) and names
each with its own "path +A -B" header row, so a `git diff` over several files no
longer shows only its first file's name over rows that belong to all of them.
A single-file diff keeps the card headline as its only name, so the fact is not
said twice.
trimDiffPreamble returning "" for a section with no --- line left a ```diff
fence without a --- /+++ pair rendering as an empty block. splitDiffSections now
returns sections untrimmed; the fence path trims each and falls back to the plain
code rail when it carries no file header, while the shell-diff path still drops a
pure preamble. A marked shell diff keeps the card's "⎿" connector on its first
row, like every other tool card's body. /history reads the embedded-diff flag the
session was built with instead of reloading config per request, and the hunk
parser rejects a body that overshoots its declared count.
[cli].diff_formatter names an optional external argv line (run without a shell)
that formats a diff before the CLI/TUI emits it — both a fenced
```diff/```patch block and a writer tool's diff card. The whole diff goes to the
command's stdin and its stdout is re-emitted with non-SGR control sequences
stripped. On failure, timeout, empty output, or an oversized block the built-in
renderer is used. Like [cli].update_channel it is user/global only: a
project-local reasonix.toml cannot run a command on the user's machine.
The run is memoised per (block content, width), because a View re-renders many
times while a fence streams and again on every resize. It runs only on a closed
fence, so a fence still streaming spawns no subprocess per delta, and the command
is handed the terminal width via COLUMNS with its output clamped to it. A
WaitDelay bounds the wait for a formatter's pipes, so one that leaves a child
holding stdout cannot block the render past the timeout. The writer card drops
the "--- /+++ " pair before piping, so the formatter cannot re-emit a raw host
path the card header already names.
This commit also wires [cli].diff_fences, the opt-in toggle that turns the
fenced-diff renderer on.
A fenced ```diff or ```patch block in the answer stream is drawn through the
colourised diff renderer — add/remove backgrounds, +/- gutter, line numbers,
chroma — instead of the generic code rail. A multi-file git-style fence is split
into per-file sections, each with a bold(accent(path)) +A -B header. Copy mode
keeps the plain rail path so the copied text stays byte-identical to the fence
source.
A fence that already carries ANSI (a pasted colourised diff) is shown verbatim,
with non-SGR control sequences stripped so a hostile payload cannot drive the
terminal.
It is off by default: the renderer runs only when activeDiffFences is set, so a
fence a model writes stays on the plain code rail unless the user opts in.
`@scope/[email protected]` and `[email protected]` were rejected by both
looksLikePackage implementations (Go installer and registry publish
validation), so an npm MCP entry could not pin its version. Both now accept
an optional `@<exact semver>` suffix and still refuse ranges, dist-tags,
empty versions, a repeated `@`, and anything with whitespace, shell
metacharacters, path segments or scheme prefixes.
A leading `-` is now refused as well, so a bare source can no longer be read
by npx as an option. The default MCP name drops the version suffix.
Pinning the top-level package does not pin its transitive dependencies.
Add owner headers to twelve contract and design documents, split their
over-wide paragraphs into rules, route their ownership to the primary
named in CODEOWNERS, and treat the generated protocol index as a
machine-read file. Baseline: doc-owner 40 -> 27, doc-prose 2276 -> 2147.
Add idle_timeout_seconds, a per-provider override of the 300s stream idle
watchdog. One knob bounds both windows a model call can spend silent: the
transport's pre-header deadline (prefill) and the read loop's inter-event
watchdog (generation). Zero or unset keeps the default.
The bound holds where the value is read: IdleTimeoutFromExtra clamps to
[1s, 32767s], so a hand-edited value — which never passes UpsertProvider's
validation — cannot overflow time.Duration(v) * time.Second into a negative
window the transport reads as "no timeout". validateProvider still rejects an
out-of-range value on the edit path.
The stall error names idle_timeout_seconds, and the docs note that a silent
pre-header wait is retried once, so the effective hold can reach ~2x the value.
A Studio install on another drive than the update cache never took the
chunked update: the swap's pre-flight renamed a probe from the install
into the cache, and a rename cannot cross volumes. The swap backup now
lives inside the install (<install>\.reasonix-update\<version>), the one
place guaranteed to share its volume; staged files still come from the
cache and are copied in when the rename fails.
Chunks are fetched through update.Transport, so they take the IPv4
route from the second attempt as the full download does, and chunks a
round could not fetch get a second round instead of voiding the delta.
Why a delta was abandoned is now a typed code (update.delta.*) that the
step giving up attaches; it rides on Progress.DeltaSkipped through the
full download and its failure, is logged, and the version panel says it
is downloading the full package and why.
Full downloads drop a connection that delivers nothing for 30 seconds
and resume on a new one; only attempts that made no progress count
against the retry budget. The artifact is written to a partial file in
the update cache named by its digest, so a timed-out or restarted update
resumes instead of starting over; a partial that fails verification is
removed. A body the manifest's size rules out (an error page served as
200) fails that address and moves to the fallback without being resumed.
With stalls caught, the fetch deadline is two hours rather than thirty
minutes.
A file copied in from another volume is written under a temporary name
beside its destination and renamed into place, so a crash mid-copy never
leaves a half-written file at the install path. A backup directory the
install refuses to create is ErrTreeNotSwappable. The delta phase has
its own 40-minute budget (update.delta.timed_out) and gives up after 16
chunks fail in a row, so a mirror that has gone quiet leaves the full
package its time. The reason is also exposed to screen readers.
"pnpm install" contains "npm install" as a substring, so verify.sh's
negative grep matched the very answer the positive grep demanded, and the
task could never pass. Disambiguate the negative check so it only matches
"npm install" when it is not preceded by "p", instead of anchoring the
positive check to line start, which would have moved the grader out of
line with every sibling task's plain substring convention.
Also extends TestSolvableCorpusSeedsMustNotGradeClean to the memorybench
corpus (it was not covered by the existing e2e/verification-stress/train
authoring guard) and adds a targeted regression test pinning the four
cases worked through by hand in the report.
Credit to chuiwenwei for the root-cause analysis and both candidate fixes.
Fixes#11329
The Studio manifest named only GitHub release URLs for full artifacts, so
every update downloaded the installer over the route CN users reach
slowest, even though the release workflow already uploads the same files
to the R2 mirror.
When the release is mirrored, studio-manifest now writes the mirror
address as each asset's url/sig and keeps the GitHub address in new
optional fallback/fallback_sig fields. Old clients ignore the new fields
and use the mirror, which the redirect allow-list already accepts.
The updater tries each address in order with its own retry budget,
resuming what the first delivered from the second. Signature, digest and
size checks are unchanged and apply to whichever address served the
bytes.
An approved market package whose reviewed version carries no content digest
was a dead end: the detail page showed "not pinned" and no way to install it.
It now offers "Trust and install". The request carries trust, and the kernel
plans it through install_source exactly like any other market install; the
preview's own contentDigest becomes the pin, apply must echo it, and content
that changes after the person confirmed is refused. The outcome and the ledger
record the install as unreviewed, and the confirmation says the content may
differ from what was reviewed.
A pinned version is unchanged: trust never replaces the reviewer's digest, a
digest other than the pin is refused as a version change, and moved content
still fails with market.content_changed. Without trust an unpinned version
still answers market.unpinned.
The publisher's own unreviewed install and the trusted install now share one
preview-pinned path, and market.unpreviewed is answered on both routes. The
list filter and badge read "pinned" instead of "installable", since an
unpinned package is now installable too.
A command the host cannot classify gets a before/after workspace scan,
and a scan that sees a change proves a write. An inline plan check such
as `python -c "import fizzbuzz; ..."` imports the module and writes its
bytecode, so the check was proven a change and owed itself another run.
Each check now measures "after the latest change" from the latest proven
change not counting its own residue: a run of exactly that check whose
written paths a complete workspace walk named, each of them a file whose
first touch this turn was its creation, none of them a file the plan
names or any other write this turn touched. A check that deletes a file
on one run and writes it back on the next is not its creator. Anything else counts: a run that does more than the check,
a check that rewrites the source it just checked, a check that rewrites
any file that predates the turn whether or not anything named it (go
generate, a whole-tree formatter, a lockfile rewrite), a path list cut
at the observation limit or never walked, and every run of
a different check - so a rebuild by one check voids another check's pass
taken against the stale build, and a check that never ran is not settled
because the only write came from another check. The plan deliverable and
the change criterion leave out the residue of every plan check.
The walk now also runs after a call whose watched paths already proved
a change, and records which files it saw appear: a new top-level entry
proves a change on its own, and without the walk a rewrite deeper in the
tree next to it went unnamed. The receipt says when its paths came from a
complete walk (paths_complete), so residue is never read off a list that
only holds what the host happened to watch.
The executor handoff now says what counts for a verify line: that exact
command, run as written after the latest change. It used to invite the
executor to validate and adapt inferred commands, which is how most held
runs ended up running a reworded variant.
Move the ProviderEntry/ProviderModelOverride types, their accessors and
validation into provider_entry.go, and the provider table rendering into
render_providers.go. Trim the moved doc comments to the <=3-line budget and
reclaim the freed repolint budget.
No behavior change: same types, accessors, validation and rendered output.
The TUI laid rows out with grapheme widths while bubbletea's renderer counts
per rune until the terminal answers the mode 2027 query, and so do the
terminals that never answer it (Terminal.app, legacy conhost). A VS16 emoji
pulled the scrollbar left, a ZWJ row lost its scrollbar cell, table lines
moved, and on conhost or behind an approval card those rows overflowed and
every row below was drawn twice. conhost also drew emoji as fallback glyphs
and `◆ ●` as `?`, and Windows Terminal drew boxes for flags and keycaps.
1.x has the alignment defect as well.
- termrender measures through one method, Cells(), with per-rune Truncate
and Cut of its own (the library's cut whole clusters and came out wider
than asked). The TUI sets it per rune and switches it to grapheme clusters
on the mode report bubbletea acts on; before the program starts it asks the
terminal how far U+26A0 U+FE0F advances, so one drawing it two wide gets
the grapheme count without answering 2027.
- Per rune, the whole frame is drawn stand-ins that keep the per-rune count:
joiners, selectors, keycap marks and tags go, a skin tone becomes its two
blank cells, a regional indicator its letter, and a one-column emoji with
only a two-column glyph is kept only before a blank.
- On conhost, told from a pseudoconsole by its window class, each rune is
asked of the console's own font (glyph and advance) and measurement; one it
cannot draw as counted takes a drawn symbol of the same meaning, its
halfwidth form, a flag letter, the OS best-fit when it really maps, or
blank cells. Windows Terminal gets letters for flags and base characters
for keycaps and tag flags.
- Live rows full screen are drawn at the transcript's width, so a pending
tool row is not wrapped again when it lands there.
Selection copies the original text; stand-ins change only what is drawn.
A desktop session whose person never named a posture now opens the way the
terminal does since #11256: Auto only where the OS sandbox confines writes
and the folder is trusted, Ask everywhere else (always on Windows). A named
posture - set in config or switched on the composer - is kept, and a value
this build does not know still opens in Ask with its notice.
- control: mode and "defaulted" are one approval sub-state; a trust answer
re-derives a defaulted posture with one check-and-set under the approval
lock, so a concurrent switch stays named. New FolderTrust port (Posture,
DecideWorkspaceTrust). TrustableFolder resolves symlinks and refuses a
filesystem root, anything holding a home directory, and anything inside or
holding the Reasonix home or state directory.
- config: desktop.default_tool_approval_mode is unset by default and renders
as a comment. A startup step releases a written "auto" once, recorded in
desktop-posture-released.json beside the config rather than in
config_version, which the 1.x line's own upgrades own; ask, yolo and
unknown values stay. The studio host now runs the startup upgrades.
- serve: POST /workspace-trust, approvalDefault on /status; the hub carries
only a named posture to later panes; a rebuild re-derives a default.
- studio: the terminal's "trust this folder?" question beside the composer
where a sandbox would confine what trust allows, and a note with a
one-click switch to Auto where no sandbox is in effect.
1.x's `reasonix run` and `-p` leave stderr empty on a clean run. Studio wrote
three slog records there on every run: `INFO boot: assembly timing`,
`WARN prompt refiner provider construction failed` (whenever the optional
refiner side model cannot be built) and, with -c, `INFO controller: resume
cache state`. A script that treats stderr output as a failure, or captures it
into a report, broke on every invocation.
All three are diagnostics nobody has to act on, so they log at debug level.
`run --debug` lowers the process log level while flags are parsed, before
assembly writes its first record, for whoever wants them back. Warnings the
user has to act on keep their own channel.
/events numbers frames from where a subscriber attaches, and Subscribe
connected in the background. An action taken right after it returned could
emit its frames before the connection registered, and the stream never
carried them. TestUnknownSlashCommandNeverReachesTheModel lost its
unknown-command notice this way whenever the kernel answered faster than the
subscription attached (every time on a Linux runner with GOMAXPROCS at 1 or 2, and on the coverage job), and the TUI's
own Init has the same order: it subscribes and then submits --prompt.
Subscribe now returns once the first connection has a response in hand (the
server registers the subscriber before it writes a byte) or has failed.
Every user-config save (reasonix config compact-ratio, the Studio settings
page, the serve settings endpoints, model and approval persistence) went
through Config.SaveTo, which re-rendered the whole file from the struct.
Anything the struct does not decode was dropped - [checkpoints],
browser.chrome_path, providers[].display_name, agent.web_search_model,
desktop.layout_style / status_bar_style_initialized,
remote.hosts[].credential_mode - and values the renderer normalises were
rewritten, so a 1.x default_tool_approval_mode = "danger-full-access"
became "ask". Losing credential_mode = "remote" flips a remote host from
using the host's credentials to tunnelling the local key.
An existing user config is now edited in place: the file is indexed by
table path (array elements by their name), the rendered form of the file
as it loads is compared with the rendered form of the config being saved,
and only the keys that differ are rewritten, added or removed. A key the
save changed but the renderer never writes (a retired field a setter
cleared) is removed, and the keys this build declares retired are still
stripped. Unknown keys and tables, comments, order, line endings and
values this build reads differently stay byte-for-byte. The edited text is
accepted only if it loads to the same configuration the full render would;
otherwise the full render is written and the previous bytes are kept
beside it as config.toml.rewrite-<time>. A missing or empty file is still
written from the template.
A config written from nothing now carries config_version = 12. The 1.x
line rewrites the whole file on start when the marker is below its latest
upgrade (12), dropping [storage], [memory] and the other tables it does
not know. This build's own upgrades still gate on version 6 and an
upgraded older file is still marked 6, so 1.x keeps running its 7-12
migrations for content that never had them.
Arrays of tables are edited per element, keyed by name. The whole array
is written from the render instead - leaving every other byte alone -
when an element the save changes or drops is not a block of its own in
the text, when an element has no name or shares one, when the save
reorders the elements, or when the file holds no such array yet (so
adding the first provider keeps the built-in ones). A new element is
placed before the next kept one, so a rename keeps its neighbours whole.
Dropped elements are removed in one pass over one index, so an element's
sub-tables are never handed to the element above it and removing many
elements is linear.
Keys and sub-tables Config does not decode are never dropped silently.
Rewriting an array carries each element's own into the rendered element
of the same name, verbatim; turning an inline table into a table carries
its plain entries as key lines. When an entry has nowhere to go (two
elements share a name, an element the load merged away, a nested table
value) the result is still written in place and the prior bytes are kept
beside it as config.toml.rewrite-<time>, as the full-rewrite fallback
does. An element the user deleted takes its entries with it.
A value the user sets is written even where the render would not show a
difference: a single-line key is rewritten when its encoded value
changed, so choosing Ask replaces a 1.x danger-full-access that already
loads as ask. A key nobody touched keeps its bytes.
A save never writes a file that does not load. system_prompt is
rendered as an escaped multi-line string (a backslash or """ in a prompt
used to produce an unparseable file). When the render still does not
load, the in-place edit is used if the lines the decoder refuses are the
same before and after the edit and the result loads as the render
describes; otherwise the save fails and the file is left as it was.
Inserted text takes the file's line ending outside strings only.
An unrecognised default_tool_approval_mode still opens a desktop window
in Ask, now with an approval_mode_unrecognized notice the frontend
localizes, and the file keeps the value until the user picks a mode.
The fixture is the file 1.x v1.39.5 writes through its own SaveTo with
the affected keys set.
A one-word message let the edit and rewind controls widen the card, and the
bubble then sat against the card's left edge, leaving a gap on the right.
The controls row no longer sizes the card (contain: inline-size), the bubble
is pushed to the right edge, and the controls drop to icons with their
accessible names, hints and keyboard focus when their labels need more room
than the bubble gives. Whether they fit is measured, not a fixed breakpoint.
Closes#11255
In the reading measure the transcript was 760px wide but replies and user
turns were still capped at --doc (706px), a value left over from when the
flow was a wide container with a narrower prose measure inside it. The
steps card inside a reply and the user bubble therefore stopped 60px short
of the composer's right edge, while the ask card and notices reached it.
The column now has one source: --column (760px) in tokens.css, with --doc
derived from it. The flow is laid at --doc, the composer and its shelves
at --column, and the per-row caps are gone, so every card shares the
composer's edges. The full measure still only moves --doc: the transcript
widens and the composer keeps the reading width. The studio-only
--measure variable that duplicated --doc is removed.
cards.mjs asserts the shared edges at 1440 and 1000px in the reading
measure, and that the full measure leaves the composer unchanged; the
new checks fail against the previous stylesheet.
Closes#11267
In 1.x a ! command is the user's own: it runs, its output is shown, and
nothing enters the conversation. The TUI handed it to RunShell, whose
answerShell puts the output into the conversation and starts a turn, so every
command cost a request and the model often replied with a question.
RunShellWith takes a ShellRun; LocalOnly skips answerShell. It sits on a new
LocalShell sub-port that only SessionAPI carries. serve's in-process /submit
takes localShell, and the TUI's shell mode sends through a RunShell client
call that sets it and echoes the command without waiting for a turn to name
it. RunShell keeps answering, so Studio is unchanged.
RunShell and its helpers move from controller.go to shell.go, which the
file-size ceiling on controller.go required.
With no terminal, 1.x printed usage for a bare `reasonix` and exited 0;
studio exited 2, the usage-error status, although nothing was wrong with the
command line. Session options with no terminal to open a session in remain a
usage error. bareUsage moves out of cli.go into its own file.
`reasonix doctor` warned on every install that the built-in review and
security-review skills allow use_capability, "which is not in the current
registry". Doctor checked allowed-tools against a hard-coded name list and
passed no tools; assembly always registers the proxy. It now checks against
the compile-time built-ins and the proxy, read from their owners.
1.x failed a request to an unreachable model service in about 0.3s. Studio
counted every transport error except cancellation as transient, so a refused
connect walked the whole MaxRetries backoff and `reasonix run` took about
92 seconds to report it, stalling every automated check pointed at a stopped
endpoint.
A refused connection (ECONNREFUSED, or WSAECONNREFUSED on Windows), a name
that does not resolve, and a certificate that does not verify are now
permanent: no backoff changes them. They are recognised by error identity.
Resets, timeouts and retryable statuses keep their retries.
1.x's `reasonix run` exited 0 once the model finished. Studio exited 1 with
`error_during_execution` whenever its final-readiness check stayed unmet (for
example, no check ran after the last write), so every 1.x script treated a
finished run as a failure.
Following the migration's decision 3 (in line with how other agent CLIs
report this):
- An unmet final-readiness judgement is a verdict, not a failed run: subtype
success, is_error false, exit 0, with `readiness` {attempts, missing} in the
result and in events-jsonl's run_done.
- `--fail-on-unverified` turns that verdict into exit status 3, kept apart
from 1 (run error) and 2 (usage) and documented.
- `permission_denials` in the result stays the gate's own list; run_done
carries its count and `-p` names the refused calls on stderr.
- `completion` repeats the turn's completion_summary when there was one.
1.x's `run --output-format stream-json` stamped every line with sessionId,
turnId, seq and status, opened the turn with turn_status (queued) and
user_message, reported tool_started between a call's dispatch and its result,
and closed with turn_done; --events-jsonl carried the same lifecycle records
without content. Studio's synchronous controller path publishes no turn
lifecycle, so both streams lacked all four kinds and the envelope, and they
leaked host-internal kinds (workspace_lease and friends) that no 1.x consumer
knows.
The run's output sink now supplies the lifecycle for the turn it drives and
stamps the envelope; only the kinds 1.x emitted reach either stream.
tool_started comes from a new host-only Tool.Executed on ToolResult, set when
the call cleared every gate and ran, so a refused call reports none.
The stats recorder swallowed RecordTurnCompletion instead of passing it to the
sink it wraps, so the run sink never learned a turn had finished: a failed run
reported num_turns 0. It now forwards the signal once (a TurnDone event still
records without a second completion).
Contract tests compare a real run against v1.39.5 output kept under
testdata/v1-run: lifecycle order, envelope keys, kind vocabulary.
* fix(goal): align Studio schema with report validation
Problem: schema-valid goal reports can fail execution for missing reasons or
blank verification commands.
Root cause: status-dependent requirements exist only in prose and execution
checks, not in the provider-visible JSON Schema.
Fix: encode conditional reason requirements and nonblank verification entries,
matching the executor's Unicode whitespace handling without relaxing Goal
authority or delivery validation. Update bilingual guidance and schema fixtures.
Verification: schema/executor agreement regressions and golden guards pass,
along with go vet ./..., make lint, and make check. The static schema changes
once on upgrade; system prompt bytes and within-version stability are preserved.
* fix(goal): keep report schema typed and within prefix budgets
The conditional status schemas omitted explicit types, which failed the
built-in provider compatibility gate. The added constraints also exceeded
both schema token budgets by 78 tokens.
Declare string enum and object branch types and trim descriptions whose
semantics are already explained by the tool. Keep every argument constraint
and the original budget ceilings, and refresh the serialized golden files.
Verified update-goal schema/execution tests, enum/type and schema-budget
guards, provider golden guards, go vet ./..., make lint, and make check.
* test(goal): keep whitespace validation coverage without schema changes
Problem: the schema hardening introduced provider compatibility risk through
a top-level anyOf and a new pattern constraint, and reduced model guidance
to fit the prefix budget.
Root cause: matching a general-purpose JSON Schema validator to execution
does not establish acceptance by model providers.
Fix: restore the original schema, descriptions, documentation, and golden
fixtures. Retain focused executor tests for blank reasons and verification
entries, optional completion fields, field diagnostics, and no report on
rejection. Existing error messages already identify the invalid fields.
Verification: update-goal tests, go vet ./..., make lint, and make check pass.
The owning suites retain the baseline ripgrep failure addressed by #11244.
The Regenerate and More menus on a finished reply were absolutely
positioned above the trigger inside the card. The card paints under
content-visibility containment and sits in the transcript scroller, so a
row near the scroller's top lost the upper part of the menu, and a short
reply lost it even mid-screen.
Both menus now go through one ReplyMenu: the list is portaled to the body,
placed by measurement, opens above the trigger when it fits and below it
otherwise, and follows the trigger on scroll and resize. The row keeps a
focus stop where the list used to sit, so Tab order through the menu is
unchanged; Escape now also returns focus to the trigger.
The scroll/resize follow effect that Picker and RewindControl each
carried is now one useFollow hook in place.ts, beside the shared beside()
flip arithmetic, which lowers the unnamed-input ceiling by one.
Closes#11250
/help was not a command, so it went to the model. /compact drew one line,
"context compacted", even for a fold that wrote nothing, and /context
dropped the breakdown the kernel attached to its summary.
/help is now answered on screen in 1.x's layout (commands, then built-in,
custom, skills and MCP prompts, eight rows a dynamic group), built from the
completion catalogue the session answers, the TUI's own commands included.
A finished fold draws 1.x's card: messages folded and trigger, the digest,
and the estimated tokens before and after (i18n CompactionEstimatedTokens,
the 1.x key); a fold with no digest draws none, and a running one says it is
working. The kernel names /context's notice with a context_report code, and
the TUI shows its detail under it.
Problem: A hidden directory could make grep search HOME and attribute its
matches to the requested external directory under Linux bubblewrap.
Root cause: Searching dot relied on the wrapper preserving the subprocess
working directory, but bubblewrap can fall back when that directory is masked.
Fix: Resolve directory roots to absolute physical paths and use the same path
as both cwd and the ripgrep argument. Restore requested output prefixes and
external-root error displays while preserving wrapped error identity.
Verification: Real Debian bubblewrap reproduced the prior failure for both
tmpfs and session-temp mounts; both cases pass with the fix. Grep regressions,
builtin and boot package tests, go vet, make lint, and make check pass.
The prologue was one chained assignment,
`$OutputEncoding=[Console]::OutputEncoding=[System.Text.Encoding]::UTF8`.
When the Console assignment throws (no console attached, or
ConstrainedLanguage refusing .NET property writes) neither encoding was
set and every command printed a 7-8 line error first. Each assignment is
now its own try/catch and .NET properties are only touched in
FullLanguage. Both encodings are BOM-less UTF8Encoding instances, so text
piped to native programs no longer starts with EF BB BF.
On Windows PowerShell 5.1 only, the shell tool also sets
$PSDefaultParameterValues['Out-File:Encoding']='utf8', so '>' and Out-File
write UTF-8 instead of UTF-16LE. '*:Encoding' is deliberately not set: it
would make Get-Content misread ANSI (GBK) files. Hooks keep only the output
part of the prologue, since they run the user's own scripts.
PowerShell discovery adds the Store install's execution alias
(%LOCALAPPDATA%\Microsoft\WindowsApps\pwsh.exe). An alias is a zero-byte
reparse point that stats fine but may fail to start the packaged app, so an
alias candidate (from the list or from PATH) must launch once before it is
selected; regular executables are taken as found.
A Chinese terminal still read English in the rows the TUI or the kernel wrote
themselves: "remembered → …" after a # note (1.x says 已记住), the session
picker's Search / No matches / Type to filter, a declined approval, a
sub-agent's call count, and the progress-watch notices. The completion menu
showed its key hint only past eight rows, and in English; 1.x always shows
it, from CompHintSlash / CompHintFile.
These now read from i18n, reusing 1.x's keys where 1.x had them. Text 1.x
itself prints in English (N lines, (active), N turns) stays English. The
language detection moves from i18n.go to detect.go; i18n.go was at the
800-line ceiling and the new keys need the room.
The memory-off arm hid the memory tool but still seeded the store, and the
state root was a sibling of the task workdir under the temp root, so agents
in the off arm found and read the seeded facts with shell commands.
- memory-off no longer seeds memory: the treatment is that no memory exists
- state roots live under the user cache dir with a random name, and a root
inside the workdir's parent is refused
- -trajectories is made absolute before the child, whose cwd is the task
workdir, receives it
A bare /rewind went to the kernel, which rewound the conversation one turn at
once, and /clear deleted the transcript with no question and left it on
screen. Both are destructive; 1.x asks first. Esc on an idle composer did
nothing, where 1.x clears what is typed and a second Esc opens the rewind
picker.
The TUI now answers /rewind with 1.x's picker (turn, then code+conversation,
conversation, code, or a fold before/after the turn; a partly covered file
restore asks again), prefills the turn's prompt and redraws the conversation
after a conversation rewind. /clear opens 1.x's Clear/Cancel question, the
cursor on Cancel, and clears at once in YOLO; the screen restarts under the
banner. Esc clears the composer, and twice within 600ms on an empty one opens
the picker. The kernel's /new and /clear notices now come from i18n.
Every todo_write and complete_step call drew a row ("● todo_write ⎿ 1
lines", "● Step"), though the task list above the composer already shows
what they changed; 1.x draws neither. A shell row previewed the result the
model reads, and the host appends its obligation notes to that result, so
"host obligations changed: - settled: …" appeared as if the command had
printed it.
A settled todo_write or complete_step that succeeded is now kept off the
screen, as 1.x keeps todo_write; a failed one still shows. A shell row
previews what the command streamed while it ran and falls back to the result
only when nothing streamed (a replayed session).
Found in an adversarial review of the new default posture:
- shellsafe: arguments that make a read-only command run another program or
write are refused in every spelling the program accepts (clustered short
flags, abbreviated long options): git grep -O, rg --pre, sort
--compress-program, go -toolexec/-exec/-vettool, file -C, uniq's output
operand, date -s, hostname NAME, git reflog expire/delete, npm audit fix,
kubectl --kubeconfig, gofmt -cpuprofile. less, man and cargo check/doc
leave the read-only tables.
- The headless gate and the posture decision live in the files REASONIX.md
declares sensitive again (approval_bridge.go, approval_orchestration.go);
the MCP fast-path refusal is decided in package permission.
- A sub-agent under an attended Auto no longer gets dynamic shell its parent
would have to ask about.
- Read-only keeps fresh human decisions human; a refusal no rule produced
names the posture instead of a deny list.
- The trust prompt and docs state what the sandbox actually bounds (temp,
toolchain caches, network) and that trust covers reasonix run; a home
directory or filesystem root is never trusted wholesale; the run result
names the posture it settled on.
- The desktop names each controller session in ready; a controller that
uses the name numbers its commands upward, and the desktop refuses a
command naming another session or an old number, so a relay cannot
replay a recorded command into a new session or twice into one.
- ready carries a per-process instance id. A state-changing request
already sent is resent only to that same instance; a restarted desktop
has no cached answer, so the request fails explicitly instead.
- The replay cache outlives controller sessions (the grace expiry no
longer clears it) and is reset only on device identity or account
change; its key binds method, path and body as well as the id.
- The phone seals and sends commands in one queue so their numbers
arrive in order; socket listeners are registered by the connection
itself; errors reach the banner through reason().
A terminal session with no named mode opens in auto only where the OS
sandbox demonstrably confines shell writes (sandbox.IntegrityEnforced) and
the person trusted the folder; everywhere else it asks, and a headless run
refuses writes and lists them as permission_denials in its result.
read-only is a real posture again: every call that is not a read is refused,
allow rules included, and an authorized MCP server's writers too. Gate
refusals carry a code (permission.unattended, read_only, deny_rule,
declined) that reaches the tool result and the run result.
YOLO keeps skipping prompts only; its first interactive use is confirmed
once and recorded under the Reasonix home. Shift+Tab follows 1.x's order,
Ctrl+Y returns to the posture it left, and a terminal's switch no longer
becomes the desktop's default. git -C/--no-pager classify as the
subcommand they wrap.
The kernel's slash menu drops the row that would replace the line with
itself, so a finished /tree left only fuzzy neighbours in the menu and Enter
accepted the first of them: /tree ran as /security-review. A finished /hooks
or /mcp stopped at their argument menu and a second Enter put its first
argument in the composer.
Complete now names the dropped row as Typed, which Studio ignores. The TUI
lists it first, and Enter sends the line when it already reads what the
highlighted row would make it: the command's label, or the argument in place.
That is the rule 1.x's composer follows; a half-typed name still completes.
Problem: Studio's ripgrep engine misses slash-glob matches under search
roots with symlinked ancestors, including macOS temporary directories.
Root cause: the absolute search argument keeps the symlink spelling while
ripgrep anchors globs against its physical process directory.
Fix: search dot from the requested subprocess directory and restore the
requested output prefix before external-root token projection. Both search
passes share the behavior; single-file targets and sandbox guards remain.
Verification: existing and new slash-glob regressions fail before the fix
and pass after it. Owning builtin/boot suites, go vet ./..., make lint, and
make check pass. The new test covers both passes and output path privacy.
The phone page reconnects silently when the relay closes for idleness, a
legacy admission expiry or a dropped socket, and resends in-flight requests
under the same id. A read is always safe to resend; a state change is
resent only to a desktop that advertises replay, and failed otherwise, so
nothing runs twice. Relay close codes decide the next step: 4401 asks the
user to sign in again (sign out, then the existing sign-in page), 4403 and
4004 stop for good.
The desktop keeps controller sessions across its own relay reconnects,
prunes them against the relay's relay_hello list, sends the relay's
heartbeat frame once the relay names it, and caches answers to
state-changing desktop requests for ten minutes so a resend is answered
from the cache instead of running again.
Refs #11226
The terminal typed /status, /help, /quit and the other 1.x commands studio
has not ported yet, and the kernel sent each line to the model as prose. That
spent a request, and for /status it ran git and asked for an approval.
A submission can now ask the controller to refuse a slash command no registry
resolves: it gets an unknown-command notice (i18n SlashUnknown, the wording
1.x uses) with the unknown_command code and starts no turn. Paths, code
comments and custom commands resolve exactly as before. The TUI always asks;
Studio does not, so its behaviour is unchanged.
A 1.x command line that reached one of these exited 2 on studio:
- `reasonix chat` / `reasonix code` were unknown commands. They are the
interactive session in 1.x, so they now route to the terminal UI.
- `reasonix --preset X -p task` was an unknown command because --preset was
not a leading session flag. It is again, so it becomes a print-mode run.
- `run --takeover` was an unknown flag. It is accepted; with no contention the
run proceeds as in 1.x. Taking a session away from another process has no
counterpart here, so a held session is still refused, and the refusal now
says --takeover cannot do it and points at --copy.
- `sessions reindex|diagnose|cleanup` fell through to the machine `session`
command. Sessions are listed straight from their directories here, so
reindex has no catalog to rebuild and reports the count it reads; diagnose
and cleanup report and trash covered conflict-recovery branches through the
sessionstore guards Desktop already uses, keeping 1.x's JSON key names for
what is measured and its dry-run-until---apply contract.
A provider entry gains display_name, the key 1.x already writes, so a
config shared with 1.x keeps it on every save. Name stays the identity:
refs, default_model, saved sessions and preset upgrades still point at it.
POST /providers/display-name relabels every entry shown as one account,
all or none, and refuses an over-long label or a control character with
its own code. The provider list, the model list and /status carry the
label; the settings list renames in place (pencil or F2, empty restores
the derived name), and the model picker, wallet header and ACP model
descriptions show it.
Closes#11237
resolveSetupTargets takes every unrecognized argument as the config path, so
`reasonix setup --help` wrote a file named --help and reported "Wrote --help".
1.x prints the setup usage for -h/--help and exits 0, and refuses any other
dashed argument with usage on stderr and exit 2. The ACP registry advertises
`reasonix setup` as the login method, so its help has to answer.
Port that guard, in its own file, ahead of target resolution.
The in-app find already searched the rows rather than the document, so
it sees messages the transcript has not mounted. What stood between a
person and it:
- The chord matched e.key exactly. Caps Lock sends "F", an input method
answers "Process", a Cyrillic layout sends "а" - none of them opened
anything. The window now reads the letter case-insensitively and falls
back to the key's position when the layout reports no Latin letter.
It takes Cmd on macOS and Ctrl elsewhere, so Ctrl+F in a macOS text
field keeps its Emacs meaning, and AltGr is not read as the modifier.
- Nothing on screen offered it. The title bar gets a find button (the
only way in on a phone) and the palette gets the command, both showing
the chord.
- It took the chord from every text field. A field hands the window's
chords through only when it says so (data-window-keys): the composer
and the find box do, a settings filter or the browser's address bar
does not. An editor that answered the press itself (CodeMirror's own
find) still spends it.
Stepping also moves within a row now. Twenty matches in one tool output
counted as twenty but painted and landed as one; the current occurrence
is the nth drawn in its row, and landing scrolls it - through the
output's own clip if it scrolls - to where it is read instead of leaving
the row's top under the bar. A newer landing cancels one still settling,
which typing a query used to race. Arrow keys step like Enter.
The current match was accent at 45%, which in the Studio theme is a
light grey behind light text in dark mode; it is the accent/accent-fg
pair now, neutral in both themes.
The window's key listener moved out of App.tsx into windowkeys.ts to
keep App under the line ceiling.
A workspace path concatenated into the sidecar is not valid JSON on
Windows, where its backslashes read as escapes; the meta then fails to
parse, the session is never routed to the blocked directory, and the copy
the test expects to fail succeeds.
A shell command whose command line exceeds CreateProcessW's 32,767 UTF-16
unit ceiling never starts; the model was told "fork/exec powershell.exe:
The filename or extension is too long." and read that as a file-size
problem. On Windows the PowerShell tool passes the whole script as one
-Command argument, so writing a large block of text (e.g. a Chinese
document in a here-string) hits this every time.
The host now counts the command line exactly as os/exec builds it and,
when it will not fit, refuses the call before launch with a typed error
(errCommandLineTooLong) that states the size, the limit, and that nothing
ran, and points at write_file/edit_file. The execution is recorded as
not run / not started. The not-run bookkeeping moves into one helper so
ExecuteDetailed stays within its size budget.
Refs #11229
Opening a session 1.x wrote deleted its <id>.context.json. 1.x writes
context schema 4 from 1.36.0; LoadCompactionState accepted only 1-3, and
loadProjectionSidecar removed the file on any load error. The model-written
compaction summary was lost for good, 1.x itself resent the full history on
its next turn, and 2.x sent the full history too.
A load error now drops the projection in memory only. Unknown schemas carry
ErrContextSchemaUnsupported. Schema 4 is schema 3 plus
projection.pinned_context_hash, so it is read when that hash is empty; a
pinned-context checkpoint is authenticated against 1.x provenance this build
does not model and stays unsupported. A load never rewrites another release's
file (lineage keys are normalised in memory), and dropping the projection of
an open 1.x event log leaves the file, since this build never changes that
log. When a 1.x conversation moves to a 2.x session, the projection is
inherited there in schema 3 if it still covers the transcript, so the first
2.x turn sends 1.x's summary instead of the folded history.
The effect test replays a schema 2 session captured from a real 1.38.7 build.
Problem: Clicking the Dock icon leaves a Studio window hidden after closing to tray.
Root cause: macOS activates the existing process without emitting second-instance, and the shell had no activate listener.
Fix: Route activation through the shared window reveal path and ignore reveal requests during shutdown. Extend native smoke coverage across activation, second-instance, and tray entry points.
Verification: macOS native smoke, Electron unit tests, frontend build, host build, go vet, and repository lint passed.
A phone reaching Studio through the account relay has no EventSource; the
page swaps in RemoteEventSource, which polls /events/replay over the
encrypted channel. It fell short of the stream it stands in for in three
ways:
- It found /replay by rewriting a URL that ends in /events. Since the
silence watchdog (#11216) a replacement stream carries ?lastEventId=, the
rewrite missed, and every poll asked for the live /events route, which the
desktop refuses over the relay. An idle pane went silent for 45s and then
stopped receiving events for good.
- It learned its starting position by asking for lastEventId=0, so each
attach downloaded the whole replay log (up to 8MB for a long running
session) through the relay and threw it away. Asking past the watermark
returns no frames and the watermark alone.
- It never said the frames SSE writes on its own, so a quiet stream looked
dead to the watchdog and a truncated log looked complete. A quiet poll now
restates the watermark, and complete=false becomes a stream_gap.
Separately, a reload always focused the first open pane, because which pane
the window showed lived only in React state. The relay's "reconnect" button
reloads the page, so the phone landed on the top project's first session
instead of the one it was on. The tab now keeps that id in sessionStorage
and takes it back when the pane is still open.
importJsonlSessions reported only artifact failures through hadArtifactFailure,
so a session whose own copy failed was skipped silently and the one-time import
marker still went down. The next launch then saw the marker and never retried,
leaving that session unimported for good.
Both copy paths now report the failure, so the marker stays off and the next
launch retries, matching what a failed artifact copy already did.
await_user's `need` is shown to the user as a one-line host notice. With
nothing bounding it, a model put the whole question there, numbered options
included, so the user got a wall of text to answer by typing instead of an
ask card they could click. The description now routes a pick among named
choices to ask, and the tool refuses a need longer than 200 characters with
an error that says to put the substance in the reply or call ask. Length is
a property of the argument, not a reading of its wording.
Closes#11220
The hand-back notice printed the model's `need` as one plain paragraph, so
its bold, lists and line breaks reached the user as literal markup. The
kernel now tags the notice with the await_user code and carries the need
verbatim as its detail; the text form stays for the TUI and CLI. Studio
titles the card from the code and renders the detail through the same
sanitized Markdown renderer replies use.
Closes#11219
Workspace configuration only takes effect once the workspace is approved,
so the perseveration boot effect tests reached the real provider instead
of the registered stub.
The perseveration guard fixtures are byte-exact recordings; checking them
out with CRLF on Windows shifts every offset the test asserts.
A phone paired over the LAN that sleeps, or whose Wi-Fi drops the link,
can leave its EventSource looking open on a socket nothing arrives on.
EventSource only reconnects on an error it is told about, so the pane
kept showing a live connection while no event reached it, and on plain
HTTP/1.1 each such dead stream also keeps holding one of the browser's
six connections to the host, starving the requests a session switch
makes.
The kernel already restates its position on every transport each 15s
(stream_watermark). The client now treats three silent intervals as a
dead stream: it closes it and opens a new one that resumes from the last
frame it folded (lastEventId), so nothing numbered is lost. Timers stop
while a phone sleeps, so becoming visible and coming back online check at
once instead of waiting for the next tick.
A workspace's reasonix.toml and .reasonix/settings.json are read as
untrusted input.
- [sandbox]: bash may only move to enforce and network only to false;
forbid_read and denied_domains add to the user's; allow_write entries
and workspace_root apply only when they resolve inside the workspace.
${VAR} in sandbox and proxy paths expands from the process environment
only.
- [permissions] mode, allow and allow_dynamic_bash, [network] proxy
settings and [desktop] default_tool_approval_mode are read from the
user config only; deny and ask add to the user's. An "always allow"
given in a workspace is stored under the Reasonix home
(project-grants.json) rather than in the checkout.
- Programs a workspace declares (hooks, language servers, providers,
tools.search.rg_path, tools.shell.path, [browser], tools.system_one
endpoints and the local Laya runtime) run only once approved for that
folder. An approval records the declaration and a digest of the files
it names, is kept under the Reasonix home, and is checked again before
each start; a change refuses the start with ErrProjectProgramChanged.
`reasonix trust` lists and approves them, and saving hooks from the
hooks page approves the block written. Model settings that named only
a held-back provider fall back to the user's choice.
- Single program paths may not point into the workspace, a temporary
directory, an allow_write root or a toolchain cache.
- Sandbox write roots and host write directories keep the identity they
had when first granted; a root whose identity changed is dropped with
sandbox.write_root_redirected or sandbox.write_root_changed. The
host-writable directory list lives in internal/base/hostwrite.
- Every ignored value is reported as a load warning with a typed reason
(Config.IgnoredProjectSettings); held-back programs raise the
project_programs_awaiting_approval notice.
The workspace explorer leaves every dot entry out, so folders such as
.reasonix, .github or a .gitignore could not be browsed from Studio at
all. The explorer head now has a toggle that asks the kernel for them.
GET /workspace/files takes hidden=1 to include dot entries in both the
folder listing and the search. VCS stores (fileutil.IsVCSStoreDir) and
dependency trees stay out either way. The default is unchanged: dot
entries hold tool state and local configuration, so they appear only for
a reader who asked, and the choice is remembered per machine.
The explorer's head moves into its own component so WorkbenchPanel
stays under the file-size ceiling.
Closing the last tab folded the docked workbench even when the file
explorer was open beside it, so dismissing a browser tab took the file
list away with it. An open explorer is now a reason to keep the column,
the same as any tab still open; the column still folds with its last tab
when the explorer is closed.
The speed meter already opens with a sparkline of recent throughput, so
the gauge glyph before it said the same thing twice and cost width in a
rail that is tight next to the composer. The cache and context meters
carry no leading icon either; the speed meter now reads the same way.
Under 760px the workbench collapses to one column and the stylesheet hid
the explorer unconditionally, so on a phone paired over the LAN (or any
window that narrow) the files button toggled to pressed over an empty
body and the workspace tree could not be reached at all.
At that width the explorer and the canvas now take turns in the single
column through the existing data-files toggle, the same way a docked
workbench already does. Picking a file still puts the list away and
shows the file.
The guard detects a degenerate generation loop — a model echoing one short block
of text or reasoning byte-for-byte — by default, and reports it through the
progress-watch channel as a new `perseveration` cause. Nothing is cut and nothing
reaches the model unless the caller opts in: a byte-identical block is sometimes
legitimate output (printing a value 300 times, a run of identical table or log
rows, a page of `=` or `A`), so cutting it by default was the wrong trade. The
notice is said once per loop episode — a scan that trips again while the previous
scan also tripped stays quiet, and the next scan that does not trip re-arms it.
The user's `progress_watch.pause` setting is what ends a run on a detected loop.
Cutting the stream and nudging an unattended retry is opt-in with
`perseveration_retries`, under [progress_watch] or per provider on a [[providers]]
entry (the provider value overrides the global default). Unset or 0 reports only;
a positive value also cuts and nudges up to that many retries; a negative value
disables the guard entirely.
The cut path records best-effort usage, lets extensions rule on the terminal
before it is persisted, and never executes the aborted stream's tool calls. It
collapses the loop to the phrase and its last repetition in what is shown and
stored alike, so the transcript follows the trim instead of silently diverging
from the stored turn — no history rewrite is needed. It then shows the user a
`[retrying (N) avoiding perseveration]` interjection, appends a host-authored
nudge through the mid-turn steer path, and retries. Once the budget is spent the
run stops with a typed perseveration pause and emits the `perseveration_loop`
notice, so a parent cannot mistake the loop for a clean result. The retry budget
lives on the run, so the next user message starts fresh.
Adds a boot-level effect test asserting what reaches the provider request and the
frontend sink, and updates the guide.
The version panel's install ran download, install and restart as one act:
once the signature checked, the application ended with no prompt. It also
wrote the pin before downloading anything, for every target, so an update
that failed (or a Windows chunked swap that rolled back after restart, the
2.20.x case behind #11115) left "pinned to 2.21.0" on a 2.20.0 install,
with its only way out disabled while any other move was in flight.
- StartInstall now stops at a verified, staged release (phase "ready").
POST /update/restart commits it; it is refused with
update.restart_busy while a local turn or background job is running,
unless the request says the person saw that (force).
- The pin is written when the install is committed, only for a rollback;
a move forward releases any pin. A failed or dismissed install puts the
previous pin back. A pin naming a build other than the running one is
released at launch.
- A failed move carries a dotted code from the step that failed
(catalog, download, signature, disk, no package, installer). A forward
move records itself; the next launch, still on the old build, reports
update.not_applied with the swap helper's reason, which the helper now
writes instead of printing to a stderr nobody reads.
- The panel explains each code, links the full installer where installing
once by hand is the way out, and drops wording that promised automatic
updates Studio does not perform.
Add an opt-in vi command mode to the composer prompt ([ui].commandmode =
"vi"). At the prompt Esc enters command mode for navigation and editing
rather than interrupting a turn; command mode owns the keys h l j k 0 $ ^
i a x I A p D and the mode switch.
The composer lives in internal/frontend/tui, so the mode is implemented
there against its textarea: vimode.go carries the command-mode keys and
the mode switch, input.go routes keys through it, and ask.go and
prompts.go keep Esc from dismissing an open question card or deciding an
approval card. Command mode consumes any key carrying printable text, so
a CJK/IME character is eaten rather than inserted.
Because the interrupt key now depends on the composer mode, the
running-turn hint can no longer name a fixed key: with ui.commandmode off
Esc stops a running turn, while in vi mode only ^C interrupts, since Esc
is a mode switch whether or not a turn runs. The thinking
status line therefore names the key that actually interrupts — "(Esc
cancels)" or "(Ctrl+C cancels)" — across en/zh/zh-TW, and the footer names
the composer's input mode, NORMAL in command mode and INSERT otherwise.
The cancelling line drops its "Ctrl+C exits" hint in vi mode, where Ctrl+C
re-cancels instead of exiting, and the approval, ask and plan card hints —
plus the plan choice list — drop their Esc mention there, where Esc is
ignored.
At the prompt, ^C with a non-empty prompt clears it and leaves shell mode,
in vi mode and out. In vi mode it first saves the trimmed draft to the
cmdline history when there is one, as send() does, so an accidental
interrupt never loses it (Up recalls it); a whitespace-only prompt is
cleared without being saved. In vi mode Esc no longer decides an approval
or ask card, where it is pressed out of habit; a row key or Ctrl+C decides
instead, and Ctrl+C still cancels a running turn even while an ask answer
is being typed.
[ui].commandmode is user-global only: a project reasonix.toml cannot set
it, so a cloned repo never rebinds the user's keys.
The fresh-start fallback was inferred from `--continue` being set, so a
bare `-r` picker run with `--continue` also skipped --copy even though the
picker resumes its choice in place and has nothing to duplicate. Carry an
explicit `startedFresh` out of session resolution instead, so only a
`--continue` that found no session skips --copy; the picker and `--copy`
alone stay usage errors.
`--continue --copy` with no saved session failed with "--copy requires
--resume or --continue", even though --continue had been passed. --continue
already falls back to a fresh session when it finds nothing, so there is
nothing to duplicate; --copy is now skipped and the run proceeds.
`--copy` with neither --resume nor --continue is still a usage error. Fixed on
both the run path (cli.go) and the TUI (tui_command.go).
The run path's copy resolution moves into applyRunCopy, which keeps runAgent
within its complexity ratchet.
OpenAI documents that GPT-6 Sol and Luna take function calls on Chat
Completions only at reasoning_effort=none, and that GPT-6 Astra's tool
calling requires Responses. The curated OpenAI preset nevertheless shipped
kind "openai" (Chat Completions) with default gpt-6-sol, effort medium and a
ladder without none, so every default turn was Chat Completions + tools +
effort medium: the one combination the model table (gpt6Capability,
Responses-only) already says cannot call tools.
- The preset's entry moves to kind "responses". Its effort list and default
are unchanged; both are inside every GPT-6 model's Responses ladder.
- shippedPresets gains the Chat Completions shape as a generation, with a
Kind field on shippedPreset: an entry still identified by preset_id
"openai", our base URL, the shipped catalog, window 1,050,000 and default
gpt-6-sol is moved onto the Responses wire. Anything its user changed in
that shape is left alone, and a second pass changes nothing.
- A consistency test walks every curated preset: a model whose table row
names its wires must be served on one of them, and declared efforts and
default must sit inside that model's ladder. The old preset fails it for
all three GPT-6 models.
- Effect tests through boot.Build hold a fresh install and an install of the
old shape to a Responses body carrying tools and reasoning.effort=medium.
Docs: https://developers.openai.com/api/docs/guides/latest-model,
https://developers.openai.com/api/docs/models/gpt-6-sol,
https://developers.openai.com/api/docs/models/gpt-6-luna,
https://developers.openai.com/api/docs/guides/reasoningCloses#11199
The agent's browser panel put its page away and showed "the page is hidden
while something covers it" when nothing a person could see was over it, and
sometimes stayed that way after the cover left.
Why it misfired:
- The check took the topmost element at nine points as the answer. A layer at
opacity 0, or a transparent full-window layer that only catches clicks, is
the topmost element and paints nothing, yet it hid the whole page.
- A cover that leaves by a CSS transition, an animation or a hover changes no
attribute the panel watched, so the page stayed away until something
unrelated moved. The observer also only listened to five attribute names.
- A popover reaching into one corner hid the whole page and replaced it with
a sentence.
What changes:
- ui/occlusion.ts decides from hit testing plus computed style and geometry:
an element counts only if it paints at the probe point (effective opacity,
visibility, background, backdrop filter, a border band, its own text rects,
or a replaced element). The slot's own content, its ancestors, and layers
that paint nothing are skipped. The rectangle sent to the shell is the part
of the slot the window shows, cut to clipping ancestors. A layer reaching no
more than 8px into the edge, like a column gutter's grip, does not count.
- Recovery no longer depends on a mutation: transition and animation
end events reschedule the check, all attributes are observed, and a 400ms poll
brings the live page back whatever moved.
- A covered page is frozen instead of hidden: the shell takes a picture of the
page on screen with capturePage before putting it away, and the panel draws
that picture in the slot until the cover leaves. The sentence is gone.
The picture channel (browser:freeze) takes only the page already shown in
this window, answers only this window's own page, and the picture is drawn in
an <img> and sent nowhere else. A freeze overtaken by a show does not put the
page away. An older shell without the verb falls back to hiding the page.
Tests: browser-panel.interaction.test.tsx covers invisible, transparent and
hidden layers, the slot's own content, recovery with no DOM change, stale
pictures and view transitions. test/freeze_live.js checks the channel in a
real Electron window.
A relay that serves several vendors' models under one address and key could
only declare one supported_efforts list for all of them. Each model can now
carry its own, stored where per-model settings already live
(model_overrides.<model>.supported_efforts / default_effort) and applied by
the same model resolution every request and every level picker reads, so a
level the picker offers is the level the request carries.
Precedence: the model's own list, then the connection's supported_efforts,
then the model table for the endpoint, then the protocol's generic ladder. A
model with no declaration inherits; installed configs need no migration.
- config: ModelEffortDeclaration / SetModelEffortDeclaration (keeps every
other override field, drops an emptied override, ErrModelDefaultEffortNotListed
for a default outside the levels) and InheritedEffortCapability. ResolveModel's
three branches share one forModel step.
- EffectiveEffort: the stored level is one per connection, so after a model
switch it can fall outside the next model's levels. That model now runs at
its own default, the level its picker's "auto" names, instead of omitting
the field while the picker says auto means something else.
- An override that only sets max_output_tokens is no longer dropped as empty
on load.
- serve: /providers lists each chat model's own, inherited and protocol
declarations; /providers/edit takes modelEfforts as the whole answer for the
listed models, refusing with provider.model_default_effort_not_listed and
provider.model_effort_unlisted.
- Studio: the "Thinking and reasoning levels" fold gains "Levels per model":
inherit (showing what that means) or pick the model's own levels and default.
The effect test builds a mixed relay through boot.Build and checks the
request body for every offered level of both models, and that a level a
model does not take never reaches the wire.
Closes#11192
The check that refuses a click as browser.covered answered a different
question from the one it was asked, in four ways:
- DOM.getNodeForLocation takes document coordinates, and it was given
viewport ones. On a page scrolled by less than the target's distance
from the top of the viewport it hit-tested a point that far above the
target and reported whatever sat there (a banner, a nav bar) as
covering it; scrolled further, the lookup found nothing and the check
passed, so a click under a fixed header or a veil went through to the
wrong element.
- ignorePointerEventsNone: true makes the hit test count
pointer-events:none elements as hits, the opposite of what a pointer
does, so decorative overlays were reported as covering.
- Newer Chromium (Edge 154) resolves a hit on a ::before/::after to a
CSSPseudoElement, which has no parentNode, so a button with a ripple
layer was refused as covered by its own pseudo-element.
- A form control drawn by its label (a zero-size or visually hidden
checkbox, a radio painted over by a span in its label) was refused as
not_visible or covered, although a person clicks the label.
The hit point is now converted to document coordinates, pointer-events:none
is left to the browser, a pseudo-element hit counts as its element, a hit
inside one of the target's labels counts unless it passes through other
interactive content (a link in the label follows the link), and before
refusing, the element is scrolled to the middle of the viewport, which
clears fixed headers and footers. A real cover is still refused, now
naming what is on top by ref. The label list comes from the page, so it is
capped and checked to be labels on the host side.
Measured with a table of pages at 1x and 1.5x device scale on Chromium 151
and Edge 154: before, 6 false refusals (7 on Edge), one click silently
landing on a fixed header and one passing through a veil; after, none,
and the true covers are still refused.
Every curated preset so far points at a Chinese coding plan or a
multi-model relay, so a user arriving with an OpenRouter, OpenAI or
Gemini key has to write the provider by hand.
- openrouter: DeepSeek, GPT-6, Gemini, Kimi, GLM, Qwen and MiniMax ids
checked against /api/v1/models; credits balance via the existing
OpenRouter decoder; HTTP-Referer / X-OpenRouter-Title /
X-OpenRouter-Categories so the traffic is attributed to Reasonix in
OpenRouter's app rankings. Claude ids are left out: on the openai
dialect no cache_control is sent, so every prompt token would bill at
the full input rate (claude-dialect).
- openai: GPT-6 Sol/Astra/Luna on Chat Completions, which already sends
max_completion_tokens to api.openai.com; declares the documented
low..max effort ladder.
- gemini: the Developer API's OpenAI-compatible endpoint.
- volcengine-coding-plan: the Coding Plan endpoint with ark-code-latest,
which follows the model chosen in the Ark console.
The presets live in their own file; provider_presets.go only appends
them.
A model can now declare optional run modes beside its effort ladder, in the
same model capability table. Each declaration names its id, the frontend's
label/hint keys, how it maps onto the request, the wires (kinds) and the
vendor endpoint it was established on, and whether it costs noticeably more.
GPT-5.6 (gpt-5.6 alias, sol/terra/luna) and GPT-6 (sol/luna/astra) declare
"pro", sent as Responses reasoning.mode "pro" beside reasoning.effort, on the
Responses API at api.openai.com only (developers.openai.com/api/docs/guides/
reasoning: mode and effort are independent; pro does more model work and is
billed at the model's rates for more tokens).
The mode is session state, not config and not prompt text:
- control.Controller lists the modes the session's model declares and sets
one; an undeclared mode is refused with ErrModelModeUnsupported.
- The agent carries the chosen id on every main-loop provider.Request; a new
conversation starts with it off. Subagents, compaction and side models
never carry it.
- The Responses adapter sends reasoning.mode only for a mode its endpoint
declared (projected by boot into the provider config), so a relay, Chat
Completions or a model without the declaration never sees the field.
- A rebuild carries the mode onto a model that declares it and drops it
otherwise, so a model switch turns Pro off.
- serve: POST /model-mode, refused as model_mode.unsupported; /status lists
modes only for a model that declares any.
Studio shows a switch at the bottom of the effort menu only when the model
declares a mode, marked as costing more; the trigger reads "... · Pro mode"
while it is on. The row stays pinned to the bottom of a scrolling menu.
Documents how Reasonix discovers and runs Agent Skills: the project,
custom, global and built-in roots, run_skill and slash invocation,
references/ and scripts/ handling, the extra frontmatter keys, and the
/skills and [skills] controls. agentskills.io asks listed clients to link
a page describing their implementation; this is that page.
Persist always-allow rules in private per-workspace user state and load them into the effective policy. Default skill installs to user scope unless project scope is requested, so neither action creates reasonix.toml in the workspace.
The model table named GPT-5.6's none..max ladder, but the provider was only
ever told a user-declared supported_efforts list, so on api.openai.com the
request builder refused "none" and "xhigh" at build time and clamped "max" to
"high". RequestEffortLevels now projects the resolved ladder (declared list
first, then the model table for the endpoint in hand) into the provider
config, so every rung the composer offers reaches the wire as itself.
Ladders, each from the vendor's own documentation:
- gpt-5.6 (alias of gpt-5.6-sol), sol/terra/luna: none|low|medium|high|xhigh|max,
default medium, on Chat Completions and Responses.
- gpt-6-sol / gpt-6-luna: none..max, default medium; gpt-6-astra: low..max
(none answers 400). Responses only: on Chat Completions GPT-6 takes
function calls only at reasoning_effort=none, and every turn carries tools.
- Model Studio Qwen3.8 (qwen3.8-max, -max-0902, -flash, -2.4t-a95b, -27b):
low|medium|xhigh plus none (enable_thinking=false), default xhigh; high and
max fold to xhigh, minimal to low. Vendor hosts: dashscope(-intl).aliyuncs.com
and <workspace>.<region>.maas.aliyuncs.com.
A ladder's vendor is now a host set with suffixes (vendorEndpoint), and a
ladder names the provider kinds it was declared for. The model table moves to
effort_models.go. The composer names none ("No reasoning") and tells xhigh
("Extra deep") apart from max, which shared one label.
reasoning.mode "pro" is not added here: it is a Responses-only dimension
independent of effort and needs its own control.
approval.go went 10 lines over repolint's 800-line ceiling with the MCP
origin handling. The ask-notification text builder now sits beside its
existing test file; no behaviour change.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The rewind menu's three scope labels and the bash coverage-gap reason are
Chinese literals held in a table and rendered as written:
<span className="lb">{s.label}</span>
Neither static guard could see them. The catalogue test only collects
Chinese inside a t() call, and the JSX test only reads text between tags or
in a rendered attribute. A table holding Chinese is correct exactly when its
render site calls t(), so the render site was the thing that was wrong. The
browser sweep that is meant to be the judge never opens this menu either:
tools/steps.mjs walks no rewind step.
Route both render sites through t() and add the four keys to the English
catalogue. A Chinese window is unchanged - zh still falls back to the key.
Verified: pnpm typecheck; pnpm test (169 files, 1035 tests).
Extract ProjectConfigPath(root) as the single place the project config
path is computed, and route every caller through it: load, credentials,
edit, retired-key migration, MCP migration and boot. It still resolves to
<root>/reasonix.toml, so behaviour is unchanged.
MigrateV2 rewrites a fact and then the index. When the index is unreadable,
reindexIn fails after the fact has already been rewritten, and the next run
skips facts that carry an id, so the entry stays out of the index for good.
The migration now reads the index once per directory before touching any fact,
the same guard RestoreArchived uses, so a failure happens before the first
write and a retry still sees the fact as unmigrated.
Cache note: no prefix bytes move; this only decides whether a migration starts.
Add a user-global [tools.shell] env table so every command the bash tool
runs inherits extra KEY=value variables (for example
`BASH_ENV = "~/.reasonix/bashsandbox.rc"`). The value is applied over the
inherited environment but under the host-owned session/egress overrides, so
a preset value never displaces TMPDIR or an egress token.
The variables ride the sandbox spec (sandbox.Spec.ShellEnv), so foreground,
background, and host-terminal runs all inherit them alike. It is
user-global: a cloned repo's reasonix.toml cannot inject variables, because
the shell env is held across the project merge next to the sandbox grants.
Presetting a variable that names a host endpoint (SSH_AUTH_SOCK, DOCKER_HOST,
CONTAINER_HOST, XDG_RUNTIME_DIR) does not unmask it: the denied authority set
resolves from both the host environment and the effective one, so a preset
that points a client elsewhere still leaves the host's own socket masked. The
egress loopback proxy ports are unioned the same way, so a preset proxy is
closed and overriding a variable cannot reopen the host's.
The interpreter itself is still resolved by [tools.shell] prefer/path. A key
that cannot appear in an environment entry is dropped rather than written as
a malformed one, and keys are sorted so identical config yields identical
environment bytes.
The recall diagnostic reported one Omitted count for two different decisions:
the per-turn hit cap and the character budget. The note the model reads already
names both, so a reader could not tell which one dropped a fact.
RecallResult now reports OmittedByLimit and OmittedByBudget apart, and the
/memory recall diagnostic prints both. The trajectory audit keeps its combined
Omitted value, so the persisted shape is unchanged, and the model-visible note
still carries the sum of the two.
From #11146's review: "Splitting omitted into limit vs budget would be a nice
separate diagnostic."
Address the two non-blocking nits from #11148's review: state the constraint
the test pins instead of narrating the implementation, and assert the error is
the pinned-budget refusal rather than any error.
The assertion matches on identity rather than on the message:
validatePinnedBudget wraps ErrPinnedBudget, and both the recovery test and the
save path's own test assert with errors.Is. The sentinel's text is the setting
the message already names, so the user-visible message stays byte-identical.
Between roughly 470px and 720px of conversation column (a wide browser
pane is the usual way there) every toolbar control was flex: none, so the
model/effort group ran past the toolbar's box: the send or stop button sat
on the effort picker and the effort label painted outside the composer.
Below 470px the send cluster was taken out of flow with a fixed 38px
reserve, which the wider stop button does not fit in.
The row now lays out in flow at every width: the send cluster keeps its
own slot at the end of the line, the toolbar wraps inside what is left,
and the model group has a minimum basis, grows to fill the line and lets
the model name shrink to an ellipsis before it moves to a line of its
own. The spacer and the per-width offsets it needed are gone.
perf/composer.mjs sweeps 340-760px idle and running with a long model
name and fails on any control outside the composer, any two controls
overlapping, or a model name narrower than 40px; it fails on the old
stylesheet at 340px (running) and 480-720px (both states).
Fixes#11159
A run that keeps calling tools without changing anything the host can
observe (#11153: dozens of successful `echo` calls with varying arguments,
about 1.1M input tokens) had no signal short of reading the transcript.
This adds one, without bringing back any round-count guard: nothing is
sent to the model, no call is refused, and the cache-stable prefix and
the per-turn execution-policy block are untouched.
Judgement (kernel, structure only):
- evidence.EffectWatch scores each round's receipts. An effect is a
successful mutation or named write, a task step moving (StepProof,
TodoStep, or the host's todo progress counter), a verification whose
outcome changed since it last ran, a first read (a read-only tool
answering a request not seen before in this run, or a shell command
naming an existing path not named before, resolved by stat), or a
delegated result coming back. A command merely being new is not.
- agent.settleProgressRound runs at each tool-round boundary; the count
lives in turnRuntime, so a user message zeroes it. A second,
model-independent backstop compares the input tokens spent since the
last round with an effect against context window x N; an effect
restarts both counts, so a long run that keeps doing observable work
is never flagged however much it spends. Without a ledger the round
judgement stays silent rather than guess.
Feature 2 (default on): a content-free progress_watch event carries the
reading; Studio shows a one-line strip above the composer with Stop
(the ordinary cancel) and "don't show again (this session)". It clears
itself when an effect lands or the turn ends. The TUI says it once per
stall.
Feature 3 (default off): [progress_watch] pause = true ends the run at
the round boundary through a resumable pause (RunPauseInfo Kind
no_progress, TurnDone outcome no_progress). No finalization nudge is
injected. Continue sends an ordinary message, which starts a new run
with the count at zero. The section is user-level only: load restores
the user's value over a project reasonix.toml. Settings > Session edits
it through GET/POST /progress-watch, which persists to the user file
and hands the new watch to the running executor without a rebuild.
Out-of-range values refuse with progress_watch.out_of_range.
Refs #11153
The market entry gains up/down vote buttons that show the signed-in
account's vote; pressing the lit one withdraws it. Signed out, the entry
offers sign-in (a jump to the account section); a publisher, an
unverified account and a paired device each say why they cannot vote.
List rows show approval and install count, and the listing defaults to
the registry's new recommended order.
The kernel owns the calls: market.Client gains MyVote/Vote, which send
the account token only to the fixed registry host with redirects
refused, and ReportInstall. Registry refusals keep their identity
(signed_out, email_unverified, own_package, rate_limited; an identity
outage stays market.unreachable) through market.* refusal codes. Vote routes sit
behind accountAuthAllowed like every other account route.
A successful market install reports once, carrying only the slug and a
random id kept only for the market (market/install-id under the Reasonix
home, unrelated to the usage-statistics id), and only when the host allows
it (release builds), both desktop statistics switches are on, and
neither DO_NOT_TRACK, REASONIX_TELEMETRY=off nor CI opts out.
The [desktop] telemetry and metrics switch descriptions now say that
per-package market install counts are reported (anonymous, no content).
A publisher's own unreviewed install is never reported.
The usage panel summed every turn in the currency its price table was
kept in, and ignored the display currency the rest of Studio reads
costs in. A DeepSeek entry holds the vendor's USD table, so a user who
pinned CNY, or whose CNY wallet selected it, saw "US$" on the panel
while the pane's cost meter said "¥".
Every quote already carries the vendor's own table in both currencies,
and the stats line records both valuations; nothing had to be converted,
only read. The usage catalog now keeps each row's valuations and tallies
one partition per view: a row the vendor priced in the display currency
moves into it, and any other row keeps its billed currency, so a relay's
USD price is still shown as USD rather than converted at an invented
rate. The schema version moves to 5, which rebuilds the projection from
the JSONL it is derived from.
The live projection path also dropped the cost of every row a running
process appended, marking the file indexed all the same, so today's
spend vanished from the panel until the next restart. It now carries
the same cost a reindex would.
A skill in the Studio composer was only the text "/name", and only a
leading one ran: the kernel reads a slash at the start of a line and
nowhere else, so "/review" typed mid-sentence reached the model as prose.
Picking a skill or subagent from the slash menu now places a chip, at the
start of the line or after any "/" that opens a word. A "/" past the start
asks the kernel's completion as if it opened the line and keeps only
skills and subagents, since a command is not something a sentence can
hold. The chip is the record of the pick; the same letters typed by hand
stay prose, so nothing reads the submitted wording to find a skill.
The chip is drawn by a mirror laid over the textarea at the textarea's own
computed metrics, so caret, selection, IME and undo stay native. Edits are
reconciled from the text the chips were last placed in, so every way into
the box (typing, drops, prompt refine, a refused send) carries them, and an
edit that reaches into a chip removes it whole. Skills take --net and
subagents --deleg.
On send the line goes out as typed (input), the text with the chips taken
out (submit), and the chips (invocations). /submit and POST /inbox/items
route a chip line through the inbox envelope, which already carries
invocations to prepareInvocationTurn, so a mid-line chip reaches the model
byte-identical to a leading "/name task". A kernel that predates this reads
only input and still runs a leading chip. TryEnqueueAndSteer queues a line
holding an invocation as a follow-up: a steer is read as guidance and would
drop the skill.
Closes#11145
RestoreArchived checked id and name collisions but skipped the rest of what a
save validates: a recovered fact could take a subject_key another active fact
now holds, or push pinned guidance over the configured budget. The fact model
states the subject rule unconditionally, and the save path refuses both.
Validate the restored fact with the same validator SaveWithOptions uses, before
any part of the restore is written.
studio still drops the read error when it rewrites the MEMORY.md index:
store.go reads the existing index for indexLinesExceptIn and flushIndexIn
with `existing, _ :=`, so an unreadable index reads as empty and the next
save rebuilds it from the managed lines alone, silently discarding
hand-written content while reporting success.
main-v2 already fixed this in 2eb878989 ("preserve index when reads fail"),
with 79acaf6e9 moving the readers into store_index.go to stay inside the
repolint budgets. This ports the same shape to studio so both lines behave
alike:
- readIndexIn keeps treating a missing index as empty but returns any other
read error; indexLinesExceptIn reports that error and whether the name was
present, which lets indexContainsIn go away.
- flushIndexIn and reindexIn propagate the read error instead of rebuilding
the index from an empty read.
- archiveLocked and archiveMemoryInDir read the index before archiving, so a
failed read happens before any side effect.
- SaveWithOptions reuses removeMemoryFromDir and archiveMemoryInDir, dropping
the duplicated remove/flush and archive/flush pairs and keeping the
function inside its size and complexity budgets.
AppendDoc discarded the read error, so an existing but unreadable doc-memory
file (REASONIX.md/AGENTS.md) was treated as empty and rebuilt from scratch,
silently destroying the user's standing instructions. Surface the read error
unless the file is simply missing.
Ported from 1.x (#8319), which fixed the same defect on main-v2; the 2.x
writer still had the original discard.
Entries may carry a discussion number instead of an issue number. Discussions
have no REST comment API, so the reply goes through addDiscussionComment and
skips a body the bot already posted there.
A publisher can now keep a package to themselves and install their own
packages before, or without, review.
- Publishing takes a visibility. "Only me" saves the package as private:
it skips review and never appears in the market. My packages marks it
private and offers "Submit for review", which moves it to pending.
- Every row in My packages can be installed. The kernel reads the package
from the registry's /v1/me/packages/:handle/:name as the signed-in
account, never from what the window sends, so another account's package
is refused (market.not_yours).
- A live version keeps its reviewer's pin. Any other version has none, so
the preview's own contentDigest becomes the pin: apply must echo it
(market.unpreviewed otherwise) and install_source refuses material that
changed since the preview. The confirmation says "Unreviewed, visible
only to you", and the ledger records the install as unreviewed.
- The plan, the risk grades, the multi-skill confirmation and the
themes-only check are the same ones every market install passes; the
confirmation view is shared with the market entry page.
Each market row is now two lines: name, kind, verified/installed badges and
the install count on the first; a one-line truncated summary with the
publisher and version, de-emphasised, on the second. Rows stay buttons, so
they open with the keyboard, and truncate rather than overflow at phone width.
The listing now says which packages can be installed from the market. The
kernel reads the registry's `pinned` per listed package (nil when an older
registry does not say, so nothing is claimed) and forwards `pinned=1` for the
new "Installable only" toggle. The registry applies that filter, so pages stay
whole; a registry that answers a filtered ask with an unfiltered page is
refused as market.filter_unsupported rather than trimmed client-side. The
install path is unchanged and still checks the approved version's digest.
The chunked update stages the new tree in the update cache and a helper
swaps it in after exit, renaming each installed file into a backup
directory beside the staged tree. Two installs can never complete that
first rename: an all-users install under Program Files, which grants its
users read and execute only, and an install on another volume than the
user's cache, where MoveFileEx without MOVEFILE_COPY_ALLOWED refuses.
For both, the helper rolled every file back and relaunched the old build
with nothing shown, so the update downloaded, "installed", and the
application came back on the version it started from. Before chunked
updates these installs took the full installer, which raises its own
consent and writes wherever it installed.
tryDelta now proves that move before fetching anything: it creates an
entry in the install root and renames it into the cache's delta
directory. If either step fails the full package is downloaded instead,
as for any other delta that cannot be used.
Closes#11115
In a conversation column of 460px or less, app.css stretches the send
cluster to width: 100%, and at 470px or less studio.css takes the same
element out of flow (position: absolute; right: 0; bottom: 0). The two
rules combined into an invisible full-width strip over the composer's
last line, so every tap on the model picker or the effort picker landed
on the send cluster. The pickers rendered but never opened on a phone,
over LAN and over the relay alike.
The absolute rule now declares width: auto, so the cluster is only as
wide as the send button. A stylesheet test resolves the cascade for
the cluster at phone widths and fails if it is out of flow and a full
row wide.
Closes#11116
An over-budget worktrees/ or modules/ group was bound read-only as a whole,
but the exact mounts for the gitdirs inside it were still emitted first, so
planting submodule gitdirs kept growing the bubblewrap argument list. Paths
beneath a read-only tree are now left to that tree.
The serve launch-token sandbox test placed its files under /tmp outside the
write root, which bubblewrap masks with a tmpfs: the control read failed and
the denied reads passed without exercising the forbid-read mounts. The files
now live inside the write root on every platform.
Add English wording for the serve.host_rejected and
auth.launch_token_required refusals.
Signed-in users can now submit skills, plugins, MCP servers and themes to
the community registry from Settings > Extensions > Discover, and follow
each submission's review state.
- internal/ext/market: Client.Publish (POST /v1/packages) and Client.Mine
(GET /v1/me/packages) send the account session as a Bearer token to the
same fixed https host the listing reads, with redirects refused, so the
token never reaches another host. The registry's refusal codes are
projected onto sentinels (ErrSignedOut, ErrEmailUnverified, ErrNotOwner,
ErrVersionExists, ErrRateLimited, ErrRejected).
- A submission is checked against the same source rule an approved
version must pass to install (sourceInstallable, shared with
installable): plugins and themes must name a GitHub tree pinned to a
full commit. Nothing is sent for review that could never be installed.
- theme is its own listing kind that installs through the plugin
installer (Installer("theme") == "plugin") under the same commit pin and
digest check. The plan must consist only of plugin packages that carry
themes and nothing else (no skills, commands, agents, hooks, MCP servers,
prompts or runtime); otherwise market.not_theme.
- serve: POST /market/publish and GET /market/mine, gated like every
account route (host grant plus a stored session), each failure a dotted
code (market.signed_out, market.unpublishable, market.rejected, ...).
- Frontend: Browse / My packages / Publish views inside the market group
while signed in, a sign-in prompt otherwise; a Theme category filter.
- A theme's apply re-plans and checks themes-only before writing, because
a planId binds the source and actions but not the listing kind. A
registry accounts_unavailable answer reads as market.unreachable, not
as signed out.
The host's own git reads the workspace repository's configuration and hooks,
so a confined command that can rewrite them can make the host run a program
of its choosing. The OS sandbox now denies writes to them while leaving the
rest of .git writable.
For the repository git itself discovers from each writable root, protected
paths are: config, config.worktree, commondir and hooks/ of the gitdir and
of the common dir; config, config.worktree and commondir of every existing
linked worktree entry (new entries stay creatable); config, config.worktree,
commondir and hooks/ of every submodule gitdir under modules/. A .git file is followed to the gitdir it names
exactly as git resolves it, and the pointer file and commondir are
protected, so a repository cannot aim the protection at a decoy while git
reads something else. The .git entry, the gitdir, the common dir, every
symlink on the way to them and each writable ancestor are pinned: they
cannot be removed, renamed away or replaced by a symlink, while their own
mode and times stay writable (touch and chmod on the workspace root work).
- macOS: deny rules after every write allowance. Existing worktree and
submodule gitdirs (up to 128 each, found without following symlinks) get
exact rules and pins; patterns anchored at the common dir cover the rest
and gitdirs created later, skipping refs/ and logs/ segments so a branch
or tag named config or hooks stays writable. The profile stops growing
past the limit.
- Linux: pinned directories become their own bind mounts and protected files
and hook trees are bound read-only; only real directories and regular
files are mount targets. Up to 512 gitdirs per group get exact mounts;
past that the whole group directory is bound read-only, so planted HEAD
files cannot overflow the argument list. Only existing paths can be
mounted and symlinks cannot be pinned.
- Windows has no Bash sandbox; the guide says so.
A protected file with another hard link refuses the confined launch with
sandbox.git_metadata_linked (ErrGitMetadataLinked), since no path rule sees
a write through the other name. Whenever a confined command's output names
a protected path, also on exit 0 (git reports some refused config writes
and exits 0), the bash result carries sandbox.git_metadata_protected.
Real-sandbox tests cover each protected path, pointer and symlink
retargeting, patterns for gitdirs created later, bounded rule size with
2000 submodule gitdirs, ordinary git work, and the git operations that now
fail or silently skip their config write.
Every git invocation the host makes goes through gitcmd, and each one must
leave the programs a repository's own configuration names unexecuted:
filter and merge drivers, textconv and external diff, fsmonitor, hooks,
signature verifiers, submodule-boundary programs and lazy-fetch transport.
- Fixed keys are overridden with -c: core.fsmonitor (empty, not "false",
which git before 2.35.2 reads as a hook name), core.hooksPath,
log.showSignature, merge.verifySignatures, diff.submodule, gc.auto and
maintenance.auto and safe.bareRepository=explicit; submodule.recurse=false
for checkout, switch, restore, reset, merge and read-tree (host tree
updates never update submodules), and elsewhere only where the
repository's own config sets it.
GIT_NO_LAZY_FETCH=1 stops a missing object becoming a fetch through the
repository's remote (git 2.44+); a historical patch that fails for that
reason returns gitcmd.ErrObjectNotLocal, decided by git's own
--missing=print listing.
- diff, log and show carry --no-ext-diff and --no-textconv; status and diff
carry --ignore-submodules=dirty. The subcommand is found past global
options, so a call passing -C inside args is hardened too.
- Filter and merge drivers defined at local or worktree scope are listed by
git itself before each invocation (includes followed) and overridden empty;
user and system scope stay live; a name -c cannot address fails closed
(ErrRepositoryDrivers).
- worktree add uses --no-checkout and populates through gitcmd inside the new
worktree, so a conditional include keyed on the new gitdir or branch is
seen by the driver listing there rather than run by the add's checkout.
The reset takes the worktree-mutation timeout, and a failed reset removes
both the worktree and the branch the add created.
- Launcher ls-remote runs Detached with gitcmd's environment (only PATH is
taken from the launcher's declared env), requires an https://, ssh:// or
git:// remote (case-insensitive; http:// and local paths are refused), and
passes the remote and ref past -- so a leading-dash value is an operand.
- frontend/cli runGit passes its directory through gitcmd so enumeration runs
in the target repository, not the process cwd.
- Repository identity is resolved once, when a session opens: boot runs
gitcmd.Open (rev-parse --absolute-git-dir --git-common-dir --show-toplevel)
before any command, the controller carries the resulting gitcmd.Repo, and a
rebuild of the same workspace passes it on. Every later host call runs
through the Repo with GIT_DIR, GIT_COMMON_DIR and GIT_WORK_TREE set, so a
nested .git, a commondir file or a damaged HEAD written afterwards cannot
substitute another repository or its config; a damaged HEAD fails closed.
Threaded through gitstatus Status/Diff (serve /changes and diff),
worktree Inspect/Create/TakeSnapshot and the candidate/apply/remove paths
(Snapshot and Candidate carry their Repo; host-created worktrees are opened
right after worktree add), the isolation store, best_of_n, and cli review
(resolved once before the review agent runs; ObjectsMissing is a Repo
method).
- Open accepts only a git dir belonging to the work tree that holds the
directory: the work tree's own .git (sharing no other common dir) or a
linked worktree's admin dir under <common>/worktrees whose gitdir file
names that work tree's .git. A .git file or core.worktree pointing at
another checkout is ErrNotRepository. Submodule checkouts and
--separate-git-dir repositories opened directly are therefore treated as
not version-controlled.
- Repo.Verify applies Open's test to a stored identity; Snapshot and
Candidate identities are verified when used again.
- The snapshot's private index copy keeps the real index's mtime: with a
fresh mtime git trusted stat for entries written in the index's own
second, so a same-size edit made in that second was left out.
- Snapshot staging uses gitcmd Repo.StageAll: gitlinks present as directories
and untracked nested repositories are excluded with :(exclude,literal)
pathspecs, because add -A checks a submodule by running git inside it under
its own config. A gitlink keeps the commit the index records; an untracked
nested repository is left out (it previously failed the snapshot when it had
no commit).
Regression tests use real git with payload scripts: the gitcmd config-key
matrix (signatures, lazy fetch, submodule boundary), the worktree call sites
(conditional includes on Create and CreateCandidate), the launcher's non-URL
remote rejection, identity pinning after a nested .git, a commondir file and
a damaged HEAD (config origin and filter marker), Open refusing another
checkout's git dir (.git file, core.worktree, foreign admin dir), StageAll
with nested repositories named like pathspec magic or globs, StageAll and TakeSnapshot
past a gitlink with its own filter, the listing and snapshot of a workspace
that later gains its own .git, and a global submodule.recurse=true against
host checkout and reset. The list-then-run race is left to a follow-up that
denies sandboxed writes to .git config and hooks.
`reasonix serve` now generates a per-launch token unless `--auth` or
`[serve].auth_mode` chooses otherwise. `none` remains an explicit opt-out for
deployments fronted by their own authentication: reads stay open to loopback
and bound names only (421 `serve.host_rejected` otherwise), and every
state-changing request, approvals included, needs the launch token (bearer
header or the /auth/token cookie) and otherwise refuses with
`auth.launch_token_required`. A request the loopback gate, a paired-device
gate or the in-process transport already admitted counts as holding it, so
Studio and the TUI keep working unchanged. Token mode also accepts the bearer
header.
The token never reaches the terminal: serve writes it to a 0600 file under the
remote state directory and prints the path, or names the --token-file of a
managed launch. Runtime sandboxes and read tools deny that directory and every
`--token-file`, `--provider-broker-file` and `--provider-broker-token-file`.
[serve] is read from the user config only, so a project reasonix.toml cannot
choose the token, the auth mode, or trust in forwarded headers.
Studio can now browse, search and install from the community registry
(Settings > Extensions > Discover). The market is a source, not a trust root:
- internal/ext/market reads the registry read-only: https to the fixed
crash.reasonix.io host, 15s timeout, capped bodies, redirects refused,
non-active rows dropped. Registry text is untrusted data.
- Only the approved version is installable, and only when its row carries a
content digest. The digest travels to install_source as expectDigest.
- install_source gains a contentDigest on every plan (machine-independent:
SKILL.md bytes, plugin commit, MCP entry) and refuses a plan whose material
differs (ErrDigestMismatch) or cannot be pinned (ErrNotPinnable). Preview
and apply both pass the check, and apply writes what its own plan read.
- GitHub plugin sources pinned to a full commit (tree/<sha>) now clone and
check out that commit instead of failing on --branch <sha>.
- A remote source that expands into more than one skill is graded high, so
the permission layer asks a person even under a blanket allow, and the
market confirmation lists every skill and holds the install button until
the person ticks that they read them.
- Market installs require the planId of the plan that was shown, go to the
global scope, and are recorded in <home>/market/installed.json; "installed"
is read back only while the recorded targets still exist.
- serve: GET /market/packages, GET /market/packages/{handle}/{name},
POST /market/plan, POST /market/install, each failure a dotted code
(market.unpinned, market.content_changed, market.unreachable, ...).
Adds an opt-in cloud backup under Settings > Account, shown only while
signed in. The kernel collects the user-level setup by category, seals
it locally (gzip, then XChaCha20-Poly1305 under an Argon2id key derived
from a passphrase the user sets), and uploads only the envelope to the
accounts service; the service never sees plaintext.
Categories: settings (providers, default model, interface look),
extensions (user skills, plugin references by source and version, MCP
servers), memory (user-level instruction files and global facts),
automation (global hooks, status line) and secrets (stored provider
keys, off by default). Without secrets, literal env/header values are
stripped with the plugin exporter's StripCredentials and URL userinfo
is dropped; the account session token never travels. Approval mode,
permissions and sandbox are deliberately not restorable.
Restore is preview-then-apply. The preview decrypts, diffs each item
against this machine, shows everything an item would write (endpoints,
env, headers, cwd, instruction file bodies) and holds the snapshot under
a single-use plan id. Apply recomputes consent against the machine at
apply time and refuses, writing nothing, unless each of these is named
in `consented`: hooks, the status line and MCP servers (code that runs
here); a provider that is new or changes endpoint, and a default model
pointing at one (conversations and keys go there); a key that replaces
one already stored; an instruction file that imports other files.
A snapshot is rejected outright when a key is not read by a provider it
carries, when a provider reads REASONIX_* or a host-steering variable
(proxy, TLS, loader, PATH), or when a unit's payload names another item.
Plugins are never installed by restore; they come back as sources for
the ordinary plugin install flow and its plan approval. File items are
written only under their named root, through validated relative paths
that may not cross a symlink; hidden files are not exported. Config
writes go through config.EditConfigFile, hooks through hook.Save, keys
through config.SetCredential.
Serve: GET/POST /backups, DELETE /backups/{id}, POST /backups/{id}/preview,
POST /backups/apply, gated by the account grant and a signed-in token,
with dotted refusal codes the frontend words in both languages.
The hosted build has no kernel behind its origin, so opening
studio.reasonix.io directly probed /runtimes, got the SPA shell and
reported that the kernel did not answer. The deploy now declares where a
visitor picks a computer, and a visit without ?device goes there.
A plan whose steps name candidate files owes a change the host proved.
The shadow verdict and the receipt already said so; the gate now holds
an answer that changed nothing, and releases a turn that concluded
blocked, is waiting on the user, or carries a change a restart brought
in. The hold names all three ways out.
The executor-handoff nudge now runs before the gate ends the run: an
executor that has not acted yet gets its one in-turn nudge first, and
the gate holds only what the nudge could not recover.
publish downloads studio-windows-signed by name, but any job in the run can
upload an artifact. windows-sign-installer now outputs the SHA-256 of the
installer it signed and verified, and publish requires the downloaded
artifact to hold exactly the installer and the portable zip, hashing to
that output and to windows-verify-package's archive hash. A mismatch, a
missing hash or an extra file fails with a studio-signing.* title before
anything is signed or published.
The Microsoft-signed d3dcompiler_47.dll and dxil.dll must now also chain to
Microsoft Root Certificate Authority 2010, pinned by thumbprint; subject and
issuer names alone can be issued under any trusted root.
The plan-criteria gate and the frozen contract verdict measured "passed
after the latest change" from LatestSuccessfulMutationIndex, which counts
an unclassified command as a change. A plan check such as `python -c ...`
is exactly such a command, so it became the latest change and owed itself
a later run that could never come: every plan whose checks were inline
scripts ended with its criteria outstanding, graded pass or not.
Both now read LatestProvenMutationIndex, the baseline project checks and
owed review already use: the latest proven write, or the latest unproven
one only when nothing was proven.
The Windows release signed only the three executables Studio builds. The
installed tree also ships Electron's ffmpeg.dll, dxcompiler.dll,
vk_swiftshader.dll and vulkan-1.dll unsigned, and Smart App Control / WDAC
can refuse to load an unsigned low-reputation DLL, so the app may not start.
Every PE file the Windows bundle may hold is now declared in
scripts/windows-signing-lib.ps1: seven the release signs, and
d3dcompiler_47.dll and dxil.dll, which Electron ships signed by Microsoft
and which are kept that way and verified as Microsoft-signed. A bundle with
an undeclared or missing PE file (.exe, .dll, .node, or any MZ header) fails
until a person updates the list.
windows-sign-payload signs the declared files, verifies all nine, and
records a SHA-256 digest of the whole signed tree as a job output. The
signed tree is the payload artifact; windows-package packages it as it
came. A new job, windows-verify-package, with no secrets and no
environment, checks the payload against that digest, unpacks the zip and
the installer's app-64.7z, requires both trees to equal the payload file
for file (plus resources/elevate.exe, pinned by SHA-256), and outputs the
SHA-256 of both packages. windows-sign-installer only requires the packages
to hash to those values before signing, and afterwards only runs SignTool
verification, so no archive is parsed in a job holding the Certum
credentials and Certum never signs an installer whose contents did not
match.
Signatures are read from the file itself through SignTool and the embedded
signer certificate. Get-AuthenticodeSignature answers from the OS catalog
for d3dcompiler_47.dll and reports a catalog signature whatever the file
carries.
The contract pins the new scripts, and validate now refuses a fingerprint
file that runs a script under scripts/ which is not pinned.
Root cause: some Anthropic-compatible gateways, DeepSeek's among them, open
the web_search_tool_result block with an empty content array and send the
results in a later web_search_tool_result_delta. The stream decoder declared
the delta's results field but never handled the event, so the search produced
no provider-run call: no card, and the only visible source list was whatever
the model wrote into its answer. 1.x fixed the same gap in #9197.
Fix: the server-run search state (serverBlock) now remembers result blocks
that opened empty and completes them from the delta, once per block. The
block-start and argument handling moved onto serverBlock with it, which keeps
readStream within its size and complexity budget.
Test: TestStreamSurfacesWebSearchResultDelta fails on origin/studio
("want 1 provider-run call from the result delta, got 0") and passes after
the fix; go test ./internal/model/anthropic/ passes on macOS and Windows.
Fixes#8900
Settings > Appearance > open theme folder failed on Windows with
`exec: "explorer.exe": executable file not found in %PATH%`.
Root cause: revealFolder started a bare "explorer.exe", which exec
resolves through PATH. explorer.exe lives only in %SystemRoot%, and the
environment Studio is launched with does not always carry that directory
on PATH, so the lookup failed before anything started.
Fix: resolve explorer.exe from %SystemRoot% (falling back to %windir%),
the same way the 1.x desktop's revealPath already does, and keep the
bare name only when neither variable is set.
Test: TestFolderCommandFindsExplorerWithoutPath sets PATH to an empty
directory and asserts the command resolves to %SystemRoot%\explorer.exe.
On Windows it failed on the base with the reporter's exact error and
passes after the fix; the serve Folder/Theme tests pass.
Fixes#11079
ACP clients render their token/cost meter from the stable usage_update
session notification (Session Context Size and Cost). The ACP server
never sent it, so clients such as Paseo showed no usage at all even
though the controller already measures the context gauge and the
session status telemetry already totals cost.
After every prompt turn, and after session/load and session/resume,
the server now sends usage_update with used/size from the controller's
ContextSnapshot (the same measurement the compaction trigger uses) and,
when every priced event produced a quote, the cumulative session cost
with its ISO currency. A session with no context window yet sends
nothing, since used and size are required by the protocol.
Test: TestPromptTurnReportsUsageUpdate drives session/prompt through the
real controller and agent with a scripted provider; it fails on the base
("usage_update notifications = 0, want 1 per turn") and passes with the
change. TestUsageUpdateForCarriesCostOnlyWhenPriced pins the wire shape.
Root cause: the live transcript draws a question from ask_request and
hides the ask tool call, since both describe the same prompt. A reload
has no event stream, so fromHistory rebuilt only the tool call - which
the transcript then hid. An answered question vanished entirely after a
reload, session switch or restart, even though its arguments (questions,
options, descriptions) and its result (the recorded answer) are both in
the history.
Fix: when an ask call has a successful result, fromHistory rebuilds it
as a sealed ask card from the call's own arguments, shaped the way
agent.AskTool shapes them for the wire, and carries the result verbatim
as the recorded answer. The card shows every question and option and,
in place of the per-question picks it cannot know, what the kernel
recorded the user said. A call with no result or a failed result stays
a plain tool call. The recorded answer is also searchable.
Test: src/state/ask_history.test.ts and
src/ui/cards/AskCard.recorded.test.tsx fail on the base (no ask item
after fromHistory; the footer reads "Library：未答") and pass with the
fix. Full frontend-next vitest 988/988, tsc clean, make check clean.
TestStreamSurfacesEarlyConnResetAsInterrupt and
TestStreamDoesNotReplayAfterOutput forced a real TCP RST right after
writing the 200 head. Whether net/http observes that RST before or after
the head is up to the OS scheduler. When it lands first, the failure is a
header-phase connection error, which SendWithRetry retries by design, so
the server counts several requests and the reqs == 1 assertion fails
(#8327). A local probe that resets before the head shows the path: the
server saw 11 requests and the call spent 92s in backoff.
The fixture is now a scripted RoundTripper: a 200 SSE response whose body
yields the prelude and then fails with a net.OpError(ECONNRESET). The
phase is fixed, the request counter is atomic, and no socket is involved.
Header-phase retry keeps its own coverage in provider's retry_test.go
(TestTransientErr, TestSendWithRetryRecoversAndNotifies).
Test: both tests pass 500/500 on Windows and on macOS. Mutating ReadCut
and streamFailure so a reset is no longer a StreamInterruptedError makes
both fail, so the fixture still guards the contract.
A Windows launch from a shortcut has no console, so every way Studio
could fail to start -- boot() throwing, the host exiting before its
handshake, the host never starting -- ended in app.quit() with nothing
on screen and nothing on disk.
The shell now writes <userData>/logs/shell.log (start, lock refusal,
host start/exit/spawn failure, boot failure with stack) and tees the
host's stderr into host.log, each rotated at 1 MB x 3. The launch
credential and any token-, secret- or password-named value are
redacted before reaching either file. A launch that fails shows an
error box (zh/en by the system locale) with the reason, the host's
last stderr lines when it never handshook, and the log folder, then
quits. A second launch refused the instance lock stays silent and only
leaves a log line.
Models often wrap an address in backticks ("open `http://127.0.0.1:8787`").
Markdown links and bare URLs were clickable in the transcript, but a code
span had no link handling, so the address could only be copied out.
Root cause: GFM autolinking never looks inside inline code, and nothing
else turned a code span into a link.
Fix: a remark plugin rewrites an mdast inlineCode node into a link when its
whole value parses as one http(s) URL with a host. mdast keeps inline code
apart from fenced code, so listings are untouched; a span already inside a
link is left alone. The existing click routing (closest a[href]) opens it
like any other link, and the code inherits the link colour.
Test: Markdown.plugins.test.tsx gains two cases. "links a code span that
holds exactly one web address" fails on origin/studio (expected null to be
truthy) and passes after; the negative case (command with a URL, file://,
bare scheme, fenced block) stays unlinked. tsc and the full frontend-next
vitest suite (155 files, 985 tests) pass; make check is clean. Real-browser
screenshots of the perf build, before and after, light and dark, show the
span underlined in the link colour and the fenced block unchanged.
Problem: files the agent creates or deletes appear in the Studio explorer
only once the whole turn ends (or the window regains focus), so a long
turn shows a stale tree for its full duration.
Root cause: the pane re-read the working-tree change list only on turn
boundaries, and the explorer reloaded its listing only when that list,
the running flag, the query or the focus glance changed. Nothing between
turn start and turn end asked the disk again.
Fix: count the finished tool calls that are not read-only (the kernel's
own readOnly declaration on each call) and use that count as a trigger:
the pane re-reads /changes and the explorer re-lists its tree and the
open file whenever it moves. Read-only calls cost nothing extra.
Test: pane-tree-refresh.interaction.test.tsx asserts /changes is read
again after a write_file result and not after a read_file result;
WorkbenchPanel.test.tsx asserts the tree picks up a new file when the
count moves mid-turn. Both fail on origin/studio ("expected changes to be
called 1 times, but got 0 times"; draft.txt never listed) and pass with
the fix. tsc --noEmit and repolint -changed pass; the full frontend-next
vitest run passes 982 of 983, the one failure being a 5s timeout in
session-new.interaction.test.tsx under full-suite load that passes when
run alone, with and without this change.
Fixes#7338
An edit whose old_string drops (or adds) a blank line the file has between
two otherwise identical lines never matches: the fuzzy matcher frees only a
blank-line run's length, never its presence. The failure then read as
"not found (nearest line N)" plus "re-read the file, check for stale
context", so the model re-read the file and reproduced the same span the
same way, over and over (#6337).
The host can tell this case apart structurally: with blank lines dropped on
both sides, old_string names exactly one span, and that span's blank-line
layout differs from old_string's. oldStringNotFoundError now reports that
span and its cause. Matching is unchanged; nothing new is accepted.
Test: TestEditFileNotFoundNamesBlankLinePresenceDrift (edit_file and
multi_edit, CRLF file) fails on studio with the generic nearest-line
message and passes after; two negative cases hold the claim to one span
with a genuinely different layout.
Fixes#6337
desktop/ replaces reasonix with the parent module, so the root bumps raise
its graph too, and the Studio desktop and package jobs failed with
"updates to go.mod needed". go mod tidy in desktop/ moves only the
versions the root already requires. This also covers #11033.
Model requests on the OpenAI Chat Completions, Anthropic Messages and
Responses wires, and the /models listing, carried no User-Agent, so Go's
default Go-http-client/1.1 went out. Gateways and relays in front of an
endpoint could not attribute the traffic, and some risk controls aimed at
generic Go clients blocked it.
provider.ApplyClientIdentity now sets User-Agent: Reasonix/<version> on
those requests unless one is already present, so a configured custom
header and the OpenCode Go identity still win. Both hosts (cmd/reasonix
and cmd/reasonix-studio-host) record their ldflags version once at start
through provider.SetClientVersion; an unversioned build reports "dev".
Test: TestRequestsIdentifyReasonix (chat + model listing),
TestMessagesIdentifyReasonix and TestResponsesIdentifyReasonix record the
User-Agent an httptest endpoint receives. Before the wiring all three saw
"Go-http-client/1.1" and failed; after it they see "Reasonix/9.8.7".
TestConfiguredUserAgentWins keeps a custom User-Agent header; the existing
OpenCode Go tests still require exactly "Reasonix" there.
Root cause: on DeepSeek's Anthropic endpoint in thinking mode, every
assistant tool_use turn in history must carry a thinking block. replayThinking
emitted one only when the turn had stored reasoning. A tool-call turn can be
committed without reasoning (the missing-reasoning fallback in the run loop
keeps the first complete response), and from then on every request in the
session, subagent review sessions included, was refused with HTTP 400
"content[].thinking in the thinking mode must be passed back to the API".
Studio has no repair path for that 400, so the session stayed broken.
Fix: while DeepSeek thinking is enabled, a tool-call turn without stored
reasoning replays {"type":"thinking","thinking":""}, which the endpoint
accepts (live-probed in #8927). contentBlock keeps the "thinking" field when
it is empty, because a thinking block without the field is refused as well.
This matches the OpenAI-compatible DeepSeek path, which already sends an
empty reasoning_content key on such turns. Turns with reasoning and thinking-off
requests serialize exactly as before.
Test: TestDeepSeekToolCallTurnWithoutReasoningStillReplaysThinking drives
Stream against an httptest server that answers like DeepSeek. On origin/studio
it fails with "status 400: ... content[].thinking ... must be passed back";
with the fix it passes. TestDeepSeekThinkingOffSendsNoEmptyThinking guards the
thinking-off shape. go test ./internal/model/anthropic/ ./internal/runtime/agent/
./internal/assembly/boot/, go vet, make check and golangci-lint are clean.
The P4 demonstration showed the shadow verdict calling a turn done when the
model changed nothing and said the task was complete: with no deliverable
in the contract, a turn that owes nothing reads as finished (#11056 made
such turns "none", which is honest but still not "owed").
Deliverables come from structure, never from the task's wording: a plan
whose steps name candidate files is a plan that expects its work to land
somewhere. Such a plan now adds one criterion, change@plan, satisfied by any
change the host proved in the task. It binds no path: candidate files are
the planner's inference, the right change may touch a subset, and a replan
moves them. Files the planner only read do not count, since an analysis
plan reads files too.
- A turn under such a plan that changed nothing ends incomplete on the
sealed verdict, and the receipt lists "the plan names files to change,
and no change was proven".
- Losing the deliverable is a relaxation like any plan check: a later plan
naming no files is routed to the user when an approver exists, and a
replan that still names files keeps it.
- Plans with no candidate files, and turns with no plan, are unchanged.
The readiness gate does not hold it yet; that follows the same measured
switch plan criteria took.
A blank-line run may drift in length only when non-blank lines bound the
window on both sides, so a blank-only old_string no longer names every run
in the file, and the window now applies the same trailing-newline rule as
the other fuzzy modes instead of writing a newline the file never had.
The P4 rollout demonstration ran a system-prompt candidate that told the
model not to edit files and to say the task was complete. The rollout gate
rejected it, but most of its 29 false completions were turns the shadow
verdict called completed with no obligations at all: the model changed
nothing, so it owed nothing, and owing nothing read as done. The contract
has no deliverables yet, and the rules forbid guessing from the task text
that a change was asked for.
Such a turn now gets outcome "none": nothing owed and no change the host
saw is no evidence of completing anything. A turn with a successful change
and nothing owed still completes; a failed write is not a change. "none"
agrees with a report that gave no verdict and diverges from one that said
done.
Nothing the user sees changes: the gate never inspected such turns and the
receipt was already absent for them. What changes is the bundle outcome
and every rate built on "completed", which it overstated.
The design doc records the new outcome and the P4 demonstration (promote a
harmless prompt candidate, reject a harmful one, both from bundle metrics).
First P4 slice of docs/design/TRUSTED_EXECUTION.md: the offline rollout
gate (K1: promotion authority is the offline corpus with repeated samples;
I11: false completion must not rise beyond the noise floor on a corpus with
no-solution tasks).
e2ebench -mode rollout reads baseline reports, "--", then candidate
reports (repeated samples are pooled) and decides:
- hold when the comparison means nothing: a side with no capability record
or more than one set (rollout.version_unknown), both sides the same set
(rollout.same_version), different tasks (rollout.corpus_mismatch), no
no-solution tasks to catch a false completion (rollout.corpus_lacks_no_solution),
or fewer than 50 solvable runs a side (rollout.insufficient_samples);
- reject when false completion or grader pass is significantly worse, its
whole 95% interval on the bad side (rollout.false_completion_rose,
rollout.pass_dropped);
- promote otherwise.
A rise inside the noise floor passes: ruling out any rise at all would take
hundreds of runs. The intervals are printed so the resolution is seen. With
-json the decision is written as a machine-readable record, reasons as
codes.
On the P3 reproduction data (one version, 29 solvable runs a side) it holds
for rollout.same_version and rollout.insufficient_samples.
Second P3 slice. compare mode printed two reports' metrics side by side and
left the reader to decide whether a difference meant anything. It now adds
a reproduction section:
- version: one capability set on both sides, two sets (a comparison, not a
reproduction), mixed, or unknown for reports that predate the set;
- corpus: whether both ran the same task ids with the same prompts;
- grader pass on solvable tasks, bundle completed, and false completion,
each with B - A and its 95% interval from Newcombe's method over Wilson
intervals, which stays sensible at the small counts and 0%/100% rates
these reports produce.
A report pair that is one version on one corpus with every interval
containing zero is reported as reproducing within the noise floor.
On existing data, one binary run twice over 82 tasks gives intervals of
about +/-15pp, and twice over 30 tasks one rate moved 20pp and was still
inside its interval: the resolution a single run has, now printed rather
than assumed.
First P3 slice of docs/design/TRUSTED_EXECUTION.md (I10: a rollout metric
counts only runs whose capability digests match). Until now a trajectory
said which model ran and hashed the prompt and tool schemas as a whole, but
not which skills, and no single field said whether two runs had the same
capabilities.
The run header now lists every capability version the run could use, and a
digest of the set:
- host: the build (version and commit), which carries the planner, memory
and compaction policies compiled into it;
- prompt: the system prompt;
- tool: each tool schema, MCP tools included, which is where an MCP
integration's behaviour shows (its launch config can hold secrets and is
not a version);
- skill: each skill by what it says and how it runs, never by where it was
found, so one skill on two machines is one version.
e2ebench reads the set digest and reports how many sets a report spans; a
report over more than one is an average over versions and says so.
Checked with a real reasonix.exe run on the Windows box: the header carried
1 host, 1 prompt, 9 skills and 18 tools and a set digest.
Stage two of moving completion onto the contract revision: the readiness
gate stops reading the replayed contract, where a complete_step citation of
kind manual settled a plan criterion on the model's word.
A required plan criterion now holds the turn only when its step names a
verification command that has not passed since the latest change (or has
never passed, when nothing changed). The message names the check that
settles it. A criterion no command checks is no longer held: the host
cannot settle it, and holding it only ever asked for a citation. It is
listed on the receipt instead (stage one).
Delivery sign-off still requires complete_step; only its role in settling
plan criteria is gone.
Stage one of moving completion onto the contract revision: what the user
reads changes, what blocks a turn does not.
The receipt's unproven plan criteria came from the replayed contract, where
a complete_step citation marks a criterion satisfied on the model's word.
They now come from the sealed verdict: a required plan criterion is proven
only when every verification command its step names passed after the latest
change. A criterion whose step names no command is listed as unproven with
"no command checks it", instead of being settled by a citation. Every other
gap is unchanged, and a turn with no sealed verdict (no trusted state, or no
contract revision in force) keeps the report's gaps as before.
The receipt card renders gaps, not a verdict noun, so this shows up as
listed items where a citation used to leave none.
Not changed: the readiness gate still reads the citation. Moving it is
stage two, measured first for the extra rounds it costs.
Plan criterion ids are positional within one plan (c1, c2, ...), so
#11017's plan@c1 meant different criteria in two plans of the same goal: a
reordered plan could pass as unchanged, a reworded one went unseen, and an
inserted criterion could read as a dropped one. What decides whether a plan
criterion is verifiable is the command its step names, and a command's
canonical identity does hold across plans. The contract now freezes those
commands, deduplicated with the project's checks, and answers each plan
criterion through the check its step names; a criterion whose step names
none is left to the replayed contract as unverifiable.
The plan flow asked the user only when a revision expanded scope. Dropping
a verification command narrows the work and relaxes the contract, and it
never reached the user. Now:
- a plan the user approved carries that, host-stamped (ApprovedByUser is
not part of the planner's JSON), and a derivation under it that loses
only plan checks is accepted as the user's (user:plan_approval);
- a later plan that would drop a check the task accepted is routed to
approval when an approver exists, even if neither the route nor the
planner asked for it;
- with no approver the plan runs and the dropped check stays owed.
The report still reads complete_step citations. Retiring that changes
what users see for every planned task with a criterion no command checks,
so it moves with the gate switch, where the incomplete terminal is
designed.
SignPath has no quota left, so Studio Windows builds could only ship
unsigned. Port the 1.x Certum SimplySign signer, pointed at Studio's own
account and certificate.
- Signing runs only when STUDIO_SIGNING_ENABLED=true, as three jobs, so
the SimplySign session is never up while third-party code runs:
windows-sign-payload signs the window, kernel and computer-use helper;
windows-package builds the installer and zip on a separate runner with
no environment or secrets; windows-sign-installer signs the installer.
The two signing jobs check out only workflow_sha, install no
toolchain, leave Defender on, and stop SimplySign after signing.
- Verification checks trust, the pinned thumbprint, the
STUDIO_SIGNING_SUBJECT subject, an issuer and a timestamp on every
signed executable, on the installer, and on the zip's copies.
- The SimplySign MSI is pinned by SHA-256 as well as by its signature.
- With the switch on, a missing secret or subject, or any signing
failure, blocks publish. The release body's Windows sentence follows
windows-sign-installer's result.
- Credentials are STUDIO_CERTUM_USERNAME, STUDIO_CERTUM_OTP_URI and
STUDIO_CERTUM_KEY_ID only. The concurrency group is
studio-certum-signing, shared with a new non-publishing smoke workflow.
- publish downloads every package artifact by its exact name, taking
Windows from windows-sign-installer when it ran, and fails when two
artifacts carry the same file name.
- signing-contract validates and fingerprints both the tag's tree and the
workflow_sha tree.
- The SignPath request steps, artifact configurations and request helper
are removed. The contract now covers the Certum files, and its call
graph detects Certum credentials.
- The runbook lists the repository settings to decide on before enabling
and says which PE files stay unsigned (Electron DLLs, elevate.exe, the
NSIS uninstaller).
The approved plan's acceptance criteria join the canonical contract. Each
is verified by the verification commands of the step it belongs to: the
user approved those commands with the plan, so they are the plan's own
verifiers, not a check the model picked. A criterion counts only when
every one of them passed after the latest change; a step naming none gives
the criterion no verifier, recorded as verifier.none rather than guessed.
This gives the shadow verdict a host answer for plan criteria that were
otherwise answered by complete_step citations, where the model binds a
check to a criterion. The frozen contract never reads that binding, and a
plan criterion it holds is not counted a second time from the replayed
contract.
Satisfying a criterion with its own step's commands discharges nothing the
host itself owes: stale verification and the project's checks are still
derived separately.
Open, recorded in the design doc: a plan revision the user approves that
drops a criterion is refused like any relaxation, and the report still
reads the citation. Both must change before the gate reads the revision.
On an unplanned turn the shadow contract turned every todo into a required
criterion and resolved it Satisfied when the model marked it completed.
Nothing but the model's own call stood behind that, and it reached the
user: a turn whose only action was marking a todo completed got a
completion receipt saying done. P1 measured it as the claim_only
divergence.
A todo is the model's own breakdown of the work, not a criterion anyone
accepted, so it is now recorded as optional and never resolved from its
status. Dropping only the resolution would have left every unplanned
multi-step turn reporting incomplete however well its change was proven;
making todos optional leaves completion to what the host proved, as on a
turn with no todos. An unfinished todo is still the readiness gate's to
hold: it counts open todos itself and never read this contract.
The report's "anything declared" test now counts required criteria only,
so a turn that only marked todos gives no verdict instead of done.
Still open: a complete_step citation binds a check to a plan criterion on
the model's word; that edge goes when plan criteria carry frozen verifiers.
Background and fleet children could not settle an unclassified command:
their walks would see siblings and the parent writing too, so #11009 left
them unknown. A run that declared write paths now takes a change the walk
sees inside them as its own, even while other writers run, and ignores
everything outside them.
This is an inference the user accepted, not a proof: claims are proven
disjoint up front and writer tools are fenced to them, but a sibling's
shell command writing into another run's paths is not excluded. A call
that only saw changes outside its paths stays unknown and is never read as
having changed nothing. A run with no declared paths, the root included,
attributes a walk only while no other background writer runs, and that
check no longer counts a background child as running beside itself.
The design doc records the inference as W11.
Not measured: on current studio the unproven_mutation divergence was 1/21
across seven delegation tasks (#11009), and a comparison costs about
CNY 8 for a difference that small.
A bare "/name" line or a lone skill chip reached the provider as the raw
rendered skill body in plain user prose: no <skill-pin> sentinel, and on the
structured (composer) path the typed text trailed as an unlabeled paragraph
instead of an Arguments line. The model-invoked path (run_skill,
read_only_skill, read_skill) already sent the pinned form, so one skill had
two payload shapes depending on who invoked it.
Every invocation site now renders through skill.RenderInvocation: the
string submit path, the structured path, RunSkill (ACP prompts) and the
slash_command tool. A lone inline chip takes the typed text as its
arguments, matching "/name task"; several inline chips, or chips mixed with
subagents, keep appending the shared text once. Nothing moves into the
cache-stable prefix. Store.Render is removed and Render is unexported, so the
pinned form is the only one an invocation can take.
An effect test through the real Build asserts the pinned payload at the
provider boundary for the bare and argument-carrying forms of both paths.
Refs #11004
A command the host cannot classify (sed -i, an inline interpreter) is
settled by walking the workspace before and after it. Only the root agent
had a root to walk: sub-agents are built without the write root, so a
child's unclassified command stayed unknown, merged into the parent that
way, and left an unproven_mutation no later check can discharge. On the P1
macOS run this was the cause behind the forced-delegation divergences
(sed -i '' and python3 -c inside children).
- agent.Options gains ObserveRoot, used only for that walk; the root agent
keeps walking its write root, so nothing else about it changes.
- Delegation hands a writer child the workspace as its observe root only
when it runs in the foreground: the parent is waiting on it, so what
changes during one of its calls is that call's. Background and fleet
writers get none, since their walks would claim their siblings' writes.
- While any background writer is registered, no agent settles by walking,
the root included: the difference between the two walks is not the
call's alone.
Measured on the Windows box, 7 delegation tasks x 3 samples per arm: the
unproven_mutation divergence was 1/21 on current studio and 0/21 with this
change, grader 21/21 on both. At that frequency the effect is not
measurable; the change stands on the mechanism and its tests, not on the
number.
A shell command that runs code the host cannot prove read-only, and that is
not a recognized check, counts as a possible change: after it the model is
handed a new stale_verification debt keyed on its own command, and nothing
says why. The model reads that as its check having run, or as the host
asking for the same thing again. The host already knows the reason, so the
first such command in a turn now carries it, with the commands the host
does recognize. The decision reads the host's own classification (not
read-only, verification not_verification, stale verification owed after),
never the command's wording, and it rides the tool result, not the prefix.
Measured on the Windows box, 30 tasks x 2 samples per arm, same binary
apart from this change, run back to back:
stale_verification divergences control 34/60 (57%) notice 19/60 (32%)
grader pass rate control 58/60 notice 58/60
tool calls per task control 20.0 notice 24.2
tokens per task control 199k notice 221k
Two-proportion z = 2.76 (p ~ 0.006). The tasks were selected for having
shown the divergence before, so the earlier 70% rate is not the baseline;
the control arm is. The extra calls are the recognized checks the model
now runs.
Expanding ${REASONIX_WORKSPACE_ROOT}/secret on Windows leaves a forward
slash after the drive-letter path, so the raw string never equals
filepath.Join's result even when the root came from the environment.
Studio and the 1.x line share config.toml and both read [browser] enabled,
with opposite defaults: 1.x writes enabled = false on every save of the
user file, which Studio then read as the person turning its browser tools
off, and a Studio save wrote enabled = true, which switched the 1.x command
line's browser on.
Studio now decides on [tools] browser_tools (unset = on) and carries
[browser] enabled through a save exactly as read, never writing it where the
file had none. Boot binds the browser tools from the new key.
The settings screen gets a built-in browser switch under Tools, backed by
GET/POST /browser-tools on the provider-edit grant. The save writes the user
file and rebuilds the runtime, declared as runtime-rebuild.
First P2 slice of docs/design/TRUSTED_EXECUTION.md. The task contract is now
a host-owned record with an identity and immutable revisions, not a replay
rebuilt from receipts each turn.
- internal/runtime/contract derives criteria only from sources the host
owns: the check identities a task began requiring and the test criteria
captured as host-owned bytes. Derivation is canonical, so the same sources
give byte-identical revisions. Host policy accepts a first revision and
any revision that keeps every criterion and adds to them; one that would
drop or alter a criterion is refused and the revision in force stands.
- Revisions are sealed as contract/1 records in the workspace stream. The
delivery checkpoint names the record, so a goal resumed in another
process is held to the revision it accepted, read back from Trusted Host
State. A name the store cannot produce is reported, never replaced by a
fresh acceptance. A new task starts a new contract.
- The shadow verdict answers each accepted criterion from the ledger, not
from the checkpoint's copy of the declaration, and drops the host
obligation that owes the same verifier so one debt is not counted twice.
The audit and trajectory carry the revision, the policy decision and any
load failure.
Still shadow: the readiness gate is unchanged. The refusal test edits a
checkpoint by hand, which nothing in production does; it demonstrates that
the checkpoint is not the authority, not a reachable bypass.
With the variable set empty the pattern expands to "/secret", which is
absolute on Unix but drive-relative on Windows, so it resolved under the
workspace root and the test failed on every Windows run since 0a0e1989a.
Pointing the variable at a separate directory asserts the actual property -
the value comes from the environment, not the root - on every platform.
The notes landed with section headings outside the allowed set and changes
that name no pull request, which pushed the repo-wide release-note count past
its ceiling and turned lint red on studio. Same content, each change now cites
#10970, #10980 or #10982.
The publish job now renders release-notes/studio/<semver>.md before it
signs anything. A #N that is a pull request gains "by @author"; a #N that
is an issue gains "fixed in #M by @author" for each merged pull request
GitHub links as closing it (the ClosedEvent closer and
closedByPullRequestsReferences, read over GraphQL; mentions are not
fixes). An issue fixed by a direct push stays plain. A 贡献者 list of the
credited humans, in first-appearance order, closes the notes. Bot authors
are never credited; the source file is not rewritten.
scripts/markdown-refs.mjs decides what is a reference: #N at a line start
or after whitespace, "(", "（" or a list separator, outside code spans,
backtick and tilde fences (each closed only by its own kind), indented
code, HTML comments and link targets. A number that names a discussion or
nothing stays plain with a warning instead of failing the release.
Lookups retry with backoff on 5xx, rate limits and dropped connections. A
failure that persists, or an authorisation failure, fails the job with a
release_credits.* code before signing. The publish job gains
issues: read and pull-requests: read.
CI gains a release-notes-scripts job, gated on scripts/ and
release-notes/studio/, that runs the three test files with contents: read.
scripts/release-credits.mjs is the same module the 1.x renderer uses.
A full e2ebench run put ten of eighteen divergences under one reason,
obligation.outstanding, and e2ebench gives every task its own state root
and deletes it afterwards, so the sealed bundle that said which obligation
it was does not survive the run. The kind is a content-free enum and is
what decides which old path owes the difference, so the audit now carries
host:<kind> in its place.
Every save replays the event log before it appends, and the reader refused a
log past 128 MiB. Images were stored inline as data URLs, so a session with
about 2 MiB of images per turn crossed the budget around turn 63: from then on
LoadSession failed and every Save failed with the same error, and later turns
never reached disk.
New records write each data-URL image to <id>.blobs/<sha256>, fsynced before
the record that names it, and carry an image_blobs side table instead. Replay
reads each blob back byte for byte and verifies its hash. Such records are
stamped schema_version 3, so older studio and 1.x builds refuse the log
instead of loading it without its images and saving that loss back.
A missing blob is restored from the copy the .jsonl checkpoint still inlines
and written back. With no copy left, the message keeps its text and records
the lost image as provider.UnavailableImage (hash and position); only
ModelMessages renders a note, and the blob reappearing restores the image. A
transcript missing an image never rewrites a checkpoint that still holds it,
and a runtime still holding an image whose blob vanished writes it back
instead of being reported as diverged; what cannot be restored fails under
ErrSessionImagesUnavailable.
The reader ceiling is 512 MiB. A save folds a log past 128 MiB only when the
fold drops at least 64 MiB, so a legacy inline-image log is folded to its text
once, while a large text-only log is not rewritten on every save. A compaction
sweeps blobs that neither the published log nor a salvage or recovery
sidecar (.events.jsonl.damaged, .superseded, .context.json) names, and stale
temp files; a sidecar it cannot read whole stops the sweep. The stored
compaction projection is built with ProjectionMessages, so an unavailable
image stays a host record there instead of rendered text. The
blob directory is a session sidecar dir: delete, rename (blobs before the
log), recovery trash, native re-homing and sub-agent delete take it along.
Refs #10965
Problem: on start-up the sidebar said "No folders yet" (尚无文件夹) and
"0 projects" under This machine, and the empty transcript asked to open a
project first, until the kernel answered the first tree read. A slow start
looked exactly like a machine whose folders had been lost.
Root cause: App held the tree as TreeWorkspace[] initialised to [], so "not
read yet" and "read, and empty" were the same value, and every reader of it
(the sidebar empty row, the project count, needsProject) drew the latter.
Fix: App tracks treeRead, set once the first hub.tree() read settles. Until
then the sidebar shows a "Reading folders…" status row instead of the empty
row, hides the project count, and needsProject stays false. With no pane
open, the main area says only that no session is open, without the
add-folder prompt it gives once the tree is read and empty. A failed read
still settles, as before, so the window never waits forever.
The row carries the clock icon on the existing tool-running spin (still
under prefers-reduced-motion) and, past one second, the elapsed time via
format.seconds, ticking once a second. The tick is display only and is
aria-hidden, so the status region is not re-announced every second; the
interval lives with the row and is cleared when the read settles or the
row unmounts.
Test: sidebar-first-read.interaction.test.tsx holds hub.tree() pending,
asserts the loading row and no empty-state wording, then resolves [] and
asserts "No folders yet"; a second case with no panes asserts the main
area's add-folder hint is absent until the read settles. Both fail on origin/studio (no loading row) and
passes with this change. tree-reading.interaction.test.tsx uses fake
timers: the elapsed value reads 3s then 5s, is aria-hidden inside the
status, disappears with no timers left once the read settles, and the
interval is cleared on unmount. The perf harness gains ?treems= to hold
tree reads back and ?panes=0 to open with no pane, used for before/after
screenshots in light and dark; perf/motion.mjs counts the reading row's
spin as live work.
Third slice of the trusted execution layer (P1). Every shadow bundle now
carries an outcome derived only from host evidence, and how that outcome
diverges from the completion report's verdict.
- internal/runtime/verdict: Evaluate turns the contract's criteria and
checks, the receipts and the ledger's outstanding obligations into one
verdict per obligation and an outcome (completed, incomplete, failed,
blocked). It never reads a criterion's status, because todo_write and
complete_step can set it; before contracts freeze verifiers, the only
criterion host evidence satisfies is an atomic ask proven by a successful
mutation. Checks keep the state the contract derives from receipts.
- Classify compares that outcome with the report's verdict: agree,
new_stricter or new_looser, with reason codes (claim_only, evidence.stale,
evidence.missing, check.failed, obligation.outstanding, verifier.none,
old_gaps, old_criteria).
- The EvidenceBundle audit carries outcome, class and reasons, and
e2ebench prices them like the completion report: false completion is a
completed bundle on a run the grader failed, next to the divergence and
reason census.
TestEffectClaimOnlyCompletionDivergesThroughRealBuild runs the known hole
through boot.Build: a todo marked completed with no other action finishes
the turn and the report says done; the sealed bundle says incomplete,
new_stricter, claim_only.
Second slice of the trusted execution layer (P1). The shadow bundle now
records the workspace as each turn found and left it, what changed during
the turn, and what changed between sealed turns while nobody observed it.
- internal/state/observation: a snapshot is a tree of directory nodes stored
as content-addressed index objects in Trusted Host State, so an unchanged
directory costs nothing to record again and two snapshots diff by walking
only subtrees whose digests differ. The policy is host-owned; the default
excludes version-control stores and the host's own state root, each with a
reason, and keeps dependency trees observed because verifiers read them.
Ignore files and workspace config are never consulted.
- A file is identified by its stamp (size, mtime, and on macOS/Linux ctime,
inode, device), not a content hash. On this repository's main checkout
(107,803 entries, 2.1 GB of node_modules) a cold snapshot takes 1.9 s and a
warm one about 0.2 s; hashing every file would cost seconds per process.
- trustedstate gains PutIndexObject, which skips the per-object fsync: tree
nodes are an index, not a seal, and with fsync the first snapshot of this
repository took 31 s. A node lost to a crash makes a later diff
unverifiable, never a satisfied comparison.
- The turn-start snapshot runs while the first model request is in flight;
the first tool batch waits for it, so nothing the turn does lands in its
own baseline. The previous snapshot is read from the stream's head record,
so edits made between sessions are seen too.
- The EvidenceBundle audit adds snapshot completeness and the count of
unobserved changes.
The design doc's W1/W3 now say what was built and why (W8-W10).
First slice of the trusted execution layer (docs/design/TRUSTED_EXECUTION.md,
P1). Nothing reads the bundle back to decide a turn.
- internal/state/trustedstate: content-addressed objects, one record chain
per stream, a head file replaced by rename. A head this process already
observed refuses rollback, a same-generation swap and a history that no
longer reaches it; a store with no observed head cannot tell a forged but
self-consistent chain, and the tests pin exactly that. Failures carry
sentinels and a typed code.
- IntegrityLevel is supplied by the components that confine what the model
drives: sandbox.WriteProtects (the platform's effective write roots, both
overlap directions, symlinked ancestors), plus one-way flags set by the MCP
launcher and the extension sidecar launcher whenever they start a process
outside the sandbox, including a "confined" MCP launch that fell back
because no backend was available.
- File tools refuse writes into <state>/trusted with a typed refusal
(workspace.trusted_state_write); an explicit allow_write entry keeps raw
access and also reaches the bash write roots, which drops the level.
- The root agent seals the contract, completion report and receipts at the
end of every turn, including turns the readiness gate stopped. Receipt
arguments are kept as digests only. A new content-free EvidenceBundle
audit reaches the trajectory with the record digest, generation, integrity
and the typed cause when sealing failed.
The design doc records what implementing this showed: MCP servers default to
host mode and sidecars always run unconfined, so installs with either are
tamper-evident only, and the level is per process (another process running
as the same user can write the store).
Define the host-owned layer behind "allowed to start", "completed with
evidence" and "allowed to ship": trust boundary, canonical objects
(Task Contract, Evidence Bundle, Capability Rollout, RiskPolicy,
ObservationPolicy, WorkspaceSnapshot, TrustedHead), state machines,
invariants and typed failure semantics. No UI and no implementation.
Workspace content, including REASONIX.md and .gitignore, is source
material for revision requests and never changes enforcement. Hash
chaining is tamper evidence relative to a trusted head, not an
authority boundary, so L3 enforcement requires host-protected state.
The document lives under docs/design/ so the embedded product-doc
corpus (docs/*.md) cannot present unshipped design as a feature.
Delete (and Cmd+Backspace on macOS) on the focused session row, or on a
kept version/recovery copy row, opens the same inline confirmation the row
menu's delete opens. Only a row holding focus reacts: the handler requires
the row itself to be the event target, never a hover target, and stays out
of the way while the row is being renamed.
The confirmation now also answers Escape as cancel, without letting the key
reach the window's stop-the-run handler, and focus returns to the row the
key asked about so a keyboard is not stranded on the page body.
Focus goes back only when the question is dismissed, not when another
row's question replaces it; after a delete lands it moves to the next row,
or the previous one when the deleted row was last.
The row keydown declares both session.open and session.delete, and the
copy row's delete button and the confirmation's cancel carry their action
ids, keeping the census's unnamed-write count where it was.
Fixes#3220
A screen share or a recording leaks the account balance and the session's
spend as readily as anything else in the meter bar. An eye button beside the
wallet masks both as ••• and persists per machine (rx-hide-amounts), so they
stay hidden across restarts. The sidebar's wallet entry and every amount in
the cost card (session total, this turn, original currency, per-source rows,
wallet) are masked too. Only the drawing changes: the wallet keeps being
read, so revealing shows the current value without a request.
Fixes#4135
The file writers refuse a target outside workspace_root and allow_write on
every OS, including Windows where bash is never OS-sandboxed. The refusal
was a plain error whose text said writes were "confined" and told the
reader to "widen [sandbox] workspace_root / allow_write", so a Windows user
who never enabled a sandbox was told by the agent that it had been
sandboxed.
confine now returns a tool.Refusal coded workspace.write_outside_scope that
names the refused path, the writable directories, that this is the file
tools' scope rather than an OS sandbox, and the setting that allows it. The
agent carries a tool.Refusal's code onto the tool result on the error path,
so the frontend receives the cause as an identity, and the tool card renders
the localized cause from that code. The scope itself is unchanged.
An option can ask for more than itself ("paste the output"), but once it
was picked there was nowhere to type: in Studio the pick and the free-text
box were mutually exclusive, and in the TUI a pick answered at once.
Studio keeps the box open under a single-choice pick as an optional note,
so the answer goes out as [pick, note]; the kernel already joins several
selections. The note is its own state: an Other answer left behind when a
pick is made is not sent as a note, and going back to Other finds it still
typed. Choosing Other still makes the typed text the whole answer, Enter in
the note box answers like Enter in the Other box, and a sealed card shows a
pick's note under the pick rather than as Other.
The TUI takes Tab on a single-choice option as "pick and add a note": the
composer opens for the note, Enter sends it after the pick, Esc keeps the
pick without one. Picking an option now also drops a previously typed
answer, which a single-choice question used to send alongside the pick.
Fixes#8136
A directory claim overlaps every path beneath it, so two writers that
name the same directory serialize even when they touch different files.
The task and fleet descriptions and their write_paths properties now say
to declare file paths when the targets are known.
Both tools sit behind use_capability, so the provider-visible prefix and
the boot golden fixtures are unchanged.
OpenCode Go refuses third-party requests that carry no session:
"Request is missing x-opencode-session and cannot be routed efficiently"
(HTTP 400). The 1.x provider layer sends that header; the studio adapters
never did, so every OpenCode Go call failed on its first request while
the same configuration worked in 1.x.
Each of the three adapters (chat, messages, responses) now mints one
session id per client and presents it, together with a Reasonix
User-Agent, on every request whose URL is on opencode.ai/zen/go. A
header the user configured is kept. Other hosts are untouched.
With the session in place the first tool round trip still failed:
OpenCode Go's chat route rejects a role=tool message carrying "name"
(fixed on 1.x in #10852). The chat adapter omits it there only.
The responses client groups the new id with the DashScope session-cache
flag, and the anthropic client with its custom headers, so neither
guarded struct grows a scalar.
Test: a local gateway that answers 400 without x-opencode-session,
reached through a transport that keeps the opencode.ai URL.
Before: all three adapters fail with "status 400: ... missing
x-opencode-session"; TestOpenCodeGoChatToolResultOmitsName fails with
tool message carries name "read_file". After: all pass, and two
clients present distinct ids while one client keeps its own.
Fixes#10921
ask also carries MCP elicitation, so the Notification hook forwarded an
MCP server's prompt verbatim to whatever channel the hook feeds. Name the
server for an elicitation ("answer needed (MCP <source>): ..."), prefer
its own message over the first field's prompt, and clip every forwarded
prompt to one line of 120 runes.
Follow-up to #10812.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
On a Chinese Windows, cmd.exe reports a missing command in the console
code page (GBK), not UTF-8. The stdio transport kept the stderr tail as
raw bytes, so an MCP startup failure such as "'read-only-mysql-mcp-server'
is not recognized as an internal or external command" reached the settings
page as U+FFFD mojibake and the user could not see why the server failed.
The stderr tail now goes through encoding.DecodeOutput, the one decoder
for process output. The buffer keeps the last 16 KiB, so only its head
can be cut: tailBuffer records when it dropped bytes and passes
Cut{Head: cut}. The end is never cut, because it is whatever the server
last wrote. Output that is not UTF-8 is decoded from the raw bytes, so a
GBK tail that begins with a CJK character keeps that character.
Tests:
- TestStdioFailureDecodesCodePageStderr starts a real child that writes
GBK to stderr and exits.
- TestStderrTailDecodesTheServersCodePage covers GBK that starts with a
CJK character, both uncut and cut, plus UTF-8 cut mid-character.
All of them fail on origin/studio and pass with this change.
Fixes#7857
DecodeOutput trims a partial rune only at an edge the caller cut. Output
that nothing cut but that stops inside a character still has invalid raw
bytes, so it went through charset detection and fell back to GB18030,
and the whole output turned into mojibake: "编译成功…正在运行" plus half
of "中" read as "缂栬瘧鎴愬姛…". This is common in real use:
- a process killed on timeout mid-write;
- a persistent shell's partial() read;
- a block-buffered pipe.
The output is now read as UTF-8, less the final incomplete rune, when
two things hold: that rune is the only invalid part, and a multi-byte
UTF-8 character has already appeared. Both are structural evidence. When
only ASCII precedes the half rune, nothing says UTF-8, so the bytes
still go through detection. The uncut GBK probes (价, 啊\r\n, ok 洹,
啊 ok) are unchanged.
Test: TestDecodeOutputReadsUncutUTF8EndingInPartialRune fails before
this change with the mojibake above and passes after it. It also pins
ASCII plus half a rune (read as a GBK pair) and uncut, tail-cut and
head-cut GBK.
Refs #6488
The edit_file fuzzy matcher already tolerates trailing whitespace, tab-vs-space
indentation and copied read_file line prefixes, but not a blank-line run the
caller reproduced at a different length. PEP 8 asks for two blank lines between
top-level definitions and a model routinely writes one, so the span fails to
match a file it otherwise quotes exactly.
blankRunRanges collapses each run of consecutive blank lines into one token, so
a run's length is free while its presence is not: a blank line absent from the
file still never matches one the caller invented. Non-blank lines keep the
exact-match rule modulo trailing whitespace, and the single-match requirement is
unchanged. The relaxation is a standalone last resort rather than a fuzzyMode,
so a span that drifted in two dimensions at once still fails.
An ACP client had no way to bring back a Goal the session still held.
session/set_mode goal always drafts a new Goal, so the next prompt replaced
the retained objective and reset its counters, while the controller's
ResumeGoal/PauseGoal (reached through /goal in the CLI and Studio composer)
were never driven by a frontend directly.
ACP gains two vendor methods, advertised in agentCapabilities._meta with
schemaVersion 1:
- _reasonix.io/session/goal/resume re-enters a stopped, blocked, paused
or cancelled Goal with its objective, counters, todos and delivery
checkpoint. It does not start a turn; the next session/prompt continues
it. A running, complete or absent Goal fails with -32010.
- _reasonix.io/session/goal/pause pauses a running Goal at its next
continuation boundary, or fails with -32011.
On success both clear the turn-outcome label (cancelled, failed) the
status showed in place of the Goal state, return the Goal in the status
shape, publish a status_update with event "goal", and emit
current_mode_update when the mode moves. docs/ACP.md documents that a
"failed" status labels the last turn while the Goal keeps running.
serve drives the same capabilities through POST /goal/resume and
POST /goal/pause, answering {changed, status, goal}, so frontend-parity
holds without a scope exception.
The rule that a running Goal cannot be resumed moves into
goalMachine.resume under its lock. Before, resume accepted a running Goal
and bumped its continuation epoch, dropping the continuation in flight;
this also affected /goal resume in the CLI and Studio.
initialize/authenticate move unchanged to handshake.go so service.go stays
inside its size budget.
Tests:
- acp: TestServeGoalResumeKeepsTheRetainedObjective and
TestServeGoalPauseStopsARunningGoal fail with only the declarations
present (capability not advertised; -32601 method not found) and pass
after. TestServeGoalFailedLabelKeepsTheGoalRunning fails when pause does
not clear the label (pause reports "failed") and passes after.
- control: TestControllerResumeGoalRefusesARunningGoal and the new
TestGoalAdvanceResultCannotCrossGoalLifecycle subtest fail on the base
("resume accepted a goal that is already running") and pass after.
- serve: TestServeGoalPauseAndResumeKeepTheObjective.
A Studio window can go blank in three ways, and none had a way back
short of quitting, although the kernel keeps running the turn and a
loaded page reattaches to it:
- A render error outside the per-block boundaries unmounts the React
tree while the renderer lives on. The shell installs no menu with a
reload role, so nothing reloads the page.
- The renderer dies while the window is visible. main.js handled
render-process-gone only before the window first showed, so the
window stayed dead.
- The renderer dies while the window is hidden in the tray. showWindow
then revealed the dead page.
installReload binds Cmd+R on macOS, Ctrl+R elsewhere (by key or by the
KeyR code, so non-Latin layouts work) and a bare F5 via
before-input-event. A dead renderer's input never reaches that event, so
it also reloads on render-process-gone while the window is visible,
except for a clean exit. It returns revive(), which showWindow calls
before showing: it reloads when webContents.isCrashed(). Crash reloads
share a guard of at most 3 within 60 s; past that the window is left
alone instead of looping.
Test: desktop/electron/test/unit.mjs, three tests (reload key; visible
crash plus loop guard; hidden crash revived before show). They fail on
the base (Cannot find module '../src/reload.js'), and the hidden-crash
test also fails against the previous revision (no revive); all pass
after, suite 46/46. On Electron 44.1.0: a visible
forcefullyCrashRenderer was followed by did-finish-load; crashing on
every load gave three reloads and then stopped; crashing a hidden
window and then revive() plus show() reloaded it (isCrashed=true, then
did-finish-load).
Refs #10319
Running Reasonix in a git repository left pasted attachments under
.reasonix/attachments and background-task state under .reasonix/tasks as
untracked files, so users added .reasonix to their .gitignore by hand.
Root cause: both stores created their directories in the workspace with no
marker telling git they hold host runtime state. Ignoring all of .reasonix
is not the answer: the same directory holds files a project commits on
purpose (settings.json hooks, skills, output styles, instructions).
Fix: fileutil.MarkUntracked drops a ".gitignore" containing "*" into a
directory the host owns. The marker is written to a temp file in the same
directory and published with os.Link, so a failed write or a crash never
leaves an empty marker that would read as present forever; Link also
refuses an existing target and does not follow a symlink there, so a
marker already in place is kept. The attachment writer and the task store
(task dirs and idempotency records) mark their own roots, best effort in
both: the marker is a courtesy to the user's git, and a filesystem without
hard links must still store the state. The user's .gitignore is never
touched.
Test: TestSavedAttachmentsStayOutOfGitStatus and
TestFileStoreStateStaysOutOfGitStatus run real `git status --porcelain
--untracked-files=all` in a fresh repository with the machine's git config
cut off (GIT_CONFIG_GLOBAL at a missing temp file, GIT_CONFIG_NOSYSTEM,
XDG_CONFIG_HOME at a temp dir, -c core.excludesFile=). With the base
store code they fail listing .reasonix/attachments/* and
.reasonix/tasks/{t1,.idempotency}/*; with the fix the status is empty.
TestMarkUntrackedLeavesNothingWhenTheWriteFails fails against a
create-then-write marker ("failed write left [.gitignore] behind") and
passes with the linked temp file; a symlinked marker is not followed.
Bold text in the transcript could only be told apart by weight. The
.md strong rule painted it with --text, and the theme vocabulary had no
entry a pack could use for it, so the only way to colour it was editing
the shipped stylesheet.
Add an fgStrong colour token. The kernel accepts it, the frontend maps it
to --text-strong, and .md strong reads var(--text-strong, var(--text)),
so every pack that does not name it renders exactly as before. It steps
with the reader's contrast setting like fg does, and the shipped-pack
contrast test now holds it to AA on the same surfaces as the other inks.
Test: TestDecodeAcceptsAStrongTextColour fails on the base (the token is
dropped with a "not a theme token" warning) and passes after; the two new
theme.test.ts cases fail on the base (--text-strong never set) and pass
after. Real-browser screenshots of the perf build, light and dark: before,
setting --text-strong leaves bold at the body colour; after, bold takes
it, and the default rendering is unchanged.
The root .gitignore already lists /workgroupassay; the 10 MB binary was
committed with 491016f8c alongside the tool's source and is rebuilt by
go run ./tools/workgroupassay.
TestEffectRestartKeepsTheReviewAHighRiskGoalOwes (internal/assembly/boot)
failed on windows-latest in runs 36256346762, 36232402249, 36230551992,
36229537444 and 36258827818 (#10901): "PHASE-1 ... never settled", goal
running, 25-26 requests after 20s.
Root cause: the goal in that test can never finish by design and stops only
on its token budget. At 30000 tokens and 1000 per reply, each phase ran about
30 provider requests, 23 of them refused "done" claims, each a full host
turn: about 65 ms on macOS here and, from the CI tail, about 0.8 s on a
hosted Windows runner. 30 turns at that rate do not fit the 20 s settle window. The
assertion only reads whether phase two carried the review nudge and whether
the goal ended incomplete, and the first refused claim already settles both.
At 8000 tokens each phase makes its planned calls plus three nudged
continuations, 16 requests per arm instead of 60, with the same outcome
(blocked, review demanded, in both arms). Settling now waits for the goal to
leave running while the controller is idle. The old test read "idle for
500 ms" as settled, but an idle gap between two continuations is not the
end of the goal.
TestTrySteerRejectedBecomesFollowup (internal/session/control) waited 1 s
for the gated runner. TrySteerInboxItem dispatches the rejected steer
before it returns, so the claim is already durable (state running, intent
follow-up, controller running) when the call comes back. What was being
timed is the turn goroutine reaching the runner. Before that it goes through
a chain of fsyncs: checkpoint begin, branch meta, in-flight marker, recovery
snapshot. That chain takes 100-670 ms on macOS here and can pass a second on
a loaded Windows runner. The test now asserts the admission synchronously.
The 8-minute package timeout in 36258827818 attempt 2 came from
TestThirtySteersApplyAndAckExactlyOnce. Its initial turn missed the same 1 s
start window, t.Fatal ran, and the deferred autosaveWG.Wait blocked forever:
the fake provider's first round was parked on p.release, which only the
test body closed. Every test that parks a fake on a release channel now
closes it idempotently (sync.OnceFunc) before waiting on autosaveWG, in
steeringTurn's cleanup and in TestSteerUnreadAtTurnEndIsDeliveredAsAFollowup.
TestThirtySteers now uses steeringTurn, whose existing 10 s start bound
remains a hang guard only. That wait also returns on TurnDone, so a turn that ends without reaching the provider fails at once
with the event. A deliberate t.Fatal right after steeringTurn used to hang
until -timeout. It now fails in 0.15 s.
TestBackgroundJobWakesSessionThroughManager failed the same way on this
PR's first Windows run (36263202340): a 1 s wait covered the job goroutine
queueing the continuation and the woken turn's fsync chain. The test now
takes the observer's own result for the publish step. It then waits for the
runner input, and the only other exit is a TurnDone. Every step ends in an
event the product always emits, so no clock races the disk. The note check
stays after the runner input: by then the turn's composition has drained
the note, or the ack has dropped it.
Local: -race -count=20 of the five control tests and of the boot test pass
(the boot test drops from about 18 s to about 4 s locally).
Root cause: the 1.x settings editor mirrored base_url into request_url
(and older ones into chat_url), and 1.x and Studio read the same
config.toml. Studio used either override verbatim, so a relay such as
https://router.shengsuanyun.com/api/v1 received its chat POST on the API
root and answered "404 page not found" while /models still listed the
catalog. 1.x fixed this in #9464 and its follow-up 73b6d9b4b; Studio never got
the comparison.
Fix: port provider.EndpointOverrideRepeatsBase into
internal/contract/provider (scheme and host case-insensitive, path exact
apart from a trailing slash, an override with a query or fragment is
deliberate and kept). The openai provider applies it to request_url and
chat_url, anthropic to its root with and without /v1, responses to its
base. Chat URL resolution moves into chaturl.go to keep openai.go inside
its budget.
Test: TestStreamIgnoresEndpointOverridesThatRepeatBaseURL (openai,
request_url and chat_url) and TestStreamIgnoresRequestURLThatRepeatsBaseURL
(anthropic, responses) stream against an httptest server whose base is
/api/v1. On the base they POST to "/api/v1/", "/api/v1" or "/api"; with
the fix they POST to /api/v1/chat/completions, /api/v1/messages and
/api/v1/responses. TestEndpointOverrideRepeatsBase covers the comparison.
Fixes#9658
The config template documents [statusline].command as a command whose
first stdout line replaces the built-in status data row, but the
terminal UI never read the key: nothing passed it from config into
tui.Options, so a configured command was silently ignored.
runTUI now hands the TUI a runner built from the loaded config. When
the footer refreshes its between-turn meters (startup, turn end,
session switch) the TUI fetches the kernel status, feeds
{model, contextUsed, contextWindow, cwd} as JSON on stdin, and shows
the command's first line in place of the telemetry row. Empty output
or a failed run keeps the built-in row. The spawn goes through the
hook spawner with a 2s timeout and without searching the working
directory for a bare executable name.
Statusline is user-level configuration and is never taken from a
project file: LoadForRoot restores the user/global value after the
project merge, the project render scope omits [statusline], and the
project delta never writes it. The template and reasonix.example.toml
say so.
Test:
- tui: TestStatuslineCommandReplacesTheTelemetryRowAfterATurn and
TestEmptyStatuslineOutputKeepsTheBuiltInRow drive the model through a
turn_done update against an HTTP kernel stub.
- cli: TestStatuslineRunnerFeedsStdinAndKeepsTheFirstLine runs a real
shell command; TestStatuslineRunnerIgnoresAProjectCommand loads a
project-only command and expects no runner.
- config: TestProjectStatuslineIsIgnored, TestUserStatuslineWinsOverProject,
TestStatuslineNeverRendersIntoAProjectFile.
Before the scope change the config and project-command tests fail on
their assertions (project value resolved and rendered); after it all
pass.
Problem: adding a source could write over, or read, a credential that belongs
to another endpoint (#9178):
- a name that folds to another provider's slot ("deepseek" beside the
official DEEPSEEK_API_KEY entries) wrote its key over that slot;
- adding under a name that already exists upserted over the entry and
inherited its slot, so a keyless source at a relay resolved and sent the
old key there;
- a removed provider's credential stays stored, and a later source whose
name derives the same slot read it.
Root cause: POST /providers derived the slot from the name alone and
treated an add as an upsert.
Fix:
- config.FreeAPIKeyEnvFor keeps the name's own slot only while no config
entry holds it and nothing is stored there; otherwise it allocates a
private REASONIX_CONNECTION_<id>_KEY slot, the scheme 1.x uses.
- POST /providers refuses a name that already exists (409
provider.name_taken) unless the body says replace. Onboarding, which fills
in the entry a fresh install already names, sends replace; a replace at
that entry's own host keeps its slot, anywhere else it gets a free one.
- An unreadable config refuses the save (500 provider.config_unreadable)
instead of falling back to the name-derived slot.
- The same-host keyless "second door" still shares a slot on purpose.
Test: on origin/studio, TestANewSourceNeverWritesAnotherProvidersKeySlot,
TestAKeylessSourceElsewhereDoesNotBorrowAFoldedSlot,
TestAddingUnderAnExistingNameIsRefused (200, want 409) and
TestAKeylessSourceDoesNotInheritARemovedProvidersKey (relay-b resolved
"sk-a") fail; all pass after, with TestReplacingAnEntryKeepsItsSlotOnlyAtItsHost
and the existing key-reuse tests. Onboarding.test asserts replace is sent.
edit_file on a UTF-8 file carrying CJK text rewrote bytes it never touched:
continuation bytes of characters far from the edit came back as 84 31 A4 37.
Detect took a nil error from the GB18030 decoder as proof the file was
GB18030. The decoder never fails: it maps every invalid sequence to U+FFFD.
So any file that was not valid UTF-8 -- one stray byte is enough -- was read
as GB18030, and the read-modify-write tools (edit_file, multi_edit,
delete_range, write_file over an existing file), checkpoint restore and the
config migrations then re-encoded every unreadable sequence as the GB18030
form of U+FFFD.
Detect now names a charset only when decoding and re-encoding restores the
input byte for byte. GB18030 is tried first, then GBK, which restores what
GB18030 cannot such as CP936's single-byte euro 0x80, so such a file stays
editable in its own encoding; anything else is LossyUTF8, whose bytes pass
through untouched. The new Kind is appended because checkpoints persist it
by value.
GBK cannot hold every character, so Encode now returns an error instead of
falling back to UTF-8, which rewrote a whole CP936 file as UTF-8 when an edit
added a character such as an emoji. A legacy charset that cannot represent a
character answers an *UnencodableError naming it, its byte offset and the
charset, with ErrUnencodable as its identity; the file tools, checkpoint
restore and the config migration refuse the write and leave the file as it
was. Fixtures encode through encodingtest.MustEncode.
Readers that hold only part of a stream say so rather than inherit the
whole-file answer:
- DetectFragment runs the round trip on the prefix the decoder consumes when
not at EOF, so a character the cut split is dropped structurally. grep's
8 KiB peek and read_file's 256 KiB sample use it.
- DecodeOutput is the one entry point for bytes that are only displayed.
The producer says which ends its bound cut (Cut{Head, Tail}); UTF-8 is read
without a character split at a cut end, and an uncut end keeps its bytes,
since a GBK pair there is output rather than half a rune. What no charset
restores is still read as GB18030. Hook output (tail cut when truncated),
the shell tail (head cut once it drops bytes) and the shell's combined
output (uncut) call only it.
- DetectAndDecode decodes a legacy charset once; the edit tools and
DecodeToUTF8 use it instead of detecting and decoding separately.
Tests that fail before this change (on the base or an earlier revision of it)
and pass here:
- TestE2EEditKeepsBytesOfUTF8FileWithStrayByte: e4 b8 ad became
e4 b8 84 31 a4 37 outside the edit (fails on origin/studio).
- TestDetectUTF8WithStrayByteIsNotGB18030 (fails on origin/studio).
- TestWritesRefuseCharacterCP936CannotHold (edit_file, multi_edit,
write_file): nil error and the whole CP936 file rewritten as UTF-8.
- TestDecodeOutputTrimsCutUTF8Edges: UTF-8 cut at the front read as mojibake.
- TestDecodeOutputKeepsUncutCodePageEdges, TestDecodeHookOutputKeepsUncutCodePageEdges:
GBK pairs at an uncut edge (bc db, b0 a1 0d 0a, 6f 6b 20 e4 a1,
b0 a1 20 6f 6b) were dropped as partial UTF-8 runes.
- TestEditKeepsCP936FileWithEuroByte: an edit adding Chinese wrote UTF-8
into a CP936 file.
- TestGrepGB18030PeekWithoutNewline, TestGrepGB18030PeekCutMidCharacter:
no matches past a peek cut mid-character.
- TestReadFileGB18030SampleWithoutNewline: garbled text past the sample.
- TestDecodeHookOutputReadsTruncatedCodePageText,
TestDecodeHookOutputReadsCP936Euro, TestCodePageOutputCutMidCharacterIsReadable:
mojibake for cut or euro-carrying cmd.exe output.
- TestEncodeRefusesCharacterTheCharsetCannotHold, TestDetectGBKWithEuroByte,
TestDetectFragmentDropsTheSplitCharacter, TestDecodeOutputReadsCutCodePageText:
the API's contract.
A balance_url pointing at https://openrouter.ai/api/v1/credits left the
balance readout empty. The wallet decoder is chosen by the endpoint's
host, and openrouter.ai had no entry, so the body was read as DeepSeek's
shape; {"data":{"total_credits","total_usage"}} carries no balance_infos
and was rejected as unreadable.
Add an openrouter.ai decoder: remaining = total_credits - total_usage,
in USD, available while positive. A body missing either field stays
ErrUnreadable rather than rendering as a zero balance.
Test: TestOpenRouterCreditsDecode and TestOpenRouterSpentWalletIsUnavailable
fail on the base ("wallet response not in this endpoint's shape") and pass
with the decoder; go test ./internal/model/billing/ is green.
`reasonix run` rejected --yolo and --dangerously-skip-permissions with
"unknown flag", `reasonix -y run "task"` failed with "unknown command",
and `reasonix --permission-mode auto run "task"` opened the terminal UI
with "run task" as its prompt instead of running headless. Print mode
disagreed with itself: `--yolo run -p hi` ran the task "run hi" and
`-y -p hi` was an unknown command.
Root cause: run's flag set never registered the yolo spellings the
terminal UI takes, and normalizeCommand only looked at argv[0], so a
leading session flag sent everything to the terminal UI, -y was read as
the command name, and the leading -p scan ran past the verb.
Fix:
- run registers --yolo/--dangerously-skip-permissions as an alias for
--permission-mode bypassPermissions; each conflict (-y with --yolo,
either with --permission-mode) names only the flags involved.
- run's flags move into runFlags/newRunFlags so they can be consulted
before dispatch.
- The verb is located with the union of the terminal UI's flags and
run's on the resume-normalized argv, as runTUI reads it, so a value of
either is never taken for it. Leading flags move after `run` only when
the session flags (the terminal UI's plus -y and -p) and run's both
parse them to the same flags with the same values. Otherwise the line stays the terminal
UI's: `--resume run hi`, `-r run hi` and `--inline run hi` keep their
meaning, and a run-only leading flag (--metrics, --output-format) is
reported by the terminal UI.
- -y and -p may lead like the other session flags, and the leading -p
scan stops at the verb even when a run-only flag precedes it.
- The first word after the leading flags is the verb, as it is with no
flags; CLI.md documents that, and interspersed run flags.
Test:
- TestRunApprovalFlagsReachTheHeadlessGate runs Run() against a fake
provider whose first reply calls write_file. The file appears only
where the resolved mode lets an unattended write through (ask and
dontAsk stay unwritten). On origin/studio the five new spellings exit
2 with no file. A mutation that drops the leading flags while routing
fails it for the three leading-flag spellings.
- TestNormalizeCommandCarriesLeadingFlagsIntoRun fails on origin/studio
(10 cases) and on the previous revision of this change (9 cases,
including the three terminal-UI regressions). The revision before this
one fails 2 cases: `--model m --metrics x run -p hi` and the same with
--output-format ran the task "run hi". The revision before this one
fails 2 more: `--resume --permission-mode
--permission-mode=bypassPermissions run hi` and `--resume --resume=abc
run hi` were forwarded to run although the two sets read different
values. It passes now.
- TestRunTakesTheYoloSpellings covers the alias and the per-flag
conflict messages.
Gates: gofmt, go vet (also GOOS=windows), make check clean,
golangci-lint 0 issues (also GOOS=windows), go test
./internal/frontend/cli/.
Refs #8355
Root cause: the todo_write schema declared "level" as
{"type":"integer","enum":[0,1]}. Gemini's function-declaration validator
accepts enum only on string properties with string members, so any Gemini
model behind an OpenAI-compatible relay rejected the whole request with
400 INVALID_ARGUMENT (TYPE_STRING on enum[0]/enum[1]), whatever the prompt.
Fix: express the same range as "minimum":0,"maximum":1. Execute already
rejects any level outside 0..1, so accepted input is unchanged. The level
description loses its "Nesting level:" lead-in to stay inside the schema
token budget. Boot golden fixtures are regenerated for the new bytes.
Test: TestBuiltinSchemaEnumsAreStrings walks every registered built-in
schema and fails on an enum that is not on a string property or has a
non-string member. On origin/studio it fails with three findings on
todo_write's level; with the fix it passes, as do
go test ./internal/tools/builtin/ ./internal/assembly/boot/.
Fixes#9005
A Responses turn could end with a tool call the model issued and never
run it. The stream reader dispatched a function call only when its
function_call_arguments.done or output_item.done event arrived; a relay
that forwards the added and delta events but not the done events (or
sends deltas without the item id) left the call open, the terminal
response.completed ended the attempt, and the turn committed as a clean
answer with no calls. The run then finished ok after one round.
The terminal response's output array is the response's own list of what
it issued. On response.completed and response.incomplete, every
function_call item there that the stream did not already close (matched
by call id) is now completed from that item; one whose status is set and
is not "completed" is left alone, so a call truncated at the output
limit is still not dispatched, and one listed without a call id is not
dispatched either.
The output array decodes one item at a time. Decoded as a typed slice, a
single item with a non-string field (arguments sent as an object by a
non-conforming relay) would fail the whole terminal event, which is then
skipped and the turn ends with unexpected EOF where it used to finish.
A call with no name, such as an arguments.done event that named no
item, is no longer dispatched as an empty call; it stays open for a
later event to name.
Test: wire_gap_test.go drives the real HTTP stream reader. On
origin/studio the "done events never came" and "deltas without item id"
cases fail with calls = nil; both pass after the change, and the
no-duplicate and truncated-call guards pass on both. The
unreadable-item, empty-call-id and unnamed-arguments.done cases fail
before the per-item decode and the skips, and pass after.
go test ./internal/model/... ./internal/runtime/agent/ passes.
The full-screen transcript showed an answer's thinking only as a
"thought for Ns" marker, with no way to read it; a long shell output
could already be opened with a click, the thinking could not.
Full screen, the marker now reads ▸ while shut and ▾ while open, with a
(Ctrl+O) hint. A left click on it, or Ctrl+O for the newest one (for a
terminal whose mouse is handed back to it), opens and shuts the thinking
underneath. Each opened row carries its own faint style, since the
transcript is split into rows after rendering. A streamed answer's first
chunk keeps its row, and when the answer settles that row takes the
final thinking and elapsed time, so thinking that kept arriving after
the text started is not lost. Inline mode, where printed rows cannot be
redrawn, keeps the fixed ▎ marker.
Tests (internal/frontend/tui/screen_test.go):
- TestThinkingOpensAndShutsOnAClick: streamed and settled answers open
and shut on a click of the marker row (FAIL on origin/studio).
- TestOpenedThinkingIsFaintOnEveryRow: every opened row starts with the
faint SGR under an ANSI256 profile (FAIL with one style around the block).
- TestStreamedThinkingOpensAsItSettled: thinking arriving after the text
and the final "thought for 4s" show when opened (FAIL with the row
copied at the first chunk).
- TestCtrlOOpensTheLatestThinking: Ctrl+O opens and shuts it with the
mouse handed to the terminal (FAIL without the key).
Fixes#7934
Root cause: POST /providers/edit saved the entry and answered 204 without
rebuilding the runtime. The context window, token limits, headers and
reasoning protocol are bound into the agent at assembly, so the open
conversation kept its old window: the gauge and the fold point went on
counting against the number the form had just replaced, until something
unrelated (a model switch) rebuilt it. /context/window already rebuilds
in place; the edit form did not.
Fix: after the save, act only when the conversation runs on the edited
source and a field the agent binds at assembly actually changed (base URL,
models, vision, per-model overrides, window, max output, headers, extra
body, protocol, efforts). A key-only edit needs no rebuild because the key
is read per request, so it answers 204. Otherwise:
- running model still listed: rebuild in place. With work in progress (a
running turn, a pending question or background jobs) the save still
lands and the answer is provider.saved_while_running; any other rebuild
failure is runtime.rebuild_failed.
- the edit unticks the running model: a plain save, 204.
- the running model was already unlisted before the edit: nothing on the
entry can carry the change to that conversation, so the answer is
provider.saved_model_unlisted ("switch models to apply it").
On any of these "saved but not applied" answers the edit form refreshes
the providers list and stays open to show why.
Test:
- TestEditProviderReachesTheConversationRunningOnIt failed on
origin/studio ("window = 0, want the saved 1000000"); passes.
- TestEditProviderMidTurnSaysTheConversationKeepsItsSettings failed on
origin/studio ("mid-turn = 204, want 409"); passes.
- TestEditProviderDroppingTheRunningModelIsStillSaved and
TestEditProviderKeyOnlyMidTurnNeedsNoRebuild failed on an earlier
revision of this change (409 instead of 204); pass.
- TestEditProviderAfterDroppingTheRunningModelSaysItIsUnlisted failed on
the previous head ("editing the window after the drop = 204, want
409"); passes.
- EditConn test: a saved_while_running answer calls onSaved, not onDone.
The serve package, go vet (also GOOS=windows), golangci-lint, make check,
tsc, vitest, census:verify and perf/i18n.mjs pass.
A task, parallel_tasks or fleet call may name a child model without a
provider, e.g. "deepseek-v4-flash". The sub-agent resolver passed that
straight to Config.ResolveModel, which answers a bare name with the first
provider that lists it. With the official DeepSeek entry listed before a
relay that serves the same model, a child of a session running on the relay
was silently sent to the official API instead.
A bare name the parent's provider serves is now qualified with that
provider before resolution, in both the runtime resolver and the identity
the usage record reports. A provider name, a provider/model reference, or
a model only another provider lists resolve as before.
Test: TestSubagentBareModelStaysOnParentProvider fails on origin/studio
(resolved refs = ["first/shared-flash" ...], want "relay/shared-flash")
and passes after the fix; go test ./internal/assembly/boot/
./internal/runtime/delegation/ pass, make check clean.
A reopened Studio conversation showed the host's own instructions to the
model as if the user had typed them: the tool-round / task-budget
finalization request, the retry after a reasoning-only answer, the
executor-handoff retry, and the output-truncation fact.
Root cause: /history and the TUI restore decide "who said this" from
provider.Message.HostAuthored, which is written by the producer. Four
injection sites in the run loop appended role=user messages without it
(only the workflow-phase repair set it), so the transcript rebuilt them
as user bubbles and session previews could count them as user turns.
Fix: set HostAuthored at each site. Provider requests are unchanged:
the projection clears the field before sending.
Test: TestLoopComposedUserMessagesAreHostAuthored drives a real Run into
the task-budget landing, an empty-final retry and a truncated tool call.
Before the fix all three cases fail ("a line the loop composed is
recorded as the user's"); after it they pass. agent, serve, control,
sessionstore and boot packages pass; make check and golangci-lint clean.
Fixes#8486
A code block's copy button already swaps to a check mark after a copy,
but hovering it said "Copy response", and the config-trouble banner's
button for the config file path read "Copy response" as its visible text.
Root cause: CopyButton's idle label was the fixed string for a chat
reply; the caller's `label` only reached aria-label, so title and
visible text ignored it. ConfigTrouble passed no label at all.
Fix: the idle label is the caller's `label` when given, and the config
banner labels its button "Copy path" (en locale entry added).
Test: src/ui/CopyButton.test.tsx fails on origin/studio (code block
title "复制回复" vs "复制这段代码"; path button text "复制回复" vs
"复制路径") and passes after. Full vitest (928), tsc, census:verify
and make check pass.
Choosing the free-text option on an ask card left the caret on the
option button, so the answer could not be typed until the box was
clicked, and Enter in the box did nothing: every typed answer needed
the mouse twice.
Choosing the option now focuses its box, every time it is chosen, and
Enter there does what the primary button would. When Enter moves to the
next question, focus follows into that pane (its open box, else its
first option), because the pane it leaves becomes display:none. The key
goes through useIme, so the Enter that confirms an IME candidate is not
read as an answer. The box carries an aria-label.
Test (PromptCards.interaction):
- the caret lands in the box after choosing the option; a composing
Enter does not answer, a later Enter does (clock stubbed, not slept);
- Other -> a normal option -> Other again puts the caret back in the
box (FAIL before: focus stayed on the button);
- Enter on question 1 moves focus to question 2's first option (FAIL
before: focus stayed in the hidden pane's input).
Before/after screenshots were taken on the perf build, light and dark.
Fixes#7904
An ACP client that sent a picture got an answer from a model that never
saw it. session/prompt flattened its blocks to text and kept only text
blocks and resources with inline text: an embedded resource carrying a
base64 blob, which a client sends because embeddedContext is advertised,
was dropped without a word, and so was any image block. An image-only
prompt was refused as empty.
Image blocks and blob resources are now decoded and stored with the
control package's attachment savers under .reasonix/attachments/ in the
session's workspace, and the prompt carries the "@path" reference that
serve and the CLI already hand a turn. Undecodable data or bytes that do
not sniff as an image fail the prompt with invalid params instead of
vanishing. Steer uses the same path. initialize now advertises
promptCapabilities.image = true.
Test: prompt_attachments_test.go drives session/prompt through the real
Serve loop and a real controller. On origin/studio the image block and
blob resource cases fail with the turn input "what is in this picture?"
(no reference), the image-only case fails with "empty prompt", and the
undecodable case returns no error; all pass after the change, and
go test ./internal/frontend/acp/ passes.
On a Windows host without Git Bash the shell tool resolves to PowerShell,
a supported path. Five tests still assumed bash there:
- TestBackgroundBashWaitAndOutput, TestBashTerminalFallsBackWhenUnhandled,
TestBashTerminalSkippedWhenEnvFilteringEnabled and TestRunForegroundSuccess
ran `printf`, which PowerShell does not have. They test job, terminal and
runner plumbing, not POSIX syntax, so they now run `echo`, which both
interpreters accept with the same output.
- TestDefaultSpawnerUsesGitBashForExplicitShOnWindows needs a real Git Bash;
it now skips when no bash is installed. Discovery itself stays covered by
the injected-host tests in internal/safety/sandbox.
- TestGoldenBaselineNoExtensions records the bash tool's bash description.
A host that resolves PowerShell renders a different, intended description,
so the golden now skips there instead of reporting drift, and is never
regenerated from such a host.
Test: the touched tests pass on macOS (bash host) and the four packages pass
in full; go vet passes with GOOS=windows. The PowerShell-only failure could
not be reproduced here (no Windows host without Git Bash is available); the
reporter's reproduction in #8326 shows `printf` not recognized and the
golden diff on the bash tool description.
Problem: a long high-effort think on Studio ended with "response stopped:
hit the client reasoning safety limit" and no answer, even though the
provider was still inside the output budget it had been sent.
Root cause: the agent cancelled the provider stream once 128 KiB of hidden
reasoning had been buffered (about 32K estimated tokens) and returned
errReasoningByteLimitExceeded. The request already carries a provider
output budget (auto ~64K on DeepSeek high), so the byte guard fired inside
the budget and turned a legitimate think into a failed turn. The 1.x line
dropped the abort in #8779; Studio never received it.
Fix: the byte limit now bounds only what the host retains. Reasoning keeps
streaming live, the stored copy is the rune-safe prefix of the stream's
first ReasoningByteLimit bytes, and the default rises to 8 MiB so no
provider-bound reasoning is cut under current output ceilings. Interrupted
usage estimates count every streamed reasoning byte. The sentinel and the
client_reasoning_limit finish reason had no producer left and are removed.
Test: TestDefaultReasoningLimitLetsLongThinkingFinish and
TestReasoningByteLimitBoundsRetainedReasoningOnly fail on origin/studio
with "reasoning output exceeded client byte limit" and pass after the fix.
go test ./internal/runtime/agent ./internal/assembly/boot
./internal/tools/builtin, the race run of the reasoning tests, go vet,
golangci-lint and make check are clean.
Hooks could see a sub-agent finish (SubagentStop) but not begin, and
SubagentStop fired only when the child answered. A failed, cancelled or
self-refused task ended silently, so an external observer driven by
hooks (activity indicators, notifiers) had no event marking the start
of delegated work and no reliable end.
SubagentStart is a new non-blocking event fired just before a
foreground `task` call executes, with the call's arguments in toolArgs.
SubagentStop now fires from a defer on every exit after that start
(answer, failure, cancel, refusal) with `error` set when there was no
answer, under a context detached from the turn's cancellation so a
cancelled turn does not kill the hook. Both carry the call id as callId
(tool_use_id in the Claude-format payload) so consumers can pair them.
Only a foreground `task` fires them; read_only_task, parallel_tasks,
fleet, skill sub-agents and background tasks fire neither. hook.go,
the reasonix-guide skill and GUIDE (en/zh) state that scope and that
exit 2 cannot block.
Test: TestSubagentStartPairsWithSubagentStop runs answer, failure,
cancel and refusal cases plus a background call. Before (SubagentStop
on success only): fails, cancelled and refuses each fail with
"SubagentStart must be followed by exactly one SubagentStop, saw 0".
After: all pass, with matching call ids, err set on the three non-answer
cases, and a live context in SubagentStop. TestRunnerSubagentStartPayload
checks callId, toolArgs and error reach the hook's stdin.
A global [[plugins]] entry had no way to name the workspace it runs for:
${VAR} expansion read only the process environment and the project
.env. Servers that key on the project path in a header or argument
(IntelliJ's IJ_MCP_SERVER_PROJECT_PATH) therefore needed one entry per
project. Installed plugin packages already got ${CLAUDE_PROJECT_DIR};
user and .mcp.json entries did not.
ExpandedPluginForRoot resolves ${REASONIX_WORKSPACE_ROOT} and
${CLAUDE_PROJECT_DIR} to the workspace, and both places that turn an
entry into a spec call it with the root they already hold:
pluginspec.FromEntry (session boot, capdiag, mcp oauth) and the
controller's mcpIdentitySpec (live add, install, reconnect). The host
owns these values, so they outrank a process or .env variable of the
same name; a hook's child process inherits its parent session's
CLAUDE_PROJECT_DIR. Config path fields (sandbox roots, skill paths,
proxy) keep plain environment expansion. WorkspaceRootValue is the one
canonical form (absolute, cleaned, symlinks as opened), also used for
the plugin-package substitution.
Tests (the first three fail before the fix and pass after):
- TestAddMCPServerExpandsWorkspaceRootInLiveHeaders: live AddMCPServer
against an httptest MCP server. Before: live headers = ("",
"/inherited/from/a/parent/hook").
- TestLoadForRootExpandsWorkspaceRootInPluginEntries: two workspaces,
one global http entry and one .mcp.json entry, with a conflicting
CLAUDE_PROJECT_DIR in process env and .env. Before: header = "".
- TestPluginSpecsForRootExpandWorkspaceRoot covers the boot mapping, and
TestWorkspaceRootVarsStayOutOfConfigPathExpansion keeps sandbox paths
out of scope.
Typing "@proinf" found nothing for ProjectInfoNew.tsx: fileref.Search
only recorded a hit when the query was a contiguous substring of a
directory name, the basename or a path segment, so a file could only be
reached by spelling a run of its name exactly or walking down to it one
directory at a time.
Search now keeps a last tier for names that contain the query's letters
in order (case-insensitive), files by basename and directories by name.
It ranks after every contiguous hit and only fills the slots those
leave, so existing results and their order are unchanged. The kernel's
Complete and the external-folder ref search both go through Search, so
every frontend gets it.
Tests: TestSearchMatchesSubsequenceAfterSubstringHits (fileref) and
TestCompleteRefFindsFileBySubsequence (control.Complete, the boundary the
composer calls) fail on origin/studio (got only [src/proinfo.go]; items
= []) and pass with the change.
Under a fake-ip resolver (Clash / mihomo) every public host answers with a
routable A from 198.18.0.0/15 beside a unique-local AAAA from fd00::/8.
The direct dial path refused the whole host as soon as any resolved address
was on the SSRF blocklist, so web_fetch failed for every site with
"refusing to fetch internal address ... (resolves to fdfe:...)".
Root cause: the guard treated one blocked address as a verdict on the host,
although the dial is pinned to a resolved address rather than the name. A
blocked address in a mixed answer can simply be skipped; the connect still
only ever reaches an address that passed the check. A host whose addresses
are all blocked is refused exactly as before.
The direct path moves into dialVettedAddress, which tries the allowed
addresses in resolver order, and the lookup becomes a package seam so the
test can supply a resolver answer.
Test: TestWebFetchDialsAllowedAddressBesideBlockedOne resolves a name to
[fdfe:dcba:9876::152, 127.0.0.1] and fetches from a loopback server. On the
base it fails with "refusing to fetch internal address api-docs.example
(resolves to fdfe:dcba:9876::152)"; with the fix it passes.
TestWebFetchRefusesHostWithOnlyBlockedAddresses keeps the all-blocked
refusal. go test ./internal/tools/builtin/, go vet, make check and
golangci-lint are clean.
A local model running at ~25 tok/s can spend well over two minutes
prefilling a long context without sending a byte. The openai, anthropic
and responses providers each cut such a call after 120s of silence (the
SSE idle watchdog, and the transport's response-header timeout on the two
that set one; anthropic set none, so its header wait was unbounded), and
the turn failed with "stream stalled — no data for 2m0s" although the
model was still working. The 1.x line already moved these guards to 300s.
The window now lives once, as provider.StreamIdleTimeout (300s), and all
three providers read it for both the idle watchdog and the header wait.
A longer header window multiplies through SendWithRetry, which retries a
response-header timeout with the full MaxRetries budget: 11 x 300s plus
backoff is close to an hour before the user sees an error, and a
prefill that timed out once times out identically on every attempt. A
transport timeout (a net.Error reporting Timeout() while the caller's
context is still live) now gets its own budget of one retry, the way
maxAuthRetries bounds auth failures, so the worst case is about ten
minutes.
Test:
- TestNewWaitsFiveMinutesForASilentModel in openai, anthropic and
responses builds each client through New and reads its idle and
header windows. Before: "stream idle window = 2m0s, want at least 5m"
in all three, and "response header window = 0s" for anthropic.
- TestSendWithRetryGivesAHeaderTimeoutOneRetry drives a real
http.Transport against a server that never sends headers. Before:
"calls = 4, want the timed-out attempt plus exactly one retry" (retry
limit 3). After: two calls and an error that is a net.Error timeout.
Fixes#6990
A Windows machine whose OpenSSH DefaultShell is Git Bash could not be used
as a remote host: `uname -sm` answers "MSYS_NT-10.0-26200 x86_64", which is
neither Linux nor macOS, and the fallback `echo %OS% %PROCESSOR_ARCHITECTURE%`
is cmd syntax that bash (and PowerShell) print back literally, so the machine
was refused as unsupported.
Root cause: detectPlatform asked the Windows question in cmd's syntax, while
every command windowsShell sends afterwards already goes through
`powershell -EncodedCommand`, which any of the three login shells runs the
same way.
Fix: ask for OS and PROCESSOR_ARCHITECTURE through psCommand. The guide no
longer says remote hosts are Linux and macOS only.
Test: TestWindowsIsIdentifiedWhateverTheLoginShell drives detectPlatform
through cmd, PowerShell, Git Bash (MSYS_NT) and MINGW64 login shells. On
origin/studio the Git Bash case fails with
bootstrap: unsupported remote: `echo %OS%` answered "%OS% %PROCESSOR_ARCHITECTURE%"
and all four pass after the change.
The explorer classified entries by os.ReadDir's DirEntry.IsDir, which is
false for any symlink. A link to a folder inside the workspace was drawn
as a file, so it could not be expanded, and clicking it asked for a file
read that fails. Search had the same flaw: WalkDir does not follow links,
so a linked folder whose name matched came back as a file hit, and a link
to a file outside the tree came back as a hit the file endpoint's
os.OpenRoot then refuses.
A link entry is now resolved: one naming a folder inside the tree is
listed as a folder (expanding it already works, listFolder checks the
real path), one naming a file inside the tree as a file, and one that
dangles or leaves the tree is not offered, matching the refusal
listFolder already gives such a folder.
Test: TestALinkIsListedAsWhatItResolvesTo and
TestASearchListsOnlyLinksToFilesInTheTree fail on origin/studio
("directories = [alpha zeta]", "search = [alpha/a.txt far.txt near.txt
txt-folder zeta/z.txt]") and pass with the fix; the serve package
passes in full.
Refs #5914
The planner keeps a session of its own and only ever saw its own plans,
so the next planning turn did not know what the executor had found or
changed, and turns the policy routed straight to the executor never
reached it at all. Users ended up relaying the executor's results to the
planner by hand.
Every executor run now owes the planner its final reply (plus the user's
input when the planner never saw that turn), and the next planning input
carries the owed outcomes in an <executor-since-last-plan> block at the
turn tail, so the planner's cache-stable prefix is untouched. The debt
clears only once a plan comes back; a planning turn that fails and rolls
back keeps it owed. Switching sessions clears it with the planner
transcript.
The debt is bounded where it is held: task and reply are cut to their
render caps on append, only the newest four outcomes are kept, and a
count of the trimmed ones is rendered. A reply is taken only from the
run's own messages; when a compaction rewrites the session mid-run,
those begin at the run's own user message, identified by a stamp later
than every message before the run, and without it the outcome reads
"no reply captured" instead of an earlier turn's reply.
Test: TestPlannerSeesWhatTheExecutorDidSinceItLastPlanned and
TestPlannerKeepsExecutorOutcomeOwedWhenPlanningFails fail on
origin/studio (the second planning input carries no executor reply).
TestExecutorOutcomeNeverReportsAnEarlierReplyAfterCompaction (an
earlier reply reported twice) and TestOwedExecutorOutcomesStayBounded
(7 outcomes held, want 4) fail on the previous revision. All pass after,
with the existing coordinator suite.
complete_step rejected diff/files evidence whose paths were cited
workspace-relative ("frontend/src/core/backend/idb.ts") when the writer
had been given the absolute path: the ledger records a receipt's path as
the tool received it, and complete_step compared cited and recorded
paths for exact equality, in the per-turn ledger and in the cross-turn
session fallback alike. The step could not be signed off even though
the file had been written.
The agent now attaches its workspace root to each tool call's evidence
scope, and complete_step checks every cited path under the forms that
name the same workspace file: the citation itself, a relative citation
joined to the root, and an absolute citation made relative to it. A path
outside the workspace keeps only its own form, relative-vs-relative stays
exact, and case folds only on Windows through NormalizePath. The ledger
queries themselves are unchanged, so completion reports and blocked
conclusions keep exact matching.
Test: TestCompleteStepCreditsCitationsOfTheSameWorkspaceFile and
TestE2ERelativeCitationOfAbsoluteWriteSignsOff fail on origin/studio
("diff paths have no matching successful writer receipt") and pass
after. TestCompleteStepCreditsNoOtherFileForACitation (a same tail
outside the workspace, a base name, a relative nested write, a deeper
file's trailing components, a .bak, a ../ escape, a different case on
Linux) is rejected on origin/studio, credited under suffix matching,
and rejected after.
A workspace below a Box Drive mount on Windows failed every config load
with "resolve project config path ...: The system cannot find the path
specified", whether or not reasonix.toml existed.
Root cause: resolveConfigAccessPath canonicalizes the whole path with
filepath.EvalSymlinks before it confines a project config link to its
directory. Below a cloud-drive reparse point that canonicalization fails
while the files themselves open normally, and the failure was treated as
fatal even when reasonix.toml was a plain file or absent.
Fix: when canonicalization fails and the config entry itself is absent or
a non-link file, use the logical path. Such a file lies in its own
directory whatever its ancestors resolve to, so the confinement check has
nothing to decide. A link still has to resolve, so an unresolvable link is
refused as before.
Test: path_access_test.go stubs canonicalization to fail below a mount
directory. Without the fallback both LoadForRoot cases fail with the
reported "resolve project config path" error; with it they load (and the
project value is applied), and a reasonix.toml link under the same mount
is still refused.
Off macOS the Electron shell sets the application menu to null so no bar
renders inside the window. Electron binds F11 only through a menu role
(togglefullscreen), so with no menu the key did nothing and the window
had no way into full screen on Linux or Windows.
The shell now listens for a bare, non-repeated F11 keyDown on the main
window's contents and toggles setFullScreen. macOS is left alone: it
keeps full screen on the title bar and the window menu.
Test: desktop/electron/test/unit.mjs "F11 toggles full screen where no
application menu binds it" fails on origin/studio (the key is unbound)
and passes with this change; node --test test/unit.mjs is 43/43.
The environment block in the system prompt printed "- Shell: bash". That
value is the interpreter sandbox.ResolveShell picked for the bash tool; the
user's login shell ($SHELL) never feeds it (it is only read to recover
PATH). Unattributed, the line reads as the user's shell, so a fish or zsh
user got advice about ~/.bashrc.
The line now reads "- Shell used by the bash tool: <shell>", and the
rendered [tools.shell] config section says the setting picks the bash
tool's interpreter and is independent of the login shell. The prefix
changes once on upgrade and stays byte-stable within a session.
Test: TestBuildEnvironmentBlockAttributesShellToBashTool builds through
boot with SHELL=/usr/bin/fish and reads the system message sent to the
provider. On origin/studio it fails (block shows "- Shell: bash"); with
the fix it passes, together with the environment and config packages.
Fixes#6823
The config documents ui.show_turn_usage as the switch for the per-request
"TURN … tok · in … · cached …" receipt in the CLI/TUI transcript, and the
1.x TUI reads it. The studio TUI never did: runTUI loaded the config but
passed nothing about it to tui.Options, and every usage row was drawn, so
setting it to false changed nothing.
tui.Options gains HideTurnUsage, set from the loaded config. A hidden usage
row still folds into the transcript (a later frame of the same attempt
restates it in place and TurnOut keeps counting), but it is marked committed
without being printed and is skipped in the live area.
Test: TestHiddenTurnUsageNeverReachesTheScreen drives a turn through the
model and checks the screen while the answer streams and after it settles.
Before the fix, hide=true failed in both states (receipt shown); after it,
both pass, and hide=false still shows the receipt.
Root cause: the workbench read an open file once, keyed on its path only.
The explorer tree beside it is re-read when a turn settles, when the
window is looked at again and when the change set moves, but the file
view never was, so an edit by the agent or another application stayed
invisible until the tab was closed and reopened.
Fix: the file view is re-read on the same occasions as the tree, and the
content is replaced only when the kernel's revision for it moved. A draft
with unsaved edits is never overwritten, including one made while a
reload read is in flight, and a hidden panel reads nothing. Revisions
are opaque, so a read only counts if no save and no later read has been
issued since it started; otherwise a reload issued before a save could
land after it and revert the view to the pre-save content.
Test: WorkbenchPanel.test.tsx adds five cases.
- "shows an open file as it is on disk once a turn settles" and
"... once the window is looked at again" fail on the base (view still
shows "First") and pass after the fix.
- "keeps unsaved edits when the file changes on disk underneath them"
pins that a dirty draft issues no read.
- "keeps an edit made while a reload was reading the file" fails when the
in-flight dirty-draft guard is removed and passes with it.
- "drops a reload that was issued before a save and lands after it"
fails without the read/save ordering (view reverts to "# Second") and
passes with it.
Full frontend-next vitest (915 tests), tsc --noEmit and make check are
clean.
Refs #5693
A fenced code block is drawn with a "│ " rail in its gutter. With the
mouse captured, selectedText read the rows exactly as drawn, so copying
code from an answer pasted a rail at the start of every line. Native
mouse mode already draws the rail as blank cells; the in-app copy now
reads the transcript rendered that way. The rail and its blank form have
the same width, so rows and columns still line up with the selection
drawn on screen, and only rows through the selection's end are rendered.
Test: TestSelectionCopiesCodeWithoutTheRail selects a railed code block
in a settled and a live answer. Before: copied
" │ func a() {\n │ return\n │ }". After: no rail; the tui package,
go vet, golangci-lint and make check pass.
remark-gfm defaults to singleTilde: true, so "500~1000 or 2000~3000"
struck out everything from the first tilde to the second. A lone tilde is
the ordinary way to write a range, especially in Chinese replies. The
transcript renderer now passes singleTilde: false; ~~text~~ still strikes.
Test: Markdown.plugins.test.tsx renders two ranges and one ~~...~~ span.
Before the fix it found 2 <del> elements; after, exactly one, holding
only the doubled-tilde text. Full frontend-next vitest and tsc pass.
SendWithRetry retries transient transport errors, but transientErr refused
anything matching errors.Is(err, context.DeadlineExceeded). net/http's
"timeout awaiting response headers" error implements Is(DeadlineExceeded),
so a slow gateway that hit ResponseHeaderTimeout ended the request on the
first attempt and left an unattended run stopped.
Whether the caller gave up is now asked of the caller's context rather than
read off the error's identity; a transport timeout while the caller is still
waiting is retried with the usual backoff.
Test: TestSendWithRetryRetriesResponseHeaderTimeout drives a real
http.Transport with ResponseHeaderTimeout against an httptest server that
stalls the first request. Before: "p: request failed: ... net/http: timeout
awaiting response headers". After: recovers on the second attempt.
TestSendWithRetryStopsWhenCallerDeadlineExpires pins that the caller's own
deadline is still not retried.
Refs #6354
A model switch rebuilds the controller from a snapshot of its history and
closes the old one. /compact runs asynchronously under the rotation gate,
but RuntimeStatus reported only running/finishing as active, so every
busy guard built on it (serve switchModel, provider/workspace rebinds,
ACP config rebuilds) let the switch through mid-fold: the new controller
carried the pre-fold history while the fold landed on the discarded
controller, which then wrote the compacted transcript over the same file.
RuntimeStatus.Running now includes the rotation gate, which also covers
rewind, summarize and new/clear session, matching the 1.x line where
maintenance already counts as running.
Test: TestSwitchModelRefusesWhileManualCompactIsFolding holds a real
manual compaction open at its summary call and switches the model through
serve. Before: switchModel returned nil and replaced the controller.
After: it refuses with busy.switch_model and keeps the old controller.
The Windows smoke and full legs looked hung: output stopped before
internal/assembly/boot and the step ran into its job timeout without
-timeout ever firing. Nothing was hung. With the result cache on, go test
passes each test binary -test.testlogfile, and before and after the run
it computes the cache key from that log, calling filepath.EvalSymlinks on
every recorded path outside the module. boot's log holds about 1.9M
entries (84 MB); on a Windows runner that costs about five minutes per
pass, and a restored cache that already holds a boot log pays it twice.
Pass -count=1 to every root-module go test that runs on Windows, and hold
ci.yml to it with a test that reads the workflow.
A quoted paragraph was wrapped to the full terminal width and then
shifted right by the "▎ " rail (plus any list indent), so every full
row ran two or more columns past the edge. The terminal soft-wrapped
the overflow, leaving a stray rail on one row and the last characters
of the line on the next — most visible with CJK text, where every row
is filled to the edge.
renderBlockquote now lays the quote's body out at the width left after
its prefix and restores the renderer's width afterwards, so nested
quotes and quotes inside list items narrow once per level.
Test: TestBlockquoteRowsFitTheRenderWidth renders top-level, nested,
list-indented and Latin blockquotes at widths 20/41/80 and asserts no
row exceeds the width. It fails on the base (an 84-column row at width 80, 24 at width 20)
and passes with the fix.
A reader who audits what the agent wrote had no way to keep diffs open
while leaving reads and commands folded. The folding settings answered per
part of the transcript (work group, step) and never per what a step did:
"steps" opened everything or only failures, and the work group folded once
the turn ended, so an edit was always two clicks deep.
Folding gains a "changed" mode for the work group and for steps. A step
opens when it changed a file (it carries a diff or line counts, the same
fact the +N/-M badge already reads); a work group opens when one of its
calls did. A "Changes only" preset sets both. The settings preview gains an
edit step so the mode shows what it does.
Test: src/ui/fold-changes.test.tsx renders a real Transcript with a read-only
turn stretch and one holding bash + edit_file. On the base, "changed" is
not a stored mode and both groups stay folded (expected [false, true],
got [false, false]); with the fix only the edit's group and the edit's
step open. Full vitest (144 files, 912 tests) and tsc pass.
curl, wget, pip and most download tools redraw their progress meter by
returning to column zero with a carriage return. The tool card renders
shell output in a <pre>, and a browser draws a carriage return as a
space, so every frame the command printed landed side by side on one
line. The card showed the first frame (0%) and the rest ran off to the
right: a 64-frame curl download measured 35003px wide in Chromium, so a
running download looked stuck at its start.
Term now resolves each line the way a terminal would leave it: every
frame overwrites the start of the one before, a CRLF ending stays a line
ending, and a trailing return holds the last complete frame while the
next one is still arriving. Copy still takes the raw output.
Test: four cases in ToolCards.state.test.tsx (latest frame shown,
shorter frame keeps the uncovered tail, CRLF, trailing return) fail on
origin/studio and pass with the fix. In the perf build the same curl
card goes from 35003px to 710px wide and shows 100% instead of 0%.
Root cause: the full-screen transcript only bound plain PgUp/PgDn, so the
Shift+PgUp/PgDn a terminal uses for its own scrollback fell through to the
composer and did nothing. Shift+Insert, which Linux terminals that pass the
key through expect to paste, was unbound too (the textarea binds only Ctrl+V).
Ctrl+C quitting (twice, when idle) and Ctrl+Insert copying a selection were
already in place.
Shift+Up/Down stay with the composer, which uses them to select lines.
Test: TestShiftPageKeysScrollTheTranscript and
TestShiftInsertPastesClipboardText fail on origin/studio ("shift+pgup left
the view on the tail", "shift+insert did nothing") and pass with the fix;
go test ./internal/frontend/tui/ passes.
Refs #4912
Anything a task produced had to be found by hand under the workspace
path, because the explorer had no way to open Explorer or Finder at a
file or folder. Nothing like it existed. The only reveal in the app
opens the theme folder.
The explorer header gains a button that shows the workspace root. Every
file and folder row gains a context menu:
- "Reveal in File Explorer" on Windows
- "Reveal in Finder" on macOS
- "Show in file manager" elsewhere
The kernel confines the path and the shell does the showing.
- GET /workspace/locate?path=<workspace-relative> answers the absolute
path of an entry in that runtime's workspace. "" and "." name the
root. It refuses "..", absolute paths and links that resolve outside
the tree with workspace.path_outside_tree, and a missing entry with
workspace.file_missing.
- The route is gated on the local-desktop host grant. AllowEditorOpen
is renamed AllowLocalDesktop because the grant now covers both
routes. A networked serve and a paired device get
workspace.locate_no_window.
- The hub refuses the route for a remote pane before proxying, with the
same code. Only the hub knows the pane is remote, and a far kernel,
compromised or not, answers with paths that mean nothing here.
- The renderer sends only its pane base and the relative path, over the
new shell:reveal IPC. Electron main does the rest:
- it requires the base to be a pane (/rt/<id>);
- it asks the kernel with its own credential;
- it acts only on an absolute path the kernel answered, and on Windows
only on a drive-letter path, never a share or device path
(\\host\share, \\?\, \\.\, \??\);
- it only ever calls shell.showItemInFolder, the root included.
openPath is never used: a directory can be an application bundle,
or a link to one, and opening it would launch it outside the
sandbox.
- StudioHost now forwards the query string, which it used to drop
silently.
- The page hides the action in a browser tab (no bridge) and in a
remote pane.
Tests:
- workspace_locate_test.go:
- entries inside the tree, and "." as the root;
- escapes, including a symlink escape;
- a missing entry;
- no grant, and a paired device;
- the hub refusing a remote pane without reaching the far kernel.
- Electron unit tests drive reveal() through StudioHost against a real
HTTP server. They check that the root is only selected, even when it
is answered as a directory, that forged bases never reach the kernel,
and that relative answers and Windows share or device answers are
refused.
- WorkbenchPanel tests cover the header button, both row menus, the
keyboard path, the remote pane and a coded refusal.
Show a pending state while slash commands and skills load, and keep a dismissed pending request from reopening the menu when it resolves. Covers the delayed and Esc paths with interaction tests. Fixes#9311.
In Settings > Model services the protocol row (.vway) lays out the label,
the segmented control and the hint in one nowrap flex row. The label and
the control are flex: none, and the hint is the only item that can shrink
(flex: 0 1 auto, min-width: 0). The detail column is only ~474px wide even
in a 1400px window: label 47 + control 367 + gaps 20 + padding 24 leave
16px, so the hint was shrunk to 16px and set one word per line, 24 lines
down the pane (computed styles read in Chromium). The only rule that
wrapped the row was a max-width: 760px viewport query, which never fires
while the pane itself is narrow inside a wide window.
A switcher row now always wraps, and the hint takes flex: 1 1 100%, so it
sits on its own line under the switcher at every width - the way the
neighbouring rows put a description under their label rather than beside
their control. The viewport query that did this only on narrow windows is
removed.
Test: perf/overflow.mjs opens Settings > Model services at 1400px and 640px
and measures every switcher hint in the detail pane (width against the
room in its row, rendered line count).
Before (origin/studio): 1400px FAIL - width 16px of 450px, 24 lines;
640px ok. After: 1400px 450/450px, 2 lines; 640px 538/538px, 2 lines.
tsc --noEmit, vitest src/ui/Providers src/ui/AddProvider
src/ui/settings-catalog src/styles (36 passed), perf/contrast.mjs clean,
make check clean.
A running bash step in the activity group showed the same static clock as
the group header; the only sign the turn was alive was the composer's R.
Each step row also left a wide blank between the status mark and the
command.
Root causes:
- Nothing animated a running call's state mark; running differed from
done only by a tint.
- `.activity-body .hl .nm` was `flex: 0 0 96px`: a fixed name column, so
a short name like `bash` left ~80px of empty box before the command.
- `.flow .call[data-k="say"] .hl` (and its `.nm`/`.arg` rules) matched
every descendant `.hl`. An activity group is re-hosted inside the say
card, so a running row (a plain `.hl`, not a disclosure summary) picked
up the answer header's 29px left padding and 10px bottom margin and sat
26px right of the finished rows; args also took `--muted` instead of
the group's `--faint`.
Fix:
- A running call's clock turns (2.4s linear) while its state holds. One
fact moves in one place: the step's own mark while the group is open,
the group header's mark once it is folded. The header also says
"{n} 项运行中" in `--net`. Reduced motion stops the turn and keeps the
tint; hidden panes pause it.
- The name hugs its text up to 96px and never shrinks.
- The say header rules are scoped to the card's own header
(`> .c > .hl`), and plain step heads get the summary's 3px inset.
The motion guard counted any two infinite loops as the whole budget; it
now classifies each loop by what it reports (the run mark, or a running
call's mark at most once per running call) and fails any other loop.
Test: new perf/running.mjs drives a finished and a running bash call via
__feed in dark/light at 1440px and 640px, plus reduced motion. Against
origin/studio it fails 28 checks (no animation on the running mark, no
header signal, 83px between name and command, rows 26px apart); after
the fix all pass. motion, idle, cards, contrast, overflow and surface
guards pass; vitest 908/908; tsc clean; make check clean.
The explorer kept listing folders that had been deleted in Windows
Explorer: 12 entries against the 4 the OS showed.
Root cause: GET /workspace/files reads the disk on every request and keeps
no cache, but the panel only asked when it was opened, when the search
query changed, or when the git change set changed. That change set is
itself fetched only at turn boundaries, and untracked or ignored folders
(and every folder of a workspace that is not a repository) never move it.
So a change made in another application was never followed by a read, and
the tree's freshness rested on the agent being the one who wrote.
Fix: the listing is also read again when the window regains focus or its
page becomes visible (useGlance), and when a turn settles. No fs watcher:
the kernel listing is uncached and cheap, a watcher would need a new
dependency, a handle per expanded folder on Windows, and a new pushed
event type across the wire, all to refresh a panel nobody is looking at.
Test: WorkbenchPanel.test.tsx "drops a folder deleted outside the app once
the window is looked at again" deletes a folder from the backing store
without any port call and fires window focus. Fails on origin/studio (the
t620 row is still present), passes with the fix. A second case covers the
turn-settle read of a file git does not list.
The clean delivery receipt lays out the tick, the label and the evidence
(file count plus passing commands) in one flex row. Only the evidence was
meant to give way (min-width: 0 + ellipsis), but the label kept the default
flex-shrink: 1. Flex shrinking is weighted by basis, so a command many times
wider than the label took almost none of the loss and the label was shrunk to
its min-content width - a single glyph for CJK, which may break between any
two characters. "没有未经验证的部分" rendered one glyph per line at every window
width.
The tick and the label now take flex: none; the evidence is the only item
that shrinks and ellipsizes.
The row also sat off the answer's column: it was indented by the tool-call
symbol column (42px), which top-level transcript items no longer draw, and
ran the full flow width instead of --doc. It now hangs like the answer card
(6px inline hang, max-width --doc), so the tick lines up with the answer
text and the activity group, and the row ends where they end.
Test: perf/cards.mjs feeds a turn_done receipt with a long && chain through
the real App in Chromium and measures the label at 1440/640/420px.
Before: "回执标签不被长命令挤成竖排 — 9 行" FAIL at all three widths.
After: 1 行 at all three, and the command is still clipped in-row.
The same page checks the row against the answer's text column: before,
tick off by 48px and row 60px wider at 1440px; after, 0px/0px at all three.
tsc --noEmit, vitest src/ui/cards src/styles (67 passed), make check clean.
Refs #10851
multi_edit returned on the first step whose old_string was missing, not
unique, or empty, so a batch with three bad steps took three round trips
to surface them all even though nothing was ever written.
The sweep now records a failed step, leaves the buffer as it was, and
checks the remaining steps against it. Any failure still returns before
the write, so the file stays untouched. A lone failure keeps its
existing "edit N: ..." form; several are listed under
"K of N edits failed; <path> left untouched", with the note that steps
after a failed one ran without its replacement, so a later failure may
be a consequence of an earlier one.
Test: TestMultiEditReportsEveryFailedStep (5 edits, 3 bad: not found,
not unique, empty old_string) fails on origin/studio, which reports only
edit 2, and passes with this change; the file is unchanged in both.
go test ./internal/tools/builtin/ passes; make check and golangci-lint
on the package are clean.
Refs #10792
The checkout under review is untrusted input, yet review built its grep
from the merged config and read the review skill with the checkout as a
project root. A reasonix.toml setting [tools.search] engine = "rg" and
rg_path = "tools/rg" made review's grep execute a program the checkout
ships, and a .reasonix/skills/review/SKILL.md without read-only replaced
the built-in review skill, handing an attacker-written prompt bash.
Review now loads the user-global config alone (Roots.LoadUserConfigReadOnly)
for its tool registry: search engine, rg_path and sandbox. Its skill store
has no project root, so project-scope skill directories are never
discovered. Provider and model resolution are unchanged.
On studio only the executor and the controller fired the session's hooks.
Every other agent that calls tools ran with no hook runner, so a PreToolUse
deny on reading a secret did not cover its reads:
- delegated children: TaskTool.subagentOptions (task, read_only_task,
parallel_tasks, fleet, background tasks and model-invoked run_skill via
RunProfileSpec) and roleWiring.skillRunOptions (read_only_skill) set no
Hooks. This ports main-v2's 896faf36d (#10843), which never reached studio;
- the dual-model planner (roleWiring.planner);
- the guardian, reachable through gateApprover -> guardianSess.Review;
- `reasonix review`, which builds its subagent outside boot.
hook.Runner gains ForRole(role): a runner firing the same live hook set in
the same environment, whose session id is the parent's id at fire time
suffixed with ":"+role. A SetSessionID rotation (/new, clear, branch
switch) therefore reaches every child, and a hook keyed on session_id
neither merges the planners of different sessions nor confuses a child
with the executor. The hooks and the repeat-suppression state live in a
shared hookSet, so SaveHooks/Replace reaches every derived runner.
boot passes the runner to roleWiring: planner fires as <session>:planner,
guardian as <session>:guardian (guardian.NewSession takes the hooks), task
and skill children as <session>:subagent:<ref|call id> through
TaskToolOptions.HooksForRole and skillRunOptions.
`reasonix review` loads only the user's hooks: hook.LoadOptions gains
Scopes, and boot.NewUserHookRunner loads hook.UserScopes (global
settings.json and installed plugins). Project hooks from the reviewed
checkout never run, since a branch under review is untrusted input. Each
review run fires under a fresh id.
Review hooks start in the checkout root so they can inspect it, which on
Windows would let cmd.exe resolve a legacy hook's bare `python` or `node`
to an executable the checkout ships, since cmd.exe searches the current
directory first. The review runner's spawner (hook.WithoutCwdExeSearch)
sets NoDefaultCurrentDirectoryInExePath=1 in every hook process, which
cmd.exe honours; the cwd stays the checkout.
Tests (real PreToolUse scripts that log their payload and exit 2):
- TestBuildRunsPreToolUseInsideTaskSubagent (boot.Build; task,
read_only_task, run_skill, read_only_skill): the child's read is blocked
and fires under <parent>:subagent:...
- TestEffectPreToolUseCoversPlannerReads / ...GuardianReads (boot.Build):
blocked, under <parent>:planner / <parent>:guardian
- TestEffectPlannerHookSessionFollowsRotation: NewSession moves the
planner's hook session to the new parent id
- TestReviewCommandRunsOnlyUserHooks: a global deny blocks the review's
read, a project hook in the checkout never runs, two runs fire under
two distinct ids
- TestUserHookRunnerDisablesCwdExeSearch: through the spawn seam, the
review runner's hook process starts in the checkout with
NoDefaultCurrentDirectoryInExePath=1
- TestLoadUserScopesSkipProjectHooks, TestRunnerForRoleDerivesSessionIDAtFireTime
Refs #9255
The 1.x line keeps the CLI's install channels until 2.x is stable, so
the npm and Homebrew job now runs only with the repository variable
STUDIO_PUBLISHES_CLI=true. Studio releases still carry the CLI archives
its remote workspaces install from.
A pull request authored with GITHUB_TOKEN never starts other workflows, so
the weekly acknowledgments PR never reported the checks branch protection
requires and could only land by bypassing it. The step now uses the
dedicated ACKNOWLEDGMENTS_TOKEN secret when it is set, and falls back to
GITHUB_TOKEN otherwise.
The contributor table also listed github-actions[bot]; bot accounts are
now filtered before the top 20 are taken (30 are fetched to keep 20).
Checked by running the script against the live API: the previous version
writes one github-actions row, this one writes none.
Wails stopped being the desktop shell when the Electron shell landed, but
seven places on `studio` still describe it in the present tense. Six of them
were already fixed on `main-v2` by #10018; they only need the same edit
carried over here.
- `CHECKPOINTS`: the desktop rewind control calls `controller.Rewind` over the
desktop host protocol, not the Wails binding.
- `TASK_CONTRACT`: the constraint keeps the desktop host JSON contract intact.
- `RECOVERY`: `doctor` inspects install problems without loading the desktop
shell, and macOS keeps LaunchServices launching the desktop app bundle.
- `DESKTOP_CRASH_DIAGNOSTICS_RUNBOOK`: the budget is pre-shell work, and
report/metric persistence runs after shell startup.
- `SESSION_MEMORY_RETRIEVAL`: the example project file no longer points at
`desktop/frontend/wailsjs/`, which went away with the Wails shell. Studio
commits its generated files under `internal/ext/extension/protocol/`.
- `REASONIX.md`: the frontends behind `control.Controller` are the chat TUI,
HTTP/SSE serve and the Electron desktop.
- `issue-auto-label`: the classifier prompt no longer tells the model the
desktop app is Wails.
Root cause: Electron 44 picks its Wayland Ozone backend by itself in a
Wayland session, and on drivers whose EGL platform init fails there (#10369)
the GPU process exits and the app dies before a window appears; the same
machine works with --ozone-platform=x11. Studio's deb entry runs the
Electron binary directly, so no wrapper builds its argv, and the only
switch main.js sets is disable-backgrounding-occluded-windows. Chromium
selects Ozone before main.js runs, so appendSwitch cannot choose it.
Decision: default to X11 whenever it is available, the same rule as the
1.x line. On Linux, when the session is Wayland (XDG_SESSION_TYPE, else
WAYLAND_DISPLAY) and DISPLAY is set, main.js relaunches once with
--ozone-platform=x11 prepended and exits, before it claims the instance
lock so the relaunch finds nothing held. REASONIX_OZONE_PLATFORM=wayland
keeps native Wayland, x11 forces X11, auto is the default. A pure Wayland
session without DISPLAY and an X11 session are unchanged, and an explicit
--ozone-platform or --ozone-platform-hint argument wins, which is also what
stops the relaunched process from relaunching again. The update handover's
app.relaunch() reuses process.argv and keeps the flag.
Test: two cases in test/unit.mjs. One loads the real main.js with a stub
electron module under a Wayland+DISPLAY environment and asserts it
relaunches with the flag and exits before requestSingleInstanceLock; on
origin/studio it fails with actual [['lock']] where
[['relaunch', ['--ozone-platform=x11', ...]], ['exit', 0]] was expected.
The other walks the session table through relaunchForOzonePlatform. Both
pass with the fix (38/38). A probe on Electron 44.1.0 confirmed a
top-level return after app.relaunch({args}) + app.exit(0) before ready
starts a child that receives the new argv.
Root cause: on DeepSeek thinking mode, reasoningOnlyFinishHonoured
accepts a finish_reason=stop with empty content as the final answer.
When that stop comes right after a tool round, the tool results never
get a visible synthesis and the turn goes idle until the user sends
another message (#9758).
Decision: a narrow structural retry. When this turn ran tools, no
visible assistant text follows the last tool result in the transcript,
and the stop is reasoning-only, the existing empty-final retry runs
once; a second reasoning-only stop is honoured. A reasoning-only answer
to a turn that ran no tools is still honoured, so the extra thinking
round the honour rule prevents does not come back there. The judgement
reads structure only: usedAnyTool, empty content, message position.
Non-DeepSeek providers keep their existing bounded retry.
Tests: TestRunRetriesReasoningOnlyStopAfterToolRoundOnce and
TestRunAcceptsSecondReasoningOnlyStopAfterToolRound drive a scripted
DeepSeek-policy provider through Agent.Run. On the base both fail with
"provider calls = 2, want tool round + reasoning-only stop + one retry";
with the fix they pass. TestRunAcceptsReasoningOnlyFinalWhenModelStopped
(no tools) passes unchanged, as do internal/runtime/agent and its
direct dependents.
read_file told the model to reference an image as @path and, if it
cannot read images, to delegate with read_only_task. Only a reference
in the user's own message attaches a picture, so for an image the user
never attached the delegation reached a child with nothing to look at.
The refusal now says an image attached this turn can go to
read_only_task, and that any other one needs the user to send it.
In 2,217 local sessions, all six image refusals were attachments, which
the delegation does carry; the unattached case has not been seen, so no
new task parameter is added for it.
build-host.js built reasonix-studio-host on Linux, and linux-payload.js
built reasonix-studio-update-helper, with cgo at its default. On the
ubuntu-22.04 runner that links both against glibc 2.35: in the
studio-v2.20.0 .deb both name /lib64/ld-linux-x86-64.so.2 and the host
needs GLIBC_2.32/2.34, so Studio will not start its kernel on glibc 2.31
systems even though the host is already held CGO-free by studio.yml. On
Linux the only cgo in its closure is the stdlib's optional net and os/user
glue, which have pure-Go implementations.
Both builds now pass CGO_ENABLED=0, and the package job reads the ELF
program headers of the .deb's Go binaries (packaging/elf.js) and fails if
one names a program interpreter.
Test: test/unit.mjs adds a case for elf.js; on the base it fails with
"Cannot find module '../packaging/elf.js'", with the fix 36/36 pass.
`node packaging/elf.js` on the studio-v2.20.0 .deb's host and helper
exits 1 ("... is dynamically linked (interpreter
/lib64/ld-linux-x86-64.so.2)"), and exits 0 on both built with
CGO_ENABLED=0 GOOS=linux.
Refs #10372
Root cause: legacy conhost with a CJK TrueType font (the default on
Chinese Windows) sizes East Asian Ambiguous runes by the glyph, so it
draws a font-dependent subset two cells wide: · … “ ” ‘ ’ — – ● → ↑ ↓
◆ ° × and Greek/Cyrillic letters among them. The TUI and its renderer
count all of them as one cell, so every full-width row carrying k of
them is k cells too wide on screen: conhost wraps it, the alt-screen
frame grows past the window and scrolls, and later repaints land on
shifted rows, which is the stacked-frame garbage in the report.
Decision: measure instead of guess. When stdout is a console, a
never-activated screen buffer of that console (same font) measures
each non-ASCII rune the layout counts as one cell, once, via
WriteConsoleW and a cursor read-back. A rune the console draws wider is
swapped, after layout, for a one-cell stand-in both sides agree on:
Unicode's halfwidth variant when it has one (→ becomes U+FFEB), else
the OS US-ASCII best-fit (· becomes ., “ becomes "), else the OS
default character. Each candidate is itself measured before it is
used. The swap is rune for rune at equal counted width, so applying it
to the finished frame changes no row's layout; escape sequences and
OSC payloads pass through untouched. A pseudoconsole (Windows Terminal,
VS Code, SSH) measures these runes as one cell, so nothing is replaced
there; other platforms get a nil fit and are unchanged.
The same measurement also covers what the inline mode prints above the
frame (answers and the banner), since a wrapped print adds rows the
renderer does not know about. The banner is printed from a command
goroutine, so the per-rune cache is guarded by a mutex.
Test: TestFrameFitsConhostMeasuredWidths renders the real TUI View at
120 columns after a streamed answer, with the width table measured on
a Chinese Windows 11 conhost, and asserts no row draws wider than the
terminal. With the substitution disabled it fails:
row 3 draws 121 cells on conhost, terminal has 120
With the fix it passes (also under -race). In a real conhost window
the unfixed binary shows the status row twice with "au" / "to" split
across rows; the fixed binary keeps the 30-row frame intact.
Refs #10540
The rendered config template writes bash = "enforce" even when nobody
chose it, so on a Linux host without bubblewrap the settings read back
as enforce and every later save was refused as sandbox.unavailable,
including one that only added a writable directory. Only switching the
jail on is refused now; a file already holding enforce saves its other
fields, and bash stays refused at run time as before.
Reproduced on a bwrap-less Linux: the new test fails there without this
change and passes with it. It skips where a sandbox exists and on
Windows, which forces bash off.
Root cause: the transcript was written only on the 30s autosave tick or
at turn end. A process killed between admitting the user message and the
next save reopened with the in-flight marker but without the prompt, so
the turn vanished from both the history and the model's context.
Decision: the same bounded change as the 1.x line's option A (1). The
agent gains an AdmissionSaver seam called from LandAuthoredUserMessage,
the one place a turn's user message lands, and the controller saves the
transcript there: one extra save per turn, skipped without a session
path, and a failed save only logs. The 1.x partial-output checkpoint
does not apply here: studio has no event-log session store, and the
cache-stable prompt prefix is untouched.
Test: TestKilledTurnKeepsItsPrompt (internal/session/control) runs one
turn, starts a second, streams part of a reply and ends the child
process with os.Exit (no TurnDone, no final save), then reloads the
session and runs recovery. On origin/studio it fails with "prompt of the
killed turn lost after restart"; with the fix it passes.
The test saves the sandbox settings twice. On a Linux runner without
bubblewrap the second save asks for a sandbox the host cannot run and
is refused, which has nothing to do with the switch under test.
When native mouse is on (REASONIX_DISABLE_MOUSE, or the /mouse toggle), the
terminal owns the mouse: the in-app scrollbar can no longer be dragged, so the
transcript drops its right-hand column and reclaims that width for content, and
fenced code drops its "│" gutter for clean copy. Capture-on is unchanged.
When --continue finds no saved session, it reports the miss and starts a fresh
session instead of exiting 1. Both the run path and the TUI resume path fall
through, a --continue miss is no longer reported as "continue" in telemetry,
and the flag help and docs say so.
The ask tool blocks the run on the user exactly like an approval prompt,
but only approval prompts fired the Notification hook, so an external
channel wired to it heard about every pending approval while a blocking
question looked like the agent still working. In YOLO mode ask is the
only prompt that waits on the user, and it was the one that stayed silent.
Fire the hook once the AskRequest is emitted, mirroring the approval call
site: message "answer needed: <first prompt>" (en/zh/zh-TW),
notificationType "question_prompt".
Rebuild of #9048 on studio.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Looked at on Windows Terminal against 1.x with the same scripted turn:
- A streaming answer is printed a block at a time, and each block lost the
blank line before it, so headings, lists, code and tables ran together.
A later stretch now starts with that line.
- Tabs were drawn zero cells wide in the full-screen view, so code lost its
indentation. Rows expand them before wrapping, as 1.x does.
- A list resumed after a code block restarted at 1; it counts from the
number it was written with.
- oneLine cut by runes, so a line with CJK text ran past the row and wrapped
to column 0. It cuts by cells.
- The approval panel and the end-of-turn mark drew ⏸ and ⚠, which Windows
Terminal renders as two-cell emoji over one-cell slots. The panel is headed
by its title in the accent colour, and its key hint is translated.
- The end-of-turn card is 1.x's: what went unproven, in the reader's
language, instead of "incomplete · 2 gap(s)".
- The footer's compaction figure reads "距压缩 81%" (headroom left), not
"压缩 81%".
write_file replaces the whole file, so a model writing from what it read
earlier silently discards anything changed since: an edit the user made
in their editor while the turn ran, a formatter, another process. The
run now keeps what the agent last saw of each file, through read_file or
its own writes, and write_file refuses when the file holds something
else, telling the model to read it again. edit_file and multi_edit match
their old text against the current file and were already safe.
In 2,217 local sessions, the case never shows in the logs, because an
outside edit is not recorded there, so this is a safety net rather than
a measured gain. It costs nothing until a file has actually changed,
and is on by default. [tools].protect_changed_files and a switch in the
Studio sandbox settings turn it off.
An explicit --model whose provider has no key failed with
`provider "deepseek-flash" requires DEEPSEEK_API_KEY`. Provider keys
resolve only from the loaded config's credentials file
(storedCredentialValue on Roots.UserCredentialsPath), so the message
sent users to export the variable in their shell or system environment,
which Reasonix never reads. It also labelled the model ref as a
provider. Reported through `reasonix acp` from the VS Code extension in
#10458.
The error now names the model, the variable, the credentials file of
the config it was resolved against, and `reasonix setup`, and says
shell environment variables are not read.
Test: TestResolveModelForCLIMissingKeyNamesCredentialFile sets the key
only in the process environment. On the base it fails with
error "provider \"deepseek-flash\" requires REASONIX_CLI_TEST_SHELL_ONLY_KEY"
does not mention ".../.reasonix/.env"
and passes with the fix; go test ./internal/frontend/cli/ passes.
GitHub acts on "Fixes #N" only for pull requests merged into the default
branch, which is studio, so fixes merged into main-v2 left their issues
open. On a merge into main-v2 this reads the description's closing
keywords, notes the fix on each open issue and closes it.
Adds [skills].suppress_warnings (default false), which quiets the non-fatal skill warnings printed during startup discovery. doctor diagnostics are unchanged. Implements #6483.
The terminal UI ignored REASONIX_DISABLE_MOUSE, which the guide still
documents. It now reads it as 1.x does: 1 starts with the mouse handed
to the terminal, 0 captures it, and unset leaves capture off over SSH,
where the native selection reaches the user's clipboard.
Co-authored-by: BuGlessRB <[email protected]>
A tag is a mutable pointer: whoever controls the action's repository can
move it to new code and every workflow here runs it on the next event,
with this repository's token and on its self-hosted runners. A commit SHA
cannot be moved.
Each reference keeps its tag as a trailing comment, the form Dependabot's
github-actions ecosystem reads and updates. This lets the repository-level
"require full-length SHA" policy be enabled without failing studio runs.
With no recovery_model or guardian_model configured, the Goal evaluator
runs on the main model. A DeepSeek thinking model can stream its whole
answer as reasoning_content and finish with stop and an empty content
block. boundedllm.Call collected only ChunkText, so the evaluator got ""
and every goal paused with "empty goal evaluator response".
boundedllm.Config gains ReasoningAnswer. When a caller opts in and the
provider reports finish_reason=stop with no content, Call returns the
reasoning stream instead. A truncated stream still yields nothing, and
reasoning past MaxOutputBytes is refused only when it would become the
answer, so reasoning before real content is never charged. The goal
evaluator opts in because parseVerdict extracts the JSON object and fails
closed on anything else; free-text callers (advisor, prompt refine) keep
the content-only behaviour.
Test: TestEvaluateReadsVerdictFromReasoningOnlyStop fails on the base
with "empty goal evaluator response" and passes with the fix;
TestEvaluateIgnoresReasoningOfTruncatedStream and TestCallReasoningAnswer
cover the stop guard, opt-in and output budget.
Refs #9678
resolveSessionQuery reported a query that matched several sessions as a
plain sentence, so neither caller could recover which sessions matched:
`reasonix run --resume <q>` exited 1 with only a match count, and the
terminal UI refused to start the same way.
The ambiguity is now a typed ambiguousSessionQueryError carrying the
matched sessions. The headless start still exits 1 but lists each
candidate (last activity, the id --resume accepts, its title) followed by
a new AmbiguousResumeHint. The terminal UI, which already requires a TTY,
opens its session picker limited to those matches (tui.Options.PickAmong).
The narrowing belongs to that first picker alone: it is dropped whether
the first session fetch succeeds or fails, so a later /resume lists
everything.
The picker resumes the chosen session in place, so an ambiguous query
with --copy is refused up front with the same candidate listing rather
than opening a picker that would silently ignore --copy.
Tests: TestRunAmbiguousResumeListsCandidates drives runAgent with an
ambiguous --resume and fails on the base with only
`session query "session" is ambiguous (2 matches)` on stderr;
TestTUIAmbiguousResumeWithCopyIsRefused fails when the picker path is
taken with --copy set; TestPickerNarrowingEndsWithAFailedFirstFetch fails
when the narrowing is cleared only after a successful fetch;
TestResolveSessionQueryAmbiguityCarriesMatches and
TestPickerStartsOnTheGivenSessions cover the typed error and the
narrowed picker.
recall() kept no draft slot: up on a one-line composer overwrote the
text with the previous prompt, and down past the newest entry called
composer.Reset(). With any history present, a single down on a draft
that had never left for the history wiped it outright.
The draft is now set aside when a walk begins and restored when the
walk returns past the newest entry; down at the live position is left
to the textarea instead of resetting it.
Tests in internal/frontend/tui/recall_test.go: TestRecallReturnsTheDraftItLeft
and TestDownOnADraftKeepsIt fail on the base (the composer ends empty)
and pass with the fix.
Refs #10425
A CLI process that died from a panic on a background goroutine or a
fatal runtime error (out of memory, concurrent map writes) left no
evidence. runWithCrashCapture only recovers panics on the main
goroutine and nothing called debug.SetCrashOutput, so that output went
only to the console's stderr, which is gone once the terminal closes.
The CLI now mirrors runtime crash output into a per-PID file under the
Reasonix home. The next start turns any dump left by a dead process
into a pending crash report that keeps the runtime classification and
the sanitized goroutine stacks and redacts the panic value, and removes
the empty files of processes that exited without one. A panic already
reported through recover detaches the file first so it is not queued
twice.
Test: TestGoroutinePanicIsReportedOnNextStart re-runs the test binary
as a child that panics on a background goroutine, then asserts the next
start lists exactly one report with the panicking goroutine's stack and
no panic value. On the base it lists none.
Dispatch-only, so nothing a pull request writes runs on that machine.
The version is a prerelease one patch above the newest release, so the
build neither offers itself that release nor hides the next one.
A comment on a pull request needs pull-requests: write. A refusal that
is not a rate limit is final, so it fails the entry at once instead of
being retried for ten minutes.
A 1.x command line keeps working under 2.x: workspace-write is Auto,
danger-full-access is Yolo, and read-only, which 2.x has no mode for,
falls back to Ask. MIGRATING says where yolo's meaning differs.
Co-authored-by: BuGlessRB <[email protected]>
In 1.x a bare reasonix, or one given only session options, was the chat;
in 2.x it printed usage, so -c, -r and every muscle-memory command line
stopped at a help screen. In a terminal it now starts the terminal UI;
without one it still prints usage, since no one is there to chat with.
The terminal UI takes the rest of 1.x's session options: --effort,
--permission-mode (plan starts in plan mode, acceptEdits allows the write
tools), --yolo and --dangerously-skip-permissions, --add-dir,
--allowed-tools, --copy, --max-steps and the retired --profile. --yolo and
--dangerously-skip-permissions were listed as session options but nothing
read them. The usage text names the interactive form again.
The migration guide says 1.x 1.38.8 and later conversations now open in
2.x, where they are imported, how an import follows 1.x, and that the
machine session list shows them once imported. The roadmap marks W1b done,
which meets gate G2, and points W2 at its pull request.
1.x 1.38.8 and later keep every conversation in <project>/sessions-v4, a
directory per session holding a manifest and an events.frames log of
checksummed batches of zstd-compressed JSON, with large payloads and images
in a content pool beside it. 2.x did not list them, so a person moving from
npm 1.x found their recent history gone.
internal/state/sessionv4 reads that store and nothing else: it validates
each batch's framing and checksum, treats a batch without its end record as
a write in progress, resolves pool references by digest, and folds the
message events into the conversation 1.x shows, with origin "host" read as
HostAuthored and pooled images carried as data URLs. It takes no lock and
writes no byte under the root.
Session lists now include each v4 conversation that has no import yet, at
sessions/v4-<id>.jsonl, using 1.x's own listing cache when it still matches
the log. Opening that path imports the conversation there first, recording
its source; opening it again after 1.x continued it refreshes the copy only
while 2.x has not added to it. The name carries a prefix because 1.x takes
sessions-v4/<name> as the mirror of sessions/<name>.jsonl. Verified end to
end against stores written by 1.x 1.38.10 and main-v2 HEAD, on macOS and
Windows.
A reply batch needs one small job, and on GitHub-hosted runners it queued
behind every branch's CI matrix. The win-gpu runner takes only jobs that
name its label, so replies start at once and CI keeps its runners.
A batch of triage replies from a maintainer's own account runs into
GitHub's content-creation limit, which answers "submitted too quickly"
and stays closed for a while. This manual workflow takes a JSON list of
replies, posts them as github-actions[bot] under the repository's quota
at a steady pace, retries a refused comment, skips a reply already there
and closes the issues marked for it.
The migration guide said 1.x writes schema 2 from 1.38.2 on. It does so
only through 1.38.7; 1.38.8 and later keep conversations in sessions-v4,
which 2.x does not list. The guide now says where each 1.x version keeps a
conversation and which of them 2.x opens, drops the REASONIX_SESSION_LOG
step that 2.x reading schema 2 made unnecessary, and states that 2.x never
writes a 1.x session's files.
The roadmap records the direction the version announcement left open: the
gates that end 2.x pre-release in the same release that moves npm and
Homebrew, the planned weekly release train and update channels, the 1.x
feature and format freeze with maintenance ending 3 months after general
availability or at a backstop date, and splits the session work into the
done schema 2 half and the open sessions-v4 half.
1.x 1.38.2 through 1.38.7 save sessions in a schema 2 event log, an
append-only DAG of messages under named heads, and 2.x refused every one of
them with "uses schema 2; this build supports up to 1". 2.x now replays
that log read-only and materializes the head 1.x would open: parent chain,
patches, redactions and system override applied, and 1.x's origin "host"
read as HostAuthored so injected context stays out of the transcript and
the preview.
2.x never writes the log or anything beside it. A save that finds the
transcript unchanged stops with ErrSessionLogUnchanged, so opening a 1.x
conversation touches no file. Before a turn starts, and at any save that
has more than 1.x holds, the controller moves the conversation to a new
2.x session with the same title and says so; 1.x keeps the original byte
for byte. Verified against sessions written by a real 1.38.7 build.
Host-authored messages no longer count as a turn or become the preview,
and the event-log probe moves to its own file.
docs/MIGRATING.md was the 0.x to 1.0 guide and told a reader on the 2.x
default branch that main-v2 was the active line. It now covers moving from
1.x to 2.x: what the two lines share under one Reasonix home, which sessions
open where now that 1.x 1.38.2 writes a schema 2 log 2.x cannot read, the
REASONIX_SESSION_LOG=v1 switch that keeps a machine running both usable,
the commands that moved, and the steps to run 2.x beside 1.x.
docs/ROADMAP.md is the roadmap the version announcement (#10748) promised:
how 2.x ships, the terminal takeover that gates the release that moves npm
and Homebrew to 2.x, the remaining workstreams, and the decisions still
open. Both are owned by @esengine, and README links to them. The guide's
old prose debt leaves the repolint baseline.
1.x and 2.x share one session directory, and 1.x writes <id>.turns.jsonl
beside each transcript. 2.x classified it by its .jsonl ending and listed
it as a conversation of its own, so a machine that ran both showed a ghost
session for every 1.x conversation.
An Anthropic `error` event (overloaded_error and the like) that arrives
before anything was emitted left the provider as a plain
StreamPayloadError, so the Agent never replayed the attempt, while the
OpenAI provider already promotes the same pre-output payload error to
StreamInterrupt(upstream_error) (#10719). Apply that rule here: the read
loop's sink records whether a chunk reached the consumer, and only an
error with nothing emitted becomes an interruption. After output a
replay would show it twice, so it stays a payload error; the payload
identity survives the wrap for errors.As.
sendChunk moves into the sink so anthropic.go does not grow past its
size budget.
A disk catalog runs in WAL mode with no journal_size_limit, so after a
burst of writes the -wal file keeps its high-water size for as long as
the database is open (#10714). The limit is a per-connection pragma and
the pool opens up to MaxOpenConns connections, so it rides the DSN the
way busy_timeout and foreign_keys do rather than a single Exec that
would reach only one of them. 4 MiB leaves ordinary checkpoints alone.
Relays that re-serialize tool schemas emit `required: null` for an
object schema that omits "required", and the upstream validator rejects
the whole request with "null is not of type 'array'" (#10614).
context_budget is one such schema on this branch, and any MCP or plugin
tool may be another, so the fix sits in canonicalization rather than in
each tool: a root object schema gets an empty array when it has none,
including after an invalid non-array value is dropped.
This changes the tool block of the cache-stable prefix once (golden
ToolsHash/PrefixHash regenerated); the budgets rise by the bytes the
array costs: provider-visible 3700 -> 3708 tokens, built-in 6767 -> 6787.
Ctrl+V (Alt+V on Windows, whose terminals keep Ctrl+V for their own text
paste) reads the clipboard of the machine the terminal runs on. An image
goes to the kernel through /attachments and stands in the composer as
[image #N], sent as the @-reference it was stored under; without one the
clipboard's text comes in the way a terminal paste would, which is also
how a console without bracketed paste gets a paste folded.
internal/platform/clipimage reads the image through what each platform
ships: osascript, Windows PowerShell, wl-paste or xclip. A tool that cannot
say what the clipboard holds counts as offering no image rather than being
told apart by the words of its error, since either way the paste falls back
to text.
The inline renderer places a print by scrolling it in above a frame it
takes to sit at the bottom of the screen, and places each print from where
its last redraw left the frame. A restored conversation arrived as dozens
of prints with no redraw between them, on a screen the frame did not yet
fill, and landed interleaved with lines lost. A commit now goes out as one
print, split into pieces that fit above the frame with a redraw between
them, and a replay first fills the screen so the frame starts at the bottom.
The cancelled-turn, compaction, shell-busy, stream-reload and declined-
question lines now come from the i18n catalog.
Full screen, a shell call's output shows its ten-line preview with a
"more lines (Ctrl+B)" row, as in 1.x: Ctrl+B opens the newest one up to
200 lines and shuts it again, and a click on that row does the same. A
settled block keeps the row it draws, so opening it redraws only that
block. A drag held against the viewport's top or bottom row keeps
scrolling the selection until it leaves the edge or the transcript ends.
A bare -r opens the saved-session picker on the first frame, and /resume
opens it mid-chat, as in 1.x: typing filters, the open session is marked
and skipped by default, and choosing one binds the runtime to it through
/resume and reads it back. /resume and /mouse are offered in the slash
menu beside the kernel's commands. /sessions dates each entry, and moves
to its own file.
The TUI's event sink now carries the configured system notifications, as
the 1.x chat screen's did.
The transcript is drawn through its own viewport, as 1.x drew it: a
scrollbar in the last column, the wheel, PgUp/PgDn and Ctrl+Home/End,
dragging the thumb, and drag-to-select that copies on release. Settled rows
keep how to draw them, so a resize rewraps them. /mouse hands the mouse
back to the terminal for its own selection, and --inline writes the
conversation into the terminal's scrollback instead.
Users coming from 1.x meet the screen they know: the banner and tip, an
accent-framed composer with the ❯ prompt, the mode tag on its colored
ground, the footer's model/effort group and its cache, context, fold,
balance and cost row, a "本轮" usage line under each request, the ▎
thought marker, the ⎿ tool summaries, the To-dos panel, and approvals and
questions as selectable panels in place of the composer. Labels come from
the shared i18n catalog, so the screen speaks the configured language.
Shift+Tab steps ask, auto and plan; Ctrl+Y toggles YOLO.
The terminal UI reads as a product rather than a log: a welcome card names
the model and workspace, the composer sits between rules with a placeholder,
a running turn shows what it is doing and for how long, the status bar
carries a mode badge and a context gauge, approvals and questions are boxed
with their keys standing out, and the user's own lines are a band.
The theme is now read from config before the program starts; it was left at
the built-in default.
A message frame that arrives after the call which closed its answer now
settles that answer instead of appending a second copy, which printed every
answer before a call twice.
The page listed every model as a card to click for the primary model,
then drew the per-task roles as a second set of dropdown cards below it,
so choosing what runs where meant reading two layouts that said the same
kind of thing. The 1.x desktop app put this in one table, and #10761 asks
for its layout back.
Each use is now a row: what it is for, a select of the models that can do
it grouped by service, and the service that model goes through. The
default model's row also lists what that model declares: image input,
adjustable reasoning, context size. Roles that follow the default say so, and
decision says it has no source rather than offering chat models. The two
settings rows it replaces become one, 按用途选择模型; reasoning effort
and context upkeep stay below it.
The card list and the role picker are gone with their styles. The
services page now works out its default selection while rendering, so
it no longer flashes an empty detail before the selection lands.
Settings kept every model setting on one long page: the source list with
an editor that unfolded inside it, the primary-model list below that, and
roles and context after. Adding or changing a service meant finding the
right row, opening it, and scrolling past the rest. The 1.x desktop app
split this into 模型服务 and 模型偏好 with a list-and-detail layout, and
users asked for that back (#10761).
模型服务 is now its own section. Services are listed on the left, with a
search once there are six or more and 添加模型服务 at the foot; the
selected service's fields are open on the right without a second click,
and adding a service takes the right side while the list stays in
place. The page opens on the service in use, or on the one the composer
sent the user to declare effort levels for. At narrow widths the list
stacks above the detail.
The remaining section is renamed 模型偏好 and keeps the primary model,
reasoning effort, per-task models and context upkeep. The composer's
manage-models entry, its effort-declare link and the palette entry now
open 模型服务.
The composer's permission menu and Settings each kept their own table of
the four approval modes, and they drifted: the menu called ask 逐项确认
and auto 自动继续, Settings 询问 and 自动, the shelf 自动批准, and the two
lists ran in different orders. Users read the menu's 逐项确认 as a mode
Settings did not have.
approvals.ts is now the one table. Menu, Settings and shelf all say
不询问 / 询问 / 自动批准 / 全部放行, ordered from strictest to most
permissive, with the same descriptions.
In a narrow conversation pane the menu opened rightward from its trigger
and ran off the screen. There it now spans the toolbar row instead.
- Questions: an open ask is answered one question at a time. A digit
answers a single choice or toggles a multi choice, typed text joins the
picks as an answer no option offered, Esc declines with nothing
selected. The card left in the scrollback says what was answered.
- Completion: `/` at the start of a line and an `@` token open the
kernel's menu as they are typed, Tab asks anywhere. Offsets cross
/complete in UTF-16 both ways, so a line with CJK before the token
splices where the kernel meant; a directory keeps the menu open a level
down.
- The task list is re-read from /todos when the kernel says it moved and
drawn while it has work left; a finished list goes away.
Found running against a real model: a thought-only step and whitespace-only
answers printed an empty speaker header; option and menu rows lost their
indent to the row-shortening helper; the receipt read the verdict "done"
as unfinished.
A `!` command ran and was shown, and the model never saw it: the next turn
had no idea what the user had just looked at. RunShell now follows the
command with a turn whose input is the command, its exit code, any launch
error and its output, so the model responds to it the way it would to a
line typed to it.
The output is bounded at 24 KiB, cut from the middle with the cut said, so
a large listing neither fills the context nor reaches the model looking
complete. A command the user stopped is not followed by a turn, and neither
is one run where no model is attached. The ACP `!` prompt now ends after
that answer.
Expanding a folder in the explorer walked the whole workspace and kept
the entries whose parent matched, so one folder the process could not
read anywhere in the tree failed every expansion with a 500, and a large
tree made every click slow; the root listing, which skips into nothing,
kept working, which is why the list drew and its folders never opened.
The explorer drew that error in the file view's slot, which the docked
file list hides, so the click looked like it did nothing.
A folder listing now reads that folder alone, and its real path is held
inside the workspace so a link cannot list what is outside it. A search
still walks the tree and passes over a folder it cannot read. A missing
folder answers 404 workspace.file_missing, a linked-out one 400.
The explorer now shows its own failures in the file list. Reloading the
tree, which happens when the changed files change after a turn, reads
the folders that were open again, where it used to fold them all shut.
Checked on Windows against a workspace with a folder denied by ACL: the
folders beside it open, the denied one reports in the list, and an open
folder stays open through a reload.
The second layer of the terminal UI: the program a person operates, on
top of the client, stream and transcript.
- `reasonix tui [--model] [--preset] [--dir] [-c] [-r QUERY] [prompt]`
assembles the kernel the way `reasonix serve` does, adopts it into a hub
and drives it through Hub.InProcessClient: no port is opened. The kernel's
logging goes to ~/.reasonix/logs/tui.log while the UI owns the screen.
- Rendering keeps the terminal's scrollback: every settled row goes above
the program in the order it happened, and a streaming answer's finished
Markdown blocks go as soon as they are final (nothing inside an open
fence). What is still changing stays in a live region capped at half the
screen, each row cut short of the terminal width so none wraps into a row
the renderer does not know it drew.
- Input: Enter sends, or queues while a turn runs; Ctrl+S steers; Ctrl+J
(or Shift+Enter where the terminal reports it) is a newline; Esc
interrupts; `!` on an empty line is shell mode; Shift+Tab cycles the
approval mode; Ctrl+C twice or Ctrl+D on an empty line quits. Large pastes
fold into a token and go to the model whole. Approvals take only the
answers the host says it honours; plan approvals map to start, revise or
leave.
- The transcript seats a turn on the message it began on, the way Studio
does: a queued follow-up moves to where its turn started, steered input
waits for its steer event, and another client's turn is drawn once from
the kernel's text. Restore rebuilds from /history for -c/-r and after a
stream gap.
cli.go's argv normalisation moves into normalizeCommand so the dispatch
switch keeps one case per command within its complexity budget, and `tui`
joins the shell-completion registry.
The theme, colour profile, Markdown/math renderer, tool cards, diff view,
assistant block and clipboard writes move out of internal/frontend/cli into
internal/frontend/termrender, so a terminal frontend other than cli can draw
the same bytes without importing cli. cli now calls termrender for every
style, width, box and Markdown helper; view_helpers.go stays in cli.
termrender exports the surface a frontend draws with: Bold/Dim/Green/Red/
Yellow/Accent/Reverse, VisibleWidth/PadRight/Boxed, ConfigureTheme,
ConfigureThemeFromConfig(ForTTYOutput), ActiveTheme/ThemeName and the
ThemeStyle/ThemeFg/ThemeLipColor/ApplyTextareaTheme helpers over an exported
Palette/Color, RenderMarkdown and MarkdownRenderer, AssistantBlock, ToolCard/
ToolDot/ToolHead/ToolArg/ToolDisplayName, DiffBlock/DiffStat, CopyToClipboard
with ClipboardCopyMsg, ANSIConsoleReady and SetColorProfile.
Transcript helpers nothing calls (edgeScrollDir, selSpan, scrollbarThumb)
are dropped with their tests, and the clipboard message loses the seq and
status-hint fields no caller set. The metadata-command test now asserts that
version/help never reach the TTY theme setup, through a cli-side seam, since
the terminal probe it used to swap is termrender's.
The repolint baseline diff is the moved files' prior essay debt carried to
their new paths (mathnode.go, md.go, width_test.go; transcript.go's is paid
off), plus orphan budget for the eight exports whose consumer, the new terminal
UI, is not in the tree yet (ToolCard, DiffBlock, AssistantBlock,
RenderMarkdown, CopyToClipboard, ApplyTextareaTheme, ThemeName) or which only
a cli test drives (SetColorProfile). Wiring the UI reclaims that budget.
normalizeNullRedirects treated a backtick as an escape inside any quote,
so in echo 'a `' >nul the backtick swallowed the closing single quote,
the string never ended, and the real >nul after it was left alone; under
bash that writes a file named nul. Single-quoted text is literal in both
bash and PowerShell, and the backtick is PowerShell's escape only inside
double quotes, which is where the backslash case already applied.
The new cases also cover the escaped-quote branches, which had no test:
the sandbox package fell to 77.6% against its 78.1% coverage floor on
the lint job, three statements short.
fc3a44dbc moved jobs from internal/runtime to internal/tools, and the
pull-request race step still listed ./internal/runtime/jobs/..., so every
pull request's race job failed with setup failed on a directory that no
longer exists. Pushes run the full ./... sweep and never saw it. Every
other path the workflows and the Makefile name still exists.
* fix(pricing): bill Chinese public holidays as DeepSeek off-peak
Port of the main-v2 holiday fix (#10756) to the studio pricing package,
which moved from internal/billing to internal/contract/pricing and now
carries the peak schedule in PeakWindow. The holiday table rides the
same struct field pattern as WeekendOffPeak: PeakWindow.HolidayOffPeak
lists Beijing-local dates off the State Council 2026 notice, and
IsPeak flattens them like weekends. Make-up workdays (调休) stay
off-peak: they are calendar weekends, which is how DeepSeek rules them.
* chore(pricing): keep the holiday comments within the repo's comment rules
English only and within the essay budget; no behaviour change.
---------
Co-authored-by: nanami-0713 <[email protected]>
Co-authored-by: yhh <[email protected]>
The first layer of the new terminal UI, which drives a session through the
same HTTP/SSE contract Studio uses and imports nothing from the controller:
- Client: typed calls for the routes a chat needs; a refusal carries the
kernel's code (APIError), never only its sentence.
- Subscribe: /events with Studio's ordering — numbered frames delivered once
and in order, a jump filled from /events/replay before the frame that
revealed it, what the replay no longer holds reported as a gap, a
backwards count read as a restarted stream, a reconnect resumed with
Last-Event-ID.
- Transcript: the fold of Studio's session reducer — the settled message
repairs the streamed answer, one card per call with sub-agent calls under
their task, prompts settled here or by the kernel's receipt, pending input
moved to where the turn read it, and turn_done saying which of four ways
the turn ended.
An end-to-end test drives a real kernel behind an in-process hub through a
turn that streams, waits on an approval answered through the client, runs a
command and ends settled.
The editor is a frontend in the kernel's process, like the terminal UI
the in-process serve client exists for. A prompt that starts with `!` now
runs through RunShell instead of going to the model: it streams back as a
tool call and ends the prompt when the command finishes; cancelling the
prompt cancels the command.
Hub.InProcessClient reaches the hub's routes with no listener: a frontend
in the kernel's own process opens no port, so there is nothing on the
machine or the network to authenticate against. Responses stream through a
pipe as the handler flushes, so /events works through it.
A `!` line on /submit is the user's own shell command, which runs
unconfined. It stays refused off a socket (shell.unavailable_over_http);
through the in-process transport it runs. The transport marks the request
context itself, and no request read from a socket passes through it, so the
grant rests on which way the request came in rather than on anything it
carries.
Every ended job drew the same green pip and printed the kernel's raw status
word. Only done is green; failed is red, killed and interrupted are neutral,
and each is labelled in the reader's language.
The background-jobs deck listed jobs with no way to stop one: the controller
had CancelJob, but no port carried it and serve had no route. BackgroundJobs
joins SessionAPI, POST /jobs/{id}/cancel drives it and refuses a job that is no
longer running as job.not_running, and each running row gets a stop button.
On touch the deck could not be closed: it opened on :hover and :focus-within,
which a tap leaves set, so the chip's own toggle had no effect. Hover opening
is now limited to hover-capable pointers, and a press outside or Escape closes
it; the context card gets the same treatment.
The meter rail did not fit a phone: the chip ran past the edge, and tapping it
scrolled the overflow-hidden .app sideways, dragging the composer with it.
Narrow panes drop the sparkline, wallet, speed and (narrowest) cost readings,
the two popovers position against the rail instead of their chips, and .app
clips rather than hides so focus can no longer scroll it.
perf/composer.mjs counts only visible peers as overlapping the model button.
bypassed() matched only exact entries and a leading "*". The bypass list
Clash, v2rayN and xray write by default is `<local>;localhost;127.*;10.*;
...;192.168.*`, so every trailing-wildcard entry missed. It also lacked
WinINET's implicit rule that loopback goes direct unless `<-loopback>` is
listed.
In the default auto mode, on Windows with such a system proxy, requests to
local and LAN model endpoints went through the proxy: Ollama or LM Studio
on 127.0.0.1, vLLM on 192.168.x. That added a hop, failed outright when the
proxy routed to a remote exit, and made a cancelled stream keep the local
model generating. Cancel closed only the client-to-proxy hop, and the proxy
held its upstream connection open.
"*" is now a wildcard anywhere in an entry. Only "*" is special, and
brackets are trimmed from IPv6 entries. localhost, 127/8 and ::1 bypass
unless `<-loopback>` is present. TestBypassed gains the trailing-wildcard,
near-miss, mid-pattern and loopback cases; it fails on 8 of them without
the fix. The same change lands on main-v2.
The CLI had no install channel on the 2.x line: release-studio.yml builds the
CLI archives for Studio's remote installs, and npm's `reasonix` and the
Homebrew tap were published only by the retired 1.x release machinery. The
2.x line now takes both over, and 1.x no longer publishes the CLI.
A cli-channels job runs after the release is published:
- npm: the existing npm/build.mjs builds the per-platform packages and the
launcher and publishes them through publish.mjs's staged dist-tag flow. A
2.x version outranks every 1.x one, so `latest` moves to it; a candidate
goes to `next`.
- Homebrew: scripts/render-brew-cask.sh writes the cask from the digests in
the release's own SHA256SUMS — a missing digest fails the render rather
than shipping an empty one — and the job pushes it to
esengine/homebrew-reasonix. Candidates leave the tap alone, since brew has
no prerelease channel.
The Studio release carries the CLI archive too, listed first. Double-clicked
from Explorer, bare argv printed the usage and exited, and the console window
Windows opened for it closed with it, which read as a crash. When this
process is the only one attached to its console, it now names Studio's
installer and waits for Enter; from a shell nothing changes.
The usage examples dropped bare `reasonix`, `--continue` and `--resume`, which
only print the usage on this line.
LAYOUT.md: three list items split to stay under the prose width.
Every workspace holding a warm runtime drew a raised box, so four rows read as
four selections and people asked how to close them; the kernel already retires
idle panes at capacity. Only the workspace of the active session keeps its
emphasis, and a session held by a pane keeps its pip.
The project row's × removed the project from the list but sat next to + where
it read as "close". It is now a ··· menu (workspace.menu) whose one item leads
to the existing confirm.
The coverage job installs no bubblewrap, so an enforced bash sandbox refused
the background job and the test read no job at all. It measures how a job's
end is attributed, not where it runs.
Product:
- Tool cards wrap their head in details.tool-disclosure, so the hit highlight
and the failed-call peek never matched them; both selectors now reach it.
- Light --faint fell below AA on every raised ground and overrode the tiered
tokens; darkened by lightness only. Segments and the new-task shortcut sit on
--overlay and read --muted. Hard-coded crumb separator, delta and failed
state colours now use tokens; the approval tool tag uses --warn-ink, the
running step reads a darker --net, and the failure pill mixes its ink
towards --text so it clears AA in both schemes.
- The local workspace row's remove control is the same Cross icon the remote
rows already draw, not a text glyph.
Guards: retargeted to the current markup (model picker trigger, tool
disclosure head, context card MCP rows, wallpaper section, queue and plan
controls), dropped checks for the removed task board and focus mode, and the
wallpaper reach is measured with the dim overlay cleared. All 22 exit 0 and
selfcheck shows each can still go red.
Run — the synchronous turn `reasonix run` drives — never took the turn gate
the guarded paths check. A turn admitted through the gate, such as the
inbox delivering a background job's end, could therefore start on the same
executor while Run was mid-turn, and the two wrote the task state together:
the race TestEffectRestartNamesWhyABackgroundJobEnded tripped on CI.
Run now admits through runSynchronousTurn, as RunTurn does, and waits out a
turn already in flight rather than failing: after a resume the host may
dispatch a job's interruption before the caller's first Run. Its turn
completion is recorded once, by the admission, instead of twice. Cancel()
now reaches a headless turn as it does any other.
The restart test's scripted model started a new job on any turn it did not
recognise, which the interruption delivery now visibly is; it only
acknowledges such turns.
Run against studio's own stylesheet, the browser guards reached parts of the
window they had never measured.
- A collapsed column is inert, not only narrow. The rail was inert only in
focus mode and the workbench never, so Tab walked into controls nobody
could see and scrolled a column of zero width to show them. Both are inert
while collapsed, and the workbench stops painting once its collapse ends.
- Focus mode is gone. Its only way in was removed with the side column in
the studio redesign; the state, the Escape branch, the action id and the
layout notes that described it are removed with it.
- The queue's withdraw control lost its enlarged hit area when it moved from
the transcript into the queue panel: 19px tall. It gets the outward
::after back, 29px.
- Switching to the run analysis gave the transcript and the docked workbench
the same view-transition name, so the browser aborted the transition and
the rejection went uncaught. The docked workbench no longer takes the
name; it keeps it when it is the tab being switched to. A transition the
browser skips is not an error.
- The studio composer's own chrome is taller than the one the queue's
shared ceiling was set against, so 64 queued lines left the transcript at
36-39% of the pane. Studio lowers the ceiling (28vh, 19vh when short) and
the transcript stays above 40%.
The egress grant test sat between TestEverySubjectSensitiveToolActuallyAsksSomething
and its comment, which read as one six-line block. Windows has no /tmp and no
sandbox that reaches the proxy on a socket.
On Linux the list only warned: bubblewrap either kept the command's network
namespace (no network at all) or dropped it (all of it), and a separate
namespace cannot reach a proxy on the host's loopback.
The command now keeps its namespace, which has no route out. The egress
proxy also listens on a Unix socket under the user's cache, mounted
read-only into the sandbox, and the host binary runs inside the namespace
as the egress bridge: it listens on the namespace's 127.0.0.1:<proxy port>,
carries each connection to the socket, runs the command, and returns its
exit status as a shell would. HTTP_PROXY and friends need no change. The
bridge is an entry of whatever binary imports the sandbox package, chosen
by an environment variable it clears before the command starts, so no
helper has to be shipped or found.
The host's own loopback is out of reach from the namespace, so a local
proxy cannot be used to go around the list. A route with no socket keeps
the namespace shut rather than falling back to open.
The bridge's forwarding and exit status are tested on any Unix; the
namespace boundary and the end-to-end refusal and approval run where
bubblewrap is usable (Linux CI).
A host the egress list does not name was refused outright. Where the
frontend can ask, the proxy now holds the connection and asks through a
network_egress approval whose subject is the host: allow once (for that
command), allow for the session (that host only), or decline. A declined
host reaches the model as declined-by-user rather than blocked-by-allowlist.
- network_egress is declared subject-sensitive in permission, so a person
answers whatever the approval mode, an unattended session refuses, and a
session grant names the host it covers. Before that declaration a grant
for one host answered for every host after it.
- The controller's sandbox approver also answers ApproveEgress; bash finds
it on the tool context the escape approver already rides, so nothing
below the controller grew a new channel. Headless runs have none and keep
refusing.
- Each command asks once per host, one question at a time, and a token's
asker ends with the command. Denied hosts are never asked.
The guard asserted that the border glow runs while a turn runs; studio's
design removed that glow, and its running signal is the run mark's R being
traced (studio-r-run). The three directions stay: still at rest, moving
while running, still again after.
It also flagged the mark's straight stroke as drawn on nothing, because an
SVG shape's box leaves out its stroke and a straight line has no area. An
SVG shape is now judged by its drawing's box.
In the light theme the new-session button and the session filter segments
were separated from the sidebar by fill alone, a 1.8 step in OKLab
lightness, and the button had its border removed: neither read as a layer.
Both now mix 3% of the text colour into their fill, in light only.
Each session row reserved 34px of its title for the menu button and drew
the button at zero opacity until hover, so every title was cut short for a
control nobody could see. It now rests at 35% and comes up on hover, focus
and selection as before.
In a conversation narrower than 460px the ask card's actions stack, and they
stacked in DOM order: "reply without choosing" above the primary answer.
The approval card already leads with its main action there, and the cards
guard holds both; the primary button now takes the first row.
The refine button is disabled until there is a draft, yet its icon still
showed a pointer and it lifted on hover, reading as something to press.
A disabled mode button keeps its tooltip but takes the default cursor and
does not lift.
Network in the bash sandbox was one bit: open to everything, or shut. With
[sandbox] allowed_domains set, bash's external traffic goes through a
host-side proxy (internal/safety/egress) that admits only the listed hosts;
denied_domains outrank them.
- The proxy serves CONNECT and absolute-URI HTTP on loopback, decides from
the requested name, refuses names that resolve only to loopback,
link-local, metadata or this host's own addresses, and chains through the
upstream HTTP or SOCKS5 proxy the environment names.
- macOS: the Seatbelt profile shuts every destination but loopback, Unix
sockets and the proxy port, and closes the loopback ports of the proxies
the environment and the system proxy settings name. Loopback stays open
so tests and dev servers keep working. Bind, inbound and outbound are
separate grants, because (local ip "localhost:*") on network* matches the
local end of every outbound connection and admits all of them.
- Each confined launch carries a token as proxy userinfo; what the proxy
refused under it is appended to the bash result by the host, so a policy
refusal reaches the model as one instead of a bare connection error.
- The list only narrows open network: it applies where network is on and
the sandbox confines; a repo may set one only where the user has not, and
its denials only add to the user's.
- Linux and Windows warn that the list is not enforced there.
Known gaps, stated where they live: a host proxy on a loopback port nobody
declared stays reachable, name lookups still reach the system resolver,
the decision reads the requested name (domain fronting is not caught), and
MCP servers are not routed through the proxy.
internal/safety/egress is declared sensitive, with its coverage floor.
The window's error bar sat in the main column under the panes: every failed
request pushed the composer up by the bar's height, as a full-width strip at
the far end of the screen from most of what fails.
It now floats. The pane in front carries it on a zero-height anchor pinned to
the top edge of its composer card, at the right: it never moves the
conversation, rises with the card as the prompt grows, and stays clear of
the send button. With no pane on screen it takes the main area's corner. Its
fill is mixed into the surface, since it now sits over content.
perf/errbar.mjs holds the geometry at two widths: the bar appears and takes
clicks, sits above the card, leaves send clickable, and does not move the
composer. It reaches the bar the way a real failure does, through a hub
method the bench can now refuse. Against the old in-flow bar it fails on the
composer moving 45px and on the bar sitting below the card.
main.tsx has loaded studio.css since the studio interface landed, and the
perf harness never followed: every browser guard since has measured a page
without the studio layout, with the composer at the top of the window and
the sidebar unstyled. Run against the real layout, fifteen guards still
report failures; four of them (cards, idle, press, surface) were passing
only because the layout was missing, and contrast and pick stop failing.
host_authorities is user-global: loadForRoot holds the user's value and puts
it back after the project reasonix.toml merges. The held value was the slice
header, and decoding the project file writes into the backing array the
user's decode left behind, so the held copy read back the repo's list. A
cloned repo declaring host_authorities = ["docker"] got the container daemon
socket inside the bash sandbox — with an explicit user grant and with the
default one alike.
The held value is now a copy.
RewrittenTestCriteria read Go test files only, so a Python run that moved
its own expectation reached the completion summary, the best_of_n judge and
the integrity bench with a clean record.
pytest modules are now read by pytest's default collection contract
(test_*.py / *_test.py, module-level test* functions, test* methods of
Test* classes). Bodies come from Python's own line structure — the
indentation stack, bracket joining, whole strings — and compare as token
signatures, so reformatting, comments, docstrings and formatter trailing
commas do not read as rewrites while a changed expectation or parametrize
case does. Source that does not lex claims nothing.
Detection only: holding a criterion is still Go-only, now enforced at
captureRewrittenCriteria too, because no backend re-runs a captured Python
test and holding one would owe the turn a baseline run nothing can settle.
Opening the card refreshed the share status and, in the same commit, minted
a pairing code on the status it already held. When phone access had been
turned off elsewhere since, the mint reached the kernel first and was
refused as share.closed, and the window's error bar told a person who had
only opened the card to "turn phone access on first".
Opening now waits for the read and mints only when the door is open and no
live code is held. A failure inside the card is said inside the card, under
its header, and clears when the card closes, rather than landing in the
window's error bar at the far end of the screen.
Each candidate kernel already emitted a CompletionSummary at turn end —
verdict, checks passed/failed/suppressed, review, gaps, and existing tests
it rewrote or removed — but the candidate sink forwarded usage only, so the
judge compared attempts on their final message and diff alone.
candidateSink now keeps the last summary per attempt; the judge sees it as
a host record the attempt cannot write, and the parent's report carries it
per attempt. A failed check counts against an attempt, and one that
rewrote tests the task did not ask to change is suspect however green.
Discovery searched /Applications as a literal, so the tests that stand for a
machine with no editor could not build one: on a Mac with VS Code installed
TestDiscoverRefusesWithAnIdentityWhenNothingIsInstalled found it,
TestInstalledPathsAreSearchedBeforePath found it before the placed copy, and
serve's TestEditorOpenSeparatesMissingFromFailedToStart launched it against
a controller with no workspace and got a 500. CI runners have no editors, so
all three were green there and red on a developer's machine.
Discovery now reads the machine through a host value: the OS, the
environment and the system application folder. Discover passes the real
one; the editor tests pass an empty folder. The serve test no longer tries
to empty the machine at all: an editor the user configured that does not
exist is the missing class everywhere, and it reaches the same refusal.
The sidebar's version rows had no rendering test: the expander, the label
and opening the version's own path are now exercised through the real
Workspaces component.
The lease-alignment race posted to /fork, removed with explicit forking, so
half of it only collected 404s. /new rotates the active path through another
handler, which is what the race is for.
Editing an earlier message, regenerating a reply and rewinding the
conversation all truncate the transcript, and only the latest one could be
undone. What was said before the cut was gone.
A conversation rewind now saves what it is about to cut as a version of the
session: a whole session file, marked Superseded with the session as its
parent, left out of every session list so it never reads as a second
conversation. The Studio sidebar hangs versions under their conversation in
the same expander as recovery copies, labelled apart, and each opens as a
whole conversation. A version someone carries on becomes a conversation of
its own: the first save that adds a turn clears the mark and keeps the
parent. Undoing a rewind drops the version that now duplicates the restored
conversation, judged by content so it holds after a restart. Removing a
conversation removes its versions. Keeping a version is a record, not a
precondition: a rewind that cannot keep one still happens.
NewSessionPath moves to session_path.go to keep save.go inside its budget.
Closing the manager cancelled every running job the same way kill_shell
does, so a job read after a restart came back as killed. Nobody killed it:
the process running it ended, which only the host knows, and a bare "killed"
left the model to guess between that and a stop someone asked for.
A job cancelled because its manager is closing now ends Interrupted, the
status an abandoned record already repairs to, and one stopped by Kill stays
Killed. bash_output and wait render the cause after an interrupted status.
The tool descriptions are unchanged, so the cached prefix does not move.
The boot-level restart test starts a background job, restarts, and reads
it: a restart cannot keep the job alive, but the model is told why it ended.
Status and its cause move to status.go.
The store kept pending results in memory and removed every worktree when the
session closed. A restart between delegating an isolated task and applying
it lost the work, and the refusal that followed said no result was pending,
a claim the host could not know was true.
The worktree is now the result and the store only indexes it. A finished
run writes an entry mark beside its worktree naming the id, the workspace
and the snapshot; what it changed is derived from the worktree on every
read, so no stored tree can outlive the objects it names. A lookup the
memory misses is recovered from disk, closing a session no longer removes
anything, and a result ends only when applied or discarded. Results taken
from another workspace are never offered, since applying one would write
into that workspace from this one. Unsettled results older than fourteen
days are swept at boot, and only directories carrying the mark are touched.
The boot-level restart test delegates in one turn and applies in the next,
with and without a restart between them, and both arms now land the file.
A goal resumed after a restart re-demanded inspection, verification and
sign-off for a change that had all three before the process ended: their
receipts lived in the ledger, which does not cross the boundary. It was
fail-closed but not restart-equivalent, and every restart cost a re-run.
The delivery checkpoint now carries Proven: what the turn's last readiness
verdict had proven for the pending change, with a content fingerprint of
every path the scope changed. On resume, with no new write in this process,
the proof discharges what it covers, but only while every path still holds
the content it was earned on. A path edited or deleted while no process was
watching voids all of it, which is more than an uninterrupted run can see.
A change with a part the host cannot name carries no proof at all.
The verdict is recorded where the turn asks to stop, so the checkpoint reads
the same derivation the gate used rather than a second one. The Delivery
branch of the readiness check moves to appendDeliveryGaps to keep the
function inside its complexity budget. The restart harness no longer pins
any stricter step: both arms now owe exactly the review.
The repository now describes the two lines the version roadmap announced
(discussions/10748): 2.x on studio, 1.x on main-v2 in maintenance.
- README (en, zh-CN): a Versions section and a Studio 2.x release badge.
Install leads with Reasonix Studio 2.x from the studio-v* pre-releases,
with the 1.x CLI and desktop app beside it as the stable line. The
zh-CN build-from-source section gains the Studio build it lacked.
- Issue forms offer 2.x / 1.x / 0.x, and the labeler maps them to v3 /
v2 / v1, with the pasted version still overriding the dropdown. The
forms link the roadmap. The PR template and CONTRIBUTING say which
branch takes which changes.
Issue forms, schedules and Dependabot are read from the default branch
only, so these take effect when studio becomes it:
- CodeQL scans pushes and PRs on both lines, and the weekly scan checks
out each line and files results under its own ref, so 1.x keeps its
security scanning.
- v1-maintenance-schedule starts main-v2's nightly app-memory and
diagnostic-overhead monitors, which measure the 1.x desktop app, on
main-v2.
- Dependabot drops /desktop/frontend and /site, which do not exist on
studio, and covers /desktop/frontend-next and /desktop/electron. It
also names main-v2 as a target for patch updates only.
layer-order ranked model, tools, safety, ext, state and platform as one peer
pool that could import freely inside itself, so state -> tools or
model -> platform passed the gate and nothing held the directory graph
acyclic. The pool is split into the order the tree already follows
(safety/state, model, platform, ext/tools), and a package now imports only
its own directory or a strictly lower rank. The tree needed no change.
The structured review a high-risk change owes was derived from mutation
receipts in the evidence ledger, which has no persisted form. A goal
restarted between its turns resumed with an empty ledger, derived nothing,
and completed without the review. The restart-equivalence tests showed it
through the real boot and the controller's own resume.
The delivery checkpoint now carries OwedReview: the review kinds a change in
its scope still owes and the paths a review has to cover. Each turn's
checkpoint joins what the live ledger derives with what was carried in and is
still unsettled, so a restarted ledger deriving nothing is never read as a
discharge. The gate owes a carried review until a review of that kind covering
those paths lands; one kind does not settle the other. The live derivation is
unchanged and shares one helper with the checkpoint, so an uninterrupted run
is held exactly as before.
The restart harness now fails any step where a restart owes less than an
uninterrupted run. What a restart still re-demands — inspection, verification
and sign-off, whose receipts do not cross the boundary either — is fail-closed
and pinned as known, and the boot-level test asserts both arms end blocked.
The production form of the restart-equivalence harness: two real boots, the
session resumed from its file the way --continue does, and goal turns
submitted the way a window submits them, so they carry the goal's delivery
scope. The scripted model acts on milestones rather than turn counts, and
every reply spends budget, so a goal that cannot finish stops on its own
token budget as a real one does.
A high-risk change (a path the project declares sensitive) is made, checked
and signed off, with no review. Uninterrupted, the goal stays blocked and the
host keeps demanding the review. Restarted between its two phases, the
resumed goal is never asked for one and completes. Each arm run in its own
process gives the same result, so no package state carries between them.
The review obligation is derived from mutation receipts in the evidence
ledger, which has no persisted form: the goal sidecar carries only the
DeliveryCheckpoint. The case is pinned as a known divergence so the fix turns
it red.
Past IndexMaxChars the listing was cut mid-rune: with 91 skills only 35
lines survived whole, the other 56 were invisible to the model, and the cut
could leave half an identifier to call. The listing now degrades to names
only, cut whole-line with a count of what it left out, and points at
use_capability search for descriptions. A catalog under the cap renders the
same bytes as before.
No per-turn retrieval over the user's wording: ranking by prose would hide
skills inside a gate. The model asks through the existing capability search,
whose keywords now include the triggers a skill's author declared.
Stopping the process at a turn boundary and resuming must leave the host
deciding exactly what it would have decided had it kept running. The harness
plays a scenario twice, once in one agent and once through a restart after a
chosen step, and compares the readiness verdict of every step. The restarted
arm is built as a resume builds it: a fresh agent with an empty ledger, the
transcript, and the DeliveryCheckpoint after a JSON round trip, which is all
the goal sidecar carries; the controller's own restore of that checkpoint is
established by goal_resume_project_check_test.
A signed-off ordinary change agrees across a restart. A high-risk change does
not: the uninterrupted arm owes structured_review at every later step, while
the restarted arm owes re-verification and sign-off instead, and once those
are redone it finalizes with no review at all. The review obligation is
derived from mutation receipts in the ledger, and the ledger does not cross
the boundary. The case is pinned as a known divergence, so the fix turns it
red and takes the mark off.
With [agent] worktree_isolation on, task takes isolation "worktree". The
sub-agent then runs as an unattended kernel of its own, rooted at a fresh
worktree of the workspace as it is now, and nothing it writes reaches the
workspace. Its result lists the changed paths under an iso_ id, and the
parent settles them with apply_isolated or discard_isolated.
apply_isolated declares every path it writes, so the host reserves,
checkpoints and records them like any other write, and it applies path by
path: a path the workspace changed meanwhile refuses the whole apply by code
and keeps the result. A workspace git cannot snapshot is refused with
isolation.not_git; isolation is never faked with the shared workspace.
The child runs under the session's own approval posture, read when it starts.
It has no one to ask, so a session that asks gets a child that refuses what
needs approval, and nothing it does exceeds what the session would do
unattended. Arguments a separate kernel cannot honour (profile, tools,
write_paths, continuation, background) are refused rather than dropped. The
child offers neither isolation nor best_of_n, and the settlement tools are
hidden from sub-agents. Closing the session removes every worktree it holds.
best_of_n's attempt runner is shared as runUnattended, and task's name,
description and schema move to task_schema.go.
The host observes a write through Previewer, which describes one file. A
writer that changes several paths named nowhere in its arguments was left an
opaque writer: a coverage gap on the checkpoint, no preimages, and a receipt
with no paths, so neither rewind nor the evidence ledger could say what it did.
tool.WritePathDeclarer lets such a writer name every path before it runs. The
host reserves exactly those paths against background writers, captures each
one's preimage and after-fingerprint, and records them on the receipt. A code
rewind then restores a modified path and removes a created one.
Apply refuses unless the whole workspace still equals the snapshot, which
holds for best_of_n, where the parent waits, and never for a candidate that
ran beside a parent that kept editing. ApplyPaths judges each changed path
alone: the workspace's version is hashed through the same filters a snapshot
stages with, and compared against the snapshot's blob and the candidate's.
A path still at the snapshot is written, one already at the candidate's
version is left alone, and anything else is a conflict. One conflict writes
nothing, and the ConflictError names every path.
ChangePaths refuses a change outside the folder the snapshot was taken of,
and DiffStat gives per-path line counts for reporting a candidate.
tools/list, resources/list and prompts/list took the first page and ignored
nextCursor, so a server that paginates lost every tool past its first page
without any error. The three now read every page through one helper, bounded
at 64 pages; a cursor handed out twice is reported as a server loop rather
than served as a complete catalog.
The readiness gate read only the checks the current process declared. A Goal
restored into a process whose declaration had changed carried its captured
baseline in the delivery checkpoint, but nothing enforced it, so running the
replacement alone was enough to finalize. The Goal resume path was shown
reachable by goal_resume_project_check_test.
The gate now also owes every baseline check no current declaration names,
inside the delivery scope that captured it, anchored on the same write the
gate already uses. The trust-domain rule settles the authority question: the
workspace cannot supersede a captured criterion.
The full switch to ledger obligations is not taken: a resumed process starts
from an empty ledger, where the obligations owe nothing at all, so the switch
would open the resume path this closes. A restored checkpoint from another
scope does not bind an unscoped turn.
The 2.20.0 release spent 226s packaging Windows and 640s mirroring to R2.
Packaging compressed the same 245 MB tree twice, the 7-Zip archive and
then the NSIS installer. They now run at once; the zip reads its own copy of
win-unpacked because NSIS writes elevate.exe into the tree it packs, and a
zip read beside that would contain it or not by timing. A local cross-build
gives the same 128-file zip as the sequential step.
Defender real-time scanning is switched off for the Windows build, which
writes that tree several times over. continue-on-error keeps a runner image
that refuses the switch from failing the release.
The R2 mirror sent 18,755 delta chunks of about 10 KB with the AWS CLI's
default of 10 requests in flight, roughly 31 a second. Raising it to 64 leaves
the published objects unchanged.
The controller keeps the session in its finishing state while TurnDone fans
out, and Running() counts finishing, so the rig's done signal always arrives
before the session is free. A slow runner submitted the second line inside
that window and got busy.session_running, which the race leg reported as a
failure of the attribution it was testing.
Every MCP tool sat behind use_capability, so calling one cost a search and
an inspect before the call, and nothing let a user say "this server is used
every turn". A server now declares `load = "always"` (or `alwaysLoad: true`
in .mcp.json, a package manifest, or an installed mcpServers document), and
the user overrides it per server in [tools.mcp_load].
An always-loaded server's tools join the provider schema when the runtime is
assembled, and only when its schema is already known and the server is
authorized: a server discovered mid-session waits for the next assembly
whatever the discovery race, so one config and one cache give one schema,
and an unauthorized server stays behind use_capability where its approval is
asked for. The server is also connected in the background at assembly, so
the first direct call does not pay the handshake the loading saved.
Studio shows the mode as a tag beside the server and offers
deferred/always above its tool list. Switching writes the user config and
rebuilds the runtime in place, the same as the other settings boot reads,
because a new session reuses the runtime and would never see it.
The retired `tier` field was already stripped on load, which left the
eager/background partition, the slow-server demotion and the startup-latency
samples feeding it with nothing to act on; they are removed.
Any tool the classifier did not know was a proven mutation, MCP tools
included. So every non-read-only MCP call left a stale_verification
debt, even one that acted only on a remote system. The model then went
looking for a check to settle it: in a live run it tried to launch the
MCP server itself to "verify" a deploy.
A tool carrying MCP identity that does not name the paths it writes now
reports EffectsUnstated, read off its type through tool.MCPMetadata, the
same identity provenance reads. ToolCallMutationClassWith makes such a
call unknown rather than proven, which puts it on the path bash's
unclassifiable commands take: the workspace is scanned before and after.
Unchanged settles it as no mutation. A changed file is a proven mutation
with the observed paths, and owes its check as any change does.
TestEffectAnMCPCallOwesACheckOnlyWhenTheWorkspaceChanged drives both
through boot.Build: a call that writes nothing here owes nothing, and
one that writes deploy.log into the workspace owes the check. Without
the reclassification the first case owes stale_verification again.
Studio opens a pane with POST /runtimes, whose handler passed
r.Context() into boot.BuildRuntime. That context became the lifetime of
every lazily started MCP server (LazyToolset's sessionCtx) and the
controller's PluginCtx. net/http cancels it when the handler returns, so
in any pane after the first, a server whose schema was already cached
failed its first call with "MCP startup launch failed after 9ms ...
context canceled". The first pane was unaffected because serve builds
it on context.Background.
build now detaches once at its boundary with context.WithoutCancel,
keeping the context's values. Teardown still runs through the host's
own cancel causes.
TestEffectAnMCPServerStartsAfterTheBuildingRequestEnded builds twice:
once to cache the schema, then with a request context cancelled when
Build returns. Without the fix the call answers "context canceled".
MCP elicitation, form mode. It is declared in the legacy initialize
capabilities and in the 2026-07-28 _meta, and answered on all three
paths:
- legacy stdio: the request arrives unattached to any call and goes to
the most recent call in flight that has a person behind it;
- legacy Streamable HTTP: the elicitor comes from the call's context;
- modern MRTR: it is answered among the input requests.
The host renders requestedSchema: string, number, integer and boolean
fields, enum and titled oneOf, and multi-select arrays. Answers are
checked for required fields, range, length, email/uri/date formats, and
integers parsed exactly. A form that fails goes back with the reason,
prefilled with what was given, up to three times. Schema defaults
prefill the first form.
The form rides the ask prompt (tool.Elicitor on the tool context,
implemented by control.Controller) with an AskOrigin naming the server.
Refusing it answers the server with decline and leaves the turn
running, where an empty answer to the agent's own question still ends
it. The decision receipt records the field names and
accepted/declined, never the values. Studio draws it as a whole form
under the server's name, with a warning not to enter secrets. ACP has
only the permission prompt to draw it in, where a field titled like an
action reads as the agent asking leave, so ACP declines it.
Bounds against a hostile server:
- one open form per stdio connection; a second request is declined
through the bounded reply queue;
- a form ends with its call;
- at most 32 fields and 64 choices, with caps on text length;
- duplicate names or labels are refused;
- nobody to ask means decline.
URL mode is not declared.
Also: this window's own answer now overrides a decision receipt that
overtook it, which sealed the card as "handled in another window".
A call the host cannot classify pays a full workspace walk before it runs
and again after. On this repository (23.6k files) one walk took ~240ms
sequentially and takes ~50ms with sixteen directories read at once. A
20k-file Unity project goes from ~120ms to ~20ms.
The answer is unchanged. Links are not entered, VCS stores below the root
are skipped, an unreadable entry or a stop leaves the scan incomplete, and
more than limit files put it over the limit.
TestParallelScanAnswersAsTheSequentialWalk keeps the old WalkDir verbatim
and holds the two equal across limits on a tree with nested VCS stores and
a link out of the tree. Letting the walk enter a VCS store fails it.
StartTracked creates each child suspended, assigns it to a job object, and
then resumes it. Finding the one thread to resume took a system-wide
TH32CS_SNAPTHREAD snapshot. On a desktop with 8.7k threads that costs 54ms
per launch, about half of what a bash `pwd` costs end to end through
boot.Build (120ms before, 60ms after).
NtGetNextThread walks only the child's threads. Both checks still hold:
exactly one thread, and a previous suspend count of at most one. When
ntdll lacks the call, or the child's handle cannot be opened, the snapshot
answers as before.
App.tsx had reached 802 lines against the 800-line ceiling, and the lint
job failed on it. The fold-away hook is self-contained, so it moves to
its own module unchanged, with its comment in English. App.tsx is back
to 784.
From the security review of the MCP 2026-07-28 client:
- -32020, -32021 and -32022 sit in JSON-RPC's implementation-defined
range, so a legacy server may answer the pre-handshake probe with one
for its own reasons. Such a server failed to start. Only a -32022
carrying a non-empty list of revisions now marks an answer as modern;
every other reply gets initialize, which is what those servers had
before.
- One input_required round may ask for at most 16 inputs and echo at
most 1 MiB of requestState, so a server cannot make each retry
larger. Over that, the call fails with errMCPInputOverBounds.
- A modern connection no longer re-runs initialize when a session
expires. A modern server has no session to expire, and initialize
belongs to the other era.
confineRead resolved every walked file with filepath.EvalSymlinks, which on
Windows costs a FindFirstFile per path component. A glob over a 50k-file
Cocos assets tree spent 94% of its 22.9s there; it now takes 0.49s. Native
grep over a Unity Assets tree goes from 6.2s to 4.5s, the rest being file
reads.
WalkDir descends only into plain directories, so a plain file or directory
below the root resolves to the root's real path joined with its relative
path. A symlink, junction or other special entry still pays confineRead in
full. TestWalkConfineAgreesWithConfineRead holds the two answers equal over
a tree with a forbidden directory, sensitive names, a junction into the
forbidden directory, one out of the tree, and a file symlink to a forbidden
file; with the special-entry check removed it fails on that symlink.
Glob, native grep (and its ignorer) and code_index use it.
TestRedactLongConcurrentTranscriptAvoidsRegexpBacktracking ran 24
workers x 20 iterations over a 2,000-line transcript. Under the race
detector that sits at the ten-minute test limit on CI: one run passed at
581s, two timed out. Under -race it now runs 4 x 2, which still exposes
a data race in concurrent Redact; the ordinary run keeps the full load,
which is what checks backtracking. Locally the race run takes 5s.
The census found four proven-writing inputs outside the action vocabulary,
which held the Studio workflow red. The window's Escape registers through
listenAction as browser.open, session.stop or chrome.focus, whichever it
performs in the state it is registered in. The gutter's keyboard toggle
and grip carry chrome.rail on the rail edge and browser.open on the dock
edge, where opening the column opens a browser view. The theme file picker
is theme.import, the same intent as the button that opens it. chrome.focus
joins the registry.
A handler saves its tape entry in a defer, after the client has already read
the last byte of the response. srv.Close cut that off, so a replay started
right after stop could find no entry for the request just recorded; on Linux
and macOS TestTapeReplayNamesTheFirstRequestThatDiffers lost that race every
time. Stop now shuts down gracefully, bounded at ten seconds.
go mod tidy in desktop/ drops an indirect gopkg.in/yaml.v3 and 32 stale
go.sum lines nothing in the module imports any more; the desktop CI job
runs the same tidy and failed on the drift.
liveSession, waitLog, lineRef and their state are used only by
live_darwin_test.go and live_windows_test.go, so on Linux golangci-lint
reported all five as unused and failed the lint job. The file now
carries the same platforms as its callers.
"C:/Windows/x.png" is absolute only on Windows. On Linux and macOS it is
a relative name that filepath.IsLocal accepts, so the route answered
404 for a missing file, which is right, and the test expected 400. The
case now uses /etc/x.png everywhere and adds the drive-letter path on
Windows alone.
A server is asked with server/discover which era it speaks before anything
else; a modern one is never sent initialize, and every request carries its
protocol version, client info and capabilities in _meta. Over Streamable
HTTP the body is mirrored into MCP-Protocol-Version, Mcp-Method, Mcp-Name
and the Mcp-Param-* headers a tool's x-mcp-header annotations declare
(base64 sentinel for values a header cannot carry); a tool whose
annotations break the rules is left out. input_required results are
answered for roots/list and retried with the server's requestState;
elicitation and sampling surface as ErrMCPInputRequired. HTTP requests
are no longer chased by notifications/cancelled on a modern connection.
A modern server sharing no revision is refused with
ErrUnsupportedProtocolVersion; one still serving a legacy revision gets
the handshake. The SSE transport is legacy-only and skips the probe.
OAuth: the authorization response's iss is checked against the metadata
issuer (RFC 9207), required when the server advertises it, and dynamic
registration declares application_type native.
Steering text into a running turn had the same gap a new message did:
only the screen that sent it drew it, because the steer event was read
only to settle that screen's own pending row, and the device it came
from was lost.
A steer queued from the inbox now carries the item's Via into the
agent's steer entry (SteerItemFrom), onto the user message it lands as,
and onto the steer event, which also says when the host wrote the
guidance itself. A screen with no pending row of its own draws the
guidance once per item, never the host's; the sender's own row takes
the device, and /history returns it on steer rows.
A line queued on a phone while a turn was running lost its device: the
queued item runs long after the request that queued it, and only the
direct submit path carried one. InboxRequest and the persisted
PromptEnvelope now carry Via, an edit keeps the item's original one,
and the queued run binds it to the turn through the same turnTags the
direct path uses, so the turn is announced and landed as the phone's.
An answer to the model's question given on a device goes through
AnswerQuestionFrom, on the same Provenance port as submit and approve,
and names the device on the ask's receipt and nowhere else. A screen
that did not answer read 已在其他窗口处理 and nothing more; it now reads
由 设备 N 回答：<what the receipt recorded>, or 在电脑上回答 on a
phone, and keeps the old line where neither is known.
Steering text into a running turn is not attributed yet: it lands
inside that turn rather than opening one, and has no announcement to
carry a device on.
A line sent from a paired phone never reached the window: each client
minted its own user row, and turn_started carried only the message's
index, so the window showed an answer with no question above it, and
the phone showed the window's answers the same way. turn_started now
carries the line itself, read the way /history reads it, and a client
with no row of its own for that index draws one from it, once.
Who sent it is recorded where the message lands. A paired device's
request carries its pairing id and the number the window lists it
under; serve passes that to SubmitHTTPFrom, the submission carries it
through the turn's context beside its output format (turnTags, never a
controller slot), and the host's turn boundary stamps it on the user
message as provider.Via, which the projection strips before any
provider request. /history returns it, so a reload still says it.
Approvals made on a device go through ApproveFrom and name the device
on the decision receipt, and only there: the device changes who the
receipt names, never what the answer allows. Both calls sit on a
Provenance port that only SessionAPI carries, since an editor has no
paired devices to speak for; the window's own input still goes through
SubmitHTTPFormat and Approve.
On screen a line from another device reads 来自 设备 N, and on a phone
the window's lines read 来自 电脑; a screen's own lines carry nothing.
An approval settled elsewhere adds 由 设备 N 处理, or 在电脑上处理 on a
phone. The device bar tells the rest of the page which device it is.
It also stops re-asking /device on the window, which it did every ten
seconds after learning the window was not a device.
DecisionReceipt and Via move to provider/decision.go, keeping
provider.go under its size ceiling.
A finished reply showed as one run-on paragraph with its "##" and code
fences in plain sight, although its stored text and message frame kept
all 43 newlines. Rendering that text directly works, and so does
replaying it as a stream. What produced the screen is SayCard's error
boundary: once the markdown subtree threw, it stayed failed for good,
and its fallback was a div without pre-wrap, so every newline read as
a space.
The run that hit it was a dev build under constant HMR from two
sessions. The likeliest trigger is the lazily loaded renderer failing
to load once: React.lazy keeps that rejection for the life of the page.
That trigger is not proven.
Boundary now takes a retryKey. When it changes (the next chunk of a
streamed answer, or the finished one) the children get another try,
and componentDidCatch logs what threw, so the next occurrence names its
cause. LazyMarkdown swaps in a fresh lazy component when the import
fails, so a retry loads again. SayCard keys its boundary on the text,
and its fallback keeps whitespace, so even a real failure reads as
paragraphs.
When a release publishes a delta for this platform, the Windows install
now tries it before downloading the full installer. The client fetches
the index and checks its SHA-256 against the manifest and its minisign
signature against the release key, and refuses one for another version
or platform. It then plans against the install, fetches only the missing
chunks (8 at a time, each checked against its name, cached so an
interrupted attempt resumes), and assembles the new tree in the update
cache, checking every file. Until that point nothing in the install has
been touched, so any failure is logged and the full package does the
job as before.
The swap follows the macOS pattern: the host copies itself out of the
install and starts the copy with a plan file (--reasonix-tree-handoff),
detached, before the application ends. The helper waits for the shell's
and the host's processes to exit and hashes every staged file again. It
then moves each file in and keeps what it replaces in a backup
directory, retrying through the seconds a scanner still holds a file.
On any failure it puts every moved file back, so the install is the new
release or the old one, never a mixture. It updates DisplayVersion on
the uninstall entry whose InstallLocation is this install and relaunches
the application. Files the release does not list, such as the NSIS
uninstaller, are left in place.
ApplicationAt now states the shell's PID off macOS as well: the swap has
to wait for it, and before this nothing outside macOS read the field.
Run for real on Windows, replaying v2.18.1 -> v2.19.0 with a live stand-in
process: the helper waited for that process to exit, and all 120 release
files then matched v2.19.0 byte for byte, with the uninstaller kept.
The release now builds a chunked update from the signed Windows portable
zip, the same bytes the installer lays down. The output is a
zstd-packed Index (731 KB for v2.19.0, down from 1.6 MB) signed with
the release's minisign key, and the chunks it names. The delta stays out
of dist, which is what gets counted and published as the release's
artifacts.
The mirror step syncs chunks into one shared store,
studio/chunks/<sha256>.zst. Chunks are named by content and immutable,
so --size-only skips every chunk an earlier release already uploaded.
They go up before the tag's delta index, and both before the catalog,
so no client ever sees an index whose chunks are not there yet.
latest.json gains deltas: per platform, the index as an Asset (URL,
signature, size, SHA-256) on the mirror, plus the chunk store's base
URL. Older clients decode manifests leniently and ignore it. A release
without mirror credentials offers no delta, since nothing would be
uploaded for it.
studio-delta build now writes <delta-dir>/<platform>/index.json.zst, with
the chunks in <delta-dir>/chunks. simulate reads that layout, and on
v2.18.1 -> v2.19.0 still fetches 21.9 MB and verifies the staged tree.
A paired phone's page was the window's own, with nothing saying the
sessions on it live on another computer, and nothing on the window said
a phone was on it now rather than at some point.
On a device, a bar above the chrome reads 正在控制 <hostname>, names the
device by the number the window lists it under, and turns grey with
与 … 的连接已中断 when the machine stops answering. Its 断开 takes a
second press and unpairs the device from its own side through
POST /device/leave; the page reloads to the unpaired notice. GET /device
answers a paired device with its id, ordinal and the machine's name,
and the window or a networked serve's browser with 404
device.not_a_device, which is how the page knows not to draw the bar.
On the window, a device is online while it holds an event stream open,
which the gate counts by the stream's Accept header rather than by a
recent request, so a shut page reads as gone within one read. The
button carries the online count in place of its dot, a line under it
says 设备 N 已连接 or 已断开 when that changes, and the lists read 在线
or 最近 <time>. Sharing is watched whenever it is on, not only while
the card is open, so those stay current unasked.
Unpairing a device now cuts every stream it holds open. The credential
was checked when a stream opened and never again, so a phone the
window had disconnected went on receiving the conversation until it
reloaded; each stream now runs under a context Revoke and RevokeAll
cancel.
Every Studio update downloads the whole installer (115 MB on Windows),
even when a release changes a few megabytes. Measured on the real
v2.18.1 -> v2.19.0 Windows builds: the Electron binary is identical but
for its version resource, the kernel changes, and the frontend changes
by about half a megabyte.
internal/platform/delta describes a release as a signed-to-be Index: every
file's path, size and SHA-256, and the content-defined chunks it is made
of (normalized gear CDC, 4/16/64 KiB). Chunks are stored zstd-compressed
under the SHA-256 of their plain bytes, so any chunk two releases share
is stored and fetched once. An update cuts the running install with the
same chunker; content-defined boundaries move with an insertion instead
of shifting every chunk after it. It fetches only the missing chunks,
checking each against its name, and writes the new tree to a staging
directory, checking every file against the Index. Validate refuses
paths that leave the tree, backslashes and drive letters, two paths
that are one file on Windows, and chunks that do not add up to their
file.
cmd/studio-delta builds an Index and chunk store from a release zip, and
replays an update from an unpacked older release. On the real pair it
fetches 21.9 MB instead of 115 MB, reuses 344 of 387 MB, and verifies
the staged tree, in about five seconds.
Nothing publishes or consumes this yet. Wiring it into the release
workflow and the updater comes next.
Adds github.com/klauspost/compress for zstd.
The card reused the settings block, which explains itself at length, so
a popover under a 28px button ran to more than 560px with three
paragraphs in it. It now has its own arrangement in the language of the
chrome's context card: title and one-line subtitle with the switch in
the header, the code as the only large thing with its expiry and two
actions under it (copy link, new code), the network as one row, the
connected devices as compact rows, and the plain-HTTP caution as a
single line at the foot. Sections are divided by hairlines, sizes come
from the type scale. The settings block keeps the long form.
A device is named by its pairing order, 设备 1, 设备 2, with the user
agent kept as the row's title; read as a name it was a hundred
characters that all began with Mozilla/5.0. Disconnecting from the card
takes a second press on the same button, which reads 确认断开 for three
seconds, in place of the inline dialog the settings block uses.
The docked workbench sat flush against the window, split from the
conversation by one hairline. It now floats in its column: 8px of space
around it, a 12px border radius, a border and a soft shadow. The page it
shows sits inset inside the card with 8px corners, both the iframe in
the browser build and the native view's slot in the desktop build.
CSS cannot clip a native WebContentsView, so browserviews.js rounds the
page itself with setBorderRadius(8), the same radius .bview has.
A device is listed under its user agent, which runs to a hundred
characters. The name already ellipsed, but the two grids around the row
sized their implicit column to the widest content, so the column grew to
the full string, the card scrolled sideways, and the warning below
stretched with it. Both grids now bound their column to the card.
Under the address sits 「复制配对链接」, which puts the full link the QR
code draws, fragment and one-time code included, on the clipboard. The
bare address shown above it pairs nothing, which read as a broken
share when typed into another browser on the same machine. The link is
the same credential as the code, so it is copied on request and never
shown as text; it pairs once and lapses with the code.
The clipboard path is CopyButton's, exported as copyText, so the
fallback for hosts without navigator.clipboard is written once.
A fenced block was a bare box: a faint language tag in the corner, a copy
button only on hover, no line numbers, and a long file pushed the rest
of the reply off the screen.
It now has a header bar with the language, the line count, and Download
(saved under the language's suffix, .txt when there is none) and Copy
buttons. A gutter numbers every line, built from spans rather than a
list so that markdown's own list spacing cannot shift it against the
code. A settled block over 18 lines opens folded to 12, with a fade and
a "Show all N lines" toggle. The tail of a reply still arriving never
folds: Block gets a live flag, separate from tail, because a settled
message has a last block too.
The picker was disabled whenever the door was open, with nothing on
screen saying so, so it simply did not respond. Choosing another
network while sharing now moves the listener there and mints a code
for the new address; a line under the picker says that the phones
already paired will need to scan again, since the old address stops
answering.
Minting a code also set it apart from the status that knew about it:
the status from the open call arrived first, without an offer, and the
effect that drops a spent code dropped the fresh one. The code and a
status read after it are now set in the same tick.
The chrome's backdrop-filter makes it a stacking context, so the card's
z-index 60 only ranked it inside the bar, and the panes after the bar
took the hits the card paints over. A press on the switch landed on the
conversation pane, useDismiss read it as a press away, and the card
closed before the switch ever saw the click. The bar is lifted while a
card is open.
Found by clicking the card with a real pointer in Chrome against the
Studio host; the earlier check drove the switch through element.click(),
which skips hit-testing and so could not see this.
How long a reply thought was measured only by the window watching it,
so a reopened session, a reload or a second window showed "思考 53 字"
with no time at all.
The agent now measures it in the stream loop: from the first reasoning
text to the first answer output (text or a tool call), or to the last
reasoning text if no answer followed; a response with no reasoning has
none. The measure rides the settled message frame and is stored on the
assistant message (ThoughtMs, local UI metadata like WorkDurationMs), and
serve's history carries it. Studio prefers the kernel's figure over its
own clock, which stays only as a fallback for turns recorded before this.
While a reply is still thinking, the fold shows a running clock
("思考中 3.4 秒") instead of a bare ellipsis, and once the answer starts
it shows the final time rather than staying on "思考中".
To stay within budget, the frame emit and the per-chunk clock move out of
streamWithFrozen into thought_clock.go, and the temperature helpers move
from provider.go into temperature.go.
The chrome gets a QR icon beside the theme toggle. Pressing it opens a
card under it holding the same switch, network choice, pairing code and
paired phones as Settings > Remote > Phone access; with the door
already open, opening the card mints a fresh code at once, once per
opening, so a spent code is not replaced behind the phone that used it.
While the door is open the icon carries a dot and its title counts the
connected phones.
The button is drawn only where the kernel has a window to share:
/share answers 404 to a browser tab and to a paired phone, so neither
gets it.
The settings block and the card draw from one hook, useShare, and one
body, ShareBody; the card re-reads the state each time it opens, since
the settings block may have changed it meanwhile.
The title bar's drag rule claimed every non-control descendant of the
chrome, which would have made the card's text and code a window handle
in the shell; a [role="dialog"] now opts out whole.
Checked against the Studio host: the card opens under the icon, the
switch opens the LAN listener and shows the code, the icon takes its
dot, and the code decodes with jsQR to the listener's pairing link.
2b504d43f rendered data-action="ask.step" without declaring it, which
fails actions.test. It only moves between panes of one card, so it is a
view action proved by the interaction.
reasonix serve and reasonix web draw the share link as a QR code in the
terminal when stdout is one: dark modules on an explicit light
background, so it scans on a dark or a light terminal. In token mode
the code carries the token in the link's fragment, the way the printed
share link already does; in password mode it carries the login page.
--public-url names what a phone opens when that is not the bound
address, such as a TLS proxy's origin, and the share line uses it too.
Without it a wildcard bind is replaced by this machine's first private
address, and a loopback bind draws no code, since a phone cannot reach
it.
A token link rides only a link that is encrypted or stays off the
internet: https, or plain http to a loopback, private or tailnet
address. A public address over plain http gets no code and a line
saying to put TLS in front and pass --public-url https://. The
off-internet rule is serve.OffInternet, the same one the LAN share
applies. A supervised serve, which keeps its token out of the log,
draws nothing.
The password-flag handling moves out of runServeWithOptions into
applyServePassword, keeping that function inside its size budget.
With more than one question, the only footer action was Confirm, disabled
until every question had an answer, so after the first pick the next
question could only be reached through its tab.
A single-choice pick now moves to the next open question after a short
pause, so the mark is seen first. While another question is still open,
the primary button is Next (i/n); it is enabled once this question is
answered. Previous steps back. Confirm appears only on the last open
question. Multi-choice and free-text answers never advance by
themselves.
Under the scene fold the rail is a drawer over the conversation rather
than a column beside it: its grid track is zero, a veil dims what it
covers and closes it on a tap, and picking a session or opening the
settings puts it away. Opening it squeezed the conversation to a 90px
strip before.
The docked workbench takes the pane's whole width there, with the
conversation and composer set aside until the 「对话」 tab brings them
back; a 560px dock beside a 390px conversation left neither usable.
Both edge grips go under the fold, since the chrome's rail button and
the 「工作台」 tab are their entrances and the grips floated over the
approval card.
The settings sheet fills the screen; the studio layer's inset had
overridden the full-screen rule app.css already carried for narrow
windows.
The transcript no longer scrolls sideways: the wallpaper's reading
plate bled 64px past a column that had no room for it. Heights use dvh,
so a phone's browser bar no longer covers the composer. A coarse
pointer gets a composer of at least 16px, below which iOS zooms the
page on focus. Without hover, controls that only appeared on hover stay
visible. The icon-only branch pill drops its change count, which
overflowed onto the approval-mode button.
Approving best_of_n lets its attempts make their own tool calls without
asking again, but the card showed only the tool name. A tool can now
declare this with tool.ApprovalScoper. The controller stamps the scope
on every approval request at its single emit point, looking the tool up
in its registry, and the wire form carries the call's arguments only
alongside a scope, since they are what it covers.
Studio renders unattended_attempts in the reader's language: how many
attempts start, that their calls are handled as Auto review (deny rules
still apply, and a dontAsk session stays dontAsk), and the task they will
work on. A scope the window does not know still says that one exists.
The approval wire mapping moves to eventwire/approval.go, which keeps
wire.go and ToWire inside their budgets. The only change in the
sensitive approval_orchestration.go is the one line that fills Scope,
which is display metadata; no decision reads it.
Settings > Remote > Phone access opens a second listener on a private
address the person picks (Ethernet/Wi-Fi first, Tailscale next, tunnels
and virtual switches last, read from the interface's flags and hardware
address). The window shows a QR code carrying a one-time pairing code
in the URL fragment; the page trades it at POST /pair for an HttpOnly,
SameSite=Strict device cookie. A code pairs once and lapses after five
minutes; closing the share or quitting Studio unpairs every device, and
each device can be disconnected on its own.
A paired device holds what a networked serve client holds, and no more.
The window's grants (provider edits, account sign-in, workspace switch,
editor open, provider setup) are now read per request, so they stay shut
for device reach even though the device reaches the same handler. The
window's own routes (folder picker, SSH remotes, tray, notifications,
browser host, updates, asks, and the share controls themselves) answer
a device with 404 device.host_only, which the page already reads as a
kernel with no window.
The device gate refuses a Host other than the listener's own address
(rebinding), a state change from a foreign Origin, and every kernel
route without a known credential; the page's own files stay public so
an unpaired phone can load the page it pairs from.
The listener is plain HTTP, and the panel says so: fine on a home
network, not on a public one. Pairings live in memory only.
[agent] code_mode offers run_script. The model writes a Starlark
script. Inside it, call(name, **args) runs a tool and returns its output,
try_call returns ok/output/error, json encodes and decodes, and print
writes the result. Several dependent steps then cost one round trip, and
only what the script prints enters the conversation.
Every call inside a script goes through tool.Invoker, which the agent
binds to each tool call. The agent's invoker runs executeOne for it, so
a nested call passes the same parsing, policy, permission, hooks,
evidence and mutation observation as one the model made. It gets its own
tool card under the caller's id (s1.1, s1.2, ...), and its result
reaches only the script. A nested call's external origin labels the
script's result when the script declares none.
The interpreter reaches nothing else: no files, network or clock. Limits:
20M steps, 64 tool calls, 64 KiB of printed output and a 32 KiB script;
the interpreter is cancelled with the turn. run_script cannot run inside
a script, directly or through a proxy.
Adds go.starlark.net as a dependency.
The base rule makes the row full width, and the Studio skin adds 18px of
margin on each side, so the session tree was 36px wider than the rail. That
put a horizontal scrollbar under the tree, and opening a row's menu scrolled
it sideways.
The CLI keyed its session dir to the raw working directory, while boot
resolves the workspace to the nearest git root. Started from a
subdirectory, `reasonix serve` and chat wrote the transcript under the
subdirectory's project while the pane and the sidebar listed the
repository's, so the conversation never appeared where it was being held.
The session dir now comes from the same resolution boot uses, for the
build and for --resume/--continue lookups: the git root without --dir, and
the --dir directory itself with it. Resolution moves to session_dir.go.
Sessions already written under a subdirectory's project stay where they
are; they are not moved.
[agent] best_of_n offers a tool that runs one task 2-4 times in
parallel, each attempt an unattended kernel in its own detached git
worktree, then has a judge pick one attempt and writes only that one back.
The worktrees start from the workspace as it is: the snapshot is a
dangling commit written through a private copy of the index, so
uncommitted edits and untracked files are included, ignored files are
not, and the user's index and refs are untouched. The winner lands with
git restore --worktree plus deletions, unstaged, and only if the
workspace still holds the snapshot; otherwise ErrWorkspaceMoved keeps
the winner's worktree and reports where it is. Every other worktree is
removed.
Approving the one best_of_n call is what authorizes its attempts: they
run in auto mode, where deny and ask rules still hold, or in dontAsk
when the session is. An attempt's kernel never offers best_of_n, so
attempts cannot fan out again. Attempt transcripts live in a temp dir.
Their usage reaches the session as best-of, and the judge's as
best-of-judge. The judge is advisor_model when set, else the session's
model.
An attempt that stops at its own readiness gate (FinalReadinessError)
still has its diff judged, with the host's reason attached; any other
error takes it out. With one finished attempt no judge is paid; a judge
that names no finished attempt applies nothing.
Three reports, one cause and two gaps.
- Choosing another conversation hid the one that was running. openPane
took any pane without a session path to be the blank one and rebound it.
A new conversation's path is minted at the first submit, so a pane
running its first turn still looked blank to a pane list read before it.
A pane that is working, or has reported a path, is no longer blank.
- 「进行中 1」listed nothing. The tree's rows came only from transcripts
on disk, and a first turn in flight has not written one yet. The host
tree now also lists the conversations its panes hold that the listing
lacks, so the running one can be found and returned to. A session past
the per-folder cap is covered the same way. Such a row reads 新会话
rather than its file name, and its tab takes the numbered fallback.
- With one pane open there was no way to close a conversation: closing
lived only on the tab strip, which appears from two panes up. The row
menu now offers 关闭会话 for a conversation a pane holds, and refuses it
while a turn runs, like archiving does.
agent.advisor_model offers the working model an advise tool. A call
hands the conversation so far and one question to the advising model,
which answers in text with no tools; the answer is the tool result. The
cheap model keeps the loop and pays for the strong one only when it
decides a moment is worth it.
The agent binds its conversation to each tool call through
tool.TranscriptReader, a copy of the canonical transcript. The advisor
renders it as text, since tool calls cannot be replayed into a request
that declares none: the first user message is always kept, the rest
from the newest back within 120 KiB, local-only messages never. Usage
bills the new advisor source at the advising model's rate.
The tool is registered only when advisor_model is set and resolves, so
whether the schema carries it is prefix configuration decided at boot;
there is no fallback, since advice from the same model is none.
UseCapabilityTool, the MCP capability runtime, on-demand connects,
capability listing and search, and the argument-contract reading they
share move from internal/runtime/agent to internal/runtime/usecap. They
were already their own types rather than agent methods, and they need
nothing from the agent. usecap depends on the agent not at all; the
agent imports it.
- The two MCP checks both sides make are now tool.HasMCPDestructiveHint
and tool.IsMCPServerAuthorized. They live in contract/tool/mcp_server.go
beside the interfaces they read.
- The agent's call-contract gate and the proxy's hints share
usecap.ReadArgumentContract, with its Hint and Broken.
- FilterCapabilityListResult, FilterCapabilitySearchResult,
ParseMCPServerCapabilityID and WithContractHint are exported for the
child registry and the dispatch path.
The integration tests that drive a real agent through the proxy stay in
agent. The runtime's own tests move to usecap. Tests that check the
proxy's judgements against agent or delegation types run as usecap_test
through export_test.go. No test was added or removed.
Baseline: usecapability.go carries its debt unchanged under the new path,
and delegation/task.go and control/controller.go each gain one import
line (-allow-widen).
agent.screen_external_content asks the triage model, once per external
tool result, whether the text addresses the agent and tries to change
what it does. The verdict is advisory: a flagged result keeps its text
and gains a host notice under its provenance label, and the user gets a
suspected_injection notice naming the tool and origin. A screen that
fails or times out flags nothing.
Screens in one batch run in parallel on the triage model and bill
injection-screen. askClass's request loop becomes askTriage so both
questions share it. The prefix does not depend on the switch.
UserDecisionPolicy and LanguagePolicy move to policies.go beside the
other prompt policies, keeping config.go inside its budget.
Projection, compaction and token estimation were 121 methods on *Agent,
free to touch any of its state. They now form one subsystem inside the
agent package:
- windowState holds what the window owns for a conversation: the
installed projection, the compaction in flight, the pressure latches.
It used to sit as eight loose fields on sessionRuntime.
sessionRuntime.reset hands a new conversation to windowState.reset, and
the lifetime guard in sessionstate_test.go now holds both structs to
their reset and carry-over lists.
- The window's methods live on *contextWindow, which carries only its
state, the session, the configuration, the services and a windowHost.
- windowHost is everything the window asks of the loop: eight callbacks
(the todo and host-context tails, tool facts, the provider projection,
preparing a sampling request, the extension compaction intercepts,
failure annotation) and Session. It was derived from the compiler, not
written by hand, so it is the whole dependency.
- The loop reaches the window through a.window(). The agent's public
context API (ContextBudget, CacheState, LoadProjectionSidecar and the
rest) is unchanged and forwards to it.
The new repolint rule window-state holds the boundary. Only methods on
the window's own types may read sess.win, and the owners are declared in
tools/repolint/windowstate.go. REASONIX.md names the boundary.
Behaviour is unchanged. No test was added or removed. Tests reach the
window's internals through a.window() like the loop does.
A web page, a browser tab, the desktop or an MCP server can write text
that reaches the model as a tool result, and nothing told it apart from
the workspace's own output. The host now knows the origin by type: a tool
declares it through tool.ProvenanceDeclarer (web_fetch, browser_*,
computer_*), and any tool carrying MCP identity is labelled with its
server. The label is read after the call ran, so a page the call navigated
to is the one named, and is added only to the provider-bound message; the
trajectory and frontends keep the raw result.
ExternalContentPolicy in the prefix says what the label means. This moves
the cached prefix once (golden regenerated).
The client went ahead when an authorization server's metadata omitted
code_challenge_methods_supported. The spec makes refusing a MUST: without it
the client cannot tell whether the server verifies the challenge it is sent.
It now refuses with ErrOAuthPKCEUnadvertised before any browser opens, and
the error names the escape hatch.
Some real authorization servers leave the field out, so a server entry can
set oauth_allow_missing_pkce_metadata = true. It is honoured only from a
config the user keeps in their own home (user config, legacy user config,
~/.claude.json): a project's config, its .mcp.json and an installed package
are written by someone else, and none of them may relax the check for
whoever opens or installs them. MCPConfigSource.UserAuthorized() also covers
project sources, so it could not be the test. PKCE S256 is still sent when
the check is relaxed.
The renderer writes the flag back, or the next config save would drop it.
The per-server overrides moved from render.go to render_plugin.go to keep
render.go within its complexity and size budget.
Security review (internal/ext/plugin is sensitive): the default is stricter
than before; the only relaxation is per server, from user-owned sources,
pinned by a test per source; the authorization URL still carries an S256
challenge, pinned by the test. plugin, pluginspec, config and boot tests
pass on a clean worktree; golangci-lint reports 0 issues; the coverage gate
does not flag internal/ext/plugin.
The transcript was one bordered, shadowed card holding every turn, so the
frame grouped nothing; turns are now separated by their own rule. The text
column lines up with the composer below it, and the scrollbar sits at the
pane edge with its gutter reserved on both sides so the column stays centred.
Under a wallpaper the column still needs a surface to be read against. It is
a veil behind the text that fades out at the sides and the bottom rather than
a card with edges.
Which language a turn answers and reasons in now lives in
internal/runtime/langpref: the context preferences a host sets, the
transient blocks that tell the model, and inference from the user's own
text. It depended on nothing in agent, and control and delegation read
it directly rather than through the agent. The block-detection helper
the workspace block shares is exported as HasLeadingInjectedBlock.
This is the one cohesive, already-exported helper left in agent. The
rest of what depends on nothing there is private to the loop, and
exporting it to give it a package would only widen the surface.
Baseline: langpref.go carries its essay debt unchanged under the new
path, and agent.go and delegation/task.go each gain one import line
(-allow-widen).
The task tool, read-only tasks, fleets, parallel tasks, the sub-agent
store and records, profiles and the child's capability grant move from
internal/runtime/agent to internal/runtime/delegation. They are clients
of the agent: they build child agents and run them. The executor loop
now names none of them.
What the loop itself does for a child stays in agent. child_run.go holds
running an agent as a child and composing its answer and host receipts.
child_registry.go holds shaping the child's tool surface. Delegation uses
a small exported surface for these: AppendHostReceipts, AttachReviewReport,
CompleteSubtaskContract, ExpandToolPatterns, MaxToolOutputBytes,
NormalizeToolSchemas, SubagentImageNote, VisionRefFor, WithCallContext
and the host-receipt labels.
Tests followed the code. The ones that check the agent's own judgements
against the real delegation tools (batch skipping, the plan-mode barrier,
contract hints, delegation profiles across the proxy) run as agent_test
in the agent directory through export_test.go. The user-turn retention
test is split so each package pins its half. Test helpers used on both
sides are copied, since neither test binary may import the other. One
test more than before, from that split; none dropped.
Baseline: the moved files carry their debt unchanged under the new path,
and task.go gains the one import line the move costs (-allow-widen).
explore answers questions about the code; the parent often only needs to know
which files and lines to read. locate is a read-only built-in subagent for
that: it issues all its searches (grep patterns, globs, code_index) in one
message so they run concurrently, confirms candidates in a second round, and
returns only "path:start-end — reason" lines, or "no match" with the patterns
tried. Its tool is capped at four rounds.
The cap is a per-call value, not a profile field (profile_boundary_test
forbids that): SubagentRunOptions.MaxSteps, set by the locate tool and taken
as the tighter of it and the default budget. It is also host-owned: a child
whose cap came from its entry point runs under WithRunStepLimit, so the grace
round it gets at the limit ends with its answer. Without that, the first real
run paused at the cap and handed the parent an error instead of the list,
because a subagent's budget was treated as the user's own limit. explore and
the other subagents keep their default budget and behaviour.
No model is pinned: a built-in naming deepseek-flash would fail for every
user on another provider. subagent_models.locate selects a cheaper model.
locate is added wherever the built-in subagent tools are listed: the
recursion exclusions (so the depth cap holds), the capability gate, named
profiles, evidence meta tools, hook mapping to Claude's Agent tool and doctor.
The Claude Agent tables moved from hook.go to hook_claude_agent.go to keep
hook.go within its size budget.
Measured once each on this repository with the default model, two questions:
locate vs explore, 20.3s vs 23.2s and 27.2s vs 27.9s wall, 18% and 16% fewer
prompt tokens, 8% and 1% lower cost. The gain is modest at n=1 on the same
model; what it changes is the answer's shape and a hard round cap.
task.go carried three concerns. Two of them are the agent's own and now
live in core files:
- child_registry.go: shaping a child's tool surface. This covers the
registry filters, foreground-only bash and the restricted
use_capability proxy.
- child_run.go: running an agent as a child. This covers
RunSubAgentWithSession, NewPlannerAgent, the read-only runners,
EvidenceSummary and the review-report nudges.
task.go keeps the TaskTool. delegationProfile moves into execute_one.go
and decorateExecutionReceipt into tool_receipts.go, beside their only
callers. reviewGrantFor goes to the TaskTool that alone uses it. The
agent hands its mutation observer to a spawning tool through an
interface instead of asserting *TaskTool.
After this, nothing in the executor loop names a delegation type, which
is what lets delegation leave the package next.
Baseline: child_registry.go and child_run.go carry the essay debt that
left task.go, and task.go's budget drops by the same amount
(-allow-widen); totals are unchanged.
The client advertised 2024-11-05, four revisions back, and never read the
revision the server answered with, so it could not tell which protocol a
session ran on. It now offers 2025-11-25 and accepts any revision it
implements (2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05); a server that
chooses another is refused with ErrUnsupportedProtocolVersion, as the spec
has the client disconnect rather than guess.
Streamable HTTP now states the negotiated revision in MCP-Protocol-Version
on every request after initialize, and not on initialize itself. This has to
land with the version bump: a 2025-06-18+ server that gets no header assumes
2025-03-26 while the client believes it agreed on a newer one. The reconnect
wrapper forwards the value to the live connection; a replacement negotiates
its own during its handshake.
Also brought to the spec's MUSTs and SHOULDs:
- A 404 to a request that carried a session id is an expired session,
whatever the body says. The old check also required JSON-RPC -32001 and
the words "session not found" in the server's message, a judgement read
from an external server's prose; a 404 with no session held stays an
ordinary status (a wrong address, not an expiry).
- close() ends the server's session with a best-effort DELETE.
- A call the host abandons over Streamable HTTP sends notifications/cancelled,
as stdio and SSE already did.
- Tool results keep every content type: resource_link, embedded resources
(text inline, binary named) and audio reach the model as text markers
instead of being dropped, and a result with only structuredContent is
given as its compact JSON rather than as an empty answer.
parseToolResult moved to toolresult.go; plugin.go is 38 lines shorter.
Declared client capabilities are unchanged (roots only), which is what keeps
every newer feature opt-in. Elicitation, sampling, tasks and the stateless
2026-07-28 revision are left for later.
Security review (internal/ext/plugin is sensitive): the header value comes
only from the client's own list of revisions; DELETE goes to the configured
URL with the configured headers and session id; the new content types carry
the same server-supplied, untrusted text as before, under the existing body
limit. plugin, boot and builtin tests pass on a clean worktree; boot's fakes
still answer 2024-11-05 and connect. The coverage gate does not flag
internal/ext/plugin; golangci-lint reports 0 issues for it.
Write path sets, write grants and the sub-agent scheduler move from agent
to internal/runtime/writeclaim. They depend on nothing else in agent,
and both the executor loop and sub-agent delegation use them, so they
are a primitive beneath both rather than part of either.
The executor's path-effect check shares the claims' containment rule,
exported as PathWithin. Tests that waited on the scheduler's queue
through its mutex now ask SubagentScheduler.Queued. The tests that
exercise an agent binding tool calls against claims and grants stay in
agent.
Baseline: scheduler.go and write_claims.go carry their essay and orphan
debt unchanged under the new path, and agent/task.go gains the one
import line the move costs (-allow-widen).
Coordinator, which wraps an executor agent with a planner, moves to
internal/runtime/coordinator. Nothing in the agent's own loop referenced
it; it was a client living inside the package it drives, reaching into
the executor's fields.
It now drives the executor through exported agent methods, collected in
agent/coordination.go: ModelRef, ProviderName, ToolSchemas,
MarkExecutorHandoff, WithTurnPreferences and MaxStepsPauseOf. Helpers it
shared with the loop are exported by rename: UserImages,
NormalizePlannerDecision, WithRunStepLimit, IsToolLoopPause,
TrackPublishedHostStream, PlanningPhase, PlanContract, SummaryTagOpen
and SummaryTagClose. Runner and PlannerPlanApprover stay in agent, since
control consumes them as the agent's contract.
Coordinator tests moved with it, and so did the agent tests that were
really coordinator tests. The one test of an agent message moved back.
The planner-sink audit check is its own test now. Test helpers used on
both sides are copied, since neither test binary may import the other.
Baseline: coordinator.go and coordinator_test.go carry their essay and
orphan debt unchanged under the new path (-allow-widen); totals are
unchanged.
On --hair the rule sat at about 1.1:1 against the light transcript card and
read as texture. It is the transcript's one structural divider, so it takes
--border, the step the cards inside a turn are drawn with. The space above it
is wider than below, so it groups with the turn it opens rather than floating
between two.
Trajectories keep derived events, never what was sent to or received from
the provider, so no run could be played back and nothing caught a kernel
change that altered what the model is asked. The cache-first prefix is meant
to stay byte-stable, and only a live run and its bill showed when it moved.
-tape-record DIR records every exchange at the meter, one tape per task and
trial. -tape-replay DIR answers each run from its tape instead of the
provider, and the report's Replay line names the first request whose body
differs from the recorded one: a message by index and role, the tool list,
or a field. The diverging request is kept beside the recorded one.
Two sources of noise reach the model and had to be held still for a replay
to match: the random workdir path, which is in the workspace block, and the
seeded files' times, which appear in any listing the agent takes. Taped runs
use a fixed workdir per task and trial and pin those times, including the
tape root's, since it is ".." in the listing.
Verified with a real run of bugfix-slug-trailing: recorded in 15.3s for
about USD 0.0014, replayed in 6.0s with no provider traffic, all 6 requests
matched, same tokens and cache hits. The control arm holds: replaying with
-ablate all is reported as "diverged at request 1, tools".
The transcript was cut into fixed 48-card blocks and a hairline was drawn
between blocks, so the only divider in a long session landed wherever the
48th card happened to be, often in the middle of a turn. Worse, transcriptRows
runs per block, so a turn cut in two left its trailing work with no sentence
to sit under.
Blocks now gather whole turns until they reach 48 cards and close at the next
turn, and each turn opens with a rule of its own. Steered and queued lines do
not open a turn. The cutting moves to blocks.ts to keep Transcript.tsx under
its size ceiling.
-attempts retries until a pass, so it measures whether the agent can solve a
task at all (Pass@<=N). Nothing measured whether it solves it every time,
which is what a user relying on it meets. -trials N runs every task N times,
keeps every outcome, and adds a Reliability line: pass^N (tasks that passed
every trial), pass@N (any trial), mean pass@1 over all trials, and the flaky
tasks by name. A trial the token budget skips is not counted as a failure,
and the line says how many tasks ran every trial. -trials and -attempts
count repeats differently and are refused together. A run without -trials
reports exactly as before.
Verified with a real run: bugfix-slug-trailing, two trials, both passed,
reported as pass^2 100% (1/1), for about USD 0.001.
The guardian decides whether the user authorised a risky action, and its
evidence carried the agent's own prose and every tool result. Both are where
injected text arrives: a fetched page, a file or an MCP server can write "the
user pre-approved this", and the agent can be talked into repeating it. The
policy already called the transcript untrusted; the reviewer still read the
claim.
The transcript now holds user turns and every tool call with its arguments,
and nothing else. This also fixes calls issued beside prose: an assistant
message with text and tool calls kept only the text, so the reviewer missed
calls the agent had actually made. The policy says what is withheld and that
authorization is read from the user's messages alone.
The new test fails on the previous extraction ("tool output or agent prose
reached the guardian") and passes on this one. guardian, control, builtin and
boot tests pass on a clean worktree.
build now reads as load, wireTools, controller, freeze. The state one
stage settles for the next lives on a builder rather than in 150 locals
of one function, and each stage fits the function-size and complexity
limits.
Sidecar ownership keeps one owner: builder.pendingMgr holds the
preflighted manager until freeze hands it to the runtime set, and the
deferred retire closes it on any earlier failure, as before.
boot.go now carries no complexity or function-size debt; its file-size
budget drops from 898 to 167.
The tokens-per-second, cache, context and cost row sat in its own bordered,
blurred, shadowed box below the composer, a second card under the first.
It is now a plain row of text in the same place.
A Markdown file read in the workbench linked to its neighbours and showed
images stored beside it, but both were left as written: a relative link
opened the kernel's own address in a new window and a relative image never
loaded.
References now resolve against the document's folder, and a leading slash
against the workspace root. A link to a workspace file opens it in the
workbench, rendered if it is Markdown; an anchor alone does nothing rather
than reloading the window; links with a scheme keep the routing every other
link has. A reply in the transcript is unchanged.
Images load from GET /workspace/image, confined to the workspace through
os.OpenRoot, typed by extension rather than sniffed, capped at 10 MiB, and
served under "Content-Security-Policy: default-src 'none'; sandbox" with
nosniff, so an SVG opened at that address cannot run script on the kernel's
origin. Errors reuse the workspace codes the frontend already words.
Verified in Chrome against a real kernel: a README link opened docs/DESIGN.md
rendered, its img/logo.png loaded through the new route, and its
../README.md link came back.
build was one 1138-line function that knew every subsystem. Each phase
now lives in its own file and build calls them in order:
- config_migrations.go: the pre-load migrations and their notices
- extension_stage.go: sidecar preflight, the UI hub's controller handoff,
sidecar provider merging, and which assembly failures are fatal
- model_selection.go: the executor model and preset
- tool_environment.go: write/read roots, the bash sandbox spec, search
- mcp_registration.go: host-session and configured MCP servers, LSP
- tool_wiring.go: hooks, session tools, skill and slash tools, the
use_capability surface
- delegation.go: the task tool and skill sub-agent options
- roles.go: planner, guardian, recovery reviewer, semantic router
Behaviour is unchanged. build drops from 1138 to 440 lines; boot.go's
complexity budget from 125 to 9. Comments that narrated how the
assembly got here are replaced by the constraint that holds.
A .md, .markdown or .mdx file in the workbench now has Read, Edit and Diff
modes and opens in Read: a document is read far more often than edited, and
its source was the only view. Reading renders the editor's draft with the
transcript's own Markdown component, so tables, highlighted code, math and
emoji look as they do in a reply, and an unsaved edit shows before it is
saved. Other files keep File and Diff.
The workbench test opens README.md, so it now asserts the rendered view and
the draft reaching it, then switches to Edit before typing.
Every settings route is a runtime's, and the sheet rendered only when a pane
had a port, so with every pane closed the wallet, account and settings
buttons set the request and drew nothing. Opening a conversation then
satisfied the condition and the sheet appeared late, unasked.
Asking for settings with no pane now opens a session in the current folder,
as the empty state's own "new session" button does, and the sheet follows
it. With no folder at all there is nowhere to open one, and the error bar
says so instead of the click doing nothing. The request waits for the first
read of the pane list, so a click during startup does not open a second
session beside one that already exists.
A self-signed or company-issued certificate made a page fail with no way
through, while the external browser offered one. The failure now carries
the certificate - issued to, issued by, expiry, fingerprint - and the panel
offers "Proceed anyway (this run only)".
What is trusted is one host and one certificate fingerprint, kept in the
window's main process memory: a restart forgets it, and the same host
presenting another certificate is refused again. Trusting is reachable only
from the window's own page over IPC, so neither the kernel nor the agent
driving the browser can trust a certificate; a certificate error is never
passed by default, since the agent browses through the same views.
Verified in a hidden window against a local HTTPS server: the first visit
fails with ERR_CERT_AUTHORITY_INVALID and the certificate's details, trusting
loads the page, trusting with no refused certificate is declined, and the
same host serving another certificate is refused again.
configPackages arrived with the config inversion untested inside pluginpkg,
which took the package below its coverage floor. The test drives an
installed v2 package through it: an enabled package's command and prompt
roots and MCP servers reach configuration, and a disabled one contributes
nothing.
POST /browser/open waited for the main frame's load event before answering,
so a page whose subresource never finishes - an intranet front end that
references a CDN or analytics host the network cannot reach - held the
request for the whole 30s navigation timeout. The page was on screen within
milliseconds, but the panel did not switch to it, and a clicked link then
fell back to the external browser as if the open had failed.
Session.Visit returns once the navigation commits, bounded by the same
timeout; Controller.BrowserOpen, which only the person's POST /browser/open
reaches, uses it. The agent's browser_open tool still calls Open and still
waits for load, because it reads what loaded. Visit runs the same checkURL
as Open, so nothing becomes reachable that was not.
Measured through the real host, relay and views in a hidden window, against
a page whose script never answers: 30202 ms -> 113 ms. A new blank tab stays
at about 100-170 ms, whether or not another page is still loading.
- guardian moves from safety to runtime: it runs an agent to review a
turn, so it is a turn-engine client, not a subsystem.
- jobs moves from runtime to tools: it imports nothing above the
subsystem layer, and builtin's bash and background-job tools own it.
- recovery.Metrics becomes hostaudit.RecoveryMetrics. The telemetry sink
reads a counter record and no longer imports the recovery gate, which
depends on the agent.
- RedactMessage and RedactMessages move from base/secrets to
contract/provider, built on secrets.Redact, so base imports nothing
from contract.
layer-order reaches 0: every kernel import now points at its own layer or
below. Baseline carried with -allow-widen for one line: recovery/gate.go
gains the hostaudit import.
Three moves close the edges from the contract layer into runtime/evidence:
- The audit records the host emits beside a run (ReadinessAudit,
OutcomeSample, DelegationAudit) move to contract/hostaudit, so event and
trajectory carry them without the ledger that computes them.
ClassifyEvidenceOrigin, which reads delegation text, stays in evidence as
a function over the record.
- taskcontract and plancontract move from contract to runtime: only the
agent and completion consume them, and both are built from evidence
receipts rather than declaring data anything lower reads.
- evidence moves from runtime to safety. It imports nothing above the
subsystem layer, and builtin tools and the trajectory recorder, both
subsystems, depend on it.
layer-order drops from 18 to 5.
The title bar's browser button opened an iframe even in a shell that draws
views, so any site sending X-Frame-Options or frame-ancestors, which many
intranet front ends do, could not load there however the address was typed.
In a shell that draws views it now opens a view, as the workbench's + did.
Typed addresses:
- Only "scheme://" names a scheme, so "intranet:8080" and "localhost:3000"
are a host and a port rather than a refused scheme.
- A host that cannot be public (a loopback, private, link-local or shared
address, localhost, or a name with no dot) is loaded over http directly;
any other bare host tries https and falls back to http.
- A refused address says so under the address bar instead of doing nothing.
Failures: a typed load is judged by loadURL's own answer, since a refused
port never starts a navigation and so raises no did-fail-load; other loads
report through did-fail-load. The panel puts the view away and shows the
Chromium error with a plain reason, a retry, and an external-browser button.
Logins: a page or proxy asking for Basic, NTLM or similar authentication
gets a prompt in Studio instead of Electron's default cancel. What is typed
goes to the window's main process only; the kernel and the model never see
it.
Verified in a hidden Electron window against a local server: a page sending
X-Frame-Options loads, a closed port reports ERR_CONNECTION_REFUSED, port 1
reports ERR_UNSAFE_PORT, a Basic-auth page prompts and loads after the
answer, and a dotted host falls back from https to http.
Session persistence moves from internal/runtime/agent to
internal/state/sessionstore: the Session type, its checkpoint and event
log, listing sidecars, branches, leases, recovery copies, migration, and
the compaction and subagent records saved beside a transcript. The agent
keeps the loop and imports the store; history, historycatalog, migration,
guardian, instanceid and sessiontool now reach the store instead of the
agent, which drops layer-order from 26 to 18.
Tests that exercise only store internals moved with it; the rest stay in
agent and qualify the moved names. DigestSessionMessages and
CompactionStateSchemaV1 are exported for the agent tests that build
legacy fixtures.
Baseline: carried with -allow-widen. The moved files bring their essay,
file-size, complexity and orphan debt unchanged under new paths, and
boot.go, acp/service.go, serve/serve.go, agent/task.go and
control/controller.go each gain the one import line the split costs.
The title-bar toggle drew one fixed half-disc and read the stored setting
rather than the scheme on screen. Under "follow the system" with a dark
system, the first click wrote "dark" and nothing changed. It now reads the
resolved scheme: a sun while light, a moon while dark, and one click always
flips what is shown.
The wordmark's tracking goes from -.065em to -.025em, and the gap between
"reasonix" and "STUDIO" from 1px to 4px.
The card inherited scrollbar-width and scrollbar-color, and while either is
set Chromium ignores every ::-webkit-scrollbar rule. So Electron drew the
Windows scrollbar: its arrow buttons sat on the card's rounded corners and
its track ran through them, and the rules meant to hide the buttons and inset
the track never applied.
The card now sets both standard properties back to auto and is drawn by the
webkit pair: no buttons, the track inset by the 20px corner radius, a 4px
thumb inset 4px from the border, faint at rest, stronger while the pointer is
over the card and when the thumb is held.
Probing an address and listing a provider's models sat in contract/config as
methods on ProviderEntry, so describing a provider and calling one over the
network were the same package, and configuration imported model/openai to do
it. They move to model/catalog: ProbeEndpoint and its reasons, the model-list
URL candidates, and FetchModels / FetchModelsVia / FetchModelListingVia, now
functions taking the entry. A probe sets its one-off key through
WithAPIKeyForProbe instead of the private field.
Configuration now imports nothing above contract. The responses-mode fold test
goes back to config, whose migration it tests; the wizard's model-listing
helpers leave cli.go and setup_manager.go for files of their own.
layer-order debt: 29 -> 26.
Configuration asked model/openai whether a base URL was DeepSeek, Zhipu,
MiniMax and the rest, reaching up a layer for pure host arithmetic that every
protocol package shares. The predicates and DeepSeek's declared image-reading
models move to contract/provider beside IsMiMoEndpoint, named IsXEndpoint;
openai keeps its own names as one-line forwards for its wire code, and loses
IsTokenRhythm, which only its test still called.
layer-order debt: 32 -> 29.
model/billing held two things: what a call costs (fixed-point money, the
official rate tables, quotes and the ledger) and asking a provider for its
wallet balance over HTTP. Configuration, the event stream and its wire form
needed only the first, and reached up a layer to get it.
The data and arithmetic move to contract/pricing; model/billing keeps the
wallet query (balance, cache, the response shapes) and reads pricing like
everyone else. Names and behaviour are unchanged; callers say pricing.X for
what moved. MigrateLegacyUsage's orphan finding travels with its file
(-allow-widen for the carried entry).
layer-order debt: 40 -> 32.
Making a theme meant knowing that packs are read from <state>/themes/<id>,
which nothing in the window said. The theme section now has two controls:
- Import theme… takes a .zip, or a pack folder's theme.json and images
selected together. The page sends bytes, never a path, so it works from a
browser tab and against a kernel on another machine. The kernel keeps only
the manifest and the two images a pack may carry, validates the manifest
with the reader every pack goes through, and swaps the directory in whole,
so a failed import leaves the previous version of a pack intact. A pack
that is not one refuses as theme.not_a_pack; a disk that would not take it
as theme.install_failed. After an import, "Use now" activates it, since a
pack with a picture lands in the folded list.
- Open themes folder creates the directory if needed and shows it in the
system file manager.
Ids are the manifest's, then the folder or archive name; the dot entries and
the plugin: namespace are refused, and List skips dot-named staging dirs.
contract/config imported eight packages from the layer above it. This takes
five of them out, each by moving the piece to where it belongs rather than
hiding the import:
- The installed plugin packages merge into configuration through data config
declares (InstalledPackage, PackageMCPServer); pluginpkg converts a parsed
package into it and names itself the source at init. How a package merges
with what the person wrote, conflicts included, stays in config; how a
package is parsed never enters it. That also breaks the loop that kept
command dirs typed by the command package: config names CommandDir and
command.Root is an alias of it.
- A permission rule's syntax is the form config stores it in, so Rule and its
parser move to contract/permrule; permission keeps both names.
- mcpdiag has no dependencies and moves to contract. The directory move itself
landed in 03e0cb894, swept in from a shared index; this completes it.
- The workspace path fingerprint is a pure function of a path and moves to
base/workspaceid, with the same result.
- The system-one migration writes the hosted address it was written for.
computer_act and computer_read now have one description on every platform,
naming the difference (Meta+s or control+s; paste needs the front on macOS, on
Windows typing brings it forward), so the generated tool contract, the schema
budget and the cached prefix no longer depend on the host OS.
layer-order debt: 47 -> 40.
Project and conversation titles were both 11px, but a project name is
usually Latin lowercase and a conversation title usually Chinese, whose
glyphs fill the em box; at one size the child read larger than its parent.
The project name is now 12px, between the machine's 13px and the
conversation's 11px, with the conversation title's tracking.
The card was painted on .flow, which scrolls with its content, so its bottom
edge ran under the composer and was cut flat there. It was also centred in
the scroller's width less its scrollbar while the composer was centred in the
full width, which set the two 5px apart.
The scroller is now the card: fixed between the tab strip and the composer,
the scrollbar inside its rounded edge, and the same width formula as the
composer so their edges line up.
internal/ was 141 packages side by side, so nothing but a reader's memory
said which were foundations and which assembled the rest. Each now sits in a
layer directory, and the directory is the declaration:
base L0 foundation with no domain in it
contract L1 types and interfaces the layers above agree on
model, tools, safety, ext, state, platform
L2 subsystems, peers of one another
runtime L3 the turn engine
session L4 the controller
assembly L5 the composition root
frontend L6 cli, serve, acp and the host adapters
Only paths change: package names, code and behaviour do not. Imports,
repolint and coverage baselines, sensitive paths, CI package lists and docs
follow the new paths; release notes keep the paths they were written with,
and sample paths inside tests and fixtures keep theirs.
repolint gains layer-order: a package may import its own layer and those
below it, read from where it lives. The 47 imports that point upward today
are recorded as that rule's opening debt (-allow-widen, a new rule's first
baseline) and can only go down. Most of it is config, which still reaches
into eight subsystems and is the next thing to take apart; the rest is
event, history and a few tools reaching into runtime for types that belong
in contract.
Only the project holding the focused pane dropped the node's 12px inset, so
the project a fresh window opens into sat one step left of its siblings until
focus moved. Remote projects already sit at the uninset position; local ones
now match.
The shell cleared look.wallpaper before applying the user's appearance, left
over from when packs were kept off the shell; packs came back and the
wallpaper stayed stripped, so an upload saved and never showed.
The glyph was centred on a guessed origin 8 units right of its bounding box;
it now sits on the box's centre.
The tray had one 16px bitmap, which a scaled display enlarges. It now ships
@1.25x/@1.5x/@2x/@3x variants that nativeImage picks by scale, rendered
without the tile's margin so the slot is filled. The .ico gains 20 and 40.
A runtime could only replace a tool by name, and that slot was never routed
to it, so a plugin that wanted to add one had to ship an MCP server. A
runtime now declares tools in its manifest, under runtime.tools with the
tools capability: a name, a description and an object input schema, known
before the process starts and shown in the install plan and the package
list. At initialize the runtime names the declared tools it serves; one the
manifest does not describe fails the handshake as capability_not_declared.
The model sees each as ext__<plugin>__<tool> and reaches it through the
capability catalog the way it reaches MCP tools, so installing or reloading
a plugin never moves the cached prompt prefix, and every call passes the
permission check under that name. A call is the new host request
extension/tool/call, bounded at five minutes; isError carries a failure the
tool reports about its own work, apart from a call that could not run.
A runtime that failed to start contributes no tools.
The Go SDK serves them from Options.Tools and names them in the handshake.
An effect test drives a call through the real assembly to a fake runtime and
back to the model, and fails with the registration removed.
Both were parsed by pluginpkg and went nowhere, while the docs said they
worked. A package's prompts are now discovered with its commands and invoked
the same way, /<plugin>:<name>, which is what the manifest documented. Its
themes are Studio theme packs: an entry names a pack's theme.json, and the
theme library lists it as plugin:<plugin>:<directory>, read in place from the
plugin root with its own images, never copied into the user's library, and
gone when the plugin is disabled. The retired desktop's .reasonix-theme
archives are not a format Studio reads, and the docs now say so.
The plugin docs are brought in line with the code: the Studio installer takes
a repository address or a folder (a .zip installs through the CLI), the routes
Studio drives replace a list of Wails methods that no longer exist, and the
protocol documents the panel and view surface kinds it already carries.
A spark button beside attach (Ctrl+Shift+E) asks the kernel to rewrite what
is in the box. The rewrite is offered in a card above the draft — adopt, try
again, or discard — and the draft is only replaced when it is adopted; a card
over a draft that has changed since says adopting will overwrite it.
The rewrite is Controller.RefinePrompt, so every frontend can drive it, served
at POST /prompt/refine. It is one bounded no-tool call on the entry the
session resolved, with reasoning off, reading the draft, the workspace name
and the last four turns so a reference like "that bug" can resolve. It keeps
the draft's language, paths, code and scope, and adds nothing the person did
not ask for. Usage is billed as its own source, prompt-refine. Each reason no
rewrite is made carries its own code: empty, too_long, no_model, timeout,
no_answer, failed.
Assembling the goal evaluator moves out of boot.go beside the refiner, and
the history accessors out of controller.go, so neither file grows.
The key action named only the keys a handful of shortcuts needed, so a
control+b, an F5 or a digit had nowhere to go but a refusal. Both helpers now
press every letter, digit, F1 to F12, insert and the punctuation keys, with
the same modifiers as before; the refusals of keys the shell answers stay.
A C++ helper speaks the macOS helper's protocol unchanged, so the kernel,
permissions and tools drive both alike. It reads applications through UI
Automation, captures a window with PrintWindow and encodes it with WIC,
injects input with SendInput, and draws the agent's cursor as a click-through
layered window, with Escape stopping a run while that cursor shows.
An application is named by its package family name when it is packaged and
by its lowercase exe name otherwise; the helper also reports the exe, and a
refusal under either name holds. Console windows report whichever program
owns the console, so no name can refuse them: the helper excludes them by
window class. A process with more privilege than Studio is refused as
computer.elevated rather than failing as a broken application.
Windows delivers keys only to the foreground, so typing, keys and paste bring
the application forward first, and the approval card says so
(computer_front). Pointer and point clicks check the window under the point
again at the instant of input, a hold ends when the application leaves the
front, and a drag always releases its button.
build:host builds the helper with MSVC found through vswhere; CI fails
without it, a dev build only loses the feature. Live tests drive a pure-Go
Win32 probe through the real helper.
When a turn had to wait for another session writing the same workspace,
the notice said "another session is writing this workspace" and carried,
as its detail, the English sentence "workspace write lease is busy;
read-only work remains concurrent". With several windows open the
person had nothing to go on: which conversation to look at, or whether
there was one at all, was left to guess.
A session now names itself when it takes the lease, from the title the
sidebar shows or, before one exists, its first message; only the cached
title is read, so naming a holder never costs a model call. A waiter in
the same process reads the name off the in-process lock, and one in
another process reads a 0600 note left beside the lock file and removed
on release. The notice's detail is that name, as data rather than
prose. Paths, pids and tokens stay out of it, as the lease's State
already promised.
The controller's lease surface moves to its own file and the session
title helpers join the rest of the title code, which pays for the new
lines and lowers both files' budgets.
A remote serve resolves every model call through the provider broker on
the machine that started it, reached over an -R forward. The serve read
that broker's address and token once, at launch, so the reuse check
refused any connect that published the broker elsewhere, and the
bootstrap then stopped the running kernel and started another. Every
other process that connected to the same host did that: a second Studio
window, a restarted one, another computer on the same account. The
conversation open in the first window lost its kernel mid-turn and read
"the kernel on this host is not answering". A reconnect that could not
get its old remote port back left the kernel dialling a port that no
longer existed.
The serve now takes --provider-broker-file, one 0600 file holding the
broker's address and token, and reads it on every request, validating
the address as loopback each time. The broker client asks an Endpoint per
request, so providers resolved before a move follow it. A kernel launched
this way records broker_file; reuse rewrites the file under the serve
lock instead of replacing the kernel, and a link that comes back on a
different port re-points every kernel on it, one reconnect at a time.
Kernels launched the old way are still replaced as before, and the flag
probe upgrades a binary that lacks the new flag.
Address and token share one file written by a single rename, so no read
pairs one connect's token with another's port, where a squatter on a
released port would receive both. The remote state directory is made
0700 and an atomic write narrows its temporary file before writing, not
after. The broker client no longer follows redirects.
The most recent connect's broker serves every conversation on that
kernel. That is no more than the SSH account could already do, since it
used to relaunch the kernel onto the new broker anyway; a window naming
which machine it resolves through is left for later.
Removing a session, a folder, a remote machine or its folder, or the
model source a conversation is on was refused whenever a pane merely had
it open: has_open_pane, has_open_panes, model_in_use. The person asked
for the delete; an idle pane showing the thing is not a reason to say
no, and a window full of such refusals reads as one that will not let
go of anything.
The hub now splits "held by a pane" into running and idle. A pane
mid-turn still holds the delete, answered as session.running,
workspace.running or remote.running with the count, and nothing is
closed while it waits. Idle panes, local or remote, are closed and the
delete goes through. A remote pane's state is asked of its own runtime
over the link; one whose link cannot answer is running nothing this
window can see.
The model source an idle conversation is on can be removed: the
conversation moves to what remains, and when nothing remains the
default is cleared, which lands the window back on connecting a model,
the same screen a first launch shows. Only active work refuses it, as
provider.running. Removing a source that is already gone is the state
asked for and answers 204 rather than a sentence. The provider list now
offers delete on the source in use too.
The sidebar closed a pane before deleting whatever it held without
asking whether that pane was running, so a delete could stop a turn. It
now closes only idle panes itself and leaves a running one for the
kernel to refuse, and the confirmation says so.
A user's recording showed the empty window with no folder, its one
button "open a new session", and every press answered in English: "no
workspace to open in — add a folder first". The kernel raised that as a
bare error, so it reached a Chinese window as the kernel's own sentence
and the window could not tell it from any other failure. It is now the
coded refusal workspace.none, and the empty state no longer offers a
session there is no folder for: with no folder its button adds one,
through the same picker the sidebar uses.
Reaching that state in this build meant closing the last pane, and a
reload then showed nothing at all. The page root was answered by the
first pane, so with none it was a 503; the boot probe asked a pane's
/status, which failed the same way and in a shipped build ends in "cannot
reach the kernel"; and the app held its whole tree behind provider
setup and the welcome flag, both read through a pane's port that no
longer existed. The hub now serves the page itself when no pane is open,
to a request past its auth gate only, since "/" is public in token mode;
the probe asks the hub's own /runtimes; and with no pane the app stops
waiting on setup and the welcome, which the next pane reads again.
The Studio workflow's census gate has failed on every studio commit
since the link router landed: three inputs proven to write the host
named no action, so the product's own vocabulary could not account for
them. The folder picker in the extension dialog, the compaction
threshold presets and the window-wide link router now carry
extensions.pick-folder, compaction.threshold and external.open, the
last registered through listenAction as the registry already describes
a transcript link.
A remote machine's sessions were listed under it but could only be
opened: the local rows carry a menu with delete, the remote ones had
nothing, so a conversation left on a server stayed there unless someone
went over and removed the file by hand.
Each remote session row now has a delete button, quiet until hovered
but never hidden, and the same confirmation the local rows use. The hub
forwards the removal to that machine's kernel over the link its list is
read through, taking one for the call when no pane holds it, and reads
the list again after. A pane holding the conversation is closed first,
since the far kernel will not erase a transcript that is still held.
When the far kernel refuses, it is the one that knows why: a pane open
over there, another process writing. Its refusal used to arrive only as
remote.kernel_refused with the raw body as detail. The far reason now
travels as structured parameters, and this route re-raises it under the
far kernel's own code and status, which the window already knows how to
say.
The usage panel reported a month of DeepSeek traffic at roughly a
hundred times what it cost: on this machine USD 192.92 for records that
sum to USD 1.94, and a user's report put CNY 1,702 on spend they knew to
be well under 200. Tokens were right; only money was multiplied.
ReconcileFile rebuilt a file's records and the rollups of its days, but
left usage_cost in place while re-adding every row's cost to it. Each
pass over a file added its whole cost again, and files are reconciled on
every hash mismatch and directory scan, so the factor grew with how
often a day had been rescanned. The same pass deleted a day's rollups
wholesale, so a second file filed under that day lost its tokens.
Records now carry the cost they were quoted at, and a reconcile derives
the affected days' rollups and costs again from every record that
remains, whichever file wrote it. The live append path still adds one
new row at a time. The schema moves to v4, which retires the inflated
projection and rebuilds it from the stats files on the next open.
agent.go carried the whole mid-turn guidance surface (Steer, SteerItem,
SteerHostNotice, the consume, close and flush paths, the unapplied-steer
notice) while the inbox type and its other Agent methods sat in
steer_inbox.go. They move there, and the orphaned comment describing
steerEntry goes back onto the type.
The move is what pays for giving renderRoot its own line in the Agent
literal: squeezing two fields onto one line kept agent.go under its
file-size budget by hiding a line rather than removing one. agent.go is
93 lines shorter, Steer's doc fits the comment limit instead of carrying
its excess across, and the baseline records the lower budgets.
On Windows the bash tool prefers Git Bash, whose MSYS programs take NUL
as an ordinary path. The Windows habit of discarding into it, as in
ssh -o UserKnownHostsFile=NUL, leaves a regular file named NUL in the
working directory instead: nearly undeletable from Windows tools, since
every path API resolves the name to the device, and sitting where the
next commit picks it up. One landed in this repository's root holding a
remote host's key.
The host can see it happen and the model cannot, so a foreground command
under Git Bash now checks the working directory before and after, and a
NUL file the command created is named in its result with the cause and
the remedy. The check reads the directory listing, the one view that
sees the file rather than the device. A steer in the tool description
was the other option; it moves the cache-stable prefix for every
Windows session and exceeds the schema budget to warn about a mistake
most sessions never make.
A relay forwards someone else's model, so its effort ladder cannot be
probed, and the composer showed "not declared". Its only row said to
declare levels under the source's requests and capabilities, which holds
a thinking on/off switch and nothing else; the real control was a
protocol select behind a fold labelled as an unremarkable line of text,
and a custom vocabulary had no control at all, only supported_efforts
in the config file.
That row now opens the running source's editor with the reasoning fields
unfolded and focused. The editor takes the levels the endpoint accepts
and the one auto resolves to; the kernel stores them as the effort layer
reads them and refuses a default outside them as
provider.default_effort_not_listed. Under Kimi K3 and "none", which
carry no custom vocabulary, the fields keep their values but stand down.
The fold is a titled card that names what it holds and shows the
protocol and level count while closed.
The composer read the model list once at mount, so a ladder declared in
settings stayed "not declared" until a reload. Provider edits now reach
the window's settings pulse, and the model and effort menus re-read the
list when they open, which also catches a config edited outside Studio.
A remembered approval reached the window only as the kernel's English
sentence, so a window in another language could not say it and could
not show the rule it saved. The three outcomes (saved, already covered,
failed to save) now carry notice codes. Their detail is the rule's
subject as a person reads it, drawn as code under the notice.
The version panel treated a Studio run from source as a failure to read
versions and offered a retry that could never succeed. The
studio.no_install refusal is now read by its code and the panel says
this is a development build.
The shell list showed Git for Windows twice, once for bin/bash.exe and
once for the usr/bin/bash.exe it launches. It now offers one row per
install and keeps a pinned path as the selected one.
The workspace list of a remote machine could be read only through a
pane already open on it. Without one the kernel refused with
remote.not_connected, so after a restart the sessions a person came back
for stayed hidden until they opened something there. The hub now takes
a link for the read and gives it back: the far kernel outlives the link
and its session book is on its own disk. Listing publishes no pane.
Each machine row has a read/refresh button. The window remembers which
machines it has read and reads them again on start. The machine-book
hook's key separator was a literal NUL byte, which made git treat the
file as binary; it is now a space.
Network settings belong to a machine, not a pane. Settings now edits
the network of a local pane, because model requests leave through this
machine's broker. When only a remote pane is open it says whose network
is shown.
The boot screen timed itself off its own CSS animations and left as
soon as they finished, often before the app had anything to show. A
bundle that failed to load could leave a blank screen.
The screen is now a scripted intro on a night sky: a meteor, the R
struck together from shards, the wordmark unfolding. It marks each
startup step that has actually happened (bundle, kernel, app) and holds
the wordmark until the app reports it has settled, with a cap for a
shell that never does. It then settles onto the app's own page colour.
If the intro never runs, the wordmark still appears.
The application icon is redrawn to match. It has a single SVG source
and a script that renders every .png, .ico and .icns from it.
The kernel listens on a new loopback port each launch and localStorage
is keyed by origin, so every launch opened on a page that remembered
nothing. The Electron shell now keeps the page's own rx- preferences in
a file under userData and restores them before any page script reads
them. Only the Studio window may read or write that file; the agent's
browser pages cannot.
The Studio stylesheet carried about 150 scheme-scoped hex literals. They
outranked a theme pack, so floating panels, code blocks, sunken grounds
and syntax colours stayed on the default palette whatever pack was
chosen. The pack vocabulary now names float, floatHi, codeBg, sunkBg and
four syntax colours. Every shipped pack sets them, held to AA contrast,
with syntax held on the code ground. A pack that predates these tokens
derives them from the surfaces it does set. A test holds the kernel's
vocabulary and the frontend's CSS mapping to the same set of names. The
stylesheet reads the variables, bringing the carried literals down to
24.
Unreferenced rules (the old run header, trajectory timeline, graph
lanes, side peek and receipt rows) are gone. So are the stylesheet
comments, which move to LAYOUT.md where they state a constraint. The
gutter rules stay: their class is built as gutter-${edge}, which no
literal search finds, and without them the pane dividers lost their
handles.
Guardian, memory, extension, compaction, ask and approval cards now
share one framed host style. The tag says who is speaking rather than
an event name. A guard's verdict is translated and a critical risk is
named. A failed delegate reads as interrupted, not delivered. The
delegate chip shows only while one is running, since a chip left after
the work stops reads as work still going.
A workspace file opened as a highlighted Markdown fence, and editing it
meant switching to a bare textarea. The file now opens directly in a
CodeMirror editor that loads with the first file opened and pulls each
grammar only when needed. The editor is painted from the theme's own
syntax and ground variables, and has its own find (Ctrl+F), go-to-line
(Ctrl+G) and save (Ctrl+S). The window's shortcuts leave alone a key the
editor has already handled. Picking a file from the docked list now
shows the file instead of leaving the list over it.
The browser column did not follow the agent. A page the agent opened
stayed behind the blank start page, and the column opened only if the
person asked for it. The column now opens when the agent opens a page in
the pane being watched, and the start page gives way to the agent's page
and to any new tab. A strip wider than the column scrolls the shown tab
into view, and the column folds only when its last tab closes. A tab the
person opens from the window now sits beside the agent's without taking
over the tab the agent's calls land on. The footer note about sites that
refuse framing, which no longer applies, is gone.
Every foldable part of a conversation had its opening behaviour decided
in its own component: thinking always closed, an activity group forced
open while a call ran, a step open only on failure, long output clipped.
None of it could be changed, and the forced opens overrode a block the
reader had just closed.
Appearance now carries a Transcript folding group with a preset and one
row per part (thinking, activity, step details, long output and the
compaction brief), with a live preview. "Live" keeps an activity group
open for the whole running turn rather than only while a call runs. A
block the reader opened or closed keeps that choice when the preference
moves.
Find stopped reaching rows that were virtualised or not yet mounted,
and a hit inside a folded group was painted where nobody could see it.
Each transcript row now carries its item id. Find lands on the hit by
block, opens every fold around it, clears the find bar, and repaints as
rows mount. A row nested inside another is painted once, under its
nearest row.
Failure diagnosis ran over the whole fold region before the compaction
card went up. A hand-typed /compact over a history with failed commands
therefore sat silent through one model call per failure. Failures that
were about to be folded away also paid for a diagnosis they would never
use.
The card is now emitted first. Diagnosis runs afterwards, and only on
the failures the policy retains, since a folded failure never reads its
selection.
A turn that wrote an HTML page or an SVG could finish on the strength of
a check that proved the file parses, which says nothing about whether it
looks like what was asked for. Nothing in the ledger could tell a page
that had been seen from one that had only been written.
A screenshot now records which workspace file it showed, read off the
URL the browser reports rather than off the model's arguments. Each page
or image written since its last screenshot is owed as an unseen_render
obligation, and final readiness holds the turn until it is looked at or
the look is declared impossible. The obligation exists only where a look
can be taken: boot supplies a render root only when the session has a
browser and the model reads images. Where the turn wrote nothing but
pages and the project declares no checks, a look stands as the check.
A browser_act the host classified as passing also counts as a
verification on the completion card, so the card no longer calls such a
change unverified. The new gap is carried through the readiness audit
and the trajectory.
The route binds the runtime as {id}, and the refusal read {rt}, which no
route declares. Every request to a runtime that had gone away was refused as
"no runtime named ''", and the window said 找不到名为「」的 runtime — a
refusal naming nothing, with no way to tell which pane had lost its runtime.
When the person closed the browser window, the next step heard
browser.no_tab: "no page is open; open one first". That is an instruction to
reopen, and the model took it — reopening the window the person had just shut,
asking for approval each time. The session knows the page went without the
agent closing it: the browser destroyed its target, or the browser itself
exited. That cause now reaches the model as browser.tab_closed, telling it to
ask before opening the page again.
CloseTab removes its tab before closing the target, so the destruction it
causes is not read as someone else's.
A model that calls tools before saying anything still streams a message,
usually with a blank thought. The transcript filed the following work under
that message and then drew nothing for it, so every call before the first
sentence vanished: of six calls in a real run, two were shown, and the one
missing was the failing test the diagnosis rested on. Work now files under a
sentence that is drawn, and a message with no words yet still draws its
speaker when work hangs under it. A blank thought no longer reads as
"thinking 0.0s, 1 character".
The completion menu reset its dismissal in an effect keyed on the answer,
which runs after the commit that opened the menu. A blur landing between the
two was undone and the menu came back. The dismissal now names the answer it
dismissed.
The browser gate read a file URL's path and ignored its host, so
file://elsewhere/C:/<workspace>/x passed as a workspace file while Chrome on
Windows opens it as a UNC share on another machine. A host other than
localhost or a drive letter now names no local file, and a bare drive (C:),
which resolves against the working directory rather than the drive root, is
refused.
Escape during a computer-use run compared the stop time against the run's
start. Windows advances time.Now by timer tick, so a stop inside the tick the
run started in compared equal and the run carried on. The stop is now counted.
The rest is CI debt:
- golden prompts and TOOL_CONTRACT.md regenerated after the browser_act
description change
- desktop go.sum tidied after the terminal removal
- the three OAuth concurrency tests the terminal removal deleted are restored
against ReconcileHTTPMCPOAuthAfterRemoval, the production writer that still
bumps the generation; their loss put internal/plugin under its floor
- the broken-config test reads the resolved user config path instead of
assuming ~/.reasonix, which is not where Windows keeps it
- frontend tests run without vi.mock or fake timers: the launch probation
waits in real time, a missing settings chunk is a real failed import, and
format switches language through boot()
Reasonix ships Studio; the `reasonix` binary exists because Studio installs it
on remote machines and the e2e bot drives it. Nobody sits at a terminal on
either, so the chat TUI was 36k lines cross-compiled to six targets and shipped
to machines that would never run it.
The binary stays, and the two things that need it keep working, because both are
measured rather than assumed. internal/remote/bootstrap launches
`reasonix serve --addr --auth --token-file --port-file --pid-file`, having first
parsed `serve --help` to check those flags exist; e2e-bot.yml drives
`reasonix run --metrics`. Both are untouched.
What went:
- the interactive entry, so bare argv is a usage error rather than an invitation
- 233 methods on the TUI model, stripped in place so a file that also held a
command kept the command
- the views, pickers and cards behind them, and the 42 test files that only
covered them
- 17 exported kernel functions the TUI was the last caller of, each checked
against what Studio actually calls first: boot.RebuildFrom (Studio uses
Rebuild/BuildRuntime), control.SaveAttachmentFile and friends (serve saves its
own bytes; the symlink checks guarded attaching a file *by path*, which only
the CLI could do), plugin.ClearHTTPMCPOAuth and mcpdiag.DiagnoseAuth (no
surface anywhere)
- mcpdiag.IsAuthFailure, which matched 401|403|unauthorized against prose an
external server wrote — the phrase table REASONIX.md says was retired, left
behind with no caller
cli leaves frontend-parity and the port-segregation guard, in both tables with
the reason: it launches serve and a one-shot run now, so a session capability it
does not drive is not debt. --preset joins run's completion, which it always
accepted and was only ever offered on the interactive command.
TestMain moved out of chat_tui_test.go. It pins the language for the whole test
binary, and two render tests started failing on this machine without it —
exactly what its own comment predicted.
internal/cli: 246 files to 162, 35,636 non-test lines to 18,224. repolint's
recorded budgets fall with it — complexity 1383 to 1014, file-size 29,492 to
24,191, frontend-parity 129 to 32 — and no ceiling was raised.
The shell asked for /_studio/ after the kernel stopped serving that namespace,
so index.html came back for every module the page imports: three script
requests answered 200 with text/html, strict MIME checking refused all three,
and the window sat on "connecting to the kernel" with React never mounted. The
page owns the root, which is where its relative asset paths already pointed.
macOS draws its window controls over the window's corner, and that corner
belongs to the rail rather than to the title bar, so they landed on the
wordmark. The reserved corner is a pair of tokens the rail head and the chrome
row both read, applied to whichever of them the rail state leaves there, and
the strip the rail gives up drags the window the way the bar it replaces does.
Their y is set rather than inherited: AppKit seats them nine points above the
line this row centres everything else on.
A reply's menu draws above the row that anchors it, and the row closed it when
the pointer left — but leaving the row is how the menu is reached, so it shut
on the way there, in the 5px offset that belongs to neither. Dismissal is
useDismiss, the one every other menu answers to. The deck reading has the same
shape and keeps its hover, so its anchor spans that offset instead.
The [desktop] table is written by hand, one fmt.Fprintf per field, so a field
added to the struct without a line in the renderer is dropped on every save.
There is nothing to notice: the control works, the file is written, and the
setting is gone on the next launch.
`editor`, added two commits ago, was exactly that. Anyone who named their editor
would have found it blank again the next time they opened settings.
The gate is the fix. It reflects over DesktopConfig, gives each field a value
that field accepts, renders, reads back, and reports every one that did not
survive. A marker the loader normalises away comes back as the default and is
indistinguishable from a field that was dropped, which is why the values are
the fields' own rather than one placeholder for all of them — two of the three
first failures were the test's fault for exactly that reason.
Three fields are exempt, each with its reason in the table: update_channel and
expand_thinking are read for compatibility and never written, and currency is
superseded by [billing].display_currency.
Checked the other tables the same way. background_jobs, system_one, wallpaper
and reasoning_display_mode are rendered through helpers. The six [agent] fields
with no renderer — auto_plan_classifier, soft_compact_ratio,
tool_result_snip_ratio, compact_force_ratio, context_editing, cold_resume_prune
— are the ones boot.go already reports as removed from config, so not writing
them back is what they are for.
Compared against the prototype, Studio's remote surface already carries more
than it does — a connection test, a proxy jump, ssh_config following, secrets
named by environment variable rather than typed, several workspaces per machine
— and the one thing the prototype states that this did not is which credential
gets used.
Leaving the key fields blank is not "no authentication". The kernel tries
ssh-agent's keys first, then the default keys under ~/.ssh, and reaches a
password only when one of the named variables is set or the machine asks
interactively. That order is the kernel's to say, and a reader left to guess
between three of them finds out on the first connect. It is on the form now.
Two comments in that file were in Chinese and are in English, per the tree's
own rule; the interface strings are untouched.
Also fixes the launch-health flake, which predates this branch and fires with
isolation on, so it was never a pooling artefact. The test sampled `said` part
way through a probation measured on a clock that advances by itself — a race
with whatever else the machine is doing, which says nothing on the run where it
loses. It reads the moment off the acknowledgement's own timestamp instead.
Verified by sabotage: with PROBATION_MS at 0 it fails with "expected 920 to be
greater than or equal to 2000", and three full runs are green.
Every http link anywhere in the window was intercepted and handed to the
machine's browser. That was right when Studio had no browser of its own; it has
one now, and it is the one the model can read and drive. A page opened outside
is a page nobody in this conversation can see — not the person who clicked it,
and not the model that would have to be told about it by hand.
A link now opens a tab in that browser and reveals it. Ctrl, Cmd or Shift is
the way out to the machine's own browser, and a shell that draws no views —
a plain browser tab on `reasonix serve` — has only that way. A kernel that
refuses to open one falls back rather than leaving a click that did nothing.
The handler moves out of App into useLinkRouting, because a rule about where
every link in the product goes should be readable and testable on its own
rather than as an effect halfway down a 700-line component.
Links inside a drawn page were already staying inside it: will-navigate allows
any http origin but the kernel's, and target=_blank becomes another internal
view rather than an OS window. Nothing there needed changing.
A button beside the file list, which is the one place the workspace is already
what you are looking at. The kernel opens its own workspace root rather than a
path the request names — taking one from the client would make this a way to
open anything on the machine.
internal/editor discovers what is installed the way internal/browser discovers
a Chromium: VS Code, Insiders, Cursor, Windsurf and VSCodium, by the paths their
installers use and then by PATH. Installed paths first on Windows, because
`code` there is a .cmd shim. A configured [desktop] editor is taken as given and
is the only candidate: naming one is how a machine with several says which, and
a search that found something else first would make the setting advisory.
Three outcomes, three codes: no editor installed asks the person to install or
name one, a launch that failed does not, and a kernel with no window says so
rather than opening a window nobody is sitting at. The button reports which
editor opened it, because a control that does nothing visible is
indistinguishable from a broken one.
Also takes `isolate: false` back out of the test config. It was fast — about 9s
against 15 — and it made the suite intermittent: a render test passed alone,
failed in one full run and passed in the next with nothing changed. A gate that
goes red by arrangement teaches people to re-run it rather than read it. The
threads pool stays, which is most of the win that does not cost correctness:
19.4s to 12s, stable across three runs.
Sub-agents and background jobs are readings about this turn, so they sit with
the turn's other readings at the right end of the run rail instead of at its
left, and the detail is inside the same anchor as the reading rather than a
panel that opened above the whole row. Hover reaches it, so does keyboard
focus, and a click pins it — the context reading already worked this way, and a
row where each control answers to a different gesture is a row you have to
learn.
The two chips are written out rather than sharing a component that computed
`data-action` from a template literal: the actions gate reads those names out
of the source, and a computed one is a name nothing can check.
Fixes a typecheck failure I committed in 71a63d325: vite.config.ts derived the
isolated-test list with node:fs, which this project has no types for. The list
lives in src/testing/isolated.ts now, and isolated.test.ts holds it to what the
sources actually mock — so it still cannot drift, and the config stays free of
node APIs.
The kernel has had these notifications since the CLI: a turn finishing, a stop
for approval, a question. Studio's host wired them and then never gave anyone a
way to turn them on — the only switch was a hand-edited config.toml, which is
why they read as missing.
Three things were wrong beyond the missing screen. The host decided at boot
whether to wrap a runtime at all, so "notify me" meant "notify me after a
restart"; every runtime is wrapped now and the sink reads a holder the settings
endpoint stores into, which is what makes the block honest in saying it applies
immediately. The bodies were English literals in a window set to Chinese; they
come from the catalogue now, like the tray's. And a kernel reached over the
network registers no route at all, because a notification fired there lands on
the server's desktop rather than the watcher's.
The block is one switch with three branches, drawn rather than greyed out of
existence, and it draws nothing where the kernel has no window to notify from.
Tests: the sink delivers once the switch flips on a runtime built while it was
off, stops when it flips back, and answers in the window's language; the block
writes what was asked and keeps what the host answered back.
Also splits the test suite by what needs a private module registry. `vi.mock`
cannot share one — a module another file already imported unmocked stays
unmocked — and format.test.ts began failing in the full run while passing alone,
which is exactly that. Those files run isolated; the rest keep the shared
worker. Which files they are is read out of the sources, never listed. 19.4s to
8.8s, verified under --sequence.shuffle.
Quoting a whole answer to ask about one sentence is not quoting. The button now
takes what is highlighted inside that card, and the quote rides above the box as
a chip the way a long paste already does — an answer pasted into the composer
becomes the composer. Which reply it is stays the kernel's to say: the turn its
checkpoint named travels with the text and is stated to the model, and a
transcript rebuilt without checkpoints sends no turn rather than a guess.
The token readings move while the model writes. usage only lands when a round
closes, so received is estimated from the chunks themselves and replaced by what
was billed. The two share one place, so which is on screen is said: an estimate
is drawn in --muted with ≈ on its unit. A number that just moved lights and lets
go on a timer; reduced motion keeps the numbers and drops the movement.
The receipt card was the only transcript card faking the gutter with a magic 42px
and owning a private row vocabulary. It is a host card now, each item a .find, so
a receipt and a notice read as one runtime speaking. The gutter is --call-sym +
--call-gap, stated once, and .nest-bd redefines those rather than re-specifying
the grid.
Tests: one worker per thread, reused across files. Re-importing React, the port
and app.css once per file was most of the run; `pnpm test` goes 19.4s to 9.4s,
verified twice under --sequence.shuffle. What it costs is written down in the
frontend README: module state outlives a file now.
.glyph leaves the mono exception list — it holds PNG/TXT/❝, which are marks, and
it no longer renders a bare string the gate reads as prose.
Ten extractions, each one concern leaving a file that had outgrown the
800-line ceiling: the gate and queue callbacks and the rewind group out of
Pane.tsx, the effort vocabulary out of Composer.tsx, provider-search splitting
out of session.ts, the mock usage report out of mock.ts, stream interrupts out
of provider.go, the steer wrapper out of agent.go, the config-forward chain
and system-prompt resolution out of config/load.go, on-demand MCP connect out
of usecapability.go, and session previews out of save.go. The MCP list filters
move next to listServerInfo, which is where they were always about.
The picker's two refusals now carry codes — picker.unsupported and
picker.failed — so a frontend can say which one happened instead of printing
whatever sentence the host wrote. EnsureBranchMetaLocked and TouchBranchMeta
were exported and called by nothing, including tests; the comment that
survived them narrated their removal, which is the commit message's job.
Also: three comment blocks in Pane.tsx that had drifted away from the elements
they described, one of which contradicted the code beneath it; the duplicated
status-totals dispatch; and three redundant nil checks whose fallthrough
returned the same value they guarded.
repolint is clean for the first time on this branch — every per-file budget
and all five repo-wide ceilings — and -update reclaims the 410 lines of
file-size budget the tree stopped using, so nothing grows back into it.
A queued line is the composer's to show, not the transcript's: leaving it in
the list split the running turn at the moment of typing and handed its work to
a line the model had not read. It now seats at delivery, and the outbox shows
only what is still owed.
Several subsystems were built and never rendered. Plan, Jobs, Agents, the
command palette and the reply actions are now mounted: the plan sits above the
composer as a one-line summary that opens, the deck chips ride the run rail,
and Ctrl K reaches sessions and commands.
Theme work: the sidebar's greys were hardcoded past the token closure, so every
migration silently missed them. Selection reuses the 2px run bar rather than an
accent fill. A ratchet test now counts the literal-colour rules that outrank
the closure.
Browser: manual tabs route through control.BrowserOpen, so what the person
opened is what the model can read and drive — there is no second
implementation. POST /browser/open carries the refusal code
browser.open_failed, and the CLI gets /browser for the same capability.
Credentials: APIKeyEnvFor is the one derivation, beside the validator that
judges it, and ErrInvalidCredentialKey gives callers an identity instead of a
sentence — a provider named "129" now reports the name as the field to change,
not the key that was pasted.
serve: the kernel serves the built page at its own paths and answers
page.not_built when none is mounted. Onboarding belongs to that page, so the
second inline setup page is gone and TestServeStartsWithMissingProviderKey
pins /provider-setup, which is what the kernel actually owes.
The System One decision backends collapse onto the general mechanism: the
hosted endpoint and its gateway become ordinary sources with a role, migrated
once for installs that already hold the old shape.
Also fixes three lint findings that predate this branch (a tagged switch in
agent/task.go, http.MethodPost in serve/hub_picker_test.go), so golangci-lint
is clean again.
repolint's repo-wide ceilings were already exceeded at 9a4ead5cd; every total
here is at or below that commit's. The per-file budgets Pane.tsx, Composer.tsx
and the config/agent files now owe are to be paid by extraction, not by
-update.
It filled the window and the only way out was a click. The dismissal every
other overlay in this window already uses, and a test that was checked against
the code without it.
`/sandbox revoke` with nothing after it said this session had allowed nothing —
the branch that lists them was lost when the command moved under /sandbox, so
the one case a person hits first was the one that lied. The test now walks it.
The clipboard went back 250ms after the paste keystroke, which is the step
saying "the application has surely read it by now" about an application it
cannot see. It has not always; a busy one reads it later and pastes what the
person had instead — their own clipboard, into their own document, silently.
The wait is now 1.75s and the step does not pay for it: it answers after 250ms
and the clipboard goes back on a timer, still only if nothing else claimed it.
Watched a real run: asked to operate the Calculator and show the result, the
model took the screenshot the tool gives it, then wrote sixty-three lines of
ctypes against CoreGraphics to find the window id, ran screencapture into a
file, and opened that file in the browser pane — six or seven calls to put a
picture somewhere it believed a person could look. It had no way to know the
card already draws the one it was given.
Sixteen tokens of schema (6751 -> 6767) against that.
The chain from a tool's image to a card is tested at each seam — the event
carries it, the wire mirrors it, the card renders it — and none of those asks
the real window. This turn takes a screenshot of the page and then reads the
renderer's own DOM for it.
The document opens by saying it is generated from the same canonical schema
path as the runtime registry. It was not: the table was maintained by hand, and
the check only asked whether a row existed with the right read-only flag. So a
description could drift from the one the model is actually sent, and sixteen of
them had — including bash, whose row still told a reader to prefer shell
redirects the tool now tells the model never to use.
The table is written from the registry, and the check compares it. Everything a
person wrote around it stays theirs. A round that changes a description on
purpose regenerates with -update-contract.
"Allow for this session" is written in no file. The rules editor showed the
file, so it showed less than the agent may currently do, and the only way out
of a grant was to end the session — which costs the work as well as the grant.
The rules the kernel is holding ride along with the rules it read, so one
request answers "what may it do right now". A revoke takes one back or all of
them, and is not behind the provider-edit grant: writing the boundary wider is
a privilege, and taking permission away is always the reader's to do.
Studio lists them above the table, each with a way back. The CLI answers the
same question under /sandbox, which is already where it says what the agent may
reach — `/sandbox revoke <rule>`, or `revoke all`.
That command took the boundary view out of chat_tui.go, which is 5468 lines and
where three budgets sat one line from their ceiling. The baseline moves down:
36 lines of file-size, and one frontend-parity edge, because reading the rules
from the CLI is what that view now does.
A screenshot the agent took reached the model and stopped there. The result
text says "[image: screenshot]", which is the tool telling the model a picture
exists — the reader was told one was taken and never shown it. It is the one
thing a person watching an agent operate an application, or a page drawn
somewhere they are not looking, most needs to see.
The tool result carries the images it showed, the wire mirrors them, and the
card draws them under the output: thumbnails, and the full size on a click. No
store and no second request — nothing persists the event, so what the window
needs travels on it.
The rules editor groups by tool and labels each group. A Computer= or Browser=
rule — which is what "always allow this application" writes — matched no label,
so it listed under a blank one, and fell through to the default note saying it
matches by path with * crossing a /. Neither is true of it: an application grant
is compared to a bundle id and only answers when it names one exactly, so a
glob there can refuse but never permit.
Typing a long value one synthetic keystroke at a time is what an editor that
completes, indents or reformats what it is given turns into something else.
paste puts the whole text in through the clipboard — and the clipboard is the
person's, so what was on it goes back, unless something else claimed it while
the step ran.
Measured first, and it changed the shape: an application that is not in front
never handles the keystroke at all. Bringing one forward is taking over the
person's screen, which is a thing they answer for separately, so paste does not
do it quietly — it refuses with computer.needs_front and names both ways out: a
pointer step to bring the application forward, or type and set_value, which
work while it is behind. The live test walks that path and reads the person's
clipboard back afterwards.
The probe application grew the Edit menu every application has. Without one
there was nothing for a paste keystroke to reach, so the fixture could not
stand for a real application.
Real run, asked whether a pricing page breaks at phone width: the model set the
viewport, saw the cards run off the side, and then had nowhere to go — scroll
only carried delta_y. It read the rest by dragging the horizontal scrollbar,
four drags and four screenshots to see three cards.
scroll takes delta_x. 17 tokens of schema (6706 -> 6723).
The request list outlives a navigation, which is what makes it useful — a click
that navigates is exactly when the agent wants to know what was asked for. But
nothing said where the page changed, so a 404 the previous document collected
read as this one's, which is a wrong answer rather than a missing one. Each
request carries the document it belongs to, and the list says where that
changes.
Alongside: the browser nobody could find says when the setting that fixes it is
read. A real run watched the model write [browser] executable into the config,
retry, get the same refusal, and start looking for somewhere to symlink a
browser into instead.
The shell target is a hand-written protocol in this window, not a browser's own
port, so what the kernel's live tests proved against Chromium says nothing
about it. Two checks read the real thing: the page laid out at phone width, and
the model told what the page requested.
Both passed the first time, which is the point of running them — but the
viewport check passed at first for the wrong reason twice over. It handed the
measured width to the argument that takes a condition, so any non-zero width
was a pass; and once that was fixed it read the wrong view, because by then the
page had opened another. The turn now names its tab and the check compares to
what it asked for.
Alongside: drawing a page over the rectangle it already has skips the work. The
panel reports its rectangle whenever anything in the window changes, which
during a turn is constantly and nearly always the same rectangle.
The resilient loader already does the right thing and records why: a user
config it cannot parse is replaced in memory by the last good one, or by the
built-in defaults, without touching the file. Whether anyone is told was left
to the frontend, through OnConfigLoadWarnings — which no frontend sets. Only
tests ever did.
So a typo in config.toml ran the session under another model, with no
providers and none of the person's permission rules, and said nothing. Driving
a headless run into it, what reached the terminal was two lines about a config
upgrade and an MCP migration failing, which name neither the cause nor what
the session is now running on.
Boot writes them to the diagnostic stream when no frontend takes them, so all
four inherit it. It does not claim they were handled: the migration notice a
window would have shown stays owed, because that one reaches a window and this
does not.
Two gaps the other implementations answer and this one did not. A page that
misbehaves is usually a request that 404ed, was refused, or never came back,
and the only thing the agent could see was the console. A layout that breaks
at a phone's width cannot be seen through a window that is not that wide.
- browser_read what=network lists what the tab requested, newest first, with
what came back: status, type, size and how long it took, or the browser's own
words when nothing arrived, or that it is still in flight. text narrows by
URL. The tab keeps the most recent 200.
- Headers and bodies are deliberately not kept. A credential travels in exactly
those, and a list that held them would put them in the transcript of every
session that read it.
- browser_act gains resize: the page lays out in the viewport it is given,
whatever the window is.
The schema surface grows 46 tokens (6660 -> 6706), which every session pays;
both are trimmed to their shortest useful description first.
TestEffectFoldDropsSupersededStandingState fails under that larger prefix, and
was wrong rather than unlucky: it asked a fold to leave strictly fewer copies
than the request before it, while the turn that follows a fold always adds its
own. It now asks for one fewer than the count that request would have carried.
Two packages had written the same size formatter, to different answers: the
storage panel's goes to PB and rounds down, the tool-output notice's stops at
MB and rounds to the nearest. A third caller was about to arrive with the
network list, so the judgement moves to the leaf both may import, and the two
callers read it from there.
The live shell run proved computer use end to end under YOLO, which answers
every prompt — so the one thing the pointer's design rests on was the one thing
that run could not see. It now runs under auto and answers as a person would.
What it reads: granting the application for the session covers operating it,
the accessibility steps go through with no further question, and the pointer
step is still put to the person. Refusing it leaves the application with
nothing — no mouse event in its log, the pointer where it was, and the
frontmost application unchanged — and the model is told it was declined.
A capture waited on the main thread for ScreenCaptureKit to finish, which is
the thread the rest of the helper's work needs; it now answers out of band,
from whichever thread the capture ends on, and the one output stream is
written under a lock.
That was not why a capture hung, though. Measured on macOS 15: while one
process that has captured a window is alive, a capture in any other process of
that same executable never returns — for any application, with no expiry, until
that process exits. Two Studio hosts on one machine is the reachable case, and
an orphaned host is the one that leaves no window to close. So the wait is
bounded at 10s, and what it says names the condition it can observe: the other
helper, by pid.
The live tests were making that state themselves, a helper per test, and the
third one waited out the timeout. They share one session now, which is what a
host holds.
Accessibility can only touch what an application published as an element. A
canvas, a drawn view, a map, a game — the other implementations reach those by
moving the pointer, and this one answered computer.no_action. The live test
pins the difference on one view: AXPress finds nothing there, and the same
point under pointer_click reaches the application as a real mouseDown.
So the pointer becomes an explicit class rather than another step in the list:
- pointer_move, pointer_click, pointer_drag and pointer_position aim in the
pixels of the screenshot the model was given, the same frame every other
point-taking step reads, and the helper posts real events to the HID tap.
- The helper refuses a point whose window belongs to another application, so
an approval for one application cannot walk into the next one's window.
- It is the person's pointer: taking it parks where they left it and the run
gives it back, whether the steps finished, failed part way, or were stopped.
- The permission subject carries a pointer prefix, and that subject is only
ever answered by an exact grant — no posture, no application-wide allow, can
hand over the pointer on its own. The approval says so in as many words.
Alongside it, the steps the other implementations have and an accessibility
tree already exposes: right_click opens the element's own menu, scroll says
whether it turned the wheel or brought a named element into view, hold_key
holds a chord for a duration, key repeats, and wait is bounded.
internal/computer's floor rises 85.8% -> 89.8%.
The golden tool schemas and the committed trace readings are what a test
compares the live assembly against, so they are only useful while they are
what it produces. Two rounds landed without them: the browser gained drag,
upload, forward, reload and find, and an approval gained the two fields that
say which answers the kernel will honour. Both tests have been failing on the
branch since.
Regenerating costs 106 tokens of cache-stable prefix (5335 -> 5441), which is
the schema of the five browser steps and nothing else: the pointer work in the
next commit registers its tools only where a computer is attached, so it does
not reach this baseline.
The scroll step's reveal worked only where an application offers an element a
way to reveal itself. AppKit does not: its scroll areas advertise
AXScrollDownByPage and then refuse to run it (-25205, measured on a live
window), while the scroll bar's own value moves the view. So the geometry is
solved on that instead — nudge the bar, see how far the element travelled with
it, and put the bar where the element lands inside what the area shows,
verifying that it did.
The live test holds it to the effect rather than to the application's own
report: an application that scrolls by pages never hears about the element at
all, so what says it worked is the scroll area having moved.
Read against Anthropic's computer tool (17 members), OpenAI's computer-use
action list and Playwright's MCP server, then filled the gaps that a real run
had already hit.
The browser gains reload — a page whose file changed is served again, which a
run worked around by appending ?v=2 to the address — forward beside back, drag
from a ref or point to another, upload, which hands a file input files from
inside the workspace and refuses anything outside it, and browser_read find,
which answers where text is on a page too long to read rather than paging 250
lines at a time. Verified against a real Chromium: the reload shows the changed
file, back and forward walk this tab, the upload arrives and /etc/hosts is
refused, and the drag travels so the page sees it.
Computer use gains right_click, which opens the element's own context menu
rather than borrowing a pointer, scroll, which brings a ref into view or turns
the wheel at the application, and wait. The keys and the pointer stay where the
person left them, as before.
And the host now names what a locked screen does: measured here,
CGSSessionScreenIsLocked makes every application answer with its own element in
place of its windows, so a snapshot holds a menu bar and a click by point finds
nothing to press. The snapshot, the missing element and the dead point all say
so; typing, keys and screenshots keep working, which is what the failing run
ended up using. The built-in schema budget grows 6346 -> 6512 for the two
vocabularies.
Measured on this machine: Calculator's AXWindows, AXMainWindow and
AXFocusedWindow all answer with the application element itself, whose children
are itself and the menu bar. Safari answers the same way; Finder does not. The
snapshot handed the model 195 lines of menu items with no window in them, and a
run spent twenty calls on it — coordinate clicks answered no_action, focus
failed, and the model ended up writing itself Quartz key-posting scripts.
The tree now says what it is: an application that hands its own element back in
place of every window gets the menus it does have plus the host's note that
nothing inside the window is there to read, click or hit, that typing, keys and
screenshots still reach it, and that relaunching usually brings the window back.
The key action also names its vocabulary when it refuses one: that run tried
"2", "Numpad2" and "Digit2" in turn against a message that said only that the
key was not one it could press, when digits go through the type action.
The card had three answers and one of them lied. "Do not ask again" sent a
grant that dies with the session — the sealed line under it even said so, in
smaller type — and the answer that writes a rule down, which the chat TUI has
offered for as long as it has had a prompt, was not reachable from this window
at all. Operating one application through nine calls meant nine prompts and no
way to say "this application, for this session".
The kernel now says with each request which answers it will act on: a session
grant, and writing the answer down. Both are derived from the call — a fresh
decision takes neither unless its tool allows a session grant, and a controller
with nowhere to write a rule does not offer to write one — so a window cannot
promise what the host would drop. The card draws exactly those: allow once,
allow for this session, do not ask again, refuse.
Verified in the real Studio: granting the session for com.apple.calculator
stopped the per-call prompts for it, and the two prompts that followed were
the ones the grant does not cover — a different subject, and a shell command.
Two things one screenshot run turned up.
The accessibility walk had no cycle guard, and Calculator's application element
lists itself among its children: the tree repeated to the depth cap, 303 lines
and 33 KB of nothing but that element and the menu bar, with the window's own
buttons never reached. The model read that, gave up on refs, and wrote itself
Quartz click scripts to finish the task. Every element is now walked once per
snapshot. The state that starts the walk at the application element rather than
a window was not reproducible on demand; the run that hit it is recorded.
And the full-width browser view left the page in the bottom of the pane: the
column that holds the conversation keeps its place in the body, and an empty
flex child still takes the room. It is not drawn while the pages have the pane.
The live test now checks the reserved rectangle is the pane, which the
comparison against that rectangle could never catch.
Every page the agent opened came back carrying an Electron security warning
about the page having no Content-Security-Policy. The window this browser runs
in injects its own bundle into every page it draws, and that bundle warns there
— so the model read the host talking to itself as the page reporting a problem,
on every read, and had to decide each time whether the site it was looking at
was broken.
A console message or exception whose every frame comes from a script the page
did not load — this window's bundle, an extension, devtools — is not the page's
and is dropped. The stack says so; nothing here reads the text. A message with
no stack at all still counts as the page's: unattributed is not the host's.
Watching the agent browse and reading what it says are one activity, and the
window made them exclusive: the pages were a pane view, so seeing them meant
leaving the transcript, and a run that opened one said nothing about it — the
reader had to know to go looking. Someone testing it asked how they were
supposed to watch both, which is the question the layout could not answer.
The pages now dock beside the conversation from the moment the agent opens one,
in a column this window remembers turning off. The browser tab still opens them
full width, and leaving it puts them back beside the transcript. The shell draws
the page over whatever rectangle the panel reserves, so the column needed no
work there.
The three diagnostic readings move into PaneDetail.tsx, which is what made room
for the layout under the pane's ceiling; their mounting contract moves with
them. pnpm browser-live now drives the dock, the full-width view and the switch
between them.
A browser task's verification is the browser: open the page the change is in,
act on it, read what it reported. The host counted none of that, so after the
model had fixed a page and proved it in the browser the turn was sent back for
"a verification command", and the shell checks it then invented were the ones
that went wrong — a real session spent 21 more tool calls and three forced
continuations on a task that was already done, at seven times the cost.
browser_act now reports what the call was, the way bash does: a page served by
this workspace — a file inside it, or something on loopback — acted on with
every step run and nothing thrown is a check that passed. Anywhere else stays
unclassified: a page on the open web exercises nobody's code here.
Re-run through the real Studio with the same task and the same model: 35 tool
calls, 3 continuations and ¥0.07 before; 14 calls, no continuation and ¥0.011
after.
Reopening a finished session showed "waiting on you" in the title bar and the
composer's amber posture, with nothing on screen to answer and the kernel
reporting neither a running turn nor a pending decision. The transcript is read
back from the record, and the frame that says how a turn ended is not in it, so
the terminal was null — which the run state read as "stopped part way".
A restored transcript now says so (TurnTerminal "unread"), and only that reads
as nothing happening. A live turn that vanished mid-flight still leaves null and
still reads as the turn stopping short, which is the case that shape was for.
The identity tail exists so a sign-off can cite a step id. A list whose every
item is complete has none left to sign, and the host has already told the turn
not to open new work under that plan — but the tail went on riding every later
request, so an unrelated task in the same session opened with the host asking
it to cite ids for a plan that ended. A real session spent a round reasoning
about whether it was supposed to adopt the finished list.
Owed is still recomputed per request from canonical state; a list with any item
left carries its identities as before.
Every request ends with what the host projects onto it — the task list's
identities, the blocks it owes this turn — and the body chain hashed those too.
They are re-derived per request and are not what the next request carries, so
from the first turn that had a task list onward every comparison reported the
carried body rewritten with no declared reason, and the window warned "the
prefix moved" on ordinary work. Measured through the real assembly: three
requests, two false reports.
A projected message says so (provider.Message.Derived, never stored and never
serialized), a coalesced run that swallowed one says so too, and the chain
stops there. A rewrite underneath the tail is still observed.
Usage and pricing move out of provider.go into usage.go so the new field fits
under the file's ceiling; the baseline update carries that file's existing
comment debt across and lowers the totals.
"The check you ran after the latest write did not pass" named nothing, and the
debt is keyed on the check's own identity: any other check passing leaves the
first one standing. A real run showed what that costs — a `grep -L` whose exit
status is 1 when it finds nothing was recorded as failed, the model rewrote the
check three different ways, each passed, each left the debt where it was, and
the turn was sent back twice more before it happened to re-run the original
spelling.
The ledger now answers which checks stand failed after the boundary, and the
readiness message names them and says the same one has to pass.
The card that asks a person to approve a call showed them the sentence written
for the model: three English paragraphs in an otherwise Chinese window, one of
them added this week with computer use. The window cannot translate a sentence
— matching prose is the one thing this tree does not build — so the kernel now
names the class instead: dynamic_bash, browser_credential, computer_use ride
the approval as ReasonCode beside the sentence, derived from the call so the
replay path answers the same as the first emission, and the window renders the
class it knows and falls back to the sentence for one it does not.
The model still reads the English it read before; only who the text is for
changed.
A page in a minimized window, or in one another application's window covers,
counts as hidden, and a hidden page drops the input sent to it: measured, the
click never arrives and Input.dispatchMouseEvent does not even answer. That is
the ordinary case, not an edge one — a person starts the agent and goes to
another application — and it failed silently: the step said it completed and
the snapshot afterwards showed the page unchanged, so the model concluded its
click had missed and tried again, twice, before falling back to a screenshot
and a coordinate.
Two mechanisms, both measured, and each one alone leaves half the failure:
occlusion is kept away from every page in this application by
disable-backgrounding-occluded-windows, and a minimize is answered by attaching
the agent's views again, which is what brings their widgets back. The cost of
the switch is that this application's renderers keep running at full rate while
nobody is watching them.
pnpm browser-live now drives the same greeting through a minimized window and
through one covered by another window; without either half a check fails. What
the two live tests share moves into test/livekit.js. A live browser test also
pins what was ruled out on the way: a click that starts a slow navigation still
answers with the page it led to.
Opening the browser view drew nothing: the panel showed "the page is paused
while something covers it" over an empty rectangle, with the tab and the
address bar correct beside it. Switching a pane view runs a view transition,
which covers the whole page while it animates, so the sampling that asks what
is drawn over the reserved rectangle answered "the document element" and the
panel put the page away. Nothing then said the animation was over: its end
changes no attribute inside the body, which is all the panel was watching, so
the page stayed away until something else moved.
The panel now also watches the mark the swap leaves on the root, which is what
says a transition is running, and places the page when it goes. The browser
live test never caught this because its window is not on screen, and a document
that is not visible skips the transition entirely.
packaging/build-host.js builds desktop/computer-helper beside the kernel, as
one universal binary for the same reason the kernel is one, and
electron-builder carries it into resources/bin. The shell finds it beside the
kernel on macOS only and passes -computer-helper when the file is there. The
kernel starts the helper, so macOS attributes Accessibility and Screen
Recording to Reasonix Studio.
pnpm computer-live drives it through the real shell with a scripted model:
the kernel lists applications, snapshots a probe application built from the
Go live test's source, and sets a value, presses a button, focuses and types
into it. All eight checks pass, including that the person's pointer did not
move and the frontmost application did not change. What the two live tests
share moves into test/livekit.js, and pnpm browser-live still passes on it.
STUDIO_SHELL_BOUNDARIES.md gains the split for other applications: the kernel
decides, the helper carries out, the shell only finds it.
Two tools over a native helper. computer_read lists the applications a person
can see (what=apps), reads one's accessibility tree with host-issued [aN] refs
(snapshot), or captures its front window (screenshot). computer_act runs steps
in order on one application — click by ref or at x/y in the latest
screenshot's pixels, focus, set_value, type, key — stops at the first failure
with its code, and returns the application's tree afterwards. An application
is named by its bundle id.
Nothing takes the person's pointer or the foreground. A click is an
accessibility action on the element under the point, and only an element of
the application the call names takes it; keys go to that application's
process. An element with no accessibility action answers computer.no_action
instead of being clicked some other way. The helper draws its own cursor where
it acts, and Escape pressed while that cursor shows stops the run between
steps (computer.stopped). Terminals, the keychain, password managers, System
Settings, authorization prompts and Studio itself are refused before the
helper is asked. A missing Accessibility or Screen Recording grant is requested
from the system once per helper, and the failure tells the model what the
person has to switch on and where.
desktop/computer-helper is the helper, in Swift: JSON lines on stdin/stdout,
built for macOS 12 with ScreenCaptureKit checked at run time. internal/computer
owns everything it is not: which applications, what a ref means, and the
screenshot geometry that turns image pixels into screen points. It is a leaf
package and declared sensitive, with a coverage floor of 85.8 from tests that
run the test binary as a fake helper; live_test.go drives a real application
through the real helper when REASONIX_LIVE_COMPUTER names one.
Permission: both tools form the Computer rule group, granted per application
as Computer=<bundle id>. A call on another application needs a person the way
typing a secret into a site does — auto, a glob and a bare rule do not answer
it; a person, the session grant they gave for that application, an exact rule,
or YOLO does. Headless auto refuses and says why. computer_act is an unknown
mutation for evidence, since an application can write into the workspace and
names no paths; computer_read is none.
The tools reach a provider only in a host that has a helper:
reasonix-studio-host takes -computer-helper, and no other host passes one, so
the default prefix and its goldens do not move. The built-in schema budget
is widened 6049 -> 6346 for these two schemas, which only a Studio session on
macOS carries.
A browser call's projected permission arguments kept every field the model
sent and wrote the origin beside them. Subjects reads its keys in priority
order and origin comes last, so browser_open {"url":"https://example.com/a",
"path":"/etc/passwd"} was decided on "/etc/passwd": in ask mode the prompt
named that, and "allow for this session" recorded Browser=/etc/passwd, a grant
any later call on any site could claim by sending the same field. On HEAD the
subject of that call is "/etc/passwd".
What the gate reads is now the arguments the tool's schema declares, with the
host's subject written over them; anything undeclared is dropped. The approval
still shows the steps, because steps is declared.
Studio half of the in-app browser. The shell answers the browser-level half of
the debugging protocol itself — targets are WebContentsViews it owns, each on a
partition of its own and never the session the credential lives in — and hands
each page's commands to that page's debugger. It holds the kernel's relay open
over the same HTTP as everything else and posts frames back one request at a
time, so an event that came before a reply reaches the kernel before it.
Pages refuse the kernel's origin from every frame, ask for no permission,
download nothing, and turn window.open into a tab the kernel is told about.
A pane gains a 浏览器 view while the agent has a page open. The page reserves a
rectangle and tells the shell which page to draw over it; four sender-checked
verbs are all the renderer gets. Whether anything covers that rectangle is read
by sampling what the page itself shows, so a menu or a sheet opened on top puts
the page away without every overlay having to announce itself. The person gets
back, forward, reload and an address bar for the page on screen.
A page nobody is watching overlaps the window by one pixel in its bottom-left
corner, which took three wrong answers to find, all measured in the real shell:
moved wholly off screen it lays out at 0×0 and every click fails as not
visible; setVisible(false) keeps the layout, but a page whose renderer a
navigation replaced while hidden accepts no input until shown, and the
protocol's screenshot waits on a frame that never comes; and a child view at
index 0 is still drawn above the window's own page. Placement runs on a timer,
not an animation frame, because a window the system counts as hidden runs none.
pnpm browser-live drives it end to end — a scripted model, the real kernel, the
real window — and checks the page is operated, the model hears the change, and
the view is drawn exactly over the panel and put away again.
A window drawing the agent's browser needs to know which tabs exist and which
is active. The session announces that a tab opened, closed, became active,
navigated or finished loading; the controller turns it into a content-free
browser_tabs_changed frame; and every frontend reads the tabs back through
BrowserTabs (GET /browser/tabs, /tabs in the TUI), from the session that owns
them. A tab now carries the browser's target id, which is what a window keys
its views by. The page's BrowserTab mirrors the kernel's TabInfo under
wire-parity, and an empty list is [] rather than null.
Kernel half of the in-app browser. A browser.Pool can reach an Endpoint a host
provides instead of launching one: the same protocol client, the same
startup demands (version, target discovery, downloads denied), and no process
of its own. A host with nothing attached answers ErrNoHost and the pool
launches as before; a host that refuses is reported, not quietly replaced.
serve.BrowserHost is that host for Studio. The shell's main process holds one
SSE stream (GET /browser-host/stream) and posts back replies, events and the
connections it ended (POST /browser-host/frames); every workspace's browser is
one connection on it, opened with a partition name derived from the profile so
the window never learns its path. A new stream ends the old one's
connections, since their views went with the window that drew them. The Studio
host registers it for every pane through boot.SetBrowserHost, on the pool that
is already process-wide, so no build or rebuild path can forget to pass it.
The browser session now belongs to the controller rather than to one build:
retained on construction, released with the controller's resources, and handed
to the replacement on every hot rebuild (boot reload, serve rebuild, CLI model
switch) the way the private temporary directory is. A model switch no longer
closes the agent's tabs — and closing no longer depends on the cleanup chain,
which drops what was chained into it whenever an extension runtime exists.
Auto lets the agent onto any site without asking, which is the decision that
was made. Entering a password, a one-time code or card details is a different
question, and a site grant or a broad allow rule is not an answer to it.
Whether a browser_act enters a secret is read from markup, never wording: a
password input, or an autocomplete token naming a secret. Typing into a frame,
or into wherever a Tab or a coordinate click left focus, counts too, since the
host cannot see what is there. Such a call's permission subject becomes
credential:<origin>. It is also evaluated as a visit to <origin>, so a rule
denying the site denies it; otherwise only a rule naming that exact subject
allows it — no site grant, glob or bare Browser rule does — and the approval
bridge treats it like dynamic bash: Guardian and the approved-plan window do
not answer it, YOLO or an exact session grant does, and auto asks.
The check that allowed a call is what execution acts on: the verdict is noted
against the call's arguments, and a step whose target turns out to hold a
secret without that confirmation fails as browser.unconfirmed_secret before
any input is sent — which is what closes typing after focus moved somewhere
the permission check could not follow.
A headless run has nobody to ask, and its refusal now leads with why a person
was needed. Before that, a real run was refused with a reason that fits any
call, tried curl instead, and closed by suggesting an allow rule; with it, the
model filled the email, reported the password was refused, and stopped.
A fake CDP page lets this logic run in CI without a browser.
Every browser_open and browser_act was classified as a proven mutation, the
default for a writer-capable tool, so each one owed a stale_verification and a
turn that only browsed ended on "verification or review gap" — which asks the
model to go run checks against code nothing touched. A real run showed it on
every call.
The browser downloads nothing and has no way to upload, so no call of its can
write a workspace path; the classifier now says so for both. The grant group,
this classifier and the schema rule each know the tools by name without being
able to import them, and a boot test holds all three to the tools that exist.
Chrome saves a download to the person's Downloads folder without asking — a
write outside the workspace that nothing the host observes can account for.
Downloads are denied at launch, and each refusal is logged on the tab it came
from, so the act that triggered one tells the model the file never arrived
instead of leaving it to assume it did.
Three tools over internal/browser. browser_open loads a page and returns its
snapshot, so the first look costs no extra round; browser_read pages a
snapshot, scopes it to a ref, takes a screenshot or drains console errors and
failed requests; browser_act runs a list of steps in order, stops at the first
failure with its code, and answers with what the page reported and a line diff
against the snapshot the model last saw — a whole snapshot only when the
document changed.
[browser] enabled (default true) decides the schema; which browser runs is
found at first use, so the prefix answers to the config and not to the
machine, and a machine without one hears browser.engine_missing. executable
and headless are the other two keys. The tools are provider-visible rather
than behind use_capability: a browsing session is dozens of calls and nesting
each one's steps inside a proxy's arguments is where calls go wrong. This
moves the default prefix — tool schema tokens 4876 → 5335, goldens
regenerated — so every install pays one cold start on upgrade, and the
built-in schema budget is widened 5590 → 6049 for the same 459 tokens.
Permission reads the site, which is host state for a read or an act: a tool
may now project what the gate reads (tool.PermissionProjector) while the call,
its hooks and its evidence keep the arguments as sent. The browser tools write
the origin the host knows over any origin the model sent. The three share one
rule group, so a session grant or an always-allow names Browser=<origin> and
covers loading, reading and operating that site and no other; a bare grant
covers none. Ask prompts once per site, auto and yolo do not, and a read
follows the read-only fallback. Rule groups move into rule_group.go with the
file-writer group they generalise, whose predicate lost its last caller.
LSPConfig and its renderer move to config/lsp.go beside the new browser.go,
and the [tools] enabled list renders through renderStringArray.
A kernel package for an agent that has to see and operate web pages, with no
frontend attached: the tools and the Studio panel sit on top of it.
It finds a Chrome, Edge or Chromium already on the machine (never downloads
one), runs it on a profile of its own, and drives it over
--remote-debugging-pipe; Windows cannot hand a child descriptors 3 and 4, so
there it falls back to a loopback port. One process per profile is shared by
every session through a Pool, since a profile admits one process.
A page is rendered from the accessibility tree, one element per line, with a
ref the package issues, never reuses, and retires when its document navigates
away — so a stale ref fails as browser.stale_ref instead of landing on
whatever replaced the element. Inputs are real pointer and keyboard events; a
pointer input whose point another element would receive is refused as
browser.covered, naming that element. A JavaScript dialog stops the page from
answering anything that runs on it, so page-bound commands fail at once while
one is open and are abandoned when one opens mid-call. Every failure carries a
Code.
checkURL bounds a page to http(s), about:blank and files inside the workspace
once symlinks resolve; a page reached past that by a link is refused when read
or acted on. The package is declared sensitive, and a utility-layer leaf.
Live tests (REASONIX_LIVE_BROWSER=<executable>) cover both transports, forms,
selects, covering elements, dialogs, popups, stale refs and screenshot
coordinates; they skip where no browser is installed.
Prepare answers from modelVisibleMessages, which already appends the host
tails, and buildSamplingRequest appended them again. The todo tail checks
whether it is already visible; the host context tail does not, so every
request after a run that died waiting for a person carried the
interrupted-adjudication block twice — reached by quitting while an approval
was pending and reopening the session.
function_call_output carried text only and the images a tool returned were
dropped on the Responses wire, while the chat-completions client already
forwarded them. They now follow the run of outputs as a user turn with
input_image parts, the shape these vendors accept for user images; a turn
between two outputs would split calls from their results.
The error path built its outcome without the images the tool returned, so a
failure's screenshot — often the only record of the state that caused it —
reached the model as a bare placeholder.
Every image a tool returned stayed on its message and was resent on every
later request, with nothing in the window estimate accounting for it. A
session that takes a screenshot per round grows its request by one image per
round until the provider refuses it.
A request now carries only the newest three tool images. Older ones leave in
blocks of three, so the edit to earlier messages — which is what costs the
prefix cache — happens once per block instead of every round, and each
message that lost an image says so. User attachments are never detached. The
transcript keeps every image; only the request view ages them.
Images also reach the window estimate (width×height/750 from the header, the
largest image's size when unreadable), and a request that carried any no
longer trains the chars-to-tokens calibration: its prompt tokens bill pixels
the host never priced, the same pollution a provider-run web search caused.
The interrupted-request billing estimate stops counting base64 bytes as
characters.
8b2a05c51 moved a brokered pane's default model, picker and rebuilds onto
the broker, but only a kernel carrying it behaves that way. The pane
floor stayed at 2.0.0, so a host already holding a 2.18.0 kernel kept
reusing it after the window upgraded, and #10448 stayed broken for
exactly the machine that reported it.
A connect that publishes a broker now needs 2.18.1, the first version
that can carry the fix; a host on its own credentials keeps the 2.0.0
floor. PaneFloor is the one place both the connect and its probe read
the floor from, so a probe cannot call a kernel usable that the connect
would then replace.
Studio has no bot surface. On this line the QQ / Feishu / WeChat gateway
is reachable only as `reasonix bot`, a CLI command no Studio user starts,
and it carries about 12.9k lines: internal/bot, internal/botruntime, the
subcommand, its config section and its docs. It is also where the recent
Windows heap-corruption and gateway-wedge fixes had to land.
What goes with it:
- `reasonix bot`, its completion spec and its usage line in three locales.
- The typed [bot] config, its defaults, render block, model-ref and
migration hooks, and the 0.x QQ import.
- GatewayAPI, the control port only the gateway named, and the two
passive inbox variants only it called; neterr.IsTransient and
textutil.FitGraphemeBytes, which only it used.
- The bot entries in repolint's layer and frontend-parity declarations,
the bot race-test target in CI, BOT_GUIDE.md and its images, and the
[bot] example.
What stays, and why:
- The user config is shared with 1.x installs, which still run the
gateway. [bot] now decodes into an opaque table and is written back
unchanged on every save, so a settings change here does not switch
that gateway off or erase its allowlists. Credential variables the
table names are still kept out of subprocess environments.
- surface.Bot stays: usage records on disk carry it, and dropping it
would re-attribute them to another frontend.
- SECURITY.md and the crash-report worker still describe the bot, since
they serve every release line.
Budgets only fall: frontend-parity drops by 20 edges and the reclaimed
headroom is recorded with -update.
A host whose provider is "local" resolves every request on the machine
that connected to it, yet the pane's model surface still read the host's
own config. A pane opened with no model started on the host's
default_model, the picker listed the host's providers, and the broker
at home refused the first turn with `unknown model` for a model that
works fine when the host is used directly (#10448).
The broker catalog could not have said otherwise: it listed one
descriptor per provider, by bare name for any provider declaring
`models`, and named no default. It now lists one ref per chat model and
marks the one a new session starts on; the broker side offers only
models it holds a key for. A build given a resolver starts on that
default, the serve launched for a bootstrapped host leaves its model
implicit, and /models on such a pane lists the resolver's catalog
without writing the host's default_model on a switch.
The pane also lost the broker on every rebuild. A model switch, an
extension reload and a workspace move built from options that never
carried the hub's resolver, so the replacement resolved through the
host's config and credentials — the exact thing provider = "local"
exists to avoid. The server now keeps the resolver the hub gave it and
every rebuild passes it on.
A ref the broker's machine does not carry now crosses as its own kind
and arrives as provider.ErrUnknownModel naming where the lookup ran, so
a resumed session recorded against the host's own model says which
machine lacks it and what to change.
Both sides need this build: a host kernel from before it still applies
its own default_model.
Two user-visible fixes since 2.18.0, one line each per the release-note
format.
The Windows crash line says a known trigger was removed, not that the
crash is fixed: golang/go#81238 is still open, and any other recovered
hardware exception on such a host can corrupt the heap the same way.
2835cd5a5 is left out because no production controller lacks a runner.
runSettled and runComposedSyntheticTurn called c.runner.Run directly. On
a controller assembled without a runner, that was a nil dereference.
spawnGuardedTurn's recover turned it into "internal error: invalid
memory address or nil pointer dereference". On Windows the fault is a
hardware exception whether or not it is recovered, the class that
corrupts the heap on AMX runners (golang/go#81238, see 3d5b0b68d).
This was an audit of the recover() sites left after 3d5b0b68d:
- Three re-panic after recording: the CLI crash capture, the subagent
progress tracker and an SDK path. Nothing to change.
- The others isolate faults: background task jobs, guarded turns, the
rpcwire after-write callback, the jobs runner and the SDK handlers.
Isolation is their job, so they stay.
- What mattered was whether anything routinely sent a real fault
through them. Temporary instrumentation over control, serve, agent,
extension, jobs, boot and sdk/go found two nil dereferences, both this
runner call, plus six explicit panic("boom") values tests raise on
purpose, which are not exceptions.
runWithRunner returns ErrNoRunner when the runner is nil. Both call
sites use it, and the identity is a sentinel a caller can test with
errors.Is. Re-running the instrumented control and serve suites records
no nil dereference, only the two intentional panics.
TestATurnWithoutARunnerReportsErrNoRunner holds the identity.
The sentinel lives in turn_projection.go beside its use; controller.go
is already past its size budget.
getOrCreateSession took gw.mu, then called into the controller to decide
reuse (WorkspaceRoot, SessionPath, RuntimeStatus) and released the lock
by hand on each branch. A panic in any of those calls left gw.mu held:
- every later message waited on it forever;
- the turn cleanup that runs while unwinding (finishTurnItem ->
sessionAPI) waited too, so the gateway hung instead of crashing.
This showed up in 3d5b0b68d's investigation: a test fake still
embedding a nil controller hung its test rather than panicking.
The decision moves into claimSession, which holds the lock with defer
and returns what it decided: absent, reused, change deferred while work
is active, or retired. getOrCreateSession acts on that result outside
the lock, in the same order as before: set the approval mode and log for
reuse and deferral; close the retired state and log before rebuilding.
TestAPanicWhileClaimingASessionReleasesTheGatewayLock panics in
WorkspaceRoot with an explicit panic, not a nil dereference, so it
raises no hardware exception on Windows. It then requires the lock to be
free within a second. Against the previous session_routing.go it fails
with "the gateway lock is still held after the panic unwound".
The repolint baseline gives back 12 units of function-size budget that
the shorter functions stopped using.
The Windows CI leg crashed twice inside internal/bot's test binary with
Go runtime faults:
- "Exception 0xc0000005 ... PC=0x0" (44150b0aa);
- "fatal error: acquireSudog: found s.elem != nil in cache" during GC
mark termination (d636e93d5).
Both are heap corruption surfacing wherever it is next read.
golang/go#81238 is still open. On windows-latest runners (Windows Server
2025), a host whose CPU saves a large XSTATE (Intel AMX) writes the
exception context below the goroutine stack when a hardware exception is
dispatched, corrupting the Go heap. The pool mixes hosts, which is why it
is intermittent. It needs a real exception, a nil dereference for
example; an ordinary panic() does not trigger it. golang/go#77975, the
Go 1.26 overlapped-I/O corruption, was fixed in 1.26.2, and it involved
UDP receive, not these paths.
internal/bot dispatched such exceptions on purpose.
safeBotControllerRuntimeStatus, safeBotControllerWorkspaceRoot and
safeBotSetToolApprovalMode wrapped their call in recover(). Test fakes
embed a nil botController, so every call to a method a fake did not
define dereferenced nil and was recovered. Counted with temporary
instrumentation on one run of ./internal/bot: SetToolApprovalMode 7,
WorkspaceRoot 3. In production the controller is a complete
*control.Controller, so the recover only hid real bugs.
- The three wrappers keep their nil check and lose the recover.
- The eight fakes embed stubBotController, a nil botController plus
no-op SetToolApprovalMode, WorkspaceRoot and RuntimeStatus. A fake
missing a method the gateway starts calling now fails at once on every
platform.
- ci.yml runs internal/bot under the race detector, which it never did,
and the Windows test leg prints the runner CPU so the next runtime
crash can be matched against the host.
Found on the way and not changed here: a panic inside getOrCreateSession
unwinds through finishTurnItem, which takes the gateway lock the
panicking frame already holds. The gateway deadlocks instead of
crashing; with a fake that still embedded nil, the test hung rather than
panicked.
Checked: go test -race over internal/bot/... and internal/botruntime
passes; golangci-lint is clean on darwin and on GOOS=windows; actionlint
passes.
newStreamAttemptID built "sa-<attempt>-<UnixNano>". On Windows two
rounds that start within one tick of the clock get the same nanosecond
reading, so the second round reused the first round's id. Stream events
are keyed by that id:
- begin/commit/abort for a round;
- tool AttemptID;
- usage.
With a shared id they attach to the wrong round.
This is what made TestTraceFixturesMatchWhatTheKernelProduces flaky on
the Windows CI leg. Reproduced on a Windows 11 box with the serve test
binary built from the release-notes commit (d636e93d5): 8 of 12 runs
passed. A diverged fixture showed the third round's attempt normalized
to r2 instead of r3, because its raw id equalled round two's.
The suffix is now a process-wide atomic sequence. The id stays
host-local, never persisted or sent to a model, so its format has no
reader. With the fix the same box passed 24 of 24 runs.
TestStreamAttemptIDsNeverRepeat issues a thousand ids in a tight loop.
The first notes written to docs/DOCS_STANDARD.md section 6 and held by
the release-note gate: one summary line, fixed group headings, one
referenced line per user-visible change. repolint -strict reports
nothing for the file.
Left out as not visible to users: the documentation standard,
CODEOWNERS, the repolint rules, the removal of site/ and of the main-v2
release workflows. Also left out: c37dac3a4, which fixed a regression
introduced and fixed between 2.17.0 and this release.
reasonix.io is built and deployed from main-v2 only. pages.yml, removed
in 68b031ae5, ran on main-v2 pushes. On studio the directory was a
remnant, and it still read release-notes/releases.json, which that
commit deleted. main-v2 keeps the site; nothing here published it.
- site/ (60 files) is deleted.
- ci.yml loses the site job, which ran site/'s node tests, and the
`site` output of the path filter. The code and desktop skip patterns
no longer name site/.
- .gitignore loses the five site build-output rules.
- The crash-report worker's shell comment names the reasonix.io website
instead of a stylesheet path that no longer exists here.
studio has no branch protection or required status checks, so dropping
the job leaves no check pending. actionlint passes and make lint is
clean. internal/fileref still skips site/.astro in file pickers: that is
workspace behavior for users' Astro projects, not a dependency on this
directory.
Users report that the question box stops appearing. It shows at first.
Later it only shows when the user tells the model to ask. In the end it
does not show even then.
Prompt ids came from a counter in each controller, starting at "1". A
controller is rebuilt on model switch, extension reload, workspace
switch, /new, /resume and remote reconnect. The rebuild keeps the pane's
event stream (rebuildSink), so the window keeps its cards. The frontend
correlates prompts by id (prompts.ts `prompted`). An incoming request
whose id matches a card already answered is dropped as a replay, which
is correct for the kernel re-emitting a pending prompt on reconnect.
So after a rebuild the new controller's first question was "1", the
window had already answered a "1", and the request never reached the
screen while the run waited for an answer. Every answered card in the
session was one more id the next generation would reissue. The longer
the session and the more rebuilds, the more questions vanished.
The same ids are written to the session's adjudication journal, so a
resumed session also recorded a second, different "1".
Ids are now `<8 hex>-<n>`. The prefix is drawn once per approval manager
from crypto/rand, and drawn lazily for a zero-value manager. The counter
moves into a named promptIDs sub-state, so struct-state keeps its field
count. Answering still resolves only against the issuing runtime.
Tests:
- TestARebuiltControllerNeverReissuesAPromptID: asks twice on one
controller, rebuilds with InheritLifecycleFrom as a model switch does,
asks again. It fails on the old counter with `reissued "1"`.
- TestDecisionIdentitiesAreOnlyMeaningfulWithinTheirRuntime required the
two panes to mint equal ids. It now asserts the property directly: B
refuses A's id and keeps its own card.
- The trace fixture's stabilize() now normalizes decision receipt ids
with the approval and ask ids. The committed receipt read "1" against
an approval normalized to "b1", so the fixture never showed the
receipt sealing its own card.
Checked: the control, serve, bot, cli, acp and boot tests pass; the
frontend suite passes (748 tests); make check is clean.
68b031ae5 was pushed with only its deletions and renames staged. Its
`git add` named CHANGELOG.md, which was already removed, and the failed
pathspec skipped every modification after it. That commit alone does
not build:
- productdocs still imports reasonix/release-notes;
- repolint still calls checkSpecParity;
- the extension golden test reads the old fixture path.
This commit carries the changes 68b031ae5 describes: productdocs and
docs-manifest without the release catalog, repolint without spec-parity,
the golden test on testdata, the /docs tests, the link fixes, ci.yml,
CODEOWNERS, the standard, the theme generator and the lowered baseline.
Verified locally on this exact tree before 68b031ae5 was pushed:
go test ./... passes and make lint is clean.
Deletes what the documentation standard (6b6a41d36) classes as dead on
the studio line, as reviewed and approved item by item.
Deleted:
- Stale or unreferenced: production_checklist (a "v5.9.9 stable" that
never existed), the 4-line WINDOWS_LTSC_2019 stub,
SESSION_REFERENCE_ARCHITECTURE, docs/superpowers (the retired
autoresearch plans), docs/research, RELEASING.md (main-v2's three-tag
line), SIGNPATH_WINDOWS_ADMIN_SOP.md (desktop line only) and
CHANGELOG.md (main-v2's Go line).
- Chinese copies: 30 zh-CN documents with an English original, plus
three with none (COLLABORATION_MODES, DESKTOP_HOOKS, GOAL_ENFORCEMENT).
Only README, GUIDE and CLI keep a Chinese page.
- main-v2 release pipeline: the prepare-release-notes, release-notes,
release-verify-issues and pages workflows; their release-notes,
generate, event, stable-validation and public-contract scripts; and
release-notes/releases.json.
What had to move with it:
- releases.json was embedded, so the docs tool served main-v2's
1.17-1.24 history inside Studio 2.17, where "latest release" answered
1.24.1. productdocs drops the release catalog: release_notes.go, the
virtual changelog paths, the version boost and Manifest.ReleaseNotes.
docs-manifest --verify-source now compares docs/ only. The /docs
example no longer promises a changelog.
- spec-parity held SPEC.zh-CN.md to SPEC.md. With one language it has
nothing to compare, so the rule and its tests are removed.
- The spatiotemporal golden fixtures lived under docs/superpowers but
are test data. They move to internal/extension/testdata.
- Links: onboarding pages point at the English documents; English
documents lose their switch to a copy that is gone. GUIDE drops the
pointer to the Chinese-only hooks page. The theme provenance generator
stops writing THEME_ASSETS.zh-CN.md. ci.yml stops linting and running
what was deleted. CODEOWNERS and the standard lose the two dead paths.
Checked: no broken relative .md link remains; actionlint passes;
go test ./... passes; make lint is clean.
Baseline only goes down:
- doc-language 33 -> 0
- doc-owner 91 -> 44
- doc-prose 2755 -> 2375
- spec-parity removed
site/ is also main-v2's and still reads releases.json. It was not on the
approved list and is left for a separate decision.
docs/*.md is embedded and served to the model through the docs tool.
6b6a41d36 gave two documents the metadata header the documentation
standard requires. Markdown reads `---`, key lines, `---` as a setext
heading, so the tool listed "owner: @esengine / backup: @SivanCola / ..."
as a section of STUDIO_RELEASE.md and DOCS_STANDARD.md, beside an empty
title section. This was checked by reading both documents through the
tool.
The parser now blanks the header to spaces before parsing, so section
offsets and cited line ranges stay those of the file. An unterminated
delimiter is left as ordinary Markdown. STUDIO_RELEASE and DOCS_STANDARD
join the maintainer audience with RELEASING and the SignPath SOP, so a
user-facing search does not rank the release runbook.
The blanking lives in metadata.go: docs.go was at its 800-line budget.
Documents on the studio line had no owner, no status and no shape. Of
120 Markdown files, 544 paragraphs and list items ran past 320
characters. Chinese copies had drifted from the English ones (SPEC.md
1301 lines, SPEC.zh-CN.md 492). CODEOWNERS still named five paths that
no longer exist. The Studio release doc claimed a required approval and a
main-v2-only signing policy, neither of which is true any more.
- docs/DOCS_STANDARD.md states the rules as ID tables: ownership,
document classes, header, writing width, section shape per type,
language, and lifecycle.
- .github/CODEOWNERS gives every area a primary and a backup, in that
order. Every rule still lists both maintainers, so review requests do
not change.
- docs/STUDIO_RELEASE.md becomes a runbook: owners, preconditions,
steps, verification, recovery, release-note format, reference. Each
fact was checked against release-studio.yml, the environment's branch
policy and the 2.17.0 release.
- repolint gains five rules:
- codeowners: a rule must match a file and name two people.
- doc-owner: a document header's owner and backup must equal the
matching CODEOWNERS rule.
- doc-prose: a block must stay within 320 display columns, with a CJK
character counting as two.
- doc-language: only three onboarding pages keep a Chinese copy.
- release-note: fixed group headings, one referenced short line per
change.
Document classes are declared by path. Landing pages, model-read files,
GitHub templates and release notes carry no header, because each is
rendered or consumed verbatim; CODEOWNERS owns them.
Baseline: -allow-widen raises only the five new rules, from nothing to
the debt that exists today (doc-owner 91, doc-prose 2755 weighted,
doc-language 33, release-note 661, codeowners 0). No existing rule
widened. Deleting stale documents and the untranslated copies follows
in its own change, after the list is reviewed.
Users report deepseek-flash, a configured and verified vision model,
saying it cannot see an attached image. The image did reach it. The text
beside each image said "image bytes are never inlined into prompt text.
Whether this model receives the image ... is stated once in the turn's
attached-images note." That note was written only for a model that
cannot read images. A vision model got the deferral and no note, and a
model reasoning at length read that as the image not having arrived.
The same judgement was wrong on a second path. unreadable() treated "this
message carries no pixels" as "this model cannot read". A Goal
continuation under a vision parent carries its images in history, not in
the synthetic message, so the host told a vision model "This model cannot
read images, so they are not in your context" and told the user the same.
- A turn whose own message carries images now gets an attached-images
note saying they are in the message as images, to be looked at
directly.
- turnImages records modelReads, the model's capability, so a
continuation is no longer called unreadable.
- The image block drops the transport clause the model misread and keeps
only the deferral to the note, which now exists in every case.
Measured with the real CLI against deepseek-flash on DeepSeek's
Anthropic endpoint. Each run is one fresh single-turn session at effort
max, with a 1100x360 PNG pasted as .reasonix/attachments/*.png and the
prompt "I sent you a screenshot. Can you see it directly, or do you need
to call another model? First tell me what it says." (asked in Chinese).
- Denial means the final answer states the image did not reach the
model; every answer lacking image-only text was read by hand.
- Tool-first means the run's metrics show steps > 1, i.e. the model ran
tools before answering.
stock: denied 5/80; tool-first 36/70 (10 early runs had no metrics)
fixed: denied 1/80; tool-first 1/80
Denials alone are not significant at this n (two-sided Fisher p~0.21).
The tool-first drop is: in half the stock runs the model doubted the
image and inspected the file first. The fixed arm also cost ¥0.65 for 80
runs against ¥1.88 for 70. Four other phrasings (codeword, "can you see
it", owner/region, open review; 40 runs at the default effort) saw the
image every time on stock.
TestAVisionTurnLandsItsImageWithTheNoteSayingItIsThere drives
runOrchestratedTurn with a vision model and fails with the note removed.
#10435: Studio 2.17.0 on a Windows 10 machine never showed a window. The
kernel served the page; the renderer exited with STATUS_BREAKPOINT
(-2147483645) and the load failed with ERR_FAILED. The report read it as
an Electron 44 / Chromium 152 regression because a downloaded Electron
43.7.1 started, but that copy ran from a different directory.
Reproduced on a Windows 11 box with bare Electron apps: an allow entry for
a specific AppContainer package SID on the DLLs next to the executable
kills the sandboxed renderer on Electron 43.7.1 and 44.1.0 alike, and a
clean directory starts on both. One entry on ffmpeg.dll is enough. A live
package's SID fails the same as one whose profile was deleted. The entry
on the exe alone, on the directory without inheritance, on resources\app,
on the parent, or as a deny does nothing; the built-in package groups and
capability SIDs do nothing. --no-sandbox starts it and
--disable-gpu-sandbox does not, the same flag profile the report gives.
The real 2.17.0 zip with that entry on its root reproduces the report's
log lines.
Such entries come from any AppContainer sandbox that grants its package
read/execute on a tool's directory with inheritance, which is what
main-v2's winsandbox does for the executable it launches.
The kernel gets -strip-package-grants: for the directory the stated
application runs from, it removes allow entries whose SID is authority 15,
base RID 2, with more sub-authorities than a built-in group. The
judgement reads SID structure, never a name. Only allow entries go, so
access only narrows. An entry inherited from above the tree is cut by
protecting the object that inherits it, which keeps its other entries as
its own and leaves the parent untouched. The shell runs this
synchronously before Chromium starts a child, on packaged Windows builds
only (~20ms warm on a 100-file install). It logs what it removed, and if a
removal was refused and the renderer then dies before the window shows,
it names that cause in a dialog instead of exiting silently. Objects it
could not read are reported apart and never attributed.
Verified on the Windows box with the 2.17.0 zip, patched host and shell:
entry on the root, entry inherited from above, entry on one DLL, and a
clean install all start and load the SPA; the stock 2.17.0 with the entry
on its root does not. The rewritten DACL is byte-identical (SDDL) to one
set directly. internal/packagegrant's Windows tests ran there too.
TestNoApprovalPostureAnswersAQuestionForTheUser closed its signal in a
defer after AnswerQuestion returned, but the reply send inside it is
what unblocks the turn. The turn could finish and the non-blocking
select could run before the answering goroutine reached its defer, so
the race leg reported auto answering the question itself when the user
had in fact been asked and had picked B.
Controller.Ask has no posture branch: every mode emits AskRequest and
waits on the reply. The signal now closes on receipt, ahead of the
answer, which puts it ahead of the turn's end.
TestIsTransient built its reset error from syscall.ECONNRESET, which on
Windows is the APPLICATION_ERROR placeholder the package exists to stop
matching. IsTransient correctly refused it, so the Windows leg failed.
The refused case already drew from refusedErrors; the reset case now
draws from resetErrors the same way.
TestIsConnReset carried the same literal and passed on Windows only
because every *net.OpError is a net.Error, which never exercised the
reset identity at all.
393ec8eed removed desktop/third_party/go-webview2 with the Wails shell,
but desktop-windows still cd'd into it after go test ./..., so the leg
failed on every push regardless of what changed. The module's own
tests are all that remain to run there.
The macOS leg's note about cgo dock-icon glue goes too: desktop/ has no
darwin-only files and no cgo left.
The shell's smoke suite judges the workbench window, and a data home with no
model configured opens on the onboarding card instead — where none of that
window exists. The drag-region check then failed with "no .chrome", which
reads as a defect in the title bar and is the suite never reaching its subject:
run over an empty home, that judgement had nothing to weigh and said so in a
way nobody would read as nothing. It now brings the home to the state its
judgements assume before the shell reads it, and leaves a home that already
carries a configuration exactly as it is.
The contrast sweeps reported a disabled button. WCAG exempts text in an
inactive user interface component — a control greys out precisely to say it is
not one you can use — so 3.92 against a floor of 4.5 was a number nobody could
act on, sitting above the ones somebody could. Both sweeps skip an element
inside a disabled control, and dark comes back clean over twelve sections
where it had one finding.
The built-in verbs are worded by the kernel and read in a window, and the two
need not agree: a machine whose CLI speaks Chinese can have an English window
on it. The endpoint read config's desktop language and, where none is set —
the default, meaning "follow the machine" — fell through to the catalogue this
process installed from its own $LANG. So an English window on a Chinese machine
opened a Chinese menu under an English composer, twenty-one entries of it.
The window is the authority on what it is drawing: it has already adopted a
configured language, and where none is configured it follows its own locale,
which the kernel cannot read. So the request carries it and the config answers
only for a client that says nothing.
Verified in the shell it is about: with no desktop language in config and the
kernel's own LANG set to zh_CN, an English window's menu comes back with
thirty-nine entries and no Chinese in any of them; the i18n sweep over the same
kernel goes from twenty-two findings to one, the 中文 in the language picker.
The catalogue is keyed by the Chinese source text and assembled by spreading
ten modules into one object, so a key written in two of them keeps whichever
spread came last and the other reading is unreachable. Five keys were written
twice with different values, and three of them were rendering the wrong word:
记录 was "Save" beside the metrics and "Transcript" beside the graph, and the
graph won — so the button that records a model's context window read
"Transcript". 还原 was "Restore" for the window control and "Revert" for a
file, and the file won, so the maximised window's restore button announced
itself as Revert. 改动文件 names the edit_file tool in the permission rules
and a count of changed files in the chrome; the chrome won.
Where one Chinese word carries two meanings the fix is two Chinese words, not
a cleverer lookup: 保存 for the button that records a value, 向下还原 for the
window control, which is what Windows calls it in Chinese. The other two
conflicts (模型, 取消) rendered the same either way and lose the definition
that never won. Twelve keys written twice with identical values lose their
second copy.
The guard reads the sources rather than the assembled object, because after
the spread the loser is gone: neither the type system nor the runtime can see
a duplicate across two object literals. It also checks that the reading covers
the whole catalogue — an entry the pattern cannot parse is one it cannot find a
second definition of either — which is what caught the bare keys prettier
leaves unquoted, Chinese being a valid identifier.
stream_options was sent unconditionally to every OpenAI-compatible endpoint.
It is a 2024 addition, a gateway that predates it or forwards strictly rejects
the request that carries it, and all it asks for is the usage record — a token
count, not anything a turn needs. So a relay that other agents drive fine would
refuse every single message here, which is what a user reported.
The client now asks that endpoint once: when a body is rejected it retries
without the field, and if that answers it stops sending it. Asked once per
endpoint rather than on every refusal, so a gateway that rejects bodies for
some other reason is not probed twice forever, and the statuses that earn the
question are named — 400, 413, 422 — rather than taken from the 4xx range,
because 402 means the account cannot pay and a second request changes nothing.
Verified against a gateway built for it: a relay that rejects stream_options
failed every turn before and completes one now, sending the field once and
never again.
One side effect stated rather than claimed: openai's client leaves the
struct-state report, and not because it shed fields — it still carries twenty
scalars. Grouping authed with the two new facts means the client no longer
holds a concurrency primitive directly, which is what that rule looks for. The
budget is reclaimed rather than kept, so the next atomic added back to the
client fails immediately instead of fitting under an allowance it did not earn.
Reasonix is an agent, so a model it cannot hand tools to cannot run a turn.
The check sent messages and max_tokens and nothing else, which is why a relay
that answers chat and rejects a tools array passed verification and then failed
on the user's first message — with the settings panel still showing the model
as checked.
The probe now carries one tool. When the body is rejected it asks again without
the array, and reports "tools" only when removing it is what made the request
answer: the finding is the second attempt succeeding, not a word in the
refusal. A credential or a rate limit earns no retry, since the second call
would be refused for the reason the first was, and the one-attempt rule that
test pins stays intact for them.
Neither this nor the connect button ever claimed more than it proved — the
connect probe only lists models, as its own comment says — but "connected,
OpenAI-compatible" reads as "ready" and the model row said checked. Now the row
can say the endpoint answers chat and refuses tools, which is the one sentence
that sends the user to a different gateway instead of into a failing session.
Three subjects come out of evidence.go, each one a different kind of thing:
ledger_queries.go is what the ledger can be asked (thirty Has* answers, each
reading recorded receipts only), verification_command.go is whether a shell
command counts as verification — read from its parsed shape, which runner it
invokes and whether a flag turns that runner into something that writes a
report — and todos.go is the todo list as evidence.
evidence.go goes 2529 -> 723, which puts it under the 800-line ceiling: its
1729 lines of file-size debt are gone rather than moved, the first file in this
series to clear its own. essay and complexity travel with the code that carries
them (34 becomes 2+6+8+18) and neither total moves.
gateway.go held a third of the package and five subjects that answer different
questions: adapter_health.go (what each connection is doing, recorded as it
happens so a status command answers without asking the platform), slash.go (the
commands a chat can send and the text each answers with), approval_shortcut.go
(which reply counts as which answer to a pending approval or ask),
session_routing.go (which session a message belongs to, and the options one is
opened with), and outbound.go (what was sent, so the gateway does not answer
itself, plus the reactions to clean up).
gateway.go goes 2973 -> 1147. file-size drops 1826; essay, complexity and
function-size are unchanged. Emit, Start and Stop stay where they are — they
share a name with methods on other types in this package, and the gateway's own
lifecycle is what gateway.go is for.
The ACP package had ten files and one of them held a third of the package.
Three subjects come out of it, each a thing the protocol names rather than a
slice of the implementation: session.go (new, load, resume, prompt, cancel,
close and the lookups they share), session_config.go (which axes a client may
switch on a live session, and how a pending change merges and applies), and
session_meta.go (the sidecar that remembers a session between connections).
service.go goes 3047 -> 1676. file-size drops 1371 and every other budget is
unchanged — the same code, the same rules, read in the order the protocol is.
Extensions to extensions.go, steering to inbox_steer.go, the job verbs to
jobs_bridge.go, plan mode to planlifecycle.go, and close/rotate to
session_lifecycle.go — each into the file its subject already had. The turn
entry points get a new one: Send, RunTurn and the loop they drive are what a
frontend calls to start work, and turn_orchestrator.go is over 670 lines
already.
controller.go goes 2024 -> 1430, so its overage is 630 where it was 2432 two
commits ago. What stays is the constructor and the accessors — the session
state every subject reads — which is what a controller is once its behaviour
lives beside the state it acts on.
file-size drops another 594. The other budgets are byte-for-byte unchanged,
including essay: the one line this pass added was a four-line file note where
three is the limit for that position, and it says the same thing in three.
Seven groups of methods move to the file their subject already owns: skills to
skill.go beside skillSet, checkpoints and summarize to checkpoint.go beside
checkpointManager, memory to memory_command.go, the in-flight and interrupted
turn bookkeeping to turn_cancel.go (where appendUniqueString's four callers
already were), branches to branches.go, session artifacts and recovery notices
to session_snapshot.go, and the goal verbs to a new goal_control.go rather than
into goal.go, which is over the ceiling already.
controller.go goes 3232 -> 2024. The essay, frontend-parity, complexity and
function-size budgets are unchanged to the point — this is the same code under
the same rules — while file-size drops 1208, which is what a 2400-line overage
becoming a 1200-line one is worth. The baseline is updated with -allow-widen
because an extraction moves each file's share, and REASONIX.md asks for that to
be visible in the command.
The approval bridge earns more than a move. gateApprover decides whether a tool
call runs, and it sat in controller.go — outside the sensitive paths, which
name approval.go and approval_orchestration.go and could not reach it there.
approval_bridge.go is declared sensitive, so the review and the coverage floor
now cover it: 77%, against 94% and 91% for the two files beside it.
Two coverage floors move on their own merit — approval_bridge.go is new, and
shellsafe rose to 81.6% when the redirect guard got the tests its own comment
promised. The rest are restored to what they were: `covergate -update` had
raised every floor to one run's reading, and providerbroker's 83.6% was seen at
83.1% on the next, which is a gate that fails for no reason.
The comment said desktop/next is absent from frontendPorts because it drove the
kernel over HTTP, where wire-parity is the guard. That shell is retired; what
the note still has to say is why botruntime is absent, which is a different
reason — it never reaches the controller at all.
The three fields already had a lock of their own — externalFolderRefsMu sat in
the Controller beside the map it guarded and the tool-side registrar it fed —
which is the shape a collaborator takes before it has a name. It has one now,
and the lock travels with the state it protects rather than sitting among
forty other fields that answer to c.mu.
A strict leaf in the sense memoryManager set: register, resolve and roots touch
only their own map, so a dropped folder never contends with a turn's run state.
The three call sites lose the locking they were open-coding — dropped.go's
seven lines become one, and refs.go's prefix walk moves next to the map it
walks.
build-host.js ran go from desktop/electron, so Go resolved
../../cmd/reasonix-studio-host against desktop/go.mod — a main-module package
built in the desktop module's context, working only while that module's go.sum
happened to carry the main module's whole dependency closure. Retiring the
Wails shell ended that: `go mod tidy` there keeps what the desktop module's own
code imports, and the build stopped with a missing go.sum entry for sftp.
It now runs from the repository root, where that package's module is, and names
its output by absolute path since the working directory moved.
vite's proxy comment matched its Origin rewrite against "production and the
Wails shell"; there is one shell now and production is the whole claim.
release-studio.yml opened by saying which of two shells it builds. And a
completion test used a wailsjs path as its nested-file fixture, where any
nested path proves the same thing — that a file below the workspace is offered
and node_modules is not.
The comparisons that remain in release-studio.yml are load-bearing: they say
what the Wails line installed, which is what the Electron package has to take
over rather than sit beside.
Section 6 of the migration contract bound these into one transaction, because
deleting any one first leaves a broken shell rather than a smaller tree:
desktop/next and its event pump, remote_pump.go, /rx-replay, the frontend's
WAILS_* constants and bus branch, the apiPaths/apiPrefixes whitelist, the
vendored go-webview2 fork, and the Wails dependency with its CGO and
GTK/WebKitGTK build requirements. They go together here.
What allows it now is the condition section 7 named — no exclusive semantics
left — plus the one ledger entry that had been recorded as unverified: the
release line. studio-v2.11.0 (2026-09-01) through studio-v2.16.0 shipped the
Electron bundle seven times, and the crossing from an installed Wails 2.10 was
confirmed by the maintainer rather than assumed here.
The kernel loses what only that shell reached: update.LocalApplication (a
process that is its own application, which Electron's is not), update.Here,
appidentity's AppUserModelID application and shortcut repair — Electron states
its own appId — and crashreport.CaptureStudioPanic. AppUserModelID itself stays,
because Windows toasts still carry it.
Two consequences worth stating. The desktop module is now CGO-free, so neither
CI nor a contributor installs GTK or WebKitGTK to build it, and the webkit2_41
tag is gone from every command. And what the old shell installed is untouched:
winuninstall, the Electron shell's legacy takeover and studio_line's binary name
are how an installed 2.10 becomes a 2.11, and none of them are Wails code.
The contract becomes docs/STUDIO_SHELL_BOUNDARIES.md: the rules the migration
established outlive it, and the ledgers it kept do not. The presentation gaps it
tracked are carried over as known gaps, with the host's missing panic capture
added to them.
SetDesktopUpdateChannel was kept for pre-single-channel Wails clients, which
reached it through Wails bindings. Those bindings are gone — the migration
contract records their removal under version reading and pinning — so nothing
can call it, and its own package is its only mention. The legacy field it
cleared is still read: NormalizeDesktopUpdateChannel folds an old config's
value on load, which is the half that has to stay.
These three outlive the application they drove. `dev` runs `wails dev` in
desktop/, which holds no Go file at all since that app was deleted; `prod_test`
copies `desktop/wails.json` and calls `scripts/desktop-build.sh`, neither of
which exists, so it fails on its first command. `.wails-version` pinned the
Wails CLI for them, and prod_test was its last reader — the shell that is still
here needs no CLI, as scripts/studio-build.sh says in its own header ("Studio
has no wails.json, so this drives go build directly").
README and CONTRIBUTING told a contributor to run `make wails-install`, a
target the Makefile does not define, and then to launch
`build/bin/reasonix-desktop`, a binary nothing builds. They now name the
command that does work. CONTRIBUTING also asked for Go 1.25 where go.mod
requires 1.26, which sends a first-time contributor to install the wrong
toolchain.
This is the retired desktop's residue, not the Wails shell: desktop/next and
everything section 6 of the migration contract binds to it stay, because that
shell still compiles in CI and the contract retires it in one transaction or
not at all.
Thirty places built the same four lines — make with len(m), range-append,
slices.Sort — to get a map's keys in order, while nine others already wrote
slices.Sorted(maps.Keys(m)). The long form says nothing the short one does
not, and having both means a reader has to check each one for the difference
that is not there.
The four collectors that do not sort are left alone: their callers may or may
not be relying on something about the slice, and a shorter spelling is not
worth deciding that here.
Two ways to sort a string slice were in the tree at once — slices.Sort in 30
places, sort.Strings in 148, and internal/hook/inspect.go used both. Since Go
1.22 sort.Strings is a call to slices.Sort, so this settles which one a reader
meets, not what the code does.
The four files that would have grown by an import line are already over their
size budget, so their remaining sort.Slice calls move too: cmp.Or over
cmp.Compare says a multi-field ordering in one expression where the boolean
form needed a chain of ifs, and the four files come out shorter than they went
in.
math/rand becomes math/rand/v2 throughout. The seeded call sites all use a
fixed seed for repeatability rather than asserting particular values, so PCG
replacing the v1 source changes which sequence they walk and nothing about
what they prove.
Backoff stays as it is. Four packages compute a retry delay and it is tempting
to share that too, but provider caps at 15s and the stream retry at 8s to match
a reference implementation's timing, while feishu uses proportional jitter and
remote full jitter. Those are four calibrated decisions, not one judgement
copied four times, and the formula is the part that was never hard.
Three packages defined pathWithin and meant three different things. sandbox
excluded the root itself and normalized neither side; environment included the
root and cleaned both; instruction included the root and resolved both to
absolute. Two of the three decide a security boundary — instruction fences
@import against escaping the workspace, environment blocks executables under a
denied root — and a reader moving between them had no way to see the rule
change under the same name.
fileutil.Under and fileutil.AtOrUnder name the two questions apart and resolve
both sides before comparing, so a relative path or an interior ".." cannot
answer by spelling rather than by location. sandbox keeps the strict form on
purpose: /tmp is not a directory inside /tmp, and mounting it would not be the
same operation. Both of its call sites already passed cleaned absolute paths,
so what changes there is only that a future one cannot forget to.
The redirect guard gets the tests its own doc comment implied: eleven safe
spellings it promises to strip, and the file-reaching forms it must refuse,
none of which had a case. That also restores the shellsafe coverage floor,
which slipped when an earlier pass retired a fully covered wrapper.
boot/runtime_plan.go spelled out extension.ComponentID("plugin/" + name) on
line 50 and called sidecar.PluginNameFromComponentID on line 136 — the same
file encoding by hand and decoding through the constructor's own package. That
is why PluginComponentID had no caller: the one place that should build an id
built its own. The two halves also disagreed on whitespace, the constructor
trimming where the literal did not, and a manifest name keeps its surrounding
spaces (IsValidName trims only to match).
The kernel's own "is this a plugin component" test reads the prefix from
extensioncontract rather than repeating the literal a fourth time.
Fifty-seven comments carried a development stage or phase — "stage 7",
"Stage 6b1", "Phase 0" — that no document in the tree defines. A reader who
never saw the plan they came from loses nothing by their removal, which is
what REASONIX.md asks of a comment. The budget is now zero, so the rule stops
being a ratchet and starts being a gate.
Three of them were not only unreadable but wrong, because a comment naming a
future stage goes stale the moment that stage lands:
- SandboxConfig said reads were unrestricted and that confining bash was
still to come, while the struct it documents carries ForbidRead, Bash,
Network and HostAuthorities.
- Activator said stage 2 wires none; boot has installed one since.
- UIHandler said stage 8 would wire real frontends; the host UI hub serves
them now.
Where a stage is a real step rather than a plan — the rewind overlay's three
screens, restoreReleaseUnit's stage-then-swap — the step keeps its meaning and
loses only the number, which the reader had to count anyway.
pluginpkg.validRuntimeProviderRef said in its own comment that it mirrors
extension.validProviderSlotTarget, and it did — by hand, with the two-branch
shape retyped and the whitespace check repeated. The parser decides whether a
package may install and the kernel decides whether its claim resolves, so the
two disagreeing is a package that passes validation and then cannot bind.
pluginpkg cannot import the kernel (extension -> hook -> pluginpkg is a cycle),
which is what extensioncontract exists for. Both now read the rule from there,
so agreement is structural rather than maintained.
boot.splitProviderRef keeps its own shape on purpose: it cuts at the first
slash and tolerates what has none, which is parsing a user's input, not
validating a kernel ref. Sharing a name with the strict one is a separate
hazard and stays as it is.
Thirteen exported functions each forwarded to a fuller form with one argument
filled in — RenderTOMLForScope(RenderScopeFull), StartPackagesWithPlan(nil,
nil), decodeForDirection(direction, strict), NewProviderWithProxy(ModeAuto) —
and production used the fuller form every time. The shorter shape had one
audience, the tests that wanted fewer arguments, so it now lives beside them:
a same-package helper where the fuller form is unexported, a direct call where
it is not.
environment.RunProbesWithOverrides shows why the shape keeps coming back: the
previous pass retired RunProbes onto it, and it turned out to be the middle of
three generations, itself forwarding to RunProbesWithOptions.
ClaimRename, SharedCatalog, CommandOverview and SharesRepo each forward to
something the tree still calls, from tests alone. fileutil.GlobSet went further:
the type, its constructor and its Match method had no user in any module, so
what survives the file is the two slash helpers other packages do call, under a
name that says what they are.
MatchSlashGlob keeps a behaviour worth stating, since the deleted GlobSet was
where it was covered: a "**/" prefix also matches at the root, which doublestar
does not do on its own.
Three packages each carried their own answer to "is this socket failure worth
another attempt": provider.IsConnReset, the duplicated case inside
ClassifyStreamInterrupt that its own default already covered, and feishu's
isTransientError, which fell through to a list of English substrings.
All three matched syscall.ECONNRESET, which on Windows is an APPLICATION_ERROR
placeholder rather than a socket code — errors.Is against it cannot match what
the runtime returns there, so the sentinel arm was dead on that platform and
the substring list was the only path left. That list reads the operating
system's own sentence, which arrives localized, so on a non-English Windows
neither arm fired and nothing retried.
internal/neterr holds the judgement once and names the identities each platform
actually reports. netclient's transport-error trimming was the other text
match: net/http hands back a *url.Error whose Op and URL are the prefix it was
cutting by hand, so it reads the field instead.
Seventeen exported kernel functions were reachable from tests alone. Each one
forwards to something the tree still calls — ensureBranchMetaUnlocked,
UpdateBranchMeta, editConfigFile, CommandDirsForRoot, DecidePlannerRoute,
RunProbesWithOverrides, ClassifyWorkspaceNonMutatingCommand,
SessionGrantRuleForScope, acquire — or, for LoadRecoveryDefaultsForRoot,
ResetOfficialProviderPricingOnUpgrade and TaskWarrantsPlanner, says in its own
doc comment that it exists for callers that no longer exist. A test calling the
wrapper is not covering the path production takes; it is keeping a second
entrance warm. The tests now call what production calls.
event.FanOut had no user at all: the type, its constructor and its whole file
were reachable only from the sink-capability guard's fixture list, which covers
the three wrappers boot actually chains.
AcquireWithExternalTimeout carried one thing its callee does not, a rejection
of a non-positive budget. That contract was the wrapper's own — acquire treats
zero as "follow ctx", which is what Acquire passes — so the case asserting it
goes with the entrance it belonged to.
adapters.go offered seven Contributor factories that each ran their own
discovery — command.LoadRoots, hook.Load, skill.Store.List. boot discovers
first and hands the kernel resolved records, so it built its contributions
from the single-record mappers and wrapped them in an anonymous "boot-legacy"
ContributorFunc instead. The two models are exclusive and only one of them
ever ran; the factories were reachable from tests alone.
Delete them and the two mappers only they called. The package comment claimed
the adapters wrapped discovery, which stopped being true the moment boot took
discovery over, and it now says what the file does. It also records that
KindPrompt and KindTheme have no contributor at all: pluginpkg parses a
package's prompts and themes and nothing carries them to a snapshot.
`default_tool_approval_mode` reached exactly one shell. The Wails binary read
it and called SetToolApprovalMode; the Electron one never did, so the same
config opened Ask in Studio and the configured mode in the shell it replaced.
The hub then propagated that wrong posture to every later pane on purpose —
`h.stance` takes whatever the first controller came up with, which is the right
rule applied to a value nobody had set.
It belongs in the shared assembly rather than in whichever shell remembers it,
so `boot` now hands back a controller already in that posture, for the desktop
surface only: a terminal frontend states its own on the command line, and
`reasonix serve` is left where it was. An unset config normalises to Ask, so
this loosens nothing nobody asked for.
`internal/boot/effect_test.go` asserts both sides through the real assembly.
Reverted, it reports `ToolApprovalMode() = "ask", want "yolo"` — the sentence
the report described.
The same change also retires a second field for a setting that already had one:
yesterday's `measure` and the existing `desktop.conversation_width` are the same
question, and the older one had a setter, a renderer and installs that may
already carry it. The endpoint now reads and writes that one, as `width`.
Two changes that look like one, and are not.
A clipped command is not a preference. `--doc` held the whole transcript to a
reading line length, so a Bash line ran off at `rm xiangqi.html xiangqi.js
xi…` and the rest of what it deleted was simply not on screen. Cards, commands,
code and output now take the container's width — a new `--wide` — while prose
keeps the measure it was given. The three places that align to the transcript's
left edge (the tabs, the run header, the task list) follow the container, not
the measure, or they would sit 100px off it.
How far prose runs is a preference, and it now has a setting: 外观 → 行宽, beside
the body size, because they are one question asked twice — how big the letters
are, and how far they run before the eye comes back. Two answers, not four: a
line short enough to find the next one, or a window used to its edge. A step
between them would be a number nobody could tell from its neighbour.
Measured at 1920: the transcript was 706 wide in a 1288 column, 291 empty on
each side. It is now 1120 at the default and 1180 when someone asks for the
window. The composer's own width was computed from a different subtraction than
the flow's, which nothing showed while both were clamped by the same max-width
and showed as a 14px misalignment the moment they were not.
`renderAppearanceSection` is hand-written and drops what it does not know, as
its own comment says: the field reached disk through the endpoint and was gone
from `/appearance` on the next read until it was added there too.
A Windows update runs the *previous* install's uninstaller first, and
electron-builder's uninstaller takes $INSTDIR whole — it enumerates every entry
under the directory and moves it aside, then `RMDir /r $INSTDIR`. It is not a
record of what was installed. With `allowToChangeInstallationDirectory` on, a
person can point that at a folder that already holds their work, and nothing
says a word until the next update removes all of it. What it moves aside goes
to $PLUGINSDIR, which is under %TEMP% and swept when the installer exits, so
there is nothing to recover.
Reproduced on a real machine with the shipped v2.15.0 and v2.16.0 packages:
four files in the chosen folder, all four present after the install, all four
gone after the upgrade.
The choice of folder is the only place left to refuse, because an upgrade runs
the uninstaller that was compiled with the *old* build. So this lands in the
directory page (`.onVerifyInstDir` greys out Next) and in `customInit` for the
silent `/S /D=` path, which never sees that page and is how a scripted deploy
names a folder. A folder carrying our own uninstaller is the one that may
already have things in it — that is what an upgrade is.
Verified against a build of this change, silently, on Windows:
into a folder with files in it → exit 2, files untouched, nothing installed
into an empty folder → installs
over our own install → installs
Two notes on the NSIS side: this file is included before electron-builder's own
script, so LogicLib has to be included here (its guard makes that a no-op) and
${UNINSTALL_FILENAME} is not defined yet — PRODUCT_FILENAME arrives on the
command line, so the name is built the same way common.nsh builds it.
This cannot help an install that is already sitting in a shared folder: that
machine's next upgrade runs its existing uninstaller, which has none of this.
A new sweep refuses every write the settings panels make and asks the four
things a refused write has to answer: did the control roll back, did the window
say anything, is anything stuck, did anything go uncaught. Seventeen writes
across twelve panels; sixteen answered all four.
The one that did not was activating a theme pack — `.catch(() => {})`, so the
card sprang back to the palette that is really on and the window said nothing
about why. Clearing a wallpaper swallowed its refusal the same way. Both now
land in the state this screen already had for the one write somebody
remembered, which was being rendered inside the wallpaper block: a palette that
would not activate is not news for the wallpaper section, so it is said at the
top, where the rest of settings says it.
Two judgements in the sweep had to be fixed before the report was worth
reading, and both are a probe answering for something other than what it names:
a panel that sends no write was being scored on whether its control rolled back
(nothing was injected, so it had not), and one shared error sentence made the
previous panel's message part of the next panel's baseline — four panels that
did speak read as silent.
Deduplicating the i18n sweep's findings — one string is one finding, wherever
it was first seen — took the report from 49 lines to 33 and brought 25 real
ones out from under an error card that rides every section and was being
counted 29 times.
What they were: the completion menu rendered its kind column and its key hints
straight from a constant table, past t(), which no static check can see —
`t(variable)` hides its key from every one of them. And the built-in verbs are
rendered by the kernel from the process's catalogue, while the window reads the
interface language: a machine whose CLI speaks Chinese showed an English window
a Chinese menu. The kernel now renders that catalogue in the language of
whoever asked, which is a per-request answer because a menu is.
What is left on an English screen: the kernel's error text, which rides the
event stream to two frontends at once and so has to carry a code rather than a
sentence, and the language picker's 中文.
Also: the fixture's "this machine has a provider" belongs to a window, not to
a module. Holding it per module leaked between tests — four of them failed
together and passed alone, which reads exactly like flake.
The i18n sweep was opening settings by an English aria-label the button had
already stopped carrying, and threw rather than passing — the one of the three
that failed loudly. The contrast sweep found the same button by trying both
languages, so it kept working and kept its own copy of the walk. A step is a
claim about what the window can be driven to show, and two copies of that
claim drift: the walk now lives in tools/steps.mjs and all three take it.
Two ways a sweep was proving nothing while reporting zero:
The contrast sweep switched themes by setting `data-theme` by hand. A pack
writes its palette to `root.style`, which outranks that attribute and does not
move until the window repaints — so the "dark" pass was reading a pack's light
inks under a dark stylesheet, a state nothing renders, and reported ten
failures in it. It reloads into the theme now, and prints the theme that
actually painted, because two passes over one theme also report zero.
The i18n sweep set `rx-lang` and trusted it. The kernel's own language setting
outranks that and reloads the window with it, so a home configured for Chinese
turned the sweep into a Chinese window reporting Chinese: 4012 hits, not one of
them a finding. It reads back what rendered and refuses to go on otherwise.
Its walk goes from 12 settings pages to 29 sections. What is left on screen in
English is the kernel's own error text — a separate setting, tracked — and the
language picker's 中文, which is written in its own language on purpose.
The connect card is the first thing a new machine shows and the last place to
be stingy with ink: its field labels, the env-var name beside them, the note
under the button and the line under the brand all sat between 2.71 and 3.46
against AA's 4.5. They were white at .30–.38 opacity on a near-black scene;
.48 reads without taking the scene's own darkness away.
The sweep had been reporting the brand heading at 1.00 — text painted through
a gradient has no colour of its own to weigh, so its transparent ink resolved
to the surface behind it. One impossible number sitting on top of five real
ones is how a report stops being read.
A rule written for a row that does not exist. `.lrow .ds` was declared twice,
and the second one — paired with a `.lrow .nm` the interface has never
rendered — clipped it to a single line with an ellipsis. All 26 descriptions
in settings were cut at 820px wide with no way to read the rest; they now
wrap, in the size and colour the first declaration always meant.
Two strings painted over their neighbours rather than being clipped: a word
longer than the box it had been squeezed into (`overflow-wrap`), and a status
that had nowhere left to go on a row that would not wrap.
What is still deliberately clipped now carries the whole string on `title` —
an MCP server's line, its tools' descriptions, a provider's host, and the
activity row, where the tail of an error is the half that says what failed.
`--accent-ink` cleared the completion popover at 6.4:1 and the selected row
inside it at 4.40. The darkest surface an ink lands on is the one that sets
its value.
And the boot line's Chinese was under Latin letterspacing, which pulls Han
characters apart for no reading it helps.
Two things the token validator cannot see, because every value involved is a
legal colour on its own.
Contrast is a property of a pair. All nine shipped packs put `fgFaint` — what
`--faint` and `--ghost` are drawn from — below AA on their own surfaces: 2.56
to 3.58 against a line of 4.5, which the default appearance has always met.
A light window under a pack reported 137 unreadable strings. Each value is
moved on lightness alone, so the palette keeps its hue and chroma, and
`TestShippedPacksMeetTextContrast` now holds the set to the line. The one
string left is the in-use badge on a selected model row, which had stayed on
`--faint` over the accent wash while everything else in the row stepped up.
Contrast is also the reader's, the way reading size already is: a pack states
a palette, not how legible it has to be for whoever is in front of it. Pinning
`--text` inline won every step of the setting, so someone who asked for
stronger text got the author's answer for as long as the palette was on. A
pack's inks are now read as the step someone who never opened the setting
sees, and the two stronger steps are derived from them by the same lightness
the built-in palette moves.
The interface sweep had been walking five of its thirty steps and reporting
the rest as skipped. Three things were behind that, and each of them failed
silently:
The entry script answered the connect card on fixed timers — 200ms, then
1800ms for a probe that takes longer — so it walked away from a card still
on screen, and its return value was dropped rather than printed. A dozen
unreachable steps read as a dozen skipped ones.
The steps named their controls by label and by DOM shape: `.sesstitle` had
not existed for months, so the step meant to open a session "succeeded" into
the rename button beside it, and the tab steps looked for English the window
only renders in Chinese. They now name the intent the interface declares —
`data-action` — which is the one thing that moves with neither.
And the fixture held "this machine has a provider" per port instance. A
session opens a second pane, which builds its own port, which had never been
given a key: the connect card came back over a window already in use.
Thirty steps, nothing skipped.
`.main` took a `--surface` background, and it is the one surface in the
middle column that the `data-bg` set never hands a transparent one: the
rails, the panes and the app itself are all cleared when a pack brings a
picture, so an image survived at the edges of the window and was painted
over everywhere a transcript is read.
The pack was loading the whole time — the asset answered 200 and the
alpha was right — which is why this read as "the image stopped showing"
rather than as a missing file.
`test (full)` timed out at 20 minutes on three separate pushes, each time
with every package it had reached reporting ok and the step dying mid-run.
The budget was set to sit "above normal full-suite wall time (~8-12m)", and
that is no longer where the suite is: green runs on this branch measured
520s, 661s, 844s, 874s, 885s, 936s and 976s, while the three that died
measured 1287s, 1295s and 1305s. 20m was inside the distribution, so a slow
runner arrived as a failed test — the same reading the package budget above
was widened to stop producing.
30m keeps what the step is for: a hang still dies on it rather than on a
package timeout that names the wrong cause.
Opening a second conversation left every answer in it rendered as its own
source text, and switching back left the first one that way too.
The three deferred plugins are held in module slots and read with
`useState(slot)` — and a plugin is a function, which React takes as a lazy
initializer and calls. What the state then held was not the attacher but the
transformer it returns, and unified attaches that in turn: it runs with no
tree at all, which is the `Cannot use 'in' operator to search for 'children'
in undefined` the renderer threw into SayCard's boundary. A boundary does not
reset, so the card stayed at its source text for as long as it was mounted.
The highlighter has therefore never worked past the card that loaded it: the
listing that triggered the fetch rendered, because the value that reached it
came from setPlugin rather than from the initializer, and every card mounted
after that fell back. katex escaped it because its slot holds
`[plugin, options]`, an array; gemoji did not.
The three hooks were one shape written three times, so they become one that
takes the slot, and every read goes through a thunk.
Measured in the workbench against a mock kernel: opening a second pane went
from 2 rich / 3 plain with two TypeErrors to 5 rich / 0 plain with none, and
highlighted tokens from 3 to 9. Markdown.plugins.test.tsx mounts a listing,
waits for `code.hljs`, then mounts a second card — and fails on exactly that
TypeError with this change stashed.
modernize fails both Index-then-slice pairs in tsRecordKeys, and the
lint job runs with cross-platform build tags where the root `make lint`
does not reach the desktop module at all.
TestAnUncontendedHoldStillReports acquired and released with nothing in
between and then asserted Held > 0. Go's monotonic clock on Windows
advances on the system tick, about every 15ms, so the whole hold fell
inside one reading and the account came back {Held:0s} — the test was
asserting clock resolution, and only that platform was red.
The hold now spans 40ms and the assertion asks for 30, the same shape
the idle test beside it already used. What it proves is unchanged: an
uncontended hold is accounted for and reports no contention.
The committed readings gate what the desktop reducer is checked against,
so stabilize() strips everything that is a measurement rather than turn
structure — a tool call's DurationMs has been zeroed there all along.
The workspace lease account arrived beside it carrying heldMs and idleMs
and nothing stripped them, so the file recorded how long one run of the
test happened to hold the lease: 24ms when it was written, 23ms on the
next machine to run it. The test could not pass twice.
It failed on ubuntu, macos, windows, race and coverage at once, which is
what a fixture keyed on wall-clock looks like rather than five separate
breaks.
Waited, held and idle are zeroed with the rest. What the fixture still
carries is the fact that a lease event was emitted, where it sits in the
turn, and that it was uncontended — the shape the reducer is judged on.
PROJECTION_CAUSE_WITHOUT_SOURCE stood at 17: every interaction whose
lifecycle axis reached Transcript's presence carried an unmount-open
cause with nothing behind it, so the invariant the reduction exists to
hold — a projection always names its sources — was broken tree-wide by
one component.
Openness is decided over every effect a component owns, and the sources
were read off `d.by`, which is the single effect a displayed line names.
Transcript has twelve: the one that makes unmountOpen true is the
useEffect at 456 whose cleanup the walk cannot read, while `by` points
at 325, the first with an open setup and no cleanup at all. Reading a
cleanup off an effect that has none yields an empty set, which is a
debt with no mechanism under it.
The predicates are now declared once and both the verdict and the
attribution read them, so the two cannot diverge again: mountOpenBy and
unmountOpenBy are the effects the verdict was taken over, and a cause's
sources are the union across them. The mount side had the same shape and
was one component away from the same result.
census:verify is unchanged across all ten fixture reports.
The account the kernel closes at each release is five integers with no
path, command or identity in it, so it can ride the channel that already
has consent: three closed enums added to the upload allow-list, and a
group on the dashboard beside the other settings metrics.
lease_hold contended | uncontended
lease_wait the existing latency tiers, contended holds only
lease_idle how much of the hold came after the last write asked
The third is the one that decides anything. A high contention rate with
a low idle share means the lease is held exactly as long as it is used,
and the proposal to release at the last verification would return
nothing; the reverse says the opposite.
Flushed on its own rather than into the turn's batch, because the lease
is released when a session's last run ends and that is not reliably
before the TurnDone that empties the batch. Nothing here changes who
reports: the policy is unchanged and still refuses a non-release build,
CI, DO_NOT_TRACK, and anything but an interactive session under `auto`.
A hold with no length has no idle share rather than a share of zero,
which would read as a hold measured to have been busy throughout.
The dashboard's group table moved to a file of its own instead of
stats.ts growing past its ceiling, and the 17 lines that file had been
carrying are reclaimed.
The kernel now closes an account at each release; this is what reads them.
It reports holds, how many were contended, how long those waited, and the
share of each hold that came after the last write asked for the lease.
Four things it refuses to let a number mean something it does not. The
denominator is holds, so a session that wrote and never waited counts —
it is most of the rate. contended and reported are separate columns,
because a wait inside the one-second grace never becomes a notice and
those are the common case. A zero-length hold has no idle share rather
than a share of zero. And a log the size cap truncated makes every
number a floor, which is said in the rendering rather than left for the
reader to remember — the frames that go missing are the ones written at
the end of long turns.
Run against every session on this machine it reports 35 logs and no
holds, which is the honest answer: the instrument shipped an hour ago
and the corpus starts now.
The workspace write lease is the reason two sessions cannot write one
project at once, and whether that costs anyone anything had no number
behind it. The only record was a sentence on screen — "waited 2.3s" —
and only for a wait that outlived the one-second grace, which hides the
common case entirely.
workspacelease.Stats closes one account per hold: contended acquisitions
including the ones under the grace, how many became notices, total time
waited, how long the lease was held, and how much of that hold came after
the last write asked for it. That last one is the number the proposal to
release at the last verification stands or falls on, and nothing was
measuring it. It rides a shadow event, the shape TodoProgress already
uses: no gate reads it and no prompt byte moves with it.
Writing the test found a real ordering error: the ask that takes the
lease is dated before the acquisition it waited for, so Idle measured
longer than the Held it is part of. It runs from whichever came later.
internal/event/event.go was at the 800-line ceiling, so the audit
forwarders moved to a file of their own rather than the budget moving.
The card was behind a localStorage key no control ever wrote, so it was
not off by default — it was unreachable. What it reports is what the
turn changed, what it verified, and what went unverified, which is
exactly what a reader wants once the turn stops moving; without it most
turns simply stopped.
It is on unless this machine turns it off, and the switch now exists,
beside the other per-machine display choices. The kernel still decides
whether a receipt has anything to say; the preference only decides
whether a reader sees one that does. The control declares that it takes
effect from the next turn, because the reducer records the card when the
turn ends rather than the view choosing per render.
A shell row showed the first 96 characters of the command, which for
`PATH=$(echo $PATH | …) go test ./x` is sixty characters of plumbing and
no verb. Which part of a command names what it runs can only be answered
by a parser — a regex over the text is the word-matching this tree does
not build — so the kernel answers it: shellrun.OperativeCommand cuts the
leading assignments positionally, from the parsed command's own byte
offsets, so quoting and substitutions survive as written. It rides
ShellExecution.Subject and never replaces the command: authorization
surfaces carry the full text, and so does the row's title.
Declaring that pair in wireparity found three drifts already there:
shellVersion and supportsAndAnd were sent and unreadable — which is
PowerShell 5.1, where `&&` is a syntax error, arriving indistinguishable
from 7 — and contextTokens was declared here while only Tool sends it.
A MultiEdit card named its file in the headline and again in the diff
header, truncating one fact twice. The diff takes the path only where
nothing around it has said it, which is the change preview.
A settled call whose whole output was "ok" measured 109px, against 39px
for one that printed nothing — a 2.8x height for two characters. Nine
ordinary calls filled a screen, two thirds of it padded ground holding
nothing. A surface exists to cut a block of machine text into the page,
and one line is not a block.
Three separate costs, each measured:
- The block's own padding and ground: a one-line output takes neither.
- The "more below" fade, drawn on every settled card whether or not
anything was clipped. Clip already knows; it now says so.
- .term's 13px bottom margin, which held the surface off the next
element and holds nothing off anything once there is no surface.
A turn of nine plain calls: 1474px to 1162px.
The diff header wrapped a long path across three lines, so the card grew
by what a path happened to measure — 37px of header became 105px, and
the file read as an empty band above its own diff. It ellipses now, with
the whole path in the title.
The bar floats over the transcript's top edge, so a row landed at the
usual 12px clearance arrived underneath it — the first hit of a search
was the one hit that could not be read.
668 comment blocks, 1500 lines, met one aside at a time while reading
rules. Almost none of them restated the CSS: they are measured colours,
layout mechanics, and why the obvious rule is the wrong one — knowledge
worth more than its placement.
It moves to two companion documents read end to end. TOKENS.md holds the
vocabulary's law: why --float exists apart from --raised, what the
categorical palette was measured against, why the type floor is 11px.
LAYOUT.md follows app.css rule by rule.
No declaration moved: both files are rule-for-rule identical to what
they were, apart from the diff gutter taking --faint and the plan's
completed rows losing the opacity that dimmed them twice.
REASONIX.md states the rule and where a constraint goes: to the
component that has to honour it, or to the stylesheet's companion when
the decision is about the medium itself. It also states that comments
are written in English — commentary in two languages is two codebases,
and the half a reader cannot read is the half that rots.
`"[data-pane="flow"]"` closed its own string, and since 60b028856
cards, bench, look, motion, scale and verify have not parsed at all —
21 card-geometry assertions and 20 behaviour assertions that nobody ran.
selfcheck read that as health: it injects a false assertion and asks
whether the exit code turns red, and a SyntaxError is also non-zero. It
now asks whether the guard parses first, then whether it can fail.
contrast.mjs could only draw four of the transcript's cards, so the
diff gutter's line numbers sat at 4.42 against AA's 4.5 undetected. Its
feed now covers sixteen, which found five more: the plan's completed
rows were dimmed twice, by colour and by opacity, putting their text at
3.22 and the tick at 2.86. Three further corrections to the guard
itself: it stops animations rather than waiting them out (a staggered
entrance measured .cost at 2.04 while it sat at opacity 0.46), it prints
the ink, the ground and the ancestry rather than a signature that four
cards share, and it skips fully transparent text — unpainted text has no
contrast, and whether a hover-only control is reachable is another
question.
**Find in a conversation.** The transcript mounts a few dozen cards out
of however many the session holds, so the browser's own find sees only
what is on screen: with 200 messages, 59 cards are in the DOM and the
first one cannot be found at all. The search reads the rows instead —
saidBy() is exhaustive over Item, so a new card has to answer what text
it carries. Matches are painted with the highlight registry rather than
by wrapping text, which would mean rewriting markdown React owns inside
cards that re-render on every delta.
**Listings are highlighted.** rehype-highlight, lazy like katex, emits
classes rather than inline colours: a highlighter writing its own hex
values leaves the token system and stops following the theme. The
palette is four new tokens; comments and punctuation ride --faint and
--muted, so they follow the contrast tier. A fence with no language
stays unpainted — guessing a grammar paints prose as code.
**A message can be rewritten and sent again.** Composed from what the
kernel already owns: a conversation rewind to that turn, then a send.
The TS mirror of RewindResult was missing conversationOk, so a commit
that touched files and left the conversation standing was
indistinguishable from one that truncated it — which would send the
message twice. The type is completed and the pair is declared in
wireparity.
**The capability a call resolved to reaches the card**, when the name
has not already said it: `tool:grep` beside Search is one fact twice,
`skill:review` is not.
**The task list draws the status its owner keeps.** Three renderers
each re-derived "which step is underway" as the first unticked one,
while HostTodo has carried status, activeForm and level all along. A
list the kernel has written but not started now points at no step, the
step in hand reads as its active form, and sub-steps indent. A
complete_step advance reaches the panel on its own frame instead of
waiting for the turn to end.
Pane.tsx was at the 800-line ceiling, so find and rewind became hooks
rather than the baseline being widened.
Twenty-two of the fifty-four tools the kernel registers had no entry in
either table, so a call through use_capability rendered as its own
title-cased id under the mark that draws a page with a folded corner. A
delegation, a memory write and an install all read as file reads, and
the category colour — the row's only warning — was the neutral one.
install_source was the worst of them: it is not read-only, it installs
an MCP server, and it had no identity at all. It was found by the gate
rather than by the sweep, whose regex missed its Name() spacing.
The fallback mark becomes a neutral dot: "·" is a document, so a name
with no entry was claiming to have read a file.
tool_identity_test.go holds both directions — a registered tool with no
label, and a label naming nothing the kernel registers. A tool is a type
with a Name and a Schema; matching on the name alone reads every bot
adapter in the tree as one.
The rule in this tree is that an error a caller must tell apart carries an
identity and never a sentence. Tool results were the exception, and the
projection comment said so outright: "only that record says a tool call failed"
— meaning ToolExecution, which the shell path writes and nothing else does.
Everything else left the fact in the words, and isErrorMessage matched "error:"
against prose the tool itself wrote.
Measured across real sessions by day: the shell side was closed on 08-17 and
has written an identity for every failure since. The rest never was — 27 on
08-16, 10 on 08-17, 16 on 08-25, and still arriving in September.
toolOutcome already held what was missing. Its refusalCode comment even says
the identity is "carried beside the words rather than recovered from them" —
it just stopped at the message. ToolFailure now carries it: non-nil is the
fact, RefusalCode names a host refusal. Local metadata on the ToolExecution
pattern, so projection.go keeps it for the next compaction and strips it at the
provider boundary. isErrorMessage reads it first; the prefix match stays as the
answer for transcripts written before any of this, which is what it always was.
The identity also never crossed the wire. event.Tool has had RefusalCode all
along and eventwire.Tool did not, so no frontend could read one — parity was
silent because both sides were equally missing it. Both carry it now, the
history projection carries it, and a failure label says which refusal it was
instead of "失败".
ToolFailure and ToolExecution move to local_metadata.go: provider.go was 1087
lines against an 800 ceiling and -update refused to widen for the extraction,
which is what it is there for. Trimming one sentence that the new file's own
header already states brings both budgets down instead — essay 3218→3217,
file-size 38207→38188.
use_capability is one provider-visible tool that stands in for every hidden
capability. The card takes its heading, its hue and its argument summary from
what the call resolved to, which is why a live transcript reads "Remember ·
2026-08-20 会下雨" and not "MCP". Reopening the session read "MCP" with no
argument at all: three separate places dropped the identity on the way.
historyMessages projected ID/Name/Arguments and left ResolvedName and
CapabilityID behind, though provider.ToolCall carries both and their comment
says they exist for exactly this. The rebuild in state/session.ts then had
nothing to pass on. And shortArgs read only the envelope's top level, where a
proxied call has action and capability_id and nothing a reader wants — the real
call sits under `arguments`, a field the proxy's own schema declares, so
reading one level in is following the contract rather than guessing.
Measured on a real session before and after: one blank "MCP" card became
Memory · 天气 下雨, Remember · 2026-08-20（周四）会下雨, and a Remember whose
arguments were refused. The remaining MCP card is action=list, which resolves
to no capability and correctly says so.
historyToolCall joins mirroredWireTypes. It was a hand-written pair with no
guard, which is how a field goes missing on one side and nothing notices;
removing resolvedName from the TypeScript side now fails wire-parity by name.
The history projection moves to its own file rather than widening serve.go's
budget — 1294 lines against an 800 ceiling — which hands back 70 lines.
Narrowing the provider surface to what a turn admits left the estimate behind:
context_breakdown and estimatedVisibleRequestTokens both asked the registry for
Schemas(), which answers with everything provider-visible whether this turn
carried it or not. The estimate is compared against a window the provider
enforces and a maintenance line the host folds at, so an estimate that counts
tools no request carried folds earlier than the conversation needs.
The surface is recorded where it is already computed — run_loop asks
ProviderSchemas once per round and hands it to the prefix-shape capture — and
the two estimators read that instead. Before any request has gone out there is
nothing to have carried, and the whole visible set answers: it overstates, which
is the direction that folds early rather than overrunning the window.
lastProviderSchemas is on sessionCarryOver for the same reason lastPrefixShape
is: the next request rebinds it before anything reads it.
The gutter names a category twice: the mark carries the hue and the line under
it carries the same hue at 30%. net, deleg, write and ask each had both. mcp
had only the mark — its line fell through to the default grey, so the icon said
"this went out to the network" and the stripe beneath it said "ordinary tool".
mem had the same gap, unrendered in the fixture and visible only in the
stylesheet.
src/styles/gutter.test.ts reads both halves out of app.css and fails a mark
whose line carries a different hue, or none. host is the one exception and
carries its reason: its line is a dash, because colour names the category and
texture names who authored the step.
Found by measuring what the fixture actually paints rather than by reading the
rules — the two mcp declarations sit four lines apart and look complete.
Three states existed where the model could only tell two apart: in the schema
and callable, registered but hidden behind use_capability, and — the one that
was nobody's intent — in the schema and refused. update_goal lived in the third:
its ProviderVisible already reads the turn for a goal recorder and its refusal
already carries goal.no_active_turn, but provider requests asked Schemas(),
which answers without a context. Across 534 real sessions it was called 121
times and refused 116.
The reasoning for asking without a context is in SchemasForContext's own
comment: a contextual answer would churn the cache-stable contract. Under
alphabetical order it would — bash_output sorts fourth of twenty-five, and
moving it invalidates the twenty-one after it. Measured rather than assumed, in
benchmarks/tool-surface-cache: at the head a tool costs 896 cached tokens, in
the middle 384, and appended at the tail it costs nothing at all.
So ProviderSchemas sorts in two segments — every stable tool, then every
contextual one the turn admits — and the two request sites take it: the sampling
request, and the prefix-shape capture, which has to see what was actually sent
or the cache diagnosis reports a surface no turn carried.
The five guards that held the old surface are rewritten to the new contract,
which is stronger than what it replaces rather than narrower:
- the stable segment must be byte-identical whatever the context, and every
contextual tool must come after all of it, so an absence is a prefix of a
presence. Nothing asserted that before; it is the property the cache rests on.
- the contract/provider comparison matches by name. Position-wise only held
while the two sets were identical, which is exactly the assumption being
dropped.
- subagent and planner isolation now read the schema rather than the refusal: a
child without the parent's recorder must not be offered update_goal at all.
The executor, which holds one, still is — an asymmetry the old "always
present" assertion could not express.
The tool schema was held still on the reasoning that changing it churns the
cache-stable prefix. True of a change anywhere, false of a change at the end,
and nothing measured which applied.
Against deepseek-chat, 10 tools behind a 1278-token system prompt: appending at
the tail reports 2048 cached tokens against a 1920 baseline — more, because
every token before the new one is unchanged and the request is longer. The same
tool at the head reports 1024, and editing the fifth tool's description 1536,
which is the tail after the edit.
A tail tool alternating absent/present holds 1920 and 2048 across three
switches with no miss spike, because the absent surface is a byte prefix of the
present one and one cache entry serves both.
It reaches the network and spends a few thousand input tokens, so it stays out
of lint and CI, next to pricecheck.
A capability kept out of the provider schema is reached by listing the catalog
and then calling by id. The listing named every id and no arguments, so the
first call could only be a guess. Measured over 534 real sessions: 12 calls
went out against 3 inspects, and 5 came back "it requires ..." — the proxy
description does say "inspect one for its arguments before calling", and a 12:3
ratio is what that instruction is worth.
The two lists the contract error prints after a call has been spent are now in
the listing before it: required field names, and every declared property. Read
from the target's own schema through the registry, the same source inspect
already used, so a tool that changes its schema changes what list reports. An
entry that is not a registry tool, or whose schema declares no properties, says
nothing rather than reporting empty lists a reader would take for "takes no
arguments".
listCapabilities and listServers move to their own file. usecapability.go was
1667 lines against an 800-line ceiling and this would have added 23 more;
carrying the debt forward through -update is what the ratchet exists to refuse.
Split instead, and the file drops to 1557 — 113 lines of file-size budget
handed back.
Not done: projecting the hidden-capability catalogue onto the turn, which was
the other half of the plan. Built, measured, removed. The block ran 870
characters against a 3486-character turn — a quarter of it — and broke
TestEffectFoldDropsSupersededStandingState by moving the fold boundary. The
premise did not hold either: remember fails once on arguments and succeeds on
the retry in the same session, so the model finds it when a task calls for it.
Zero use across 534 sessions is 534 tasks that never needed to remember
anything, not a capability out of reach.
id="flowScroll" was written into Transcript, which renders once per pane, so
two open panes answered to one id and the rail's aria-controls pointed at
whichever came first — not necessarily the one it scrolls. The sweep only ever
reported it with two panes open, which is a state its 23-step walk does not
reach; it turned up on a session opened by hand.
useId per pane. The stylesheet and the perf scripts move to [data-pane="flow"],
an attribute the element already carried, so nothing depended on the id being
the same string twice. Specificity drops from (1,0,0) to (0,1,0) and the four
rules still land: .scroll is written earlier in the file, and the [hidden] rule
gains a second attribute.
#trajScroll in that same [hidden] rule has no element anywhere and is left
alone.
Vertically clipped output has two tells — the fade at its foot and "Show all".
Horizontally hidden output had none, and the scrollbar is an overlay: at rest
the line simply looks finished.
Measured over 499 real sessions, 7587 tool outputs: 54% have a longest line
past the ~80 columns this width fits, and 31.5% past 120. In one session on
screen, 19 blocks scroll sideways; the worst holds 2881px of content in a 624px
box, so 78% of it is off-screen with nothing saying so.
A right-edge fade on the same gradient as the foot, driven by the block's own
inline scroll position: opacity starts at 0, so a timeline that is inactive —
which is what an output narrower than its column has — draws nothing at all.
Verified by progress rather than by computed style, since an opacity animation
is composited and the main thread reads the base value: 0 unscrolled, 0.5 at
the midpoint, 1 at the end, where it fades out.
712 assertions, and audit-sweep clean at 1600/820 in both themes. The dupId it
reports for #flowScroll is present with this stashed — two panes, one id.
Four levels sit in the right rail, and the block title was at the bottom of all
of them: 12px w700 at --ghost, against rows of 13px at --faint, a legend at
--muted and values at --text. Smaller than anything it introduces, and the
palest ink in the column. Of the three signals it carried, two said "minor".
In English the tracked uppercase carries it — that is what an eyebrow is, and
the sweep has never had anything to say about it. Chinese has no small caps to
carry, so once the letterspacing came off there was nothing left but a slightly
bolder, slightly paler line the same length as the rows beneath it.
It takes the column's own size now and ink one step darker than the rows, so
weight alone carries the rank. Not a larger size: the context total went to 22px
to give this column one place for the eye to land, and six more large things
would be six more places. Size is what that landing is made of, and spending it
here spends it there.
The rule is split out of the :lang(zh) group rather than layered over it, since
:is() takes the specificity of its strongest arm and the group has a
three-class one. .side .lbl is named inside the new :is() for the same
arithmetic — the rail's own rule for it is written later in the file.
Six titles measured: 13px w700 --muted, no tracking, no transform. Clean at
1600/820 in both themes in Chinese, and in English, where the rule does not
apply; contrast-sweep reports zero across twelve sections in both schemes.
The sweep parsed getComputedStyle's text by hand, and a computed colour comes
back in whichever notation its value was authored in. An oklch colour arrives
as `oklch(0.85 0.012 255)` — lightness under 1, hue past 255 — and read as
8-bit RGB that is r=1, g=0, b=255, which is the #0100FF the report was full of.
Hue 262 gave b=262 and printed #0100106, seven digits wide.
So every settings page was being judged against colours nothing on screen has.
Ten rows of "below AA" in dark and eight in light were invented, and a real
failure among them could not have been told apart. A gate that misfires is
worse than no gate: this one was printing a verdict on eleven panels it was
not measuring.
It paints instead of parsing now, the way audit-sweep already did: fill a 1×1
canvas with the value and read the pixel back, which is the same engine that
drew the thing under test and accepts every notation there is. The fillStyle
reset before each fill is not decoration — an unparseable value leaves the
property at what it held last, and the sweep would report the previous
element's colour as this one's.
Both schemes now report zero across twelve sections. Raising --text to 88%
brings eight rows back with every colour legible, and dropping it again clears
them.
The light scheme's neutrals were laid out along hue 255. #EEF1F7 has more blue
in it than red, which is what an engineering tool looks like, and it sat under
an amber accent — the two are on opposite sides of the wheel, so the largest
surface in the window and the colour that means "you are needed here" were
quietly working against each other. They run along hue 85 now: #F4F1EA, red
over blue instead of under it.
Only the hue and the chroma move. Lightness is untouched at every one of the
52 declarations, so no contrast ratio was traded for this, and --raised and
--float keep a chroma of zero — a card stays white on a warm ground, which is
the arrangement that was drawn and chosen.
Dark keeps its blue. The two schemes' neutrals interleave through this file by
selector — :root under a media query, then [data-theme], then three contrast
tiers of each — so which side a declaration belongs to is read from its own
value instead: in light a surface is bright and ink is dark, and in dark both
are the other way round. 52 declarations moved and 52 stayed.
--shadow-float stays cool. It is a fifth of an alpha over the ground, and it
was not part of what was drawn.
contrast-sweep could not check this: on every settings page it now prints
colours like #0100106, a channel-parsing fault that reproduces with the change
stashed and predates it. audit-sweep's own contrast judgement is sound —
raising --text to 88% made it report 174 rows with the warm ground resolved
correctly in every one — and it reports none here, at 1600/820/760, with dark
unchanged.
Letterspaced uppercase is Latin lettering. Tracking separates words there; on
Han characters it pulls apart the strokes of a single glyph, and uppercase has
nothing to act on at all. The stylesheet already knew this — a :lang(zh) rule
hands seventeen small-caps selectors a normal face, no tracking and no
transform — but ten more had been written since, and one of them is the only
semantic heading the workbench has. In Chinese the right rail's block titles
were 11px at 1.54px of tracking, uppercase, with .dgrp-h's own count inheriting
both: 成本, 运行指标, 子代理, 本会话.
Which ones belong is settled by where the text comes from, never by reading it.
A class carries Han if its element's children call t(): .hl .fail says "{n}
项失败" and joins, while .hl .src and .hl .who sit in the same badge row and
stay, because what they render is an MCP server's name and a subagent's id.
.shot .glyph stays too — IMG, TXT, PDF are not words.
Two things that judgement cannot see, so both were measured in a running
window: a label handed down through props (.seglb, .dgrp-h) shows no t() at the
element, and it is exactly .dgrp-h that was worst.
audit-sweep grows a ninth judgement rather than leaving this to a script that
runs once. hanCaps reads resolved style — Han text under tracking or uppercase
— so it holds whatever rule set it, and it rides the walk into the panels a
render-time check would never open.
The first clean run was a false one: the sweep drives the kernel build, where
the language comes from the kernel's config and adopt() overwrites the
localStorage the fixture answers to, so it had been measuring English. With
[desktop] language = "zh" and .dgrp-h pulled back out, the sweep reports the two
rows; put back, zero. Clean at 1600/820 in both themes in Chinese, and at 1600
in English, where nothing in this change applies.
Monospace says a machine produced this: a path, a command, an id, a column of
figures that must not jump, a mark that has to hold its cell. The window was
setting its own sentences in it — "仅当前项目 · 后续相关时会被检索", "Palettes
install under themes/ …", every empty state, every settings footnote — and a
column of prose in that face reads as a terminal rather than as something
written. Measured on the fixture: 54% of the transcript's characters, 37% of
the right rail's.
The judgement is structural and never looks at the words, because a rule that
sorted sentences from identifiers by reading them would be the phrase table
this repository does not build. A class is monospaced if a rule in app.css
gives it var(--mono); an element renders prose if its own children call t().
The two together found 63 classes across 155, which a screenshot could not
have — a sweep sees what one render drew, and most of these live on panels a
walk never opens.
46 rules move to var(--ui). What stays is what earns it: terminal output, tool
arguments, paths, URLs, ids, every figure, and the marks. Where a rule wanted
figures not to jump rather than a face, --msub already said so with
tabular-nums; .fold gets the same, because it repaints every second while a
turn runs.
src/styles/mono.test.ts holds it, and holds the two exception lists apart. Nine
marks and keycaps carry a reason each, plus the welcome screen, whose wordmark
is deliberately set in the terminal's own face. Thirty-six classes render prose
and data through one box; splitting those is a change per call site rather than
per rule, so they are recorded and may not grow. A third assertion fails an
entry that stopped being needed, so the lists cannot outlive their reasons.
Reverted one rule to check the gate reports it, then reverted that.
Characters set in monospace: 42% → 33% overall, 54% → 45% in the transcript,
37% → 22% in the right rail. Held by audit-sweep at 1600/820/760 in both
themes against a kernel, and by 712 unit assertions.
Two numbers that only mean anything together. The transcript's prose was
13.5px in an 820px column, which measures 103 Latin characters or 56 Han to
the line — half again past the 45–75 / 30–40 where the eye still finds the
start of the next line without hunting for it. The column was right and the
size was small, so neither one looked wrong on its own.
--read moves to 15px, 16 in Chinese where the strokes are denser, and the
step ladder shifts with it so a reader who had already picked a size keeps
the one they picked. --doc goes to 706px, which is not taste: the narrowest
thing this column has to hold is 80 columns of IBM Plex Mono at --fs-ui,
measured at 624px, and the transcript's own indent and padding want 82px
more. The main-line terminal block now lands on exactly 80 columns.
Measured on the fixture at 1600x1000: the answer's line goes 103 → 71 Latin
characters and 56 → 39 Han, 36 at the Chinese default. Sub-pixel spill is
unchanged at seven elements, every one a 2px rounding that predates this.
Held by audit-sweep at 1600/820/760 in both themes, against a kernel and
against the fixture, and by the 709 unit assertions. Both sweeps still
report four prefs truncations and the oobe contrast findings; both are
there with the change stashed.
Twelve counts render in the rail and six of them say "0 会话". A machine row
counts open panes, so every machine says it at rest; a workspace with no saved
conversation says it under its own name, and the absence of rows beneath it had
already said so.
Plan.tsx settled this for the transcript — a block reading "0 / 0 · 尚未制定" is
a wall to skip on every glance — and the session row in this same file has
always followed it, printing nothing for a turn count of zero. The workspace row
and both remote rows did not.
An empty project has nothing to report and one thing to offer, which is the "+"
beside its name.
Five measurements, five changes, all in the stylesheet.
The transcript separated what the model said from what a tool did by colour and
leading alone — same 14.5px, same weight — so a column of them scanned as one
undifferentiated stream of events. The answer gets a size step; machine output
stays where it was. Its own breathing room widens with it, which pulls the
rhythm apart into three real steps: 22px between two machine rows, 32px across
the boundary into speech, 42px between two separate utterances. It was 22/28/34,
a ladder pointing the right way with treads too shallow to feel.
Every tool card carried a filled icon chip, which meant the fill said nothing.
It is transparent now for the neutral ones, so net/write/ask/deleg/mcp keeping
theirs turns the fill into the signal the gutter's own comment always claimed it
was. Their headlines keep the heavier weight too; the rest step down.
Settled output that succeeded is clipped to a glance. The criterion is outcome
rather than category: a call still running and a call that failed keep theirs,
because a failure's output is the only thing that step has to say. Measured on a
full turn: unrequested output 560px to 358px. The transcript itself only drops
7.6% — the bulk of it is card count, not output, and this does not change that.
The right rail read as a dump because it was set as one: 33 numbers at rest and
37 of its 62 text elements sharing two nearly identical steps, with a single
15px element as the only hierarchy. Nothing was removed and nothing shrank —
hierarchy by making five things smaller is five chances to make CJK illegible.
The context total goes to 22px and its gauge from 6px to 10px, so the eye has
somewhere to land and everything else becomes background by staying still.
The product introduces itself in Inter 200 under a 0.34em all-caps eyebrow,
which is what any product reaches for. Its own vernacular is the terminal, and
that face is already in the bundle: the wordmark is set in it, and the eyebrow
becomes a lowercase line. No new bytes, the metallic sweep intact, and no
overflow at 900px where a monospace wordmark could have found one.
Held by contrast/cards/motion/panels/overflow/press/lang, in both themes.
"Never: incident or conversation history" is a rule nobody recognises breaking.
A writer with a fix in hand narrates the fix, and the result passes every gate
there is, because the essay rule compares line counts and nothing reads
register. Meanwhile the instruction to write code that reads like the code
around it is unambiguous, and much of the tree reads as prose — so the tree
teaches the habit back faster than the rule removes it.
The rule now states its test — a reader who has never seen an earlier version
must lose nothing, and past tense about this code's own behaviour is the tell —
gives the paired example, says where the narrative does belong, and says that it
outranks the surrounding style. It also says no gate reads register and why one
will not be built: separating narrative from a statement of constraint needs a
phrase table, which is the one thing this repo does not build. That rule is held
by review, and saying so is better than implying a check exists.
repolint's paragraph no longer claims to enforce all of it.
Deleting a conversation another Reasonix process has open is refused, and the
refusal was a dead end. The pane map belongs to one process, so the sidebar
shows no pane to close, no button in that window would close one, and
session.in_use rendered as "held elsewhere — close it there first" while naming
no there. The guard had already read the lease in order to refuse and knew the
pid, the hostname and when it was taken; all of it was dropped at the boundary,
and the wording it left behind — still being written to — is not even true of
that case, since nothing is writing.
session.in_use_by carries the holder, and only when the holder is another
process: a lease this one holds does mean a write is in flight here, which is a
different cause and keeps the old code. Params already reach the window's own
wording, which is what busy's params exist for.
Verified against two hosts sharing a state root: the refusal named pid 88240,
pgrep confirmed that was the second host, and the delete succeeded once it was
gone. The rest of the flow was exercised in the same run and is sound — an
unheld session deletes, close-then-delete deletes, and the rail's own gesture
asks, deletes what it asked about, and sequences the pane close ahead of the
delete rather than racing it.
Orphan hosts are what produce the state in the first place, and nothing here
stops them being produced.
GET /todos has been publishing the canonical task list — the latest todo_write
merged with every complete_step advance — and the window never called it. The
panel derived its own instead, by parsing todo_write arguments back out of the
transcript, which is a second implementation of rebuildTodoState and drifted
from it two ways: it replayed no complete_step, so every sign-off was lost, and
it checked no receipt, so a list the kernel refused became the plan. Every
rebuild — on mount, on rebinding a pane, on a stream gap — reset the panel to
the list as the model last wrote it. A signed-off item rendered as the current
one and no later call could move it, which is what "the todo panel will not
clear" looks like from the outside.
The task list is not derivable from a transcript at all: the advances are not
todo_write calls, and the refused writes are. So fromHistory stops trying, the
window asks, and the reads that re-open a session are collected in one place
with the new one. A turn's end re-reads the list too, for the points it moves
with no event to say so — a cancel makes the kernel rebuild its own state. A
read that fails leaves the panel as it stands rather than blanking it. The live
path is unchanged except that a refused todo_write no longer sets the plan.
"A plan that ran to the end is spent" now has one definition, because two ingest
paths have to draw a finished list the same way.
todoItem is lifted to a named type and declared in wireparity: the desktop keeps
a hand-written copy of it, the two are compiled by different toolchains and meet
only over JSON. The handler moves to its own file, which takes serve.go 21 lines
further under its ceiling; the reclaimed budget is recorded.
withTodoIdentityTail decided it owed nothing whenever every step id was still
readable in the view. Ids are readable forever: they sit in the model's own
todo_write arguments. The statuses under them do not stay put — complete_step
advances the canonical list host-side without the model writing anything — so a
list the host had moved on went on reading as the model last wrote it, and the
next sign-off named an item the host no longer called current. complete_step
refuses that, which costs a whole round at full context to learn nothing about
the task.
Canonical state changing and no projection rendering the change is the case
"Detection is semantic" exists to forbid. Freshness is now decided against the
rendered line — citation and status together — through a single todoStateLine
shared by the note and the check, so what the projection says and what the
check looks for cannot diverge.
In 23 recorded sessions complete_step failed 16 times in 43 calls; five of those
are this, the largest single group.
Every session stays mounted and the off-screen ones are hidden with CSS, so a
tab switch throws away no stream, no transcript and no scroll position. That
trade is affordable only while the hidden panes are quiet, and one of them was
not: the /status poll was gated on the turn running, never on the pane being
visible. Each background pane with a live turn therefore cost a round trip and
a full re-render of its subtree four times a second, plus two JSON.stringify
passes over the status object, and the bill scaled with the number of open
conversations rather than with the one being watched.
The poll and the elapsed clock now need the pane to be visible; when the run
began is still recorded either way, so a pane brought forward mid-turn shows the
time that passed instead of restarting at zero, and the tick fires on the way in
so it is current rather than up to 250ms stale. The wait spinner in the
transcript gets the same treatment: ten redraws a second are wasted on a pane
nobody has open, and it reads from the stamp, so the tick on the way back in
covers the whole wait.
Measured on a real pane driven by a mock port with fake timers: four /status
reads per second per hidden running pane before, zero after. That is what the
new test asserts, and removing the visibility gate turns it red.
A turn that stopped with items still open was read as work left undone, and
continueUntilReady pushed it on for up to eight rounds with a message the host
wrote. That is right for a step the model can advance alone. It is wrong for a
step whose next input is the user's — presenting one item of a list and waiting
for a reply was indistinguishable from quitting early, so a list worked one item
per turn could not be worked at all: the turn stopped, the host restarted it,
and the whole list came out in one round.
Nothing about the shape of a turn tells those two apart, so a call does.
await_user joins ask and conclude_blocked as the third way a turn ends on the
model's terms: it names the waiting item and what the user must supply, the list
is kept as it stands, readiness waives the open list, and the continuation loop
does not run. Under a Goal the gate is a pause cause, so the FSM stops rather
than driving through it and the evaluator does not spend a call judging a turn
that already said why it stopped; the next user turn lifts that pause and no
other.
The guards are structural: there must be an open list, the step_id must name an
item on it that is not completed, and there must be an interactive user — a
headless run refuses and is pointed at conclude_blocked. The continuation prompt
names the call too, so the round being told to keep going can take it.
Prefix cost is 292 tool-schema tokens for the new schema, and every existing
session cold-starts its prompt cache once.
Left undone and worth its own change: conclude_blocked is registered but absent
from HostControlToolNames, so the host names it as a way out of an unfinished
turn while the schema does not carry it and only use_capability reaches it.
Adding it grows the prefix enough to move where the compaction fixture in
TestEffectFoldDropsSupersededStandingState lands its first fold, which that
test reads as a fold that dropped nothing.
It named `/bin/echo`, with a comment saying why the command has to exist:
resolving the executable happens before the context is consulted, so a
missing one fails earlier and for another reason. On Windows that is
exactly what happened — `exec: "D:\bin\echo": executable file not found`
arrived in place of the cause, and the guard has been red on that leg
since it was written.
Both judgements fired on what the interface does on purpose: at the
narrowest window every settings nav button reads as past the right edge,
though the rail scrolls to each one, and the twist beside a tree row is
aria-hidden because the row is the control. Seventy-three findings, none of
them a defect — and a gate that cries wolf is read as noise, which is where
the two real ones beside them were going.
Translation tables are data — they grow one entry per label, so the line
ceiling fires on every new string without pointing at anything worth
splitting. The exemption saying so still named the tree the retired desktop
kept its locales in, and has therefore exempted nothing since that tree was
deleted. The live catalogues sat at the ceiling instead.
Twenty-six strings reached the screen written into JSX rather than through
t(): the sign-in device code, what an install or an MCP connection says when
it finishes, the package rows, the tab menu, the Ask and Rewind cards, and
six in the version panel — the last read by nobody, because the sweep that
walks the running app only sees what a run renders, and its catalogue
answered 404.
The catalogue test beside this one checks the keys a t() call names, so a
literal that names no key was invisible to it. `jsx.test.ts` reads every
component's syntax instead: Chinese in JSX text, in an attribute, or in an
expression is a finding unless the nearest enclosing call translates it,
and a file renaming t on import is followed. The one helper that took a
Chinese label and translated it inside now takes a translated one, so its
seven keys are visible to the catalogue check too.
The one shipped theme pack named in Chinese takes the English name its eight
siblings have.
`.seg` does not shrink, so the row shrank the label instead: at the window
sizes this app supports down to, "Interface" was drawn under the first
segment rather than beside it. The group wraps now, and the label stays
whole.
The guard refuses a POST that is not application/json, and refuses it the
way a missing route answers — so a call with no content-type could never
land, and being silent about it, never said so. Acknowledging a launch's
health and replaying a waiting prompt were both making that call.
The kernel states why a total is incomplete; the panel answered "price not
reported" for all four. Three of them are not about pricing at all, so a
user who had simply not sent anything yet was sent to go and fix a price
table that was fine.
The ignore state at a directory was read twice: the file tools carried their
own walk of it, and completion carried none at all, so typing `@` in a
project root offered `node_modules` and `dist` above the files anyone meant.
A name list is one ecosystem's answer; `.gitignore` is where this repository
stated its own, so that is what both now read, through one package.
Inside a directory the rules already exclude, they exclude everything —
which is an empty list, not an answer. A user who typed their way in there
has named it, the way grep searches a path named explicitly, so the rules
step aside rather than offering nothing.
The flash model is `deepseek-flash` everywhere: the id it is served under
lost the generation it never needed. An installed entry is renamed rather
than left behind, and the rename moves every key that named the old id with
it — a price or an effort list stranded under the old key stops answering
for the model that replaced it, which reads downstream as a setting the
user edited reverting to its default.
A preset is now what settles which of its models read images. Reading a
name misses every Kimi, Qwen, MiniMax and Claude model these presets
declare, and `deepseek-flash` spells nothing at all; the spelling stays the
last resort for an address nothing has declared, and stays a correctable
suggestion rather than a claim. The connection that existed only to reach an
image-taking model folds into the entry beside it once that entry reaches
the same model on the same key — unless its user configured it, because
folding would answer their edit by deleting where it lived.
A preset changing shape reaches installs holding the old one through one
declared shape per generation and one upgrade that brings a matching entry
forward. The guard is the whole shape, because an entry holding what we
shipped is ours to move and anything else its user curated. That retires
nine hand-written migrations that each recognised one vendor by hand.
Official list prices live once, in `officialRates`, oldest generation first.
A price change appends rather than edits: the superseded rate is what lets
an installed config be recognised as holding one of ours and brought
forward, instead of quoting a retired rate for the rest of its life. `config`
reads them through `billing.CurrentRate` and `SupersededRates` and restates
none of them — a table written twice is one that drifts, which is how a
vendor's USD rate ended up published on one side only.
`make pricecheck` reads each vendor's own page and compares it against that
table, and says how long ago a person last confirmed each one. It reaches
the network, so it stays out of lint and out of CI. A page it cannot read
exits non-zero: unread is its own verdict and never counts as agreement.
A server started on its first tool call runs on a context the host owns.
When that context ends before the subprocess is up, exec.CommandContext
returns "context canceled" from Start() — in well under a millisecond,
with no stderr, because the process never ran. What reaches the reader
is `MCP startup launch failed after 0.7ms: context canceled`, which
reads like the server failed to launch. The server is fine.
The host is the only one that knows which of two things happened, and
they are not the same thing to go fix:
- the MCP host shut down — the session ended or the runtime was rebuilt
- that server was removed, disabled, or reconnected
Both are now carried as causes through context.WithCancelCause, and the
launch failure reports the cause rather than the mechanism. Nothing
about when or whether a context is cancelled changes; only what the
failure is able to say about it.
Found while testing #9931 against a real server. That report's leading
theory — that the stdio client rejects the framing the official SDKs
speak — does not hold up: a server built on modelcontextprotocol/go-sdk
writes plain newline-delimited JSON (verified byte-for-byte on the
wire), the spec requires exactly that ("Messages are delimited by
newlines"), and `reasonix mcp add` connects to it on the first try. The
0-4ms cancellation is a separate path, and this is what it was hiding.
internal/plugin/** is a declared sensitive path. The change is
attribution only: no boundary, no grant, no launch decision, and no
condition under which a context is cancelled is touched; the causes are
host-authored sentinels, never anything a server supplies.
go test ./internal/plugin/ ./internal/boot/ ./internal/control/ — pass
make lint / make check / make coverage-gate — clean
All three were green at a1adff18c, where these assertions were added,
and red after the changes that followed. One was the product, two were
the guard reading a shape that had moved.
The product one — the approval card's narrow tier. Its two secondary
buttons sit side by side under the primary, and "never ask again" is a
step smaller than "refuse". align-items:center then centres two boxes
of different heights against each other, so their tops differ by a
pixel: a row that looks unaligned, and counts as two. They stretch to
the same height now.
The guards — a menu and a card that each moved:
- The model menu is rendered through a portal, so it hangs off body
rather than inside the picker. `.picker:first-of-type .modemenu`
could only ever time out, and by the time it did, the mutual
exclusion it was checking already held. It asks the picker's own
aria-expanded instead, which no change of mount point can move.
- Quick actions stopped being a card inside a card. The container has
no border or shadow of its own any more; the hover landed on the
row — a fill, 8px of indent, the chevron stepping forward. Same
question, asked where the answer is now drawn.
And one signal removed. `.sym` carries a comment of its own: running is
grey, settled takes the category colour — the colour is the completion
signal. The pulse around it was a second telling of that, and it ran
beside the light travelling down the connector, two loops on one card.
The travelling one stays: it says something the pulse cannot, which is
that the step is advancing rather than hung — the reason it was added.
Restoring the pulse is the `.call[data-running] > .g .sym` rule and its
keyframes, if that reads as too quiet.
All 22 guards green, and all 22 still go red under selfcheck.
.flow lets the rail through by narrowing itself, and then centres what
is left with margin-inline:auto — so one rail's width of room is split
between two sides and only half of it lands where the rail is. Measured
at 1512: content ran to 1077 with the rail starting at 1070. The rail is
pointer-events:auto along its whole height, so those pixels answer a
click with a jump instead of a selection.
Two rails' width, symmetrically, which is what centring costs.
perf/verify.mjs has been asking this all along.
And the guard over the guards was reading a hand-kept list. selfcheck
injects an always-false assertion into each guard to see whether it
really goes red, and its GUARDS array had drifted: cards, composer,
intrinsic, motion, overflow, press and surface — seven scripts, never
once asked whether they can fail. It now finds every script in the
directory that expresses failure through `fails`, so a new guard joins
by existing. All 22 go red on injection.
selfcheck has a blind spot of its own worth naming: a guard that is
always red also passes it. Running the 22 on their own turns up three
reds that predate today — cards, composer and motion — all of them
green at a1adff18c, where those assertions were written, and red after
the changes that followed them.
--ghost is the bottom of the text scale and is calibrated to clear 4.5:1
on the darkest surface it lands on. Three places then took it further
down, and each landed under AA:
- .cost's second reading multiplied it by 76% to sit a step behind the
duration. A step is a tier, not an opacity: with the base already at
the floor there is nothing below it, so the three readings move up
one instead — live to --muted, the duration to --faint, the token
count to --ghost. The same spacing, all of it legible. Dark 3.30.
- The approval card's secondary button kept --ghost after that card
was lifted onto --float, which is several steps lighter than the
--page it was measured against. Dark 4.07 — and this one was mine,
from 2d1cd8bfd.
- A pane tab's count sat on --surface for the same reason. Dark 3.92.
perf/contrast.mjs already measures all of this and reported none of it:
its scripted turn gives a tool result with no contextTokens, so .cost
renders one span and the rule on the second never has an element to
match. One field added to that injection, and the sweep finds all three
— including a light-scheme instance of the first that a hand-rolled
survey of mine had missed.
Verified against the existing tool: three findings without the fix
(dark 3.30 / light 3.33 / dark 4.07), none with it, in both schemes.
.crumb carries flex:1 and min-width:0 so it can shrink, and a comment
saying that is load-bearing. It is — for the box. The children were
left with overflow:visible, so the text went on painting past it: a
folder with a long name ran the whole width of the bar and out the
other side, under the run pill and the three buttons at the right,
which ended up drawn on top of each other.
The clipping existed. It was written under
[data-fold~="rail"][data-fold~="side"] — the tier where both side
columns are folded away — and blowing out the title bar does not wait
for a narrow window. Moved to hold at every width; the narrow tier no
longer restates it. The session title goes with it: it was in the
flex:none group beside the separator, so it could not shrink either.
perf/overflow.mjs supplies the impolite name the fixture never has and
asserts where content lands rather than how it was clipped — an
ellipsis and a scroller are both right, and a box whose scrollWidth
exceeds it may just be holding an unhovered tooltip. Verified it fails
without the fix at all four widths (the breadcrumb reaching 1336px
past the controls at 1512, 1948px at 900) and passes with it.
Eight was a machine's guess about another machine. It was enforced in
three places and explained in a fourth, and the reader met it as a
greyed-out button on a laptop that could have held thirty.
Removed rather than raised, so nothing is left half-holding it: the
refusals in Open and OpenRemote, the X-Panes-Max header the list
carried, the [desktop] max_panes setting and its clamp, the ceiling the
window read off that header, the guard on the new-session button, and
the hub.too_many_panes wording on both sides. An unknown key in an
existing config file is ignored, so a machine that set max_panes keeps
loading.
What the ceiling was defending is real and is now unbounded: every pane
is a full assembly with its own tools, extensions and MCP subprocesses.
That cost is the person's to spend.
The rail never enforced this anyway — it greyed out the button that
starts a new session while opening an existing one went straight past
it to the kernel, so the two paths already disagreed about whether the
limit existed.
Measured with every session in the fixture opened: fifteen panes, one
in front, no refusal, no console error.
A relay can answer the Responses protocol without storing any state.
It then rejects previous_response_id rather than ignoring it, and every
turn after the first fails — with a sentence naming a field the reader
has no control over. The config field to pin it has always existed;
there was no way to reach it from the window, so the only cure was
editing reasonix.toml by hand.
Declared rather than detected. The fallback already in the client
retries once when the endpoint names the field it rejected; widening
that to any 400 was tried and backed out, because a single unrelated
400 would then drop a good endpoint out of stateful mode permanently,
off the prefix cache, on the strength of one request — and a test named
for exactly that case stands against it. What an endpoint does with a
field it was sent is not evidence about what it supports.
Built on the shape the thinking-parameter pin already uses, because it
is the same class of relay incompatibility:
- The capability is a bit on the protocol catalog, which is the single
source of truth for wire differences. Only Responses can carry a
turn by reference; Chat Completions replays by construction and has
nothing to decide. It is not a comparison against the kind string.
- config states the precedence once — mode over the legacy boolean —
so a panel and a request cannot disagree about what is in force.
- The list carries canSetContinuation and continuation the way it
carries canSetThinking and sendsThinking, so the control appears
only where the choice exists.
- An unknown mode is refused, never folded into auto: that would
record "decide for me" for a request that said the opposite.
Verified end to end against the running panel: the control is absent on
the OpenAI protocol, appears with three tiers on Responses, and the
pin reaches the config file and comes back on the list.
Reported in #9815.
The guard that finds Chinese rendered without t() reads JSX text as
">…<". A fat arrow was already excluded from the opening side, for the
reason the comment gives: a check that cries on valid source is one
people learn to edit around.
The closing side has the same shape. `Record<string, string> = { … }`
ends a type argument with ">", and the text this pattern then reads
runs to the next "<" anywhere in the file — so a table of wording whose
call sites each pass it through t() reports as unrouted. That is the
one construct such a table is most likely to be written as.
A ">" followed by "=" is closing a generic, not opening a tag. Verified
the guard still fails on a literal rendered without t().
Two spellings say this row is the drag handle, and they disagree about
inheritance. --wails-draggable is a custom property, so under Wails
every span on the bar inherited drag and the opt-out on the controls
was the whole story. -webkit-app-region is a regular property and
inherits nothing: measured on the running page, .chrome computed drag
and all nine of its descendants computed none. The bar was draggable
only where nothing was painted — the breadcrumb alone spans 1060px of
it, the right-hand group another 328 — which leaves the gaps beside the
wordmark, and those are what a reader finds by hunting.
`inherit` is not the fix: the parser accepts it and it still computes
to none. The row names its descendants instead, excluding only what a
control draws inside itself — that stays out of the union and is
covered by the control's own no-drag rectangle, so the list of controls
is still written once.
perf/press.mjs asks it as a hole rather than as a list: nothing on the
bar may be neither draggable nor part of a control. Verified it fails
without the rule (six holes, the breadcrumb among them) and passes with
it. Chromium computed values are what was measured; a real window drag
is not something synthetic events can drive.
Reported in #10156.
Checking a provider against a kernel that does not grant the provider
routes answered 403 provider.editing_disabled, and the panel drew every
failed check the same way: 「无法连接」 over the kernel's own sentence.
The two then contradicted each other — the heading named a transport
that was never reached, while the line under it said the request was
refused on purpose. A reader who connects to a remote host sees it on
every check there, because that grant is the desktop shell's alone: a
source writes an API key into the credential store of the machine
running the kernel, so a server reachable over a network must not take
one from a client.
Read off the code, never the status: 403 is also what a gateway in
front of the kernel answers, and that is a different thing to go fix.
A refusal now says what it is and where the source is configured
instead.
The code is spelled twice — the exported constant the branch reads, and
the literal key the kernel's parity guard reads this file as text to
find. Neither language notices when one of them moves, so a test holds
them together.
Reported in #9772.
The task view lays the steps out at full width while the rail is still
up, so one list stood twice on one screen in two hands: numbered, with
a measured cursor and a strike, in the rail; dotted, with a 进行中
label, in the view. Neither is wrong for the width it was drawn for —
316px and 880px do not want the same density — so they are not merged.
They are stopped from being on screen at the same time.
Presence stays the panel's own contract, which is where the rail's
order table says it belongs: Plan takes shownElsewhere and returns
null, the same way it already returns null with no steps. The order
table is untouched, and every other panel keeps its place.
Measured across a tab switch: conversation has one in the rail and
none in the view, task has none in the rail and one in the view, and
coming back restores the first. The room the rail gets back goes to
the panels under it — tokens per round and the prefix cache reach the
first screen on the task tab.
A project row drew its × at full strength beside its +, while a session
row drew both of its own at .45. The three baselines came from the move
to the row layout: the old card hid its × until .ws:hover, the row
selector no longer matched, and opacity:1 was what put it back on
screen — not a decision about weight, and never commented as one.
Not hidden until hover: these reserve their width, so hiding them buys
nothing back and leaves a control that reads as missing. perf/press.mjs
holds exactly that — with the buttons at 0 it reports five ghosts and
fails. Quiet is the setting that is available here, and the rows below
already use it.
The × now sits a tier under the + it stands next to, in both kinds of
row, and comes up to full on hover or focus.
The rule that raises an unanswered approval out of the flow keyed on
data-k="ask". Authorisation was split off to data-k="write" — a grant
is a write permission — and this was not moved with it, so the common
case, the one that is about to touch your working tree, has been
drawn flat ever since. The criterion is whether a grant is still
unanswered, which .apv:not([data-sealed]) already states; the category
says which kind it is, never whether it blocks.
Lifting also needs a layer, not just an edge. Measured on a blocked
frame, the elements carrying a shadow were the chrome, the search
field, the selected project row, the selected session row and the
composer — five, and the card holding everything up was not among
them. A 9% wash over a transparent fill tints the page it sits on; it
does not leave it. The fill is --float now, with the shadow that goes
with it, and the amber edge stays as the categorical mark.
Verified in both schemes: before an answer the card is the only lifted
element in the transcript, after one there is none.
.mfind stood for two different structures: a bare <input> inside the
popup menu, and the <div> wrapping a field and its count in the model
lists. Both stylesheets that carry the name were unscoped, so the two
reached each other from both directions — the menu's sticky rule stuck
the settings container to the page while its rows scrolled underneath,
and the container's margin-bottom overrode the margin the menu's own
rule declared.
The menu keeps .mfind; the wrapper becomes .msearch. That leaves
`.mlist .mfind`, which reset position/width/margin/padding/border/
background back to static, with nothing to undo — it was the local
patch written the last time this collision surfaced, applied to
ModelChoice and never to Models, which is why only one of the two
lists was ever affected.
Measured on the three call sites: the menu input keeps sticky, its
9px 11px padding and the --float fill, and regains the 5px bottom
margin its own rule asks for; both wrappers resolve to the flex row
they were always meant to be, with no fill and no border.
Reported in #9648.
Two readings off a 3x capture of a real call.
"64.0s 82" — two quantities of different kinds set side by side with
nothing between them, and the second carrying no visible unit at all. It
is the tokens this step left in the context, which only a title attribute
ever said. A middle dot separates them, and it steps back one notch:
how long the step took is what you are waiting on, how much context it
holds is what you ask afterwards.
"Bash git-bash curl A/B · 200 次并发" — the name and the tag answer one
question (which tool, in which shell) and the arguments answer another
(what this call did), but all three sat 8px apart and read as three
parallel items. The pair closes to 5px, the arguments open to 11px.
Both are three pixels of change. They are here because the line repeats
on every card on the screen, which is the only reason three pixels matter.
contradicting its colours
Measured on the running rail, and the first two readings were mine being
wrong: I took the weight off the selected session row, which is bolder by
design, and read a hierarchy that was not there. The real numbers say
something else.
Weight and colour pointed opposite ways. A machine name was the heaviest
step in the column (700) in the palette's quietest ink (--muted); a
project name was a step lighter (600) in the brightest (--text). One axis
said machines outrank projects, the other said the reverse, and a glance
resolved neither. What a person looks for here is a project or a session,
never a machine — so the weight comes down rather than the colour going
up. A machine row still reads as its own thing: no indent, a status pip,
and a count of projects rather than of sessions.
Grouping. Projects sat 0px apart and machines 8px — eight pixels in a
264px column reads as "these two are slightly further apart", not as a
boundary, which is the same failure the metrics rail had one commit ago.
Projects get 7px of their own, machines 20px, and the seam between this
machine and the first remote takes that same 20px because it is the same
kind of seam.
Two things the rail was not doing.
Grouping. Nine blocks sat 12px apart with a hairline between them, and
9px apart inside — three pixels and a line between "these two answer
different questions" and "these two answer the same one". Read down the
column it was one evenly spaced list, which is the reading the group
headings were added to fix. Space groups better than a line does: a line
only says there is a boundary, while spacing also says which side is
nearer. 22px between, 9px within, no rule at all.
The leading figure. A comment has claimed since the postures landed that
"the one in the leading block is a step larger than the rest" — and no
rule ever implemented it. .mtop .amt took the display step unconditionally
while the working posture had already moved cost to fifth place, so the
largest number in the column was the one least worth watching: ¥0.00, four
blocks below the context gauge it dwarfed. The step now belongs to the
first block rather than to the cost block.
Measured on the running rail at 1512×945, both before and after.
Each was measured against the app, not against a mock-up. Two of them were
rewritten after the screenshots came back, because a mock-up of a card and
a card are not the same object.
- A reading column. The transcript had no width ceiling, so at 1920 a line
ran 159 characters — twice what is readable. Two earlier attempts were
refused for the same reason ("the right edge is left hanging"), and both
had only narrowed half: one the outer column while the body kept 68ch, one the
body while the column ran full. Taking both together was never tried,
and it is the only version where nothing hangs. 820px is what the 1512
window already lays out — the default window was always right.
- The host gets a voice. data-k reads categoryOf(tool), so compaction,
guardian and notice — the three things the host does itself — carried no
identity at all and sat in the same grey as an unclassified tool. They
take a dashed rail: same line, same palette, different material. Colour
is spoken for by category, length by duration, motion by state; material
was the one channel still free, and it is colour-blind safe.
- Duration becomes spacing. It was meant to be the length of the gutter
line, and on the real thing that does nothing: .line is flex:1 and real
cards run past two hundred pixels, so min-height never applies. Spacing
does not compete with content height.
- A pulse travels the running line, replacing a static gradient that left
a 64-second call looking identical to a hung one.
- Authorisation stops wearing consultation's clothes. Both were data-k
"ask" with the same "?": one asks your opinion, the other asks to write
your files. It takes the write category and a key glyph, and the three
buttons are ordered by consequence — "never ask again" is a permanent
grant and no longer the same size as "just this once".
- The guardian's tag printed guardian_assessment. Every other card spends
that slot on something a person reads.
- Diff line numbers were array indices. No @@ parsing, so a change at line
205 was labelled 1, 2, 3 — and the hunk header itself rendered as code.
Blank lines were dropped, and long lines were clipped with no way to
scroll. Deleted lines now show no number at all: they do not exist in
the file the column is offering to take you to.
Centring came out of the same session: with no ceiling, "flush right" and
"full width" were one thing; once the column narrowed they separated, and
the transcript sat 414px away from its own composer. Both now centre, and
their edges agree at 1920, 1512 and 1180.
One proposal was withdrawn after reading the code: a notice's severity is
already a left colour bar, as it is on .guard and .find. Changing its glyph
would have introduced a second language for the same fact.
Sixteen rows declared role="treeitem", which tells a screen reader the
arrows walk them, and not one of them could be reached by any key. The
tree had no roving tabindex, no arrow handling, and no comment saying the
omission was deliberate. What Tab did reach were the small buttons inside
the rows — so a keyboard could delete a session it had no way to open,
and a screen reader was promised a tree that answered nothing.
Roving tabindex rather than a tabbable row each: a tree is one stop on the
Tab path and the arrows move within it, which is the whole point of the
pattern — forty rows in the tab order is the same as none. The entry point
starts on the open session and follows the walk, so coming back with Tab
lands where the arrows left off.
Up/Down walk what is showing, Right opens a closed branch and steps into
an open one, Left closes an open branch and otherwise goes out to the
branch the row hangs under, Home/End reach the ends, Enter and Space do
what a click does. Order is read from the DOM — document order already is
visual order and a collapsed branch is already absent — so nothing has to
be told when the tree changes shape. aria-level goes on all seven rows
because Left needs it and a screen reader was owed it anyway.
The handler rides JSX rather than addEventListener: a registration made
through the platform call has nowhere to write which action it belongs to,
and an input outside the census is one nothing checks. tree.navigate is a
view action — the arrows only move focus, and what Enter reaches is the
row's own action.
Verified against the running app: 1 tab stop across 16 rows before and
after walking, Enter opening a second pane, Left collapsing 16 rows to 11
and Right restoring them, and a rename field keeping its own arrow keys.
Two rules computed the same left edge by different routes — the flow pads
20px inside a margin, the composer takes the margin alone — so only the
right edges disagreed, by exactly that padding. A card's right edge sat
20px inside the box below it, which is small enough to read as "not quite
square" and never as a number. The padding gets a name and both sides
reference it, so the two cannot drift again.
Also: the sub-agent block led with a row labelled "子代理数量" under a
heading already reading "子代理" — in English, "Sub-agents" under
"Subagents". The heading supplies the noun; the row keeps the count.
The title, the run pill and the approval mode are the front pane's, and
they were written in one place: the report handler, when the reporting
pane happened to be the active one. Nothing read them on a switch. A pane
reports when something about it changes, so switching to a pane that is
sitting still left the chrome naming the conversation that had last
spoken — verified by clicking between two panes three times, with the
title never moving off the second one.
This is the failure mode the projection notes name: freshness that rests
on every writer remembering to announce itself is one quiet writer away
from stale. Each pane's last report is kept in a ref — a ref rather than
state, so a background pane's usage round does not re-render the window —
and the switch reads from it instead of waiting to be told.
The fixture's fold also still carried the pre-boundary shape, so the one
place a reader could see a compaction card was showing the wording that
was replaced two commits ago.
The fold point was drawn as a notch and read as something to drag, which
is the control a reader already expected — and it is the right one. What
it must not become is a percentage slider. This bound is an absolute input
size and that is its entire point: the same 16% is 160k against one window
and 20k against another, so a track measured in shares would rewrite the
setting every time the model changed. The track spans the window because
the bar does; the number it carries stays tokens.
The three buttons and the number field are gone. The two ends are not
extremes but the other two answers — past capacity the economic bound has
nothing left to tighten, and the default's own position is a detent,
because "the default" and "a number equal to today's default" stop meaning
the same thing the moment the default moves.
Four things only a real drag showed:
- Given its own min..max the track cut off everything below the floor and
above capacity, so the handle sat at one fraction of the track while the
mark sat at another. Dragging to the visual middle moved the mark
somewhere else entirely. Both are placed by the window now.
- A one-step detent is about two pixels of track. Landing beside the
default instead of on it silently converts "use the default" into a
number that stops following it, so the detent is two steps wide.
- The reading and the thumb need different clamps: a controlled range
clamped mid-drag pulls its thumb back under the pointer, while a reading
left unclamped past capacity names a size nothing folds at.
- Rounding the step in powers of two puts 160k between two stops, so the
handle could never sit on the number the panel was naming. Thousands.
The state is a hook rather than a component: owning the track would
rebuild it on every open, and a bar that remounts animates its width from
zero, which reads as the session's usage jumping. Three scoped
declarations, one per event — a generic data-action on an element with
several handlers names none of them. UNDECLARED_CEILING drops to 220.
The footnote said why a 1M window folds at 160k and then left the reader
with nowhere to go: the bound itself lived in a settings sheet two clicks
away, under a disclosure called Advanced. A setting that can only be found
by people who already know it exists is one most people never find, and
the reader this footnote was written for is exactly the one who did not
know.
The rail now offers the same three choices the sheet does — default,
custom, capacity-only — because they are one intent and not two. Only the
labels differ, since one of them is drawn in a 245px column. FoldMode and
foldModeOf move to src/ui/foldbound.ts so the rule that reads a stored
number as an intent has one home rather than two.
- The fold point becomes the way in, with the same dashed affordance the
window figure already carries. Opening one editor closes the other:
side by side they are two boxes of numbers with nothing saying which
ceiling each answers for.
- The footnote stands down while the editor is open. The chosen mode says
what it does there, and two greyed paragraphs stacked in one narrow
column read as one nobody finishes.
- A write rebuilds the runtime, so the gauge handed back is the kernel's
own — port.context() after the save, never this reply's arithmetic.
- The fixture answered 128k to the settings sheet while the gauge had been
told 1M, and saving moved neither. Both faces now read one pair from one
bounds(), so the editor is developed against a session that moves.
- The rail's segmented control is a step smaller than the sheet's: at the
sheet's size it reads as a part from another product dropped into a
20px-line column.
A session folds at whichever comes first: compact_ratio of the window, or
context_soft_limit_tokens of visible input, default 160000. Against a 1M
window the second always wins, so compact_ratio = 0.8 never reaches the
800k it asks for — the session folds at 160k, 16% of what the same panel
says the model holds, with nothing on screen naming the other bound.
The host had already decided it. compactBoundary() answers capacity or
economic and has ridden ContextMaintenance since 280dfd8c9; nothing
rendered it. The card said a threshold was reached, the rail showed a bare
160k beside 1.0M, and the reader supplied the only explanation left.
- event.Compaction carries the boundary and its size, stamped by one
compactionFrame rather than four copies of the same two lookups.
- ContextBreakdown carries the boundary and the window's own line, so the
rail states which bound holds instead of comparing the pair itself —
that comparison is the kernel's rule and belongs in one place.
- The rail notches the fold point onto the capacity bar: 160k against 1M
is a division nobody performs while reading a panel. The footnote is
written only where the bound is not self-evident, since a fold at the
window's own share explains itself.
- The notch is drawn in the text colour, not accent. Accent sits one step
from cat-4 and the legend for cat-4 is directly beneath that line, so a
position mark would have read as a sixth category.
- Three statements that compact_ratio is the sole automatic trigger are
corrected. It has not been one since 280dfd8c9, and one of them is
written into every config.toml the wizard renders.
- wire-parity now holds both mirrors that carry this: a boundary the page
cannot read is a fold it explains by guessing.
Found while answering "why can't I open this conversation — it says something
else has it". Something else did: four Reasonix kernels were alive on this
machine, one of them for ten days after the application that spawned it was
gone, and between them they held five session leases. Clicking any of those
conversations is refused, correctly, by a lease whose holder nobody can see or
close.
The host is supposed to end when its shell does, and it reads that off the
stream the shell holds: `io.Copy(io.Discard, os.Stdin)` returns at EOF, which
is the parent going away, "exit or crash alike". What enabled it asked for
`os.ModeNamedPipe`, and the shell is Node: libuv gives a child's stdio a
socketpair, not a FIFO, on every platform Studio ships. So `parentLease`
answered nil at every real launch and the watchdog was never armed — a host
whose window was force-quit, or whose Electron died, simply kept serving, kept
its data home, and kept its leases.
A socket is a lease now. A terminal and a regular file still are not: one never
ends, and the other ends at once and would take the host down at startup.
The existing test proved the mechanism with `os.Pipe()` — a FIFO, which no
launch uses — so it passed while production had no watchdog at all. The new one
uses the stream the shell actually hands over, and checks both halves: that it
counts as a lease, and that reading it ends when the peer closes. Against the
old predicate it fails on the first.
Swept both languages for text that ellipsizes, and set the fixture's own titles
aside — a session's name is data and is supposed to clip. What was left is a
label that does not fit the slot it was given, and in English there were three.
The settings list truncated its section names. The rule for that row is written
above it — "the value gives up its width first... a row that truncates the
section's own name to keep four characters of its value has traded the label for
the footnote" — and it was not in force: the name was `flex: 1`, so its basis is
zero, the row never counted as overflowing, and the name simply took what the
value left it. "Tools and permissions" wants 138px and was handed 99.6. The name
now lays its content as its basis, so the row does overflow, and the value takes
99 shrink against the name's 1.
That alone leaves the value at 13px, which is not a value, so the column widens
from 224 to 240: enough for the longest name and its value together. The 224 was
measured against Chinese names, which are half the length.
The account footnote wrapped to two lines instead of eating its own last words
("Only the networked features n…"), and the rail's search placeholder lost the
last letter of "projects" — 180.3px of text in a 179.8px field — so the English
reads "or projects" now, which fits with room to spare.
The workspace tree's disclosure is a stroked polyline on the 16-unit grid. The
transcript's fold ("思考 11 字") and the settings sheet's advanced section were
solid triangles out of the type — ▸ and ▾ — so the same idea, "there is more
under this", had two shapes depending on which part of the window drew it.
Both take the tree's polyline now, as a mask so the pseudo-element can still be
a pseudo-element, with the fill coming from currentColor exactly as the type did.
The token holds the one path. Checked in WebKit as well as Chromium: the desktop
shell is the former, and a mask that quietly does nothing there would leave the
mark invisible rather than merely different.
The composer's policy summary and the cache panel both marked their one
dangerous state with the character `⚠`. Every other mark in that row — the
attach plus, the plan and execute glyphs, the model diamond, the send arrow — is
a stroked path on the same 16-unit grid, so the one that matters most was the
one shape in the row a font chose for us. The code point is also in the emoji
set, which leaves its presentation to the platform rather than to this design.
It is a path now, the same grid and stroke as its neighbours, taking the colour
of whatever says it — err beside 全部放行, warn-ink beside 前缀变了.
The two tests that pinned this pinned the character. What they are for is that
the state is marked at all — "the quiet may not swallow a fully-permitted
session" — so they ask for the mark rather than for the glyph.
Correcting the earlier note on the rail's own marks: it said `✎` and `×` were in
none of the shipped faces. That part is wrong — both faces carry both. What held
is the rest of it, and it is what that commit's message says now: two characters
out of two different stacks at 11px and 15px, beside a 13px drawn plus, with the
destructive one drawn largest.
The one block in the transcript that is the reader's own words was drawn at the
column's full width whatever it held. "帮我看下这个文件" and a twenty-line brief
got the same white band, and a conversation of short questions read as a stack
of empty slabs with a sentence in the corner of each.
It is as wide as its longest line now, and still stops at the column. Nothing
else about it moves: the ground, the corner, the top highlight and the gutter
mark are the ones it had.
The five parts of the context window were drawn in deleg, net, accent, ok and
faint — the palette's status colours, each of which already means one thing, and
none of which means "the system prompt". Two costs. The status vocabulary lost
five of its slots to a chart. And the chart had no palette: run the six checks a
categorical set has to pass and it fails four of them.
The one that matters is the fourth. 工具输出 (faint, grey) against 模型回复 (ok,
green) measures ΔE 12.0 to normal vision, under the floor of 15 — not a
colour-vision case, a plain "these two read as the same colour" — and they are
the second and fourth largest slices on the bar. Alongside: accent sits outside
the categorical lightness band at L 0.78, deleg and faint are under the chroma
floor (they read as grey rather than as a hue), and accent measures 1.79:1
against the panel it is painted on.
The five slots are their own tokens now, stepped for each scheme and validated
as a set in both: lightness band, chroma floor, adjacent CVD separation (worst
9.1 light / 8.4 dark against a target of 8), normal-vision separation (19.6 /
19.3 against a floor of 15), contrast. Four light steps land under 3:1, which
the relief rule allows because the legend spells out every row — identity is
never colour alone here.
The gap between segments goes to 2px. At 1px the ground between two slices is
not visible on a dark surface, and that gap is the mark that says they are two.
The control shelf is pulled back out to the card's edge with negative margins,
and the card's padding is written in a different rule, so the two drifted: the
margins are 14 and 10 against a padding of 15 and 11. A one-pixel strip of the
card's own gradient shows down the left, down the right and along the bottom of
the floor, which is not a seam anyone drew.
The padding is two named lengths now and the margins are computed from them, so
"the floor ends where the card ends" is one statement rather than two numbers
that agree by memory. Measured after: 0, 0, 0.
The floor's corners take the card's radius rather than a step of their own —
9 inside 12 leaves the inner arc bulging past the outer one — and inset by the
border, so the two curves are concentric.
Two things in the column that is actually read, both of them a hue or a rule
doing work that type already does.
A markdown table was a grid: every cell boxed on four sides, the header row
filled and set in the monospaced face. Four columns of that read as a form
someone has to fill in. The vertical rules go — the horizontal ones already say
which words are on one line — the header keeps a heavier rule under it and takes
the interface face, because a column heading is a phrase and not a value, and
the first column loses its left padding so the table's left edge lands on the
prose's.
Inline code in an answer was --deleg. That hue says one thing in this palette:
this work was handed to a sub-agent. A file name is not that. The face is what
marks a machine word — it is doing that already, in the middle of Han text with
no argument — so the colour goes back to the prose's. The settings pages have
been rendering their inline code in a neutral all along; this was the outlier,
and the same teal was on two other prose surfaces.
Four cards of one weight, and the page's actual answer — what is this doing, how
far along — was the first of them. Two of the four are usually empty states, one
of them is a card whose content is a list of places to go, and its first row
went to the same place as the link in the card beside it.
The state and the goal are the page's head now: no box, the goal a step larger,
a hairline under it. The plan and the live trajectory are the content, and the
trajectory takes the full width it always should have had — it was sharing the
row with three buttons. What is left of those buttons is two, side by side under
a hairline, because they are the way out of this page rather than a quarter of
it. The duplicated one is gone.
Each card also carried a colour: --tk-glow, a 520px radial wash that lit up on
hover, tinted per card — net for the plan, deleg for the trajectory, accent for
the other two. A card is not a control, so nothing happens when a pointer
enters one, and none of those four hues meant anything: "当前任务" and "快速操作"
were both amber. What stays is the one that was true — something inside took
focus, so the border says so — and it says it in the focus colour.
The trajectory's own link stops being blue. --net is "the system is running on
its own", and it was the only blue text on a page that also has a blue running
pill; the rail's links have been --muted all along.
The fade at the bottom of a long tool output is the clip's own ::after, and the
button that expands it is inside the clip. That went unnoticed for as long as
the fade was an invalid declaration reading a token that never existed: nothing
was painted, so nothing was covered. Fixing the token turned the gradient on and
it landed over 展开全部 — the one control that answers the thing the gradient is
there to say.
The control sits above the veil now. The fade still runs to the clip's edge, so
the last line still dissolves, which is the whole point of it.
An empty composer was three bands of text: the placeholder, two capability
hints, and "Enter 发送 · Shift+Enter 换行" — which is the least surprising fact
about a box you type into, standing permanently in the one place a reader looks
before they start writing.
The slot is not decoration; it carries what is happening to a draft (sending,
stopping, an attachment that failed) and it is the input's accessible
description. So the slot stays and its idle sentence goes. What Enter does is
already declared to assistive technology through aria-keyshortcuts, and while a
turn runs Enter means something else — that sentence is worth writing, and it
still appears.
#A76200 was not chosen as a colour. It is the darkest amber that still carries
white text, arrived at from the other end: white on it measured 4.4977, which is
not 4.5, so there was nothing left over. A fill that has to be that dark to hold
white ink is brown, and in the light scheme it was the largest saturated area on
the screen — the primary button on the empty state, the approval card's action,
the stop button, the waiting pill.
The dark scheme has always done it the other way: the hue itself, with dark ink
on it. Both schemes do now — #E6AC45 against dark's #DDA144, with the ink
measured at 7.25:1 rather than assumed.
Three consequences, and the gate that found each of them:
- **A mark is not a fill.** At 78% lightness the hue is a face for dark ink; a
5px pip of it on the rail reaches 1.79:1 against the page. --accent-ink is
already the readable value of this hue, and in dark it *is* --accent, so the
marks move to it and that scheme does not change: pips, the tab marker, the
meters, the composition bar's own segment, the ask card's gutter mark. The
guard now holds every painted semantic hue to 3:1 against what it is painted
on — WCAG 1.4.11's threshold, scoped to the six hues the palette declares
rather than to "thin things", because a hairline is supposed to be faint and
a state is not. It named three: a 4px marker, a 6px host pip and the 28px ask
mark.
- **--err needs its own ink.** Two danger buttons were painting --accent-fg on
a filled --err, which only worked while the two hues happened to share a
lightness in each scheme. --err-fg is declared: white in light at 5.45:1,
near-black in dark at 6.0.
- Nothing else regressed: 21 guards and 661 tests, with the contrast sweep's
known list still empty.
`perf/tokens.mjs` exists because CSS is silent about an undefined custom
property: `background: var(--bg)` with no fallback makes the whole declaration
invalid, the box keeps whatever it inherited, and it reads as the design. The
guard collects every `--x:` in the stylesheets as a declaration and every
unfallbacked `var(--x)` as a use, and fails the difference.
It scans the file as text, comments included. One of those comments is the note
left when the veil behind the connection dialog was fixed: "--page, not --bg:
there has never been a --bg, so this whole declaration was invalid". That
sentence contains `--bg:`, so the guard has been reading the explanation of why
the token does not exist as the proof that it does — and the seven remaining
uses have been green ever since.
The seven: the fade over a clipped tool output, the initial in the account
button (its ink, on a filled circle), and the fields and list in the remote
connection dialogs — an input with no ground, sitting on a floating card, which
is what "the box looks like it is missing" was. They take the surface a field
sits on everywhere else, the fade takes the ground it fades into, and the
initial takes --accent-fg.
Comments are stripped before either side is collected now. Checked by running
the guard on the tree as it was: it names --bg and exits 1.
The last sweep found five lines under AA in light and fixed them by eye. That
result held for exactly one day: a colour is a token, so what a value change
reaches is every rule that reads it, not the handful the person changing it can
picture. This walks the rendered window instead — workbench with an approval, an
ask, a failed call and prose, plus the settings sheet — in both schemes.
Three things decide the number, and each one read wrong turns a failure into a
pass:
- Colours go through a canvas, which parses CSS Color 4. Reading the components
out of `oklch(0.605 0.016 255)` as if they were R, G and B makes the hue angle
the blue channel — the same defect the picker guard was just carrying.
- The ground is composited upward. A 13% tint is not a ground; what shows
through it is. Written the other way, ImageData is never premultiplied, and
dividing by alpha again reported the fail pill as 1.19 when it is 4.39.
- Large text is exempt at AA's own two steps: 24px, or 18.66px at 700.
Six lines came back, all of them one fact: **--ghost's headroom is measured
against --page**, which the tokens file says outright, and these six had it
landing on a raised face instead — a selected project row (raised), the search
field's ⌘K (raised), the signed-out avatar (overlay), the prose copy control
where the settings sheet draws it (surface), and the ask card's hint (the card's
own wash). On those grounds the weakest tier is faint, and that is what they
use now. The seventh, the failure pill, was --err reading on a tint of itself:
--err-ink exists for exactly that and the light scheme needed it.
The known list is empty, so any line that falls under AA from here is new. The
guard is in selfcheck's roster and goes red with a false assertion injected;
putting one of the six back reproduces its own finding.
The last of the selection surfaces. Every menu's current value, the completion
caret, and the model list's chosen row were all drawn with a tint of accent and
an accent bar — the same mark the rail, the icon column and the settings sheet
have already given up, and for the same reason: a hue that means "a decision is
waiting for you" cannot also mean "this is the one you picked".
These sit on --float rather than on the page, so the neutral fill is mixed from
the text colour instead of stepping to a named surface: that moves it away from
hover in whichever direction the scheme goes — darker than --float-hi in light,
lighter in dark. Measured by perf/pick.mjs: 38.6 against a hover step of 19.6
in light, 25.9 against 13.8 in dark, where the rule asks for 1.4×.
Amber in the interface is now the approval card, the ask card and its options,
the pill and the stop button that a running turn puts up, and the pip on a
conversation that is holding for an answer. Everything it marks is something
waiting on a person.
`pick.mjs` compares the current row's fill against what hover paints, and
requires the same direction — the rule exists because --accent-wash moved the
wrong way in dark and left the selected row reading as a hole. Both sides of
that comparison were being computed from strings parsed as RGB triples.
A computed colour is serialized in whatever space the author wrote: a token is
`oklch(0.31 0.02 255)`, a color-mix comes back `oklab(0.897 -0.0009 -0.0035)`,
everything else is `rgb(...)`. Reading the three numbers out of the first and
weighting them as red, green and blue makes the hue angle — 255 — the blue
channel, and 0.0722 × 255 then dominates the whole expression. The two sides of
the comparison were not in the same units, and one of them had no relation to
lightness at all. Both numbers were stable, so the check looked like it was
working: the sign it reported depended on which colour syntax the stylesheet
happened to produce, not on which fill was heavier.
Colours now go through a canvas, which parses CSS Color 4 and hands back the
bytes that reach the screen. The hover reference is read from the `.mi:hover`
rule's own declaration rather than from a token name written into the guard —
and through `getPropertyValue`, because CSSOM's typed getters return an empty
string for a `var()` and the guard was silently finding nothing.
Checked against the bug it was written for: putting --accent-wash back on the
row is now reported as -9.2 against a hover of +13.8 in dark — the wrong
direction, which is the defect in one line. The current fills are unchanged
and pass with 1.9× the hover step in both schemes.
The transcript colours a call by category, and the categories were reading off
the semantic palette: net for a network call, deleg for work sent out, accent
for a question that needs answering. Three of them say what their hue says.
Write did not. An edit_file was drawn in the same amber as the approval card
sitting four rows under it — one hue, two meanings, adjacent in the same
scroll, and the one that needs a person is the one that loses.
warn exists for exactly this. It was split out of accent on the grounds that
"琥珀是「该你了」，橙是「这一步有代价」", and a write is the second sentence.
The mark, the thread line, the timeline bar and the task board's dot all move
together, because a category is one decision rendered in four places.
The anchor label above the main model goes neutral in the same pass: an eyebrow
that appears on the page whatever its state is a label, not a state.
Same rule, the two places it had not reached. The section list filled the open
page with accent-wash, wrote its label and its value in accent-ink, turned the
icon amber on hover, and hung an accent bar off the left edge — five marks, one
of them a hue that means a decision is waiting. And every segmented control in
the product wrote its chosen option in accent-ink: the reading window, the date
range, the approval posture, all of them.
The list row now carries a fill, a ring and the bar together, because this
column lays --surface and hover already spends the one neutral step under it —
the same pairing the rail's project row uses, for the same reason. The chosen
segment keeps the raised chip and the shadow it always had and drops the hue:
the chip is the mark, and under it the postures that really are coloured (全部
放行 in err) have room to be read as colour again.
The section's own icon loses its amber tile too. It appears on every page of
the sheet, so tinting it says "you are needed" nine times over, once per page.
Measured on a 1512px window: a card's prose starts 42px from the middle
column's left edge, the composer's caret at 37. Five pixels is not read as a
misalignment — it is read as "these two things are not part of the same
thing", which is the opposite of what a conversation is. The gap between the
prompt mark and the text is what sets that inset, so that is what moved; the
box, the mark and the guide line under it keep their places.
Three more edges in the same family. The rail's search field sat 10px in while
every row in the tree sits 12, and the account row at the foot sat 13 — three
gutters in a 264px column, none of them a decision. They are 12.
The shelf under the composer laid `--page` outright: 7.9 L below the input
surface in dark, 4.2 in light. A step that size stops reading as a floor and
starts reading as a seam between two widgets, which is what the hairline over
it was already saying on its own. Half a step now, in both schemes.
`--face-sunk` was 2 L below the page in dark and 0.8 below in light — the same
token cutting twice as deep in one scheme as the other, and in dark it landed
past the page it was supposedly cut down to, so machine output was the darkest
thing in the window. Both schemes now sit just under the page, and the visible
step is the one against the card the output is set into (3.9 L).
A session row carries rename and delete; the project row above it carries add
and delete. The add is a stroked path on Sym's 16-unit grid — it was moved off a
"+" character for a reason already written down beside it: "place-items 对齐的是
行盒，一个「+」字形在行盒里靠基线坐，看上去永远偏下". The other two were still
characters, and not even from the same face: `✎` at 11px out of the monospaced
stack, `×` at 15px out of the interface stack, under a 13px stroked plus.
Three hands in one column, and the heaviest of them is the destructive one on
every row: delete is drawn 40% larger than rename, so what the eye lands on
first, down the whole list, is the one that removes things.
Both are paths now, on the same grid at the same 1.5 stroke, in the same 20px
box, and the shared `.wsdel` covers the project row and the remote list too. The
opacity rule that keeps them quiet rather than absent is untouched, and
perf/press.mjs still finds every control it did.
The interface's own scale exists because 24 sizes with 442 declarations inside
the four steps between 10 and 11.5px read as nothing quite matching rather than
as one line outweighing another. Six steps replaced them, and a guard keeps a
seventh from being typed in.
That guard exempts `calc()` and `var(--read)`, because the reading size is a
setting rather than a step — and behind the exemption the reading column kept
exactly what the scale was introduced to end. The four heading levels an answer
is written with were `--read` +1.5 / +.5 / 0 / -.5 pixels: two pixels of range
around the body, in the one column a person reads a paragraph at a time. A
model writing `##` was producing structure the screen could not show, and long
answers arrived as one flat block of prose.
The levels are a ratio ladder now — 1.38 / 1.2 / 1.06 / 1 — so they hold at
every value of the reading size, which is the reason the sizes were written
against it in the first place. At the default 14.5px that is 20 / 17.4 / 15.4 /
14.5. Nothing else about them changes: the weight, the colour and the margins
that bind a heading to the text under it are the ones they had.
The guard grows the case it was missing. It fails a ladder whose steps are
closer than 1.05 apart, and a top level that does not outweigh the body by
1.25 — checked by putting h2 back within a step of h1, which reproduces the
flat reading exactly.
The palette assigns one job per hue, and the file says so at the top: accent is
"需要你介入". Two of the largest painted areas in the window were spending it on
navigation state. The icon column filled the current page with accent-wash and
drew an accent bar beside it; the rail filled the open project's whole two-line
row with a mix of accent-wash and 9% accent, and hung a 8px glow off its bar.
Neither is a decision waiting for anyone. Both are on screen the entire session.
What that cost is visible with an approval on screen: the card that does need a
person was competing with a permanently amber row and a permanently amber chip,
in the same hue, two of them larger than it.
The session rows had already worked this out one level down — "拿它再说一遍『你
在看这条』，两个意思就分不开了" — and settled on a raised ground. Both places now
say it the same way. The ground carries in either scheme: +4.2 L over the rail
in light, +7.9 L in dark, which is the step the rail's own selected session row
has been using.
The project row also loses its bar. A fill, an inset ring and a bar are one
state said three times, and that bar was square against a 9px corner, so it cut
a notch out of the left edge of the row it was marking. Two levels are still two
levels: the indent and the weight already say which is which.
Amber left in the interface: the approval card, the pill that says a turn is
waiting, the stop button, and the pip on a session that is holding for you.
The side panel's cost figure and the connection panel's model rows are both
`.mrow`. Two components, one class — and the second definition only overrides
what it lists: display, alignment, gap, min-height. The background, the 9/12
padding and the bottom hairline stayed the picker row's, so the one number that
side of the window is built around sat inside a white slab with a rule under it.
Read cold, that is an input field nobody filled in.
The metrics row takes a name of its own, `.mtop`, and the figure sits on the
panel's own ground with the sub-label beside it. The picker keeps `.mrow` and is
untouched; the size, the tabular numerals and the second-currency step are the
ones it already had.
A name is an interface. Nothing warns when two components pick the same one —
the collision only shows up as chrome the second component never asked for.
Swept the ports for capabilities the frontend cannot reach. frontend-parity
reports 150 missing edges, but every one has some frontend driving it — there is
no capability nobody can use. The sharper question is which of serve's 163
routes no client calls, and that turned up four. One of them matters.
POST /update/health had a handler, a capability behind it, and no caller
anywhere in the tree — not the page, not the Electron main process, not the
host. Its own comment says what it is for: "the swap is performed by a process
that cannot judge it. This is the other half: the application that booted from
the replacement says it is working, and only then is the rollback material
retired."
Nothing said it. So pending-update.json and the backup bundle were never
retired, ensureNoPendingUpdate found a transaction it judged live, and every
install after the first refused with "a pending update already exists" —
permanently, per machine, starting the first time self-update worked. The
release line is on this path now: cmd/reasonix-studio-host builds the capability
and runs MaybeRunMacHandoff, so legs one and two are in place and only the
acknowledgement was missing.
Said from the page, not the shell. A window that opened and then failed to
render is exactly the case the rollback is kept for, and only the page knows it
got past that. Two seconds of probation first, the same wait the old desktop
used and for the same reason, and nothing at all while onboarding is still on
screen: an application still asking for a key is one the user cannot use, and
retiring the way back from inside it discards the rollback on a launch that has
proven nothing.
Silent on failure both ways. Nobody asked for this, there is nothing to do about
it, and the two ordinary answers are non-events — a kernel with no update
capability has no route, and a launch that booted from no update has nothing to
retire.
Two tests, and the first fails against the previous tree with "never
acknowledged; the transaction stays open". The second pins the onboarding case,
which is the one an eager implementation gets wrong.
The other three unreferenced routes are recorded but not acted on here:
GET /branches (session branch tree — no switch endpoint exists either, so the
feature is unreachable from Studio rather than half-wired), GET
/extensions/actions, and POST /auto-approve-tools.
Swept every browser-layer guard looking for regressions. Found none — what the
sweep found was four assertions that had drifted off the thing they name, three
of them red for long enough that the failure had become the expected output.
lang.mjs認词，and the words expired. It had already been rewritten once when
Metrics / Pending changes / Agents and tools disappeared; the replacements —
Prefix cache, Activity, Workspaces, Worktree changes — are gone the same way.
The tab strip has said Conversation / Task for a while, and the other three
blocks do not render under this fixture at all. Every red one was the guard,
never the interface. It now reads structure: the same label elements in both
languages, present in both, differing position by position, with no Chinese
left on the English side. Panels may be renamed or added and it keeps up.
look.mjs died on the first thing a user would actually do — typing a font name.
The two font slots live inside the "advanced" details, and a closed details is
not rendered, so the element resolved and was never visible. The eight
assertions before it passed because they click through page.evaluate and the DOM
click does not check visibility. Opens it first, and says so as its own check.
verify.mjs waited on a rewind button that could not appear. The entry point
attaches only to a row that claims a message (state/checkpoints: no claim, no
entry, because a rewind cannot be undone), the claim arrives with msgIndex on
turn_started, and this harness exists precisely so the fixture's own frames
never reach the UI — BenchPort overrides subscribe. The driver has to feed that
frame like every other. Feeding it, the button appears immediately.
That timeout had been hiding the last one: the trajectory view is no longer on
the tab strip. Timeline, event trajectory and run graph moved into the "run
details" picker, so nth(1) was clicking Task and counting rows in a page with no
table.traj — zero, every time, and never once reached.
No product defect behind any of them. Two new assertions fall out of the fixes:
the advanced block opens, and a rewind entry lands on the turn it claims.
Asked how to stop the two lists from drifting. They should not have been two
lists — and proving it turned up the half of the previous fix that was missing.
Three places knew "this tool's authorization reads its subject": the branch in
subjectRequiresHuman, the subjectScopedTools table, and a copy in the test. I
had just fixed the no-approver hole in one of them, for the write fence only.
So this was still true, and had been all along:
install_source, apply, planId "high:..."
Decide → ask (the grading works)
Approver == nil → allow=true (nobody ever sees the plan)
That is the case the grading exists for. A high-risk self-extension plan — a
resident process, a lifecycle hook, an external server — was granted silently
under YOLO, which is built with no approver at all. Older than this branch, and
worse than the fence hole I found first.
Membership in subjectSensitiveTools is now the single declaration, and it
carries all three consequences, so a tool cannot arrive with one and not the
others: Decide returns Ask whatever the fallback says, unattendedAsk refuses
rather than answering for the absent person, and a session grant must name the
subject it covers. Adding a fourth tool is one map entry.
The convergence is real rather than a layer beside the old one: widensWriteFence
had no callers left afterwards and is gone. The test that was the third copy is
now a guard over the declaration — it fails an empty table (a guard that would
pass by examining nothing) and an entry whose question is never true for any
probed subject, which would sit there looking like protection while granting
none.
Both new cases fail against the previous commit: the high-risk plan is granted
with no approver, and reverting unattendedAsk to the fence-only check reproduces
it exactly. A low-risk plan still runs unattended — the grade decides, not the
tool — and a plan-only call still reads as the preview it is, allowed before Ask
is reached.
The previous commit stopped recording bare-tool grants for the two tools whose
authorization reads their subject. It left the ones already recorded alone, on
the reasoning that they were what the user granted and rewriting them would be
deciding on their behalf.
That reasoning is wrong, and the direction it gets wrong matters. When the user
pressed "don't ask again" they were looking at one install plan, or one path.
That is what they answered about. The bare-tool rule is not their answer written
down — it is their answer widened by the code that recorded it. Keeping it is
what carries a decision they never made: every later plan, including a high-risk
one they would have been shown, is covered by a yes they gave to something else.
Migrating is not available — which subject it was given for is not in the rule,
which is the whole defect. So the check moves to the read side:
SessionGrantMatches refuses a bare grant for a subject-scoped tool, and the
question is asked once more. One extra prompt, for a decision that was never
taken.
Scope, deliberately: this is only the session-grant path, the one the code
widened by itself. A rule the user wrote in their config is their own sentence —
`allow = ["install_source"]` means what it says, goes through the policy, and
is untouched here.
Against the previous code the new test prints the stale rule it objects to and
the three subjects it still covered.
Chasing whether the fence widening this branch added could be opened wholesale
by one click. It could — and so could the self-extension grading that was
already here, the same way and for the same reason.
SessionGrantRuleForScope keeps the subject for bash (a command prefix) and
folds the file tools into one Edit grant. Everything else fell through to the
bare tool name, and a bare-tool rule matches every subject that tool will ever
have. Measured before the fix:
granting extend_write_paths /ws/internal/foo/bar.go → rule "extend_write_paths"
matches /home/user/.ssh/authorized_keys → true
matches /ws/.git/hooks/pre-commit → true
granting install_source low:sha256:abc → rule "install_source"
matches high:sha256:def → true
The second one is older than this branch and is the more serious of the two. The
whole point of grading an install plan is that a high-risk ticket returns to a
person even under a blanket allow; sessionGrantAllowsLocked is consulted before
that check, so approving one harmless low-risk plan disarmed the grade for the
rest of the session. Nobody was ever shown the high-risk plan.
A tool whose authorization reads its subject cannot be granted by name. The two
that do are named in one table, and the grant rule carries the subject for them:
"extend_write_paths=/ws/internal/foo/bar.go" covers that file and no other.
TestEverySubjectSensitiveToolIsSubjectScoped is the guard over the table —
a tool that requires a human for some subject but grants by bare name fails it,
which is how this would otherwise come back.
Both new tests fail against the previous code with the rule they objected to
printed in the message, and the guard fails if either list drifts.
Not fixed here, and worth naming: grants already persisted in a session's
authorizations keep their old bare-tool form, and those still match everything.
They are what the user granted under the old shape; rewriting them would be
deciding on their behalf what they had approved.
What a run must touch is not always knowable before it has read anything. A
write_paths declaration could only be made up front, so every such discovery was
terminal for that file: the tool refused with "outside this subagent's declared
write_paths", which told the run neither who could change that nor where to put
the need. It worked around it or gave up.
It now asks. The question goes to the user — never to the parent, because the
parent is a model and a model approving its own reach is not a fence — and it
goes through the gate every other permission goes through, the one a delegated
run already shares with its parent (task.go hands it t.gate). Nothing new
carries the request: widening is a capability, and permission is the axis
capabilities live on. It is not an ask (that axis is for what only a user can
tell us) and not a plan decision (that axis is workflow).
Widening returns to the user under every fallback posture, on the same yardstick
install_source already used: subjectRequiresHuman. "Allow every write" is a
statement about this workspace's files, never that a run may redraw the boundary
it was given. An explicit allow rule for the path still wins — that is how the
line gets moved deliberately rather than by a posture nobody re-read.
WriteGrant keeps declared and granted apart, because only the declared set can
be proven non-overlapping before anything starts; nothing added later can join a
proof against runs already going. So scheduling reads Declared() while the audit
reads Scope(), and a granted path does not surface as a write that escaped its
claim. Every write outside the declared set also reserves through the scheduler
for the length of the call: a grant says this run may be here, never that
another may not. The reservation is a try, never a wait — a caller inside a tool
call already holding paths is the shape a deadlock needs.
The security review of this change found a hole in its own first draft, and the
fix is the reason unattendedAsk exists. Ask is fail-open when no approver is
attached ("preserve autonomy"), and YOLO is built with exactly that — nil. So
the fence question would have answered itself under the one posture that most
needed a person, leaving confinement weaker than before it was a question at
all. Autonomy is a statement about a posture with nobody watching; it is not
permission to move a boundary. TestWideningIsRefusedWhenThereIsNobodyToAsk fails
against the draft and passes here.
The adversarial tests are unchanged in substance and still pass: a symlink, a
traversal and a move destination are compared after resolution, so the path put
to the user is where the write would land, and their fixture binds no gate —
which is the case they were always about. With nobody to ask, nothing widens.
"占用了我打开又如何呢" — and the answer is that opening it was never the
problem. The lease exists so two windows cannot write the same transcript back
over each other: each holds its own in-memory copy, and Hub.Close and resume
both Snapshot theirs on the way out, so the one that closes second erases
whatever the other produced meanwhile. That is a real way to lose a
conversation. It is also entirely about the write-back. Reading is not that,
and the session you most want to read is the one you can see running.
So a pane attaches instead of demanding. SessionLeaseKeeper.Attach takes the
lease when it is free and reports that it did; when a live runtime holds it,
the pane opens with no lease and no authority bound. The guard does not move —
it was already in the right place and was simply being duplicated at the door.
Turn admission goes through ensureWriteAuthorityReady, and every save through
requireWriteAuthorityForSave; neither has anything to present without a lease,
so a read-only pane cannot reach the transcript at all. Callers that are about
to write (chat, run, bot, switch-model) keep Rebind, where read-only is not an
answer.
RuntimeView carries the state rather than leaving the composer to discover it
by being refused: derived from the keeper, not stored, because the keeper
either holds that path or it does not. The composer says so in the placeholder
and takes no line.
The tests that asserted the old refusal are not deleted — they move to the
boundary that still holds. control.TestReadOnlyAttachmentCannotWriteTheTranscript
is the one that matters: attach read-only over a live holder, save, and the
save must fail with ErrSessionWriteAuthorityMissing and the file must come back
byte-identical. If that ever passes silently, the lost update is back.
Worth saying what this does not touch, because the two get the same word: two
different sessions writing one workspace already queue rather than refuse
(internal/workspacelease — readers never wait, and an agent team is not
serialized there at all, SubagentScheduler claims write paths instead). This is
the other thing entirely: one conversation, two windows, and no second writer
to coordinate with.
Reported as ugly. It placed each mark at its message's position in the whole
transcript, so the rail drew how much each turn produced rather than the list of
what was asked: a turn that ran twenty tools landed ten times further from its
neighbour than one that ran two. Measured on a session of mixed turn lengths,
gaps ran from 14px to 171px, σ=56 — clumps too tight to aim at, then nothing.
Two workarounds had grown on top of it: a neighbour-nudge for when marks landed
within 46px of each other, and a 120px aim radius to find one at all.
Marks now sit together in the middle at a fixed 9px step, clamped to the track
when there are enough of them to need it (300 marks land on a 2.21px step and
stay inside it). Where the reader is in the record is what the viewport box
already says; this is the list, in order, one step each.
Length and weight are a falloff from whichever mark the pointer has picked out,
and every mark is identical until one is. A cosine, not a line: a linear
falloff has a corner at the focus, which reads as the neighbours being a
different kind of thing rather than the same thing further away. Measured
across the three states — at rest every mark is 11px at .30; on the pane, 11px
at .46; with the pointer on the rail, 11·11·12·16·21·25·26·25·21·16·12·11·11
and .46 up to 1.00 and back.
The size no longer tracks how many files that turn touched. That put a column
of equal entry points at unequal lengths to say something the hover preview
says in words a few pixels away.
One thing the cluster broke and this restores: ⌘↑/↓ picked its starting mark by
comparing rail geometry against scroll progress. The rail is a cluster in the
middle now and its geometry says nothing about how far down the record a mark
is, so the walk starts from the message's own position in the transcript.
Reported as the scrollbar jumping back on its own. The native bar is hidden —
the rail's viewport box has been the only scroll indicator this transcript has
since it took that job — and the box is placed at scrollTop over scrollHeight.
Neither of those is wrong; the height under them was.
A block nobody has scrolled to yet stands in for its own height, and it stood
in at 96px an entry. The shortest card that exists measures 119, the median 199
and the mean 216 — the numbers are already written down one file over, beside
the identical fix made to a card's contain-intrinsic-size, where the note ends
"the scroller always landed short, then corrected, which is the jerk". The block
placeholder was left on the old number.
Measured, scrolling back through 300 turns: the content grew 18393px (+20%)
under the reader, and the indicator slid down three times while they scrolled
up, worst 48.8px on a 713px rail. The content itself never moved — scroll
anchoring does its job, and scrollTop rising by exactly the height added is that
compensation, not the defect. Only the ratio the indicator divides moved.
The estimate is now learned from this transcript's own blocks, a running mean
over a bounded window, seeded at the measured 216. Card heights differ by an
order of magnitude between a one-line read and a twenty-line diff, so no
constant was ever going to fit both; what fits is whatever this conversation
turns out to be made of.
After: content growth 18393px → 1113px (-94%), indicator reversals 3 → 0, worst
0.5px. Holds at 1200 turns: 1229px, zero reversals.
Reported: delete a conversation, click another one in the same project, and it
comes back "held elsewhere — close it there first". The log of a real window
has the shape of it:
POST /runtimes/r1/close 204 the deleted one's pane, closed first
POST /tree/sessions/remove 204 the delete itself
POST /runtimes 409 the next click
POST /runtimes 200 the same click, seconds later
resumeInto returns (status, error), and its doc says why: "answering with the
status a refusal deserves so both the HTTP handler and a hub opening a session
in a new pane refuse for the same reasons". /resume passes that status to
writeErr. Open discarded it into `_`, and openRuntime passed 409 as the
fallback for everything — so every failure with no code of its own arrived as
Conflict, which the frontend renders as in-use. A transcript the list still
showed and the disk no longer had reported as one another window was writing.
So did a provider the kernel could not resolve.
Open now keeps the status, and the catch-all becomes 500: what is left after
every coded refusal is a pane the kernel could not build, which is ours and not
a clash over the session. The path refusals in resumeInto were bare
errors.New — a status with no identity, which leaves the frontend printing the
kernel's English — and now carry session.bad_path and session.outside_dir,
both of which the frontend already had wording for. session.open_failed is the
one new code, for a failure that reaches the hub with no code of its own.
Two tests, and the pair matters: a deleted session must say it is gone, and a
session a live holder really is writing must still refuse as in-use — the fix
would otherwise have bought clarity by losing the guard. Against the old code
the first fails with "409: invalid session dir" and the second passes, which is
the old behaviour exactly: one answer for every outcome, right by coincidence
in the single case that was actually a conflict.
A listing the assistant wrote rendered in the box every tool result renders in.
Not similar — identical: both fills measured the same value, so nothing on
screen separated what was said from what was run. The step meant to sink them
was mixed against --raised while the column lays --surface, which left 2.7 L in
dark and 2.2 in light, and a code block all but dissolved into the page.
Two faces are declared instead, and they separate by different means. Machine
output takes the step, now cut properly into the ground: ΔL 2.7 → 5.7 dark,
2.2 → 3.9 light. A listing takes a line, which is also the half that survives
in light, where there is no room left above --surface to raise anything. Between
the two, ΔL 0 → 3.2 dark and 2.6 light. The listing carries its language and a
copy of its own, the corner handing one to the other under the pointer; where
there is no pointer the control stands and the language gives the corner up.
The answer's mark on the rail was a 1.5 stroke at --ghost: "not a button"
carried all the way to "not there", on the one thing in the column that holds
the turn. Filled, in the reading ink, plus the run its cell failed to cover —
a mark that does not fill its cell reads as the line having stopped. The two
labels naming the speaker are gone; the mark says it a column to the left, on
the same line. The row they sat in stays for what only it can carry.
The prose's copy had the paragraph's own left edge and nothing else, which is
what made it read as a stray list item rather than an offer. It gets the mark,
the prose's exact left edge, a ground that arrives under the pointer, and the
tick where the offer was.
Two things found on the way, both older than this change:
perf/surface.mjs read oklch(0.156 0.015 255) as rgb/255, landing the hue in the
blue channel at full. Every fill in the tree returned 45.2, so every parent and
child matched, and equal fills are the one case it exempts — it has been passing
by examining nothing for as long as it has existed. Reading L directly, it found
.wsrow[data-open] at ΔL 0.8 in light: the fill half of "the fill says which row,
the bar says it from the edge" had never taken effect. Carrying a little of the
hue moves it off the ground in both schemes.
An unscoped `.acts`, written for the action at the end of a server row, wins on
source order over every other use of that class and was adding its row-end
margin to the transcript. Qualified here only; the other eleven uses have lived
with it and are not this change's to move.
Cost: five nodes per code block (20 blocks, 577 → 676), render unchanged at
2330 → 2284ms. 658 tests, eight browser guards, and an action census identical
to before at 101/24/8/79.
The file was written when the version was one fix. It now carries three, and
notes that describe a third of a release are worse than none: a reader who
reads them decides they have seen the change list.
Reported as the interface looking stuck while a command runs. Measured first,
because "stuck" is two different defects and only one of them is a defect.
The thread is not blocked. Over an 18s turn the fixture produced one long task
of 131ms, and switching views mid-run answered in 62-71ms across six presses.
Nothing there needs fixing.
What is wrong is that the wait says nothing. Sampling every running call's own
card: four calls under 600ms went through one distinct text each, and the 7.4s
call through four — 0.41 changes a second. The only motion on a running call is
sympulse, a 1.9s breath on a 14px glyph, and a pulse reads the same at two
seconds as at two minutes. A command that runs for half a minute therefore
draws one unchanged line for half a minute, which is indistinguishable from a
window that has died.
So the wait reports its own length. It lands in the slot the settled duration
already uses, so when the call ends the number stops rather than a different
value appearing in a different place. Under a second nothing is drawn: a call
that answers that fast never looked stuck, and a digit that appears and leaves
is its own noise. No bar while it runs — the bar is a length against a known
duration, and growing one against a duration nobody knows yet is a progress bar
that cannot be honest about the fraction it has drawn.
The kernel's startedAt is deliberately not the source. It is unix ms on the
kernel's clock, and over a remote session that is not this window's, so
counting from it would spend a clock skew as elapsed time. This counts on the
window's own clock from when the window saw the call running, and says nothing
about a call that was already running when it arrived — that is a duration this
window does not know.
Measured again after: the 7.4s call goes from 4 distinct texts to 11, and the
four sub-second calls stay at one each.
Also removes two reduced-motion rules that turn off a shimmer that no longer
exists — .shim has been a colour for some time, and a rule disabling an
animation nobody declares tells the next reader there is one.
Reported from use: with a transcript on screen, the 运行详情 menu opened under
the cards and its rows took no clicks.
Nothing in the transcript outranks it. The menu is z-index 30; a runtime scan
of every descendant of the scroller finds no z-index at all above 5, and the
stylesheet agrees. So the transcript was never being compared against 30 —
the menu's level was already spent inside an ancestor of the bar. A stacking
context anywhere above holds the whole menu at that ancestor's level, and the
scroller, the later sibling, then paints over it and takes the presses. Two
things in this tree make one without saying so: an entrance animation's fill
transform and a card's paint containment. RewindControl's menu was moved out
of the flow for this same reason, and its comment says so.
Which ancestor it is here is not established: eight states at the reporter's
own window size, scrolled and zoomed, did not reproduce it, so this does not
claim to name one. What it removes is the dependency. The menu is rendered
into the body, where its level is its own, and that holds whatever forms a
context above the bar tomorrow.
Position is therefore measured instead of anchored. The layout box, not the
client rect: the entrance transition's scaleY is running while this measures,
and placing the menu by a size it is on its way out of put it 6px off. The
anchor rules stay for the composer's policy menu, which is not a Picker.
Alignment moves from the stylesheet to the call site, since there is no
positioned ancestor left for a selector to reach through.
Verified in a browser at 2000x1080 and again at zoom 1.25: all three Pickers
sit at the same offsets the CSS used to give them, right-aligned on the bar
and left-aligned in the composer, none clipped by the viewport. The guard
asserts the menu is not under the trigger, not that today's ancestors are
innocent.
The bullets had been written by translating commit subjects, which are
deliberately aphoristic in English and become spoken-register couplets in
Chinese — "先有账单，再有决定", "按下要有回答". A release note is not the place
for that form. Each entry now leads with the technical claim and carries the
mechanism, the identifiers and the measurements, the way 2.12.0's and 2.13.0's
notes do.
One fix, and the one thing a reader has to know that the fix cannot do for
them: the window updating into 2.14.1 is still holding 2.14.0's document, so
this update is the last one that can show the blank screen.
Found by clicking 设置 against a window whose assets had been rebuilt under it:
the whole screen went white. The document that window was holding asks for the
chunk name it was built with, the rebuild had written a different one, and the
404 rejects the promise lazy() is waiting on. A rejected import throws during
render, and there was nothing above it to catch the throw — so React unmounted
the tree and took the window with it.
This is not only a development accident. Studio updates in place: the .deb
replaces the SPA tree under a running window, and any window that outlives an
update is holding names that no longer exist. Opening settings is then the
first thing that asks for one.
The tree already answers this exactly once. The transcript's markdown is
deferred the same way, and its call site wraps the boundary in Boundary so a
throw costs one message its formatting rather than the window — Boundary's own
comment says why. The settings chunk is the other deferred route and had a
Suspense with nothing behind it.
It now falls back to the settings overlay saying the screen did not arrive,
offering the reload that actually repairs a stale document and a close that
gives the window back. chrome.reload is registered because the census holds
what a person can do here, and closing the panel unmounts the boundary, so a
second attempt is a fresh one.
The test renders App with the module mocked to throw, which is what a missing
chunk does to the import, and asserts the panel appears with the window still
mounted behind it. Run against the code without the fix it fails on both.
Committed before the tag rather than after it. 2.13.0's notes landed after
studio-v2.13.0, so the push-triggered run read a tag that did not carry the
file and would have published the standing text alone.
The case named "the system temp root itself" was written as /private/tmp,
which is the temp root on macOS and an ordinary path everywhere else. On
Windows the slug under test came out -private-tmp-run while the tool derives
its scratch slugs through filepath.Abs, which qualifies that path with the
current drive, so the test failed on a tool that was behaving correctly.
The case now reads the host's own temp root, which is what the surrounding
comment already claims the check does. The second name a root may be reached
by keeps its own case, run only where resolving /tmp lands somewhere else —
comparing the resolved path rather than the string, because EvalSymlinks
returns \tmp for /tmp on Windows and a spelling is not a second root.
The composer's paste handler reaches port.attach through attach and upload,
so pasting an image sends its bytes to the host exactly as the picker does.
The root carried no action id, which is the one thing the census exists to
refuse: an input proven to write with nothing naming it.
It takes session.attach, the id the picker's button and the file input
already carry. The registry's note on that entry — the bytes reach the host
as the file is chosen, before anything is sent — is the same fact about this
root, and a paste that becomes a chip is the same intent arriving by another
modality.
Splitting the settings page out behind lazy() took every action on it out of
the census's product graph: 75 ids the registry declares came back as having
no production root, and seal D failed on a tree where nothing had actually
gone unreached.
The walk does read dynamic imports — it looks for a call whose callee is
named Import, which is how @babel/parser 7 spelled one. Version 8 spells it
ImportExpression, with the specifier on .source rather than in .arguments, so
that branch has matched nothing since the parser was upgraded. It cost
nothing while every route was imported statically, and the first lazy
boundary in the tree is what made it visible.
Reading the node the parser actually produces puts the settings subtree back
in the graph: orphans 75 to 0, and the inputs it contributes rejoin the
denominator the open seals are measured against — B moves 55 to 79 because
those inputs were never being counted, not because any of them changed.
Measured first. A machine, a project inside it and a conversation inside that
were drawn at 13px each; the machine and the project both started at the rail's
edge; and the project's row was 52px against the machine's 47, so row height
denied the order it was meant to express. A selected project carried four marks
at once — fill, ring, bar, and an accent dot — none of them the main one. The
leaf's title, the only thing on its row that cannot be read anywhere else, held
87px of 201 while needing 210.
Depth now says the level: 0 / 12 / 37px of indent, weights semi / medium /
regular, heights 47 / 46 / 30. The leaf steps down one size on the scale rather
than two, because indent and weight carry the hierarchy and type has a floor to
respect.
The leaf's two controls leave the layout and keep the screen: placed one after
the other over the row's tail, still visible at rest, no longer holding 38px of
the title's width. The count drops its unit — every row on the list is in
turns, so the row says the number and its title says what it counts. Measured
result: the title goes from 87px to 128px, and with the rail's default at 264px
rather than 236 it renders about eleven Han characters where it rendered five.
A state says itself twice, not four times: the fill names the row, the bar
names it from the edge the eye is already travelling. The dot goes back to
neutral — it was this state's only visible mark when data-open changed nothing
but a text colour, and it has had three companions since.
Acceptance was the four numbers stated when this was proposed: title width
87 → 128, heights monotone 47/46/30, state marks 4 → 2, and overflowing boxes
unchanged at 35 before and after.
perf/panels.mjs carried its own copy of the rail's default and failed on all
three of its width checks the moment that default moved — the copy described
the rail until someone changed it, and then described nothing while still
failing. It reads RAIL and SIDE out of Gutter.tsx, which is where a span is
declared.
The checks these guards print were worded in a spoken register — 吃指针的控件,
按下去没有任何回答, 没量到卡片 — while the interface they guard was swept into
written Chinese for the reason upstream recorded: a spoken register reads as
unserious in something that states what software does. A report about the work
should not be looser than the text inside it.
Twelve check names and their detail lines rewritten. The two Chinese block
comments still left in perf/intrinsic.mjs and perf/pick.mjs are English now,
which is where comments in this tree belong.
No behaviour changes: every guard was run before and after, and all five pass
on the same measurements.
Reported from use: over SSH the session title never came across. It did come
across — once, at connect, before the session had one. The far kernel names a
session when its first turn ends, and nothing re-read the book after that, so
the row kept the name the session had before it had a name for as long as the
window stayed open.
This machine's tree is re-read whenever the pane list comes back, which is how
the window hears that a turn ended — Pane says so on purpose, and the comment
there has always said why: "when the turn ends, that is when it has a generated
title and a turn count". The far books were held inside the remote column with
their own trigger, the set of connected hosts, which does not change when a
turn ends. One beat for this machine, another for every other.
The books move to one owner. useMachineBooks holds every connected machine's,
answers with a single reload, and reads a machine's book when it connects; the
window calls that reload beside the local one, on the beat it already had. The
column draws what it is handed. That is the rule this tree already states for
projections — whoever owns a dynamic fact owns the invalidation that makes it
owed again — and the far book had been kept fresh by a trigger that belonged to
something else.
Three tests: the title read at connect, the title arriving on a re-read, and
the wiring itself — that the pane-list path re-reads both books, because the
defect was never in the reading, it was that nothing asked. Each was run
against the code without the fix: the last one fails alone when the far re-read
is removed.
Rename and delete sat at opacity 0 until the row was hovered, and they reserved
their width the whole time — 38px of a 201px row, plus the gaps around them,
spent on two controls nobody could see. The workspace row directly above keeps
its own actions visible at rest, so the same list drew the same kind of thing
two ways, and the invisible half was the one that also cost the title its room.
They rest at .45 and come up on hover and focus as before. The width was always
theirs, so nothing moves; what changes is that the row now says what can be
done to it.
perf/press.mjs gains the rule, and it is a narrow one on purpose: a control
that reserves space and paints nothing. Measured before writing it — the whole
screen had exactly these two kinds, 18 of each, one pair per session row — so
it starts green everywhere else rather than arriving with a backlog.
Not fixed here, and worth saying: the title still gets 87px of that row while
it needs 210, so six sessions in one workspace can read as the same truncated
string. Reclaiming that is a layout decision — a second line, a wider rail, or
fewer controls on the row — and it is not this commit's to make.
The bar on the selected row was an inset shadow, so it followed the row's 6px
corner and curved into a crescent. The rail draws the same idea on the
workspace a pane is open in — an absolutely placed 2px bar, inset from top and
bottom, with an end of its own — and that is the shape a reader already knows
here. One idea, two drawings, and the menu had the one that bends.
The value pickers had no bar at all: a hue change on a 6px dot was the whole
mark for "this is the model you are on". The stylesheet's own note beside the
completion menu says why that does not work — the eye resolves area, not a hue
shift on a dot — and it said so while the pickers two hundred lines up were
doing exactly that. They take the same fill and the same bar now, because they
answer the same question: which one is it right now.
perf/pick.mjs was reading the bar as "the row has any box-shadow", which is a
proxy for a drawing rather than for the mark — it would have passed a row whose
shadow was anything at all, and failed this change for no reason. It measures
the mark: a painted element under 4px wide against the row's left edge, with
the old spelling still accepted. Run against a row with the bar removed it
fails all four menus.
Reported as the content twitching up and down while a reply comes back, and
narrowed to the moment an ask appears. Measured on the running page: at the
frame the ask lands the transcript moves 108px one way, and on the very next
frame 561px the other. One beat down, one beat up — which is what the eye reads
as a shake rather than as something arriving.
What grew in that frame names the cause exactly: two .call cards went from 96px
to 325px and 428px. 96px is the fallback in contain-intrinsic-size, the height
an off-screen card is assumed to have until it is laid out for the first time.
The `auto` keyword covers every card the reader has already reached, so this
only ever applied to cards never scrolled to — and the fallback was below the
shortest card that exists. Measured across a 40-turn transcript: min 119,
median 199, mean 216. Every unseen card was underestimated, so the error
accumulated in one direction: the scroller computed a bottom from estimates,
landed short, and corrected once they resolved.
The fallback is the measured mean now. Same page, same ask: direction reversals
2 → 0, backwards scroll 108px → 0px, worst single-frame shift 561px → 321px —
and what is left is the card arriving, one movement in one direction.
perf/intrinsic.mjs holds it by measuring rather than by remembering the number:
it walks a long transcript so every card lays out, then fails a fallback below
the shortest card or above the tallest. Run against 96px it says 96 < 119.
Ruled out along the way, each by measurement rather than by argument: the
reasoning block's auto-collapse (2 frames of 55, 26px), the entrance animation
(8 frames of motion, the 561px jump unchanged with it disabled), and block
virtualization (chunk count and placeholders unchanged across the jump).
The slash menu listed its built-in commands in English inside a Chinese window:
"compact context", "discard current context". The translations exist and always
did — messages_zh.go has every one of them — and nothing was reaching for them.
i18n.DetectLanguage is what points the process catalogue at a language, and it
is called from internal/cli and nowhere else. The Studio host never imported
i18n at all, so the kernel it assembles kept the English default that exists so
that code running before detection still has text. Everything the kernel
renders itself went to the window in that default: the built-in slash hints are
the ones a reader sees, and they were the ones reported.
The top-level language rather than the desktop's, because config.toml already
declares that split — Desktop.Language dresses the shell, the top-level one
dresses the kernel and what it says to the model — and a host is not the place
to redefine which authority owns which. With neither key set, as here, both
sides resolve from the OS locale and agree, which is the case that was broken.
Verified end to end: rebuilt the host, reopened the window, and the menu now
reads 压缩上下文 / 查看上下文窗口、阈值与上次维护结果. wiring_test.go holds it,
and was run against a resolution that ignores the config first — it names the
exact English sentence that was on screen.
Every button in the top-right of the shell was dead: the account button, the
icon buttons beside it, and the window's own minimize, maximize and close. The
title bar is the drag handle, -webkit-app-region inherits, and a control that
does not opt back out is drag surface — the OS takes the press and the page
never hears it, with nothing on screen to say why.
The opt-out had been there. 49b574687 removed .themer, a control that no longer
existed, and .themer happened to be the last selector of the list that carried
the declaration — so the block left with it and the two selectors above it were
swallowed by the next rule's comma. The comment above the rule went on saying
"every control on it opts back out" for two days while none of them did.
Membership is now what the markup says is interactive rather than the controls
someone remembered to list, so a new button on the bar is covered by existing
and deleting one takes nothing with it.
The check belongs in the shell and only there. In a plain browser the property
does not inherit — a child of a drag region computes "none" — so a page-level
guard cannot fail on this and would be worse than having none. It went into
test/smoke.js, which drives the real window, and it was run against the missing
rule first: it names button.thbtn, button.wc and the account button exactly.
Two defects met in one place. The composer draws stop and steer side by side
while a turn runs, and data-primary sat unconditionally on steer — so the
emphasis, the thing that answers "what would you press now", pointed at
interjecting rather than at stopping. And with an empty box the steer button is
display:none, since there is nothing to send: the single button on screen was
therefore 停下 drawn as a ghost, with no filled action anywhere.
Emphasis follows the running state now. Steering keeps its place as the
rightmost button, so that position always means "send what I typed", and it is
an Enter away with the footer saying so; stopping has no other way in.
perf/focus.mjs was reporting this as 插话 while a hidden button was what it
read: it selected .send, which was the answer only back when the composer had
one button. It reads [data-primary] instead — which button is emphasised is
the question it was always asking.
The rule also lands in composer-salience.test.tsx, because focus.mjs needs a
browser and does not run in CI; two of the browser gates were found red today
from wording and structure that moved under them months ago. Both were run
against the old markup first to watch them fail.
Every comment added over this pass was written in Chinese, which leaves the
tree with two voices in the same file and this branch adding to the half that
has to be read twice. All of them are English now, and the register goes with
the language: what the code does and why, not how it feels to use.
The gates keep their Chinese console output. Thirty of them print Chinese and a
reader runs them together, so switching three would make the report bilingual
rather than making it English. What those three print is now written rather
than spoken — 接受指针的控件 rather than 吃指针的, 按下后没有任何反馈 rather
than 按下去没有任何回答.
perf/reason.mjs is the one whose wording was load-bearing: it asserted a
specific Chinese sentence, and when upstream rewrote the interface into written
Chinese the assertion went stale and reported "中文界面不说中文" — a defect that
had not happened. It reads the expectation out of kernel.ts and en_kernel.ts
now, so a rewording moves both sides at once. That is the same rule the tree
already states for judgements: read structure, never wording.
Untouched and worth naming: 1027 Chinese comment lines across 93 frontend files
and 285 across 47 Go files predate this branch. Converting them is a sweep of
its own, not something to bury in a UI pass.
Merging the two panels left the search box filtering one of them. In two panels
that read as a local search; in one list it is a search that quietly skips most
of the list, and the half it skips looks like a half that is not there.
The word now belongs to the box that collects it rather than to either list:
RailSearch owns it, publishes it, and both lists read it. Lifting it into App
would have split "the box at the top of the rail" from "who uses it" across two
files, and leaving it where it was would have made the remote half ask the
local half for it.
Remote filtering follows the local rule exactly: a machine whose own name or
address matches keeps everything under it, otherwise only the folders and
conversations that match survive, and a machine with nothing left drops out.
One difference is deliberate — a machine that has not connected has only its
name to match on, because its projects are on the far side, and answering "not
here" for them would be this window answering on its behalf.
Folding follows too: a fold is a resting-state preference, and while a word is
being typed it hides the very rows that word just found. The local half has
always done this; both halves do now, including this machine's own group.
The box is a type=search at last, so it is announced as one, and the native
cancel button Chromium draws for that type is suppressed — this field already
draws its own, and two controls for one action is worse than either.
Five tests hold it, and all five were run against a disconnected query first to
watch them fail; a filter test that passes on an unfiltered list is the shape
of guard this repo has been bitten by before.
The rail drew two panels: 「工作区」 above, 「远程」 below, each with its own
caption, its own add button and its own idea of what a row is. But the hierarchy
underneath them was never two things — a remote workspace was already rendered
with the local workspace's own class, and opening a session in a folder is one
intent whichever machine the folder is on. What differed was only that local
skipped the machine level, because the machine was implied.
It is implied no longer: this machine is the first row in the list, shaped like
a host row and folding like one. A filled pip is a connection state and this
machine has none, so it carries a hollow ring — it is not connected, it is
here. The add button moves into the slot a host's already occupies, which makes
the two buttons one meaning: open a folder on this machine.
Both halves now render into a single role="tree". That was a correctness fix as
well as a visual one: every remote row already claimed role="treeitem" while
sitting outside any tree, so assistive technology was handed items belonging to
nothing. The hosts render as children of the tree that was already there rather
than App growing a wrapper, which keeps the search state where it is.
The line between the two sections goes with them. A rule that draws one there
says "above is local, below is remote", and that is the distinction being
withdrawn; machines separate by space, like everything else in the list.
Two renames follow the widened meaning: .rmthead is every machine's row and is
.machrow, .rmtpick is every machine's add and is .machpick. .addws and .rail-hd
and .rmtcap are gone with the captions they styled.
Known gap, unchanged by this: the search box still filters only this machine's
workspaces. In two panels that read as a local search; in one list it reads as
a search that quietly skips most of the list, and it is worth closing next.
205 border declarations against 16 uses of the float shadow: the interface
separated almost everything by drawing a line around it, which is what makes a
screen read as a table of cells rather than as things sitting on a surface.
Two containers in the flow drop the line and keep the fill — the user's own
message, which is the most-looked-at box in the app, and the settings block,
which the settings screen is made of. Floating layers keep their line: the
float shadow carries a ring in dark and nothing like it in light, so a menu
without a border smears into the page on one of the two themes.
Removing a border removes whatever was hanging off it, and two states were:
.grp:hover tinted the border and .grp:focus-within tinted it alongside a halo.
A state has to be said in the same vocabulary as the separation it modifies, so
hover lifts the fill and focus draws a ring, both still on the card tier. Left
as they were, hover would have done nothing at all — the third dead declaration
this pass has turned up, after var(--hover) and var(--shadow).
perf/surface.mjs is the gate, and it measures the thing the change actually
claims: a layer that separates by fill has to be a layer you can see. It reads
every rounded box's own fill and its nearest filled ancestor's, converts both
to OKLab lightness and fails a gap under 2. An identical fill is not a failure
— that is a box deliberately not claiming to be a layer, which is how an
unselected tab is drawn, and reading it as a defect was this gate's own first
bug.
24 sizes, and 442 of the 665 type declarations inside one 1.5px band: 11.5,
11, 10.5 and 10px, four steps separated by half a pixel. Half a pixel is not a
level — it is not read as "this line is heavier than that one", it is read as
"nothing here is quite the same as anything else", which is most of what makes
an interface look unconsidered next to one that was drawn. The conversation
body was never the problem: it has had its own token all along. Everything
around it was.
Six steps, widening as they go: 11 / 12 / 13 / 15 / 17 / 22, with --read left
where it is. The floor rises to 11px, which is where the smallest labels,
badges and table headers were living at 9 and 9.5 — dense Han strokes lose
their counters there before Latin does, and the large-text exemption that
excuses low contrast starts at 18.66px, so none of this was ever inside it.
Above 24px stays off the scale: a splash wordmark is one size for one thing,
not a step other text is measured against.
Measured rather than eyeballed, on the running page at 1440×900: the same 16
boxes overflow before and after, all of them ellipsis truncation and the
scrolling settings nav — the change introduced none. The one thing that did
move was the transcript's share of the pane at 1100×640, which fell to 39.8%
against a floor of 40%: bigger chrome eats fixed pixels, and at that height the
composer's auxiliary budget is what the gate says must yield rather than the
transcript. It yields 2vh, and the share comes back at 42%.
typescale.test.ts holds the scale on the stylesheet, with the same two guards
the motion rule needed: a coverage assertion so a renamed property cannot leave
it passing on nothing, and an exemption for calc() against --read, whose 1.5px
adjustment is not a size and had been read as one sitting below the floor.
Measured before changed: of the 42 pointer-taking controls the harness page
puts on screen, 21 showed nothing at all on mouse-down. Hover lit 179 rules and
press answered on 17, so the gap between pressing and the state changing was
empty — which is the half of "手感" that no amount of colour work reaches,
because the question being asked in that gap is "did it hear me".
The cause was membership, not intent: the pressed rule already existed and
listed nine class names, with a second copy of the same nine in a reduced-motion
block and a third, differently-spelled copy further up. Membership now comes
from what the markup says a control is — button, summary, a[href] and the
interactive roles — so a new control is covered by existing, and the classes
that want a different press (.thbtn, .seg button, .mode) say so in one
declaration instead of joining a list. --press carries the shape, which is what
lets reduced motion answer for all of them by changing one value rather than
repeating the set, and drops the !important the second copy needed.
The wash composites over whatever fill a control already has, so one rule
answers for a ghost icon and a filled row without knowing either. Full-width
rows take the push without the squeeze: a percentage on a 300px row moves its
far edge several pixels, on a 24px button a quarter of one.
perf/press.mjs holds it from the running DOM rather than from the stylesheet,
because the thing that rots here is the list, and a list is exactly what a
stylesheet cannot check. It also caught two of its own bugs worth keeping: a
disabled control owes no pressed state, and splitting a selector on commas
without counting parens shreds :is(...) into fragments that match nothing.
Three defects it turned up on the way:
- var(--hover) and var(--shadow) were never defined by anyone. CSS drops the
whole declaration in silence, so .mverify:hover and .mrefresh:hover — from
this branch's own model-verification work — did nothing at all, and the nav
tooltip had no shadow.
- .mrow was two things: a <button> in Models and a row of numbers in the cost
panel. The numbers inherited cursor:pointer and a hover fill, so the panel
claimed to be clickable. The layout stays on the class; the interaction
moved to button.mrow.
- transition-duration beside the shorthand escaped the tier migration. Both
are on tokens now, and the gate covers that spelling too.
tokens.css has carried three weights and said what they are for since it was
written, and the stylesheet ignored them: of 157 transitions, one used --m-*
and 156 typed a number. Fourteen distinct durations for four weights, with
.12 / .14 / .15 / .16 all meaning "a line just changed" — so the same change
ran at four speeds in four corners, which is what reads as an interface that
has not quite settled rather than as anything nameable.
191 transition segments and 33 short animations now take their duration from a
tier. Where the easing was already the tier's own, the pair collapses into
--m-line / --m-card / --m-panel / --m-exit; where the author chose --ease,
--ease-in or the spring deliberately, only the duration moves onto --t-* and
the curve stays. The split is not cosmetic: a transition's timing function *is*
its shape, so leaving it at the initial `ease` was the one decision nobody had
made, while a keyframe animation is often shaped inside its keyframes and
overwriting the curve there would apply easing twice.
--t-live joins them as the tier that is not a weight. Five fills were running
at .5s, .6s and .9s because a meter reports a rate rather than acknowledging an
action, and the three weights had nothing to say about that job. It is held to
a fill's own geometry, which is how a meter reports: the settings icon that had
drifted for .5s moved to --t-panel instead, since answering a hover on the live
tier answers it late.
Delays divide the same way. Under 100ms nobody is waiting for a weight, they
are offsetting a batch, so those become --m-step; the one real wait keeps its
tier. motion.test.tsx holds all of it on the stylesheet, with a coverage
assertion so a renamed property cannot leave the rule passing on an empty list.
Both sides of the update grew Settings.tsx and it landed at 802 lines, two over
the ceiling. The part that does not belong to drawing the sheet is the search
matcher: it reads SETTINGS, NAV and a row's aliases, all of which prefsnav
owns, and it answers a question about the catalogue rather than about the panel.
Upstream reworded the interface into written Chinese while this branch was
moving the composer's own strings out of en.ts, so the two halves met with the
screen asking for 不询问 and 全部放行 and the catalogue carrying 不打扰 and
全放行. The approval notes were invisible to the i18n guard on top of that:
Policy passes them through t() from a table, so a key with no English renders
Chinese in an English window and nothing fails. They now read as upstream
spells them, and the spoken copies the extraction left behind are gone.
Chinese is the key, so 手动添加 for a model the reader typed collided with
手动添加 for writing a hook by hand — one label, two English answers, which
TypeScript caught as a duplicate property. The model's provenance badge says
用户添加, beside 已配置, 现场探测 and 本次未返回, which are origins too.
Clicking all 121 non-destructive buttons in the app against a live kernel, then
asking of each one whether the screen said anything when the kernel turned it
down. One did not: 创建隔离副本 on the session page. run() had caught the
refusal and stored the reason correctly — but the banner that prints it was
copied onto the model and extension pages, and the session page writes the same
state with nowhere to show it. The banner moves to the column every page is
drawn into, which is where a Settings-wide state belongs; the two copies go.
The sweep's own criterion is worth stating: a 4xx is not a defect, since this
server declines several capabilities on purpose. A 4xx that leaves the screen
unchanged is. Everything else came back clean — no uncaught error, no crash,
no silent failure.
The copy pass that preceded this could have broken two things and did not, by
luck rather than by design: a skill row decided its mark by comparing the
rendered "调不到", and the session reducer compared "等待工作区" to know which
state it was leaving. Both are a sentence doing a second job, and a rewrite of
the sentence breaks them without failing anything — the row just stops being
marked. The skill row now returns reachability beside its text; the reducer
names the two values it also recognises.
wording.test.ts holds the rule at a ceiling of zero rather than a ratchet,
because the event that produces these is exactly the pass that just ran.
Comparing against a named constant passes; the literal at the comparison site
is what it refuses. It carries its own regression, four shapes it must catch
and five it must let through — a catalogue keyed by the text is a lookup, not
a judgement.
The settings screen went first; this is everything else the reader sees. 348
strings across 62 files, the same way: the Chinese that renders it and the
English catalogue keyed by it move together, so the i18n guard fails on any
key left half-moved.
Where it mattered most was the refusal catalogue. kernel.ts is what a reader
sees at the moment something did not work, and it was written to be overheard
rather than read: 八成粘错了东西, 这句话排到它后面了, 这边出了点问题, 先关掉再
移除. 156 refusals now state the condition and the action, which is the whole
job of that file — the code carries the identity, the sentence carries what to
do about it.
Then the transcript cards, which are the lines a reader passes every turn
(要动手了, 想了 12 秒, 这一趟没折叠掉什么), the run graph and queue, the
onboarding and welcome flow, the remote connect prompts including the host-key
warning, and the model picker.
English moved too where it was informal in the same way — contractions,
"approved writes just happen", "Next tidy-up", "I am R." — though most of its
second-person phrasing is ordinary for an English interface and was left alone.
Three strings printed raw rather than through t() and so had never moved with
the rest: the identity-service error on the signed-in account branch, and two
remote progress labels whose catalogue keys are now in step with them.
Assertions that pinned the old wording were updated with it: nine of them
across the graph, workspace, pane-close, remote-directory, trajectory, shell
and kernel tests, each one a test that reads the copy rather than the state.
The screen was written in spoken Chinese: verbs from conversation (测一下,
加一条, 开一份, 搬迁), sentence-final particles, and the reader addressed as 你
throughout. That register suits a chat transcript and reads as unserious in a
settings panel, where every line is a statement about what the software will
do.
274 strings rewritten into written Chinese across all 30 files the screen is
made of. Both sides of each move together — the Chinese that renders it and
the English catalogue keyed by it — which is what let this run as batches: the
i18n guard fails on any key whose translation was left behind, and it did,
twice, on catalogue keys written unquoted because Chinese is a valid
identifier. The rewriter now handles that spelling too.
Merges that fell out of it: 删掉/删除 and 加上/添加 were two spellings of one
label and are now one catalogue entry; 问我 became 请求确认 rather than 询问,
which the approval segment already uses for a different control.
Deliberately unchanged. Search keywords in prefsnav stay colloquial — they buy
discoverability and nothing else, and a reader hunting for a setting types the
word they would say. 这台机器 stays as the nav group: it was never the informal
part of that list, and folding it into 本机 would collide with the scope badge
that already means something narrower.
The workspace lease's package doc said it serializes Delivery writers. It does
not: the gate is plan.mutates at every role setting, and the lease is re-entrant
within a session, so parallel tool calls and concurrent subagents share one and
an agent team is never serialized by it. What schedules those is
SubagentScheduler, which claims write paths rather than the workspace. The doc
now says both.
Driving every control on the settings screen against a live kernel turned up
one fault with several faces: an answer that existed was not making it to the
person who needed it.
SseHttp.get threw a bare Error carrying a path and a status, while every write
went through fail() and kept the kernel's refusal code. So a read the kernel
had spelled out — "this server does not open account sign-in" — arrived as
"/account: 403", and the three panels that folded the failure back into their
initial null went on saying "loading…" about a question already answered, for
the rest of the session. Versions, Account and Memory now hold three states
rather than two, and say which one they are in. saveShell, installMcp,
removeMcp, removePlugin and dryRunHook hand-rolled the same throw and lose the
same code; they go through post0/del0 now, and del0 is post0's counterpart for
a DELETE whose answer is a payload.
Storage had a row whose own note says "every path is either actionable or says
why it is not" — and a server that refuses moves left it with neither. Memory
had no way out of an empty store at all: the panel reads, rewrites and removes
facts, and writing one is the composer's /remember, which the CLI's memory view
already points at and this page never named.
Escape was window-scoped, so the six inline forms inside the sheet closed the
whole sheet along with whatever had been typed into them. useEscape claims the
key in the capture phase the way useDismiss already did; both now declare the
registration through listenAction, which lowers the unnamed-input ceiling by
two rather than raising it by one.
The section list was a tablist with twelve tab stops, and closing the sheet
left focus on <body>. The switch pill was a 30x17 hit target, theme cards sat
on two baselines because a CJK name and a Latin one resolve `normal` line
height differently, and a workspace path broke through the middle of a number.
The locks storage root reported "0 B · 7871 files" under a heading that asks
how much is on disk: the count breaks down a size, so it now goes where there
is a size to break down. The files themselves are correct and deliberate — a
lock file outlives its use because deleting one breaks exclusion for a holder
that still has it open — but nothing said so at the decision, and a measured
run shows a fixed home adds none while each fresh REASONIX_HOME adds four.
Both notes now say it, to the reader and to the next person reading the code.
Seven guards, each checked by removing the fix and watching it fail.
Coverage repair answered a digest that forgot a changed file by summarizing the
same fold a second time. The facts it was recovering are host-owned — the
receipts already prove which paths were written and which commands failed — so
the correction was buying nine thousand tokens of transcript to recover a
filename the host could name for free. On the fixture P0-B measured, the same
fold both ways:
calls summary input summary output coverage
before 2 18,500 850 complete
after 1 9,000 400 complete
The correction now runs on what the host knows. backstopFoldCoverage already
existed and already ran immediately after the repair, writing the dropped paths
and command signatures into the digest itself; it was the fallback for folds
under hard pressure, where the repair path was skipped. It is now the only
correction there is, which makes the expensive path and the cheap path the same
path. Nothing about the first summary changes — not its prompt, not its output
budget, not the fold geometry — so the number above is a deletion and not a
trade.
The circuit breaker survives, and deliberately judges the digest rather than
the completed text. A summary that named none of the fold's changes is broken
whatever the host wrote in afterwards, and measuring the backstopped text
instead would have retired the one signal that says so — it can only ever find
the facts the host just added. What changed is the price of finding out:
refusing used to cost a second reading of the whole fold first.
CoverageRepaired went with it, everywhere it was carried. A digest needing a
second call is a state that can no longer occur, and the CLI card and the
Studio card both had a branch for it that would never fire again. The backstop
line already says the true thing: the facts are in the projection, just not
because the digest carried them.
P0-B's accounting is untouched and still gated on more than one call. No
production path bills a fold twice now, so the cases drive two calls inside one
transaction directly — whatever brings a second call back has to land in one
bill, and the ledger cross-check still holds it.
Three gates, each shown to make two calls against the code before this: a
dropped change costs one call and is in the installed text, what gets installed
drops nothing, and refusing a useless digest costs one call too.
/compact set Force, and Force was one bool doing five jobs: waive the trigger,
shrink the recent tail, skip the idempotence check, skip the new-history rule,
and skip the fold's own economics. Only the first two are what a person means
by asking. The other three are why typing the command twice bought two
summaries of a context nothing had been added to — the shape a user actually
meets, since this machine's own history shows automatic compaction firing once
in five thousand calls while every /compact fires by definition.
The bool is now two: a request waives the threshold, because asking is what
makes it manual, and waives economics only when the user says so. Both halves
matter. Setting Force to false would have kept the economics and lost the tail
shrink, leaving a command that does nothing at all below the trigger.
Measured in the project's own harness, one /compact per generation over six
generations:
fold calls summarizer input projection @gen6
before 6 96,654 18,311
after 3 79,890 33,594
-50% -17.3% +83.5%
The last column is the trade being made rather than a regression: folding only
when a fold pays for itself means holding more between folds, and 33.6k of a
128k window is what that costs. The three skipped generations were skipped
because a checkpoint costs the whole prefix cache and too little had closed
behind it to earn a second one.
Declining is now an answer. A manual noop returned rejectCheckpoint — an error,
carrying a sentence that said "no foldable region remains" whichever gate had
actually declined. It returns a verdict with the code the host already settled,
and CompactDeclineText turns that code into words for a caller with no phrase
of its own. Over HTTP the endpoint answers 200 with the code rather than the
204 that could not tell a fold from a session it decided not to pay for. The
verdict's Installed is a bool and not a CompactionOutcome because that enum's
zero value is "installed", and a verdict nobody filled in must not claim a fold.
Two smaller things fell out. acceptCheckpointCandidate had a branch that read
like a force exception and rejected exactly what the branch above it rejected;
a checkpoint landing back at the trigger has bought the next fold rather than
avoided one, and nobody may waive that. And the overflow paths passed Force
alongside a trigger that already implies both waivers.
/compact --force is the escape hatch and stays one: economics only, and it
still cannot land a candidate that is not smaller than what it replaces. The
five behaviours are gated, and the two that matter — a request over an
unchanged context, and one over a few hundred new tokens — were each shown to
buy a summarizer call against the code before this.
A compaction's telemetry read res.Usage — the usage of the answer it decided to
keep. A fold that needed a coverage repair makes two billed calls and keeps one
of them, so what the receipt reported was never the transaction:
the repair improved the digest reported 1200 in, the provider charged 2200
the repair improved nothing reported 1 call, the provider charged 2
the repair billed and then failed reported 1 call, the provider charged 2
The first row is the one worth staring at: adopting the retry replaced the whole
result, so the first call's tokens left with it. Driven through a real
compaction, an applied receipt reported 9500 input tokens against 18500 the
provider was paid — a maintenance under-reporting its own bill by half, in the
one record a cost display would read.
A transaction's bill is now accumulated where the charge is, in the deferred
emit inside summarize, beside the usage event the ledger receives. That
placement is the point: the paths that lost a call were the ones that discarded
its answer, and no call site can discard a charge it never handles. Both entries
that reach a summarizer open a transaction — compactToProjection and
compressVisibleRange, the second of which builds its own telemetry and would
have been the next thing to go unaccounted.
Calls and RequestAttempts are kept apart. A call the provider retried inside
itself is one summarizer call over several requests, and collapsing them loses
the retries while counting them as calls loses the shape. Calls counts billed
calls, which is what makes it comparable to the ledger.
The receipt carries the same total, because the receipt is what survives, and
its InputTokens is the context that was worked on rather than what the work
cost — the two are routinely orders apart, and reading the first as the second
is what made a compaction look like it had read 160k of anything.
The gate against future drift is the cross-check the cases all carry: a
transaction's bill and the usage ledger are two readings of the same charges
and may not disagree. Each case bills its two calls differently so a total that
silently describes one of them cannot pass, and each was shown to fail against
the previous accounting.
Cost stays out. Quoting belongs to the sink that already prices these events,
and internal/agent does not import internal/billing; a per-transaction figure
wants the receipt's OperationID on the usage events, which is its own change.
A tool result the model saw bounded reached the summarizer in full. Content is
the provider-visible body, capped at maxToolOutputBytes, and RawContent holds
the original beside it for local display and recall. projectMessages clears
RawContent for both ModelMessages and ProjectionMessages, so no provider ever
receives it — except that a summarizer call does not go through either. It
renders the stored messages into a user message, and renderTranscript preferred
RawContent, so compaction was the one path in the tree that put display-only
state into provider request bytes.
The cost of that is not marginal, because the bound it undoes is the one thing
keeping a large read out of a request. The same fold rendered both ways, through
the estimator the budget itself uses:
fold shape model saw summarizer got ratio
20 reads truncated from 300KB 164297 1536332 9.4x
20 reads truncated from 100KB 164297 512232 3.1x
50 mixed results truncated from 80KB 410739 1024639 2.5x
This is also why the size of a compaction did not follow from the size of the
session it compacted: a conversation is bounded per result, and this read the
copies those bounds had cut away. The first row does not even fit a 1M window,
so a fold a bounded transcript would have sent in one clean call was either
shortened first or refused outright.
Both routes into the request are closed, not just the rendering one.
shortenFoldForSummary sketched long bodies from RawContent as well, on the
reasoning that a digest should see the real outcome shape. A head-and-tail of
the full output is bounded, but its tail is material the conversation never
carried, and the digest becomes what the session remembers — so the sketch is
cut from the body the model was given. Recall is untouched and stays the
deliberate exception: it exists to answer with what actually ran, as a tool
result its own budget bounds.
summaryInputTokens shares the renderer, so a fold's measured size was already
counting the raw copies. It now measures what actually rides, which is what the
budget was always meant to be comparing against.
Three gates, each shown to fail against the code before it: the request never
carries a body the conversation did not, a longer local copy cannot move a
fold's measured size, and the shortening path sketches only what was sent.
A session's pricing completeness was one boolean, and an aggregate has four
answers to give. A session that has billed nothing, one whose every round
priced, one that priced some rounds and not others, and one where nothing
priced at all all came out as costComplete true or false — and the first and
last of those also total the same amount, zero, so nothing downstream could
tell them apart. Studio could not tell them apart for a second reason: the
field was declared in the page's own CostQuote and read by nothing, so the
session projection carried no completeness at all.
Coverage is that fact with the states a boolean cannot hold: none, complete,
partial, incomplete. It is folded rather than assigned — the join over complete
and incomplete, with none as the identity and partial as the top — so it is
commutative, associative and idempotent, and the same rounds billed in any
order reach the same state. A run that has priced everything so far cannot fold
back to complete once an unpriced round joins it, which is the failure a
boolean invites and the one the ledger was already committing.
That ledger defect is the one thing here that was a wrong answer rather than a
missing distinction. Entries merge by pricing key, and going bucketed on a
second currency re-asserted completeness before folding the incoming quote in,
so an entry that had already seen an unpriced call read as complete again. On
the pre-change tree, a ledger given one unpriced call and two priced ones in
different currencies reported the session as costComplete true with the reason
erased. It reads partial now, because coverage folds and the boolean is a
reading of it rather than a second answer free to drift from it.
Zero is an amount, not a state. A model billed at a published price of zero and
a session that has not spent both total zero and must not share an identity:
the first is complete, the second is none, and both halves are pinned.
The kernel owns the answer on restore, because the record is not replayed —
usage rounds are not in the transcript, so the fold has folded nothing when a
pane opens on a session that already ran. /status carries the session's own
aggregate and that is where the coverage comes from. A kernel older than the
field restores nothing rather than a guess, and the live fold takes over from
the next round, which is all it can speak for.
Deliberately not here: the cost block's wording is untouched and still reads
pricing state off whether an amount is above zero. displayStatus and
displayComplete stay the separate question of whether a requested currency
could be shown, and aggregateMode, originalTotals and legacyEstimate stay in
the kernel — the page keeps the smallest set that maintains the fact's
identity, not a copy of the quote.
Every cost figure on the rail was formatted to exactly two places, so anything
under half a cent rendered as US$0.00 — the same string a true zero prints. Read
back from a sampled session's own journal, all 45 usage quotes were complete and
non-zero, at $0.000206 and $0.00291 a round and $0.018644 for the session, and
every per-round and per-source figure on screen said US$0.00. A turn that cost
money read as a turn that cost nothing.
That is not the same defect as a missing price, which is what it looks like from
the outside and what the block's own "价目未上报" line claims when it appears.
The completeness fact the kernel sends is a separate matter and is untouched
here; this is only the figure being unreadable.
Ordinary amounts keep their currency's own precision, because paying for the
small end with six places everywhere would be a different kind of noise. Only an
amount that the fixed precision would swallow is given the significant digits it
takes to stay non-zero, so $12.28 and $1,234.50 are unchanged, $0.005 is still
$0.01, and $0.0049 becomes $0.0049 rather than nothing.
The gate is the contract rather than a table of renderings: across six orders of
magnitude, no non-zero amount may format to the string zero formats to — held on
the Intl path and on the fallback path for a code Intl does not know. Two more
pin the halves that a fix could trade against each other: ordinary amounts stay
at ordinary precision, and a true zero still reads as zero.
Context drew its usage figure twice — once against the fold point, once against
the window — and 393 sampled renderings never once disagreed about it, because
it is one number. It is drawn once now, with each ceiling keeping a row of its
own and naming its own denominator. Collapsing them into a single percentage
would have been the same defect wearing less: "6%" cannot say whether it is 6%
of the point where the host tidies up or of what the model can hold at all, and
those are two different things to do next.
The cache block led the rail at its largest size with a session-cumulative hit
ratio, on the argument that a session which stops hitting its prefix costs
several times more per turn and a number that size gets noticed. A cumulative
ratio is the one shape that cannot do that: the longer a session runs the less
one broken turn can move it, and four sampled runs watched it drift three points
across a hundred seconds of turns. It is a figure beside the block's name now.
What can answer "why did this turn suddenly cost more" is the prefix having
moved, so that is what surfaces, with the kernel's own reasons on it — and only
when it has. A block nobody has made a request against says nothing at all.
Both stop easing their numbers. useTicker eased a metric from its old reading to
its new one over 520ms, which at a 250ms sample turned 11 real cache updates
into 21 ratio renderings and 25 hit renderings; on the context gauge, which
Round 2 established moves once per request, it drew a per-request step as a
smooth climb. A reader cannot tell an eased frame from a measurement, and
nothing on screen offers to. The ratio is also hit / (hit + miss), so easing it
on its own clock briefly disagreed with the two figures it is derived from.
With both of them off it, useTicker had no readers and is gone rather than kept
for a caller that might want it: what is left in num.ts is one hook whose timer
samples a shape and one whose timer may only end an observation. Geometry and
emphasis still move — the bars keep their transitions.
The gate is the contract in one line, held for each of them: one metric update
is one displayed value, asserted by advancing timers and frames afterwards and
finding nothing added. Against the deleted helper the same test reports six
readings for one update, four of which no request ever produced.
The runtime panel drew six counters on every rail, standing at zero whether or
not anything had happened, and three panels beside it held a block each to say
they had nothing. A sampled clean run spent 100% of its samples showing 失败步数
0, 外部请求 0, 子代理数量 0, a background-jobs block whose entire content was
"没有在跑的后台任务", and a work-tree block whose entire content was "尚无改动".
A reader who has learned to skip five zeroes skips the sixth on the run where it
is finally not zero.
Each of them now speaks only when it has something to report, which is the
contract the rail already claimed for itself and most of its panels already
kept. A failed step, a call that reached outside, a delegate, a background job, a
changed file: absent at zero, present the moment they are not. The work tree is
the one review posture draws first, so an unchanged one led the rail with a
sentence about nothing every time a turn ended.
Throughput goes with them but on its own reading. It is about a turn in flight,
so it is drawn while one is running and not after — a permanent "— tok/s" on an
idle rail is the same zero row spelled differently, and D1 already made it fall
silent within the turn.
待确认 is the only fact here a reader can act on, and the only one about them
rather than about the run. It leads the rows and is toned as a request rather
than as telemetry, label and number both, because what matters is that
something is waiting and not how many things are. The transcript says what is
being asked; this says that something is being asked at all, which is why the
two saying it at once is not the duplication the next paragraph is about.
改动文件 was: it and the 工作树改动 block were one derivation rendered twice, four
rows apart, from the same visible(changes, tree) call — measured identical
sample for sample. One projection is kept.
工具调用次数 moves off the rows and onto the group's own line. D2 made it a
correct cumulative fact; that is not the same as it deserving a standing row,
because how many calls a turn made is almost never what decides the next thing
to do. Being right is not a reason to be loud.
Jobs carried a comment arguing the opposite case — that empty is a state and a
vanishing block moves the rail's order under the reader. The order is a fixed
table per posture, so a block leaving moves only what is below it, and jobs sits
near the end of both. Measured against a standing row nobody reads, that is the
cheaper of the two. The inspector's contract test kept the same shape and
changed which panel is its example.
Runtime's own doc described three headline figures on a head card that
Metrics.tsx says twice does not exist. The panel is now what it actually is, and
no comment in the rail claims that card any more.
Four controls stood on the shelf under every turn, and on an ordinary one three
of them recited a value the session already had before anyone touched it:
均衡, 计划, and whichever posture the policy chip had collapsed to. Sampled runs
watched all three sit unchanged for the whole of a turn — zero changes, zero
time away from baseline — beside a model picker and a stop button that were
doing the work.
policySummary already knew how to do this for effort and approval, and preset
was the one field it recited unconditionally. It is baseline like the other two:
balanced is what a session runs as before anyone changes anything, so it is what
the shelf stops spending width on, and delivery — or any preset the kernel names
that this table does not — is a deviation and shows. With all three quiet the
control has nothing to report, so it draws nothing at all rather than an empty
chip, and it carries its own separator so nothing dangles where it stood.
The plan toggle is not the same reading, and the difference is the rule worth
keeping: a status may recede to its baseline, but the only way into a mode may
not. Preset, effort and approval are readouts whose control lives in the
settings sheet as well, so what recedes there is the shelf's copy. The plan
toggle is where plan mode is discovered — Shift+Tab is a shortcut for someone
who already knows, not a hint — so it stays, drawn as text rather than as
another chip while it is off, and taking its full weight back the moment it is
on. It keeps its border on hover, because a control that only exists once you
are already touching it is the one nobody finds.
The model has no baseline to recede to. Every value of it is a choice somebody
made, so it stays, and so does stop.
The gate is the two halves together: a session at balanced / auto / ask must
recite none of it, the plan toggle must still be there saying it is off, and
each deviation on its own must be visible. The one
the quiet may never swallow has its own two tests — a fully-permitted session
shows 全放行 and its mark with everything else at baseline, and again while a
plan is running. A third catches the shape of failure this kind of change makes:
the dangling-separator check is vacuous if its selector is wrong, so the
deviating case asserts the same query counts something.
The rail counted tool calls, failed steps and external reaches by walking the
transcript for items of type "tool". The transcript is a projection whose job
is to collapse cards — read_file alone was 96 calls across a sample of recent
sessions against 47 for bash — so it folds settled lookups into one manifest,
nests a subagent's calls under the task that spawned them, and replaces a saved
memory's row outright. Every one of those moves an execution out of the shape
the counter recognised, and the counter is labelled with a cumulative fact. Four
sampled runs watched it count down: 7 to 5, 13 to 12, 15 to 14. Failures went
with it, because the same walk derives all three behind one type test, and
nothing stops a read that failed from being folded.
The three facts now come from the executions the session records, keyed by the
id the wire gives each call. Identity is what makes this idempotent rather than
a guard: the same event reduced twice — a replay, a reconnect that re-delivers —
is one fact restated, not a second call. An outcome is absent until the result
lands, because a call still running has not succeeded. Classification stays in
derive.ts beside the categories the rest of the interface uses; what moved is
where identity lives, which is the part the projection was overwriting.
Recording happens before the branch that deletes a card, not after it: a row
being replaced is not the call not having run.
The gates are the four ways the transcript destroys a card, plus the general
form — the same executions drawn two legal ways must answer identically, which
is what a new collapse rule has to pass. Against the old derivation all five are
red: the two fold cases report 0 where 2 and 3 ran, a subagent's call reports 1
where 2 ran, a replaced memory reports 0 where 1 ran, and a failure folded into
a manifest reports 0.
Every restore hands the executions over with the transcript, and the `as never`
the three dispatch sites carried is gone — it was what let one of them be
written without them, which a live run then found by reducing a tool event
against nothing at all. Dropping the cast is what makes the next omission a
compile error rather than a crash.
The folding rules move to state/fold.ts, which is what keeps session.ts inside
its ceiling and also says the thing this change is about: drawing and recording
are two jobs, and only one of them is allowed to be the source.
What this does not fix: /history carries no error field and no resolved name, so
a rebuilt execution has no outcome. After a reload the failure count reads 0
however many failures the session had — the same reading as before, now for a
stated reason rather than a silent one. Closing it means the kernel projecting
what it already knows, not the frontend inferring it.
The rail's throughput row was read four times a second by the same interval
that advances the elapsed clock, whether or not a token had arrived. Between
arrivals the window's samples age out of the front while the span they are
divided by does not, so the value slid down a smooth ramp and the reader
watched a rate fall through a dozen readings the model produced nothing for. A
sampled run measured seventeen consecutive readings, 87 to 2 tok/s, across 4.3
seconds in which the turn was waiting on a tool. 134 of the 136 value changes
on that rail in four runs came from this one row.
The intent was never wrong. tokens.ts already says the window is "short enough
that the number falls to zero while a tool runs instead of implying the model
is still writing", and falling to zero is right. What was wrong is that the
fall was drawn as a series of rates rather than as an ending.
A rate is an observation of what arrived, so useRate makes one only when
something arrives, and gives wall time exactly one power over it: to end it. On
each new sample it reads the window once; it then schedules the single step to
zero at that sample's own expiry. Between the two the last observation stands
unchanged. WINDOW_MS is untouched — how long the window should be is a separate
question from what may write a number into it, and answering both at once would
leave neither answered.
The invariant test drives the hook through arrivals and silence and asserts
that silence produces exactly one transition, to nothing. Because that is also
satisfied by a hook that never changes at all, a second test requires a fresh
reading as soon as tokens resume, and a third requires the last reading to
stand until its window actually closes rather than vanishing early. A fourth
keeps the defect stated rather than remembered: asked repeatedly with nothing
new, the formula itself still answers a different number every time, which is
correct for a pure function of `now` and is exactly why nothing may ask it on a
clock.
The page did not read as a console because any one control on it was obscure.
It read that way because all of it arrived at once, in an order nobody chose:
语言 and 窗口 first, 明暗 and 配色 last. What a visit is actually for now comes
first — 明暗, 配色, 大小, 壁纸 — with 语言 and 窗口 after them, and 字体, 文字粗细
and 文字对比度 folded into one disclosure.
A disclosure that hides a value somebody set is a screen disagreeing with the
window it describes, so the summary says which of the three have been changed,
read from the same values the folded blocks render rather than from a second
copy of that question. Its label is drawn at the weight of a settings row, not
a footnote, because what is behind it is three whole blocks.
Which disclosure a jump has to open is answered by structure — the anchor's own
ancestors — rather than by a table of which settings count as advanced, which
would have to be threaded through prefsnav, Appearance and Settings and kept in
step with all three. The landing then has to survive the page: 配色's packs and
the font list arrive after the scroll is already running, and a smooth scroll
aimed once lands short by however much grew above it. Measured on the fixture,
文字对比度 came to rest with only its heading edge on screen. A jump owns its
landing until it lapses, so it re-aims for as long as it is owed.
Gating 壁纸's opacity, dim and focus behind the same treatment was considered and
dropped: `look.wallpaper &&` is already the gate, and hiding those once a
wallpaper is chosen hides them exactly when they became worth having.
The chrome is the one line that is always on screen, so what sits in it is a
claim about what a session needs within reach for all of it. A theme cycle is
not that. It is set once and then left, and 明暗 on the appearance page already
owns the same state with its three values named rather than reached by clicking
through them — which is also what made the button hard to write: two of the
three look identical on screen, so the cycle had to be re-derived from what the
system currently resolves to just to guarantee the first press changed
something.
What goes is the control, not the capability: the button, the two props the
window threaded down to it, the registry entry and the icon's per-state CSS.
`.thbtn`'s shared rules stay, because the account, focus and settings buttons
are still drawn in that weight class. audit-sweep's theme-toggle step goes with
them — with no control left to find it would report a permanently skipped step
on every run, and a skip a reader has to re-diagnose each time is worse than no
step.
Shrinking the button instead was the other option, and it answers the wrong
question. It would leave the same claim on screen — that this is one of the few
things the window shows unconditionally — while making the control harder to
hit.
The preceding commit establishes that the producer owns the identity and that it
survives the pipeline into the model's own view. It does not establish that the
model does anything differently for having it. This is the harness that would
answer that, and the record of what happened when it was pointed at the question.
Three arms share one transcript ending in a refused update_goal and differ in
the refusal tail alone: the shipped sentence, that same sentence byte-for-byte
plus the identity Refusal.String() appends, and a synonymous rewrite carrying
none. A minus B is then the identity, and the rewrite is the control that says
whether any difference was the identity or merely changed words.
TestRefusalArmsDifferOnlyInTheRefusalTail runs in CI without a provider, because
it is the claim every live number would rest on: the arms are checked to be
identical in transcript and tool surface up to the last tool result, the typed
arm to be exactly the sentence arm plus the identity, and the reworded arm to
carry no dotted token that could serve as an identity proxy. The measurement
itself is opt-in behind REASONIX_LIVE_REFUSAL and skipped otherwise.
The pilot result, recorded because it is the outcome:
R1 typed refusal architecture PROVEN
Behavioural claim NOT MEASURED
Reason the design pilot found the invalid-goal-retry
primary at the floor on this fork, 0/15 across
all three arms; no confirmatory run launched.
A pilot is allowed to falsify the assay rather than the hypothesis, and that is
what this one did: with the primary at the floor, a confirmatory run buys a more
precise measurement of something the instrument cannot see on this fork. The 15
observations are excluded from any reported result, including the secondary axis
that varied in them — moving the primary to an axis noticed after looking is the
move a frozen primary exists to prevent. Measuring this properly needs a new
assay, preregistered from host state rather than from these runs.
Classification reads the calls the model emitted, never its account of itself,
and the outcome vocabulary and the two-call window were frozen before the first
request. The other-goal-mutation set is declared rather than name-matched: a
guess at "some goal tool" would count one that never existed and miss one that
does.
The goleak allowance is scoped to the transport read loop a live provider owns
and no test can reach to close, and only under the env gate that asks for real
traffic. Forgiving everything parked on IO — the first shape of this — would
have made the live harness the one place its own leaks cannot be seen.
`ContextualReasoner.Unavailable` answered a bare string, so a caller that has to
tell two refusals apart was left matching the words one of them happened to be
phrased in this release. The rule the tree already holds errors and HTTP
refusals to — the identity travels, the sentence is presentation — did not reach
the one refusal the model reads most often.
`tool.Refusal` carries both. Five codes land, each backed by exactly one
predicate its producer can prove: jobs.no_job_context, plan.mode_active,
plan.no_planning_turn, goal.no_active_turn, and tool.unavailable_unspecified for
a contextual tool that says nothing, which is a fact about the registry rather
than about the call and so gets its own identity instead of a bare sentence.
The middle two are the argument for doing this at all. complete_step refuses
because plan mode is active; submit_plan refuses because no planning submission
exists. Those are opposite facts with opposite recoveries, and under
sentence-matching both read as "something about plan state is wrong". The two
plan tools share one code and keep their own wording, which is the shape: one
identity, two presentations.
No code is invented ahead of a producer. update_goal's ProviderVisible proves
only that this turn carries no goal recorder, so there is no second goal code
for a completed-but-armed turn; that state has no producer yet.
Refusal implements error because update_goal had two refusal paths for one fact
— the availability gate and the fail-closed Execute a stale transcript reaches —
with the sentence hand-copied into both. Returning one value from both is what
stops the identity from being present on one path and lost on the other. The
same shape was live in submit_plan and conclude_no_changes.
The identity crosses both boundaries it has to. Refusal.String() renders it into
the text the model reads, because a code the model never sees is one it cannot
cite; refusalCode rides toolOutcome to event.Tool.RefusalCode structurally,
never recovered from the words. No sink reads that field yet — this commit
claims that the producer owns the identity and that it survives the pipeline,
not that anything has been shown to act on it.
The registry tests pin which tool refuses under which code. Nothing about a
tool's name says which host fact stops it, and two tools sharing a code is a
claim that one predicate stops both, so a new contextual tool has to enter the
table and make that claim in the diff.
The narrowed standards gate built its universe from `git diff --name-only
HEAD`, which answers what the worktree changed against HEAD and says nothing
about a file git has not started tracking. Three new files reached `make check`
as clean while the full sweep found a violation in one of them. Not a wrong
judgement — a measurement universe missing a piece, and a green meaning only
that the gate never opened the file.
The universe moves into Go as `-changed` rather than growing another expression
in the recipe, because the defect was in the universe and a universe computed in
a Makefile cannot be tested. `trackedChangedPaths` is kept as its own function
though nothing in production calls it: it is the incomplete universe, and a test
that cannot express the incomplete one cannot prove the complete one fixed
anything. That is what the second test does — one finding, two universes, two
verdicts — and the first fails on purpose if `git diff` ever starts reporting
untracked files, because the witness would be gone.
Deleted paths stay out. A path the change removed cannot be scanned, and handing
one to the scanner asks it to fail on an absence the change intended.
REASONIX.md now names `make check` as the owner of that universe rather than
naming the flags behind it. The rule being preserved is that the evidence entry
point is the make target; which flags implement it is not the contract, and
writing them down is how the document went stale the first time.
CI is unaffected: it runs the full sweep with no narrowing, so the hole existed
only in the local check cited as evidence that a change owed nothing.
The catalogue could answer when a change takes effect and not who it
reaches, so ownership was read off the page a block happened to be filed
under — and the model page alone holds one value stored per provider
entry, three stored machine-wide, and one stored nowhere at all.
Every scope here came from reading the endpoint behind the control and
the authority it writes. Three findings the screen could not have shown:
the compaction threshold sits on the model page and is one [agent] key
every session on this computer reads; 执行设定 and 计划模式 reach the
controller and persist nothing, while 工具批准 and 模型 look identical on
screen and are written as the default every later session starts from;
and four blocks — hooks, MCP, skills, memory — take the authority as a
kernel parameter the reader chooses per write, so naming one owner for
them would be wrong half the time.
Scope and apply stay two fields, joined only where they are drawn: a
pre-joined sentence would give search, filtering and export nothing to
read. Both come from the one catalogue, so the block and the search
result that leads to it cannot disagree about what a setting owns — and
search is where it is worth most, since a proxy found under 网络 with no
page around it says nothing about whose proxy it is.
Ownership is a fact, so it rides the weak line the timing already used.
No badges, no accent: thirty of them down a page must not read as thirty
alarms.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_013UmAThRKnRPWvBouHWHkQ3
Three kernel facts were recited on every turn, including every turn where
none of them was unusual — so a shelf that already carries a model, a plan
toggle and an attachment row spent its remaining attention saying that
nothing had been changed. It now spends one word on a session nobody has
configured, and the whole reading stays on hover: baseline recedes, it is
not deleted.
What recedes is decided by the kernel's own defaults, not by length. ask
is the only approval mode that changes nothing about what happens without
being asked, so it is the only one allowed to be quiet: auto lets calls
through unasked, dontAsk refuses what it would have asked about, and yolo
asks about nothing and carries its own tone, because it is the one state
that costs a workspace if it is forgotten. The summary says 自动批准 where
the menu says 自动 — under a 工具权限 heading that word is unambiguous, and
on the shelf it stands next to a reasoning rung.
The projection reads committed fact only. A field still in flight shows
its pending state inside the open menu, where the person who clicked is
looking; a shelf that moved first would name a posture the kernel has not
accepted and may refuse. With nothing read yet it names the control rather
than the posture the kernel usually answers.
The rail's own 运行详情 becomes 运行指标: it reports throughput, calls and
files changed, and the pane's detail menu now owns the other name.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_013UmAThRKnRPWvBouHWHkQ3
Two navigations sat one above the other speaking the same grammar — a row
of tabs under a row of tabs, both drawing the same travelling marker — so
which row changed the session and which changed the view had to be worked
out on every glance. The inner one now projects the five views onto three
standing purposes: the transcript, the task board, and one entry for the
three that are diagnosis.
Demoting that entrance must not hide the position, so the trigger carries
the category alone while nobody is inside any of the three, and the open
lens's name alone once somebody is — at every width, which is why nothing
here arbitrates between the two by container width. What pins it is three
renders, one per lens, each a first render: that is also how a pane
arriving from somewhere other than this menu reaches the projection, since
it keeps no memory to consult and can only draw the identity it was
handed. The other gate is that opening and closing the menu picks nothing.
An entrance that reopens the last lens, or defaults into one, is a state
machine with no place on screen to show itself.
The five view identities are untouched, and so is everything that reaches
them without going through the bar: a graph node still lands on its call
in the transcript, the task board still reaches the trajectory and the
latest turn, and a run that loses its graph still takes its timeline with
it — the menu offers no timeline there is no graph to draw. Each
diagnostic view is still mounted only while it is on screen; that
asymmetry is a performance contract, not markup nobody tidied, and a test
now reads it off the source so unifying them fails rather than quietly
costing a transcript's worth of work per streamed delta.
The travelling marker is PaneTabs' alone. The transcript's item count is
gone — the largest number on the bar and the one that changed nothing —
while task progress stays and the diagnostic counts move into the menu.
Two bounds decide when a session folds and only the lower one fires. The
window was the one on screen, so a 1M session drew a bar 16% full at the
moment maintenance happened, and the setting behind it was the kernel's
configuration language: one signed integer, where a negative retired the
economic bound and left the window share firing at 85% under a label that
read as off.
ContextBreakdown now carries the boundary in force, read from the rule
that fires it rather than recomputed by whoever draws it. The panel leads
with the distance to it and keeps the window as a quieter second figure —
capacity answers whether the model is too small, and is still the only
place a relay's wrong window is corrected. The two rungs the kernel
already tells the model about, 75% and 92%, are the two the panel shows,
so the screen and the conversation are never under different pressures;
both read as accent, because a routine fold painted as a warning makes
every long session look broken.
The setting states the three intents instead of asking for a sign, names
which of them is in force while collapsed, and says capacity still
applies when the economic bound is retired.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_013UmAThRKnRPWvBouHWHkQ3
Renaming a session, moving where compaction starts, and renaming a pane all
saved on blur and nowhere else. Blur fires when focus moves for reasons
nobody aimed at — a click elsewhere, a Tab, a window going away, an element
being removed — which is why the census counts it as a runtime event and
never as an interaction root. So three host writes had no root at all, and
Seal A's "every proven write has an identity" was true over a universe that
could not see them.
Enter now commits, and carries the identity. Blur still saves, because
clicking away is an answer and taking that away would be a worse product
for a cleaner number; what changed is that it is no longer the only way in.
Each of the three guards against sending the same value twice, since Enter
commits and then blurs — for the compaction threshold that matters more
than tidiness, because declaring it rebuilds the runtime.
One id for two places: the sidebar's tree and the pane tabs rename the same
session through the same host call, so session.rename covers both and says
which on data-target. compaction.threshold is new. The sandbox's workspace
root turned out to be fine already — its Enter has committed and been named
all along, and it is in this only as the shape the other three now have.
There is a guard now, and it is about the rule rather than these three: a
field whose blur handler reaches outside the component — a port or hub
call, or a callback handed in from above — must declare a user input on the
same element. Blur closing a menu or clearing a local flag is untouched,
which the check demonstrates on both a commit it must see and a local write
it must not.
Found while adjudicating the workspace rail, and worth saying that the
first count was wrong: a four-line grep found three of these and there were
five. The two it missed committed through a local function rather than
inline. Queue's was already named and Sandbox's already committed on Enter,
so three needed the change.
Seal B 79 to 76, unnamed 231 to 228, Seal A still held — now over a
universe that includes what it is claiming about.
Ten unnamed inputs across onboarding, the remote list and the composer, and
four of them do something outside this window.
Opening the vendor's console during setup and opening a link in the
transcript are one thing to do, so both sites take external.open. It is
shell-native and not a mutation: the reader is handed to a browser and no
state on either side moves.
Probing a remote asks a machine whether it answers. Nothing changes, and
asking again is the point when the first answer was "not yet", so it is
repeatable and carries the host it is about on data-target.
Choosing an image uploads it before anything is sent — the picker's own
button only opens a dialog, and the bytes reach the host on the change.
That is where session.attach goes, and naming the button instead would have
put the identity one step away from the write.
The other six stay unnamed on purpose. Picking a vendor, typing a URL or a
key, and choosing a model all edit onboarding's draft until
onboarding.connect sends it. Setting or dropping a remote's default folder
edits a draft the save reads. Restoring or discarding a long paste moves
text in and out of the box you are still writing in.
Seal B 83 to 79, unnamed 235 to 231, ratchet lowered, roots unchanged at
418. Three ids for four roots, and six looked at and left, which is the
same discipline both ways: an id is what a person did, and there is nothing
to name where nothing was done to anything.
Two of the four unnamed inputs on the workspace rail really do change the
host: the folder picker and the typed-path form both end at addWorkspace.
They take the id the empty transcript's own button already carries, because
which of two ways you named the folder is not a different thing to have
done.
The other two do not, and are left alone. Folding a workspace row writes a
Set in the window and nothing else. Renaming a session commits on blur —
its keydown only blurs the field, so naming that would name the trigger and
not the write.
That blur is worth stating plainly, because it is a hole in a number this
tree quotes. Three host mutations in the desktop commit from onBlur — two
renames and the sandbox's workspace root — and blur is classified as a
runtime event, so none of them can ever be an interaction root. Seal A
reads held over a universe that cannot see them. Reclassifying blur is not
obviously right (it fires for reasons nobody aimed at) and giving these an
explicit commit control is a product change, so this records the gap rather
than closing it.
ModelChoice is refused as identity debt, and that is the other half of this
change. Its four inputs — the model ticks, the vision flag, the default,
and adding a name the endpoint never reported — all write React state that
lives until someone presses save. The canonical mutation is already owned
by provider.add and provider.save, and inventing model.enabled or model.add
would have said something untrue: typing a model name and then cancelling
changes no provider config at all. It would also have sat one word away
from model.select, which switches the model this session is running on.
So this is two roots named out of eight looked at. Seal B 85 to 83, unnamed
237 to 235, and the ratchet lowered to match. The rule the earlier census
should have been applying, and now is: a root earns product identity when
it triggers the host mutation itself, not when it edits a draft some later,
already-named commit will read.
Thirteen inputs on the appearance page changed durable state and had no
identity — the interface language, the interface and reading scale, four
background parameters, weight, contrast, light-or-dark, and two font slots.
The same file already declared five other actions, so this was a gap in the
vocabulary rather than a page nobody had reached yet.
Eight names for thirteen controls, and the difference is the point. The
interface scale has a row of presets and a slider beside it: two element
types, one thing a person is doing. The four background sliders edit four
fields of one background — changing how much it is darkened is not a
different capability from changing how opaque it is — so they share
appearance.background and say which parameter on data-value, the way
pane.close already says which panes on one. Naming each control would have
been the DOM renamed, not a vocabulary.
Three boundaries kept on purpose. theme.activate installs a palette pack
and appearance.scheme is light, dark or follow-the-system. wallpaper.change
and wallpaper.remove decide which image is there; appearance.background is
how the image that is already there is drawn. Weight and contrast look
alike in CSS and are two different things a reader wants.
The surface stays out of the id. These are reached from the settings sheet
today, and an id that said so would need a second one the day onboarding or
a command palette can change the same setting — which is the rule
chrome.preset was already keeping when the composer started rendering it.
Where they land decides their kind rather than how they look: the scale,
the reading size, the background, the fonts and the language all reach
saveAppearance, while light-or-dark, weight and contrast are this browser's
and stay view, which is what chrome.theme already is.
Two controls, one of which must not fail. Swapping the opacity slider for a
number input leaves every guard green — the identity is not the widget's.
Giving each background parameter its own id turns the vocabulary contract
red, which is the shape this was most likely to drift into.
Measured, and every root accounted for: Seal B 98 to 85, and the thirteen
that left are exactly the thirteen named here — the appearance page now has
none in that population. Actions 112 to 120, unnamed 250 to 237, the root
count unchanged at 418, and Seal A still held. What remains in Seal B is
not this kind of debt: it is dominated by an identity axis whose unresolved
provenance is one list shared across fifty-seven roots, and by callees the
analyzer has no verdict vocabulary for.
Seven changes to the desktop's presentation layer, and what is worth keeping
from them is not the diff. Each rule below is held by a guard that fails
when it is broken, which is why they are standing instructions rather than a
changelog:
38c1477 transcript visual hierarchy
49b5746 turn-policy ownership
637c0ff certified primitive callback roots
47e518f anchored pane-close confirmation
3966791 settings discovery and apply truth
b0af1d1 motion has explicit causes
2ebfff6 lifecycle-aware inspector composition
Seal A of the action census stayed held throughout, and the one time Seal B
moved it was the instrument being corrected rather than debt being added:
certifying a primitive's callbacks brought the Picker call sites into the
universe, one of which switches the model and had never been counted.
The rail drew the same ten panels in the same order whether the turn was
running or long finished. While it runs the questions are "is it alive,
what is it doing, how much room is left, where is it in the plan"; once it
is over they are "what changed, what came of it, what did it cost" — and
the answer to the second set sat below six answers to the first.
Two postures, and deliberately only two. A rail that reorders itself on
every change of fact is not lifecycle-aware, it is unstable, and a reader
who has to find the same panel twice in one turn has lost more than the
ordering gave. Working leads with context, runtime, agents and the plan;
review leads with files, plan and jobs, and context drops — how full the
window is matters while there is a turn to fit in it and is forensic once
there is not.
The plan moves up rather than staying with the after-the-fact group. While
a turn runs it answers where it is and what is next, which is orientation,
not an audit trail.
Posture comes off the run and never off what the panels hold. It is derived
beside runState because "halt" answers two different questions — a turn
waiting on a decision has not finished, and a turn that ended badly has —
so blocked is asked separately rather than read back out of the state that
already collapsed them. The rail was reading `!running`, which called a
turn waiting on your approval finished.
One list of panels, keyed, reordered. Two branches of JSX would be the
obvious way and the wrong one: the same panel under a different parent is a
different element to React, so changing posture would tear every panel down
and build it again — losing whatever was open inside and asking again for
whatever it reads. Changing which reading the rail is for is not a change
to any panel's lifetime, and there is a guard that fails if it becomes one.
Priority is not presence. Whether a panel appears is still its own
contract, in both directions: Plan draws nothing without steps, and Jobs
reports zero on purpose so the order does not move under the reader every
time the last background task finishes. Composition decides where something
goes, never whether there is something.
The diagnostics drawer this was going to grow is not here, and that is a
finding rather than an omission. Mcp already speaks only when a server has
failed or has never been answered for — a drawer would add an empty one to
every healthy rail and shut it over the one thing worth seeing on a rail
that is not. Ordering it last is the whole of what it needed.
Three panels gained the id the others already had, so what the rail put
where can be read off the document instead of guessed from the words
inside it. Three sabotages: two conditional subtrees, an order that follows
the data, and a wrapper that overrules a panel's own silence.
Also recorded rather than fixed: there is no head card. Three comments in
this rail describe one, and Context still carries a row=true form for it
that nothing passes. That is panel API, which this change does not touch —
but the comment that sent readers looking for it is gone.
Seal A held, Seal B 98, and the action universe unchanged at 418 inputs and
250 unnamed. Reordering what is already there gives nobody a new thing to
do, which is what this should have cost.
Two places took a DOM node coming into existence for something happening.
A transcript card animates in whenever it mounts, while blocks of 48 mount
and unmount as the reader scrolls — so a fact from an hour ago arrives
again every time its block comes back. A settings block does the same on
every section change, and four of them flying in says four new things
appeared when the reader only walked to another page.
Entrance is now a debt, owed once and spent by the render that draws it.
The projection keeps it, because only the projection knows whether a card
is arriving or being replayed: a restored transcript owes nothing, a card
the live reducer first materialises owes exactly one, and a delta rewriting
a message it already made, a dispatch settling into its result, or a block
scrolling back into the document are all the same card and none of them is
a new fact. Kept beside Item rather than on it — what a card is does not
depend on whether its arrival has been shown yet.
Provenance would not have been enough, and that is the trap this is written
against. A card that was live three hours ago is still live-origin when
virtualization brings it back, and a mark meaning "this came in live" would
animate it a second time. What has to be asked is whether the entrance is
still owed, which is a question with an answer that changes.
The debt is spent by render and never by the animation. Reduced motion runs
no animation at all, an element can leave the document before one ends, and
either would leave the debt standing for a card to arrive again later.
Motion does not get to own the state machine.
The mark rides a display:contents frame around each row rather than a prop
threaded into twelve card components. Measured rather than assumed: every
card still has its block's exact box, content-visibility still applies, and
the turn anchor's margin still collapses to the same 28px.
The settings sheet gets the same treatment from the other end. Its blocks
stop animating and the column is keyed on the section, so changing section
is one movement of the thing that changed — the view — instead of a stagger
of everything mounted beneath it.
The rule is written down twice where it will be read: beside the motion
tokens, and as a guard over the stylesheet itself. That guard is the only
thing standing between this and someone writing `.call { animation: card }`
again, and it needed vitest to stop stubbing CSS — through ?raw it was
handed an empty string, which every rule in it would have passed.
Four sabotages, each reddening its own half: not spending the debt, giving
it to a restored transcript, re-owing it on every revision, and putting the
settings rule back. Seal A stays held, Seal B stays at 98, and the action
universe is unchanged at 418 inputs and 250 unnamed — this adds no way for
a person to act on anything, which is what a motion change should cost.
testkit gains an IntersectionObserver: jsdom has no viewport and therefore
no intersections, and the transcript asks one which block is near.
The comment over the composer's pending state said every control on that
shelf rebuilds the runtime. Reading the endpoints for UX-2D showed it is
true of the model and the effort ladder and of nothing else there: preset,
plan mode and tool approval set kernel state and return, with no rebuild in
the path.
Behaviour is untouched — the pending state is worth having either way,
because a control that looks dead for half a second is the thing it fixes.
What changes is that the next reader is not told something the kernel
disagrees with, and is pointed at the kernel rather than at this file.
Two questions the settings screen could not answer about itself. Finding a
setting meant already knowing which of fourteen pages it was filed under.
And what a change would do was one sentence at the top of the whole sheet —
"takes effect immediately; things that rebuild the runtime cannot be changed
while a turn is running" — which speaks for two of the three answers and
leaves the reader to work out which one they are holding.
Both are now facts in a table, not something to work out.
The search corpus is that table and never the page. Sections mount one at a
time, so reading the DOM could only ever search the page already open, and
mounting the rest to search them is how a page nobody asked for starts
making requests. Typing 代理 finds the network page without opening it, and
the guard measures exactly that: the block is absent from the document and
the port is asked nothing it was not already asked.
Keywords buy a way in and nothing else. 代理 is not what that setting is
called, the result says the setting's own name, and no alias may be spelled
like some other setting's title — the same line R3 drew between what makes
something discoverable and what makes it what it is.
When a change lands is declared per block, from what the endpoint behind it
really does. Every value here was read off whether that handler reaches the
kernel's rebuild, not off a hint's wording or a handler's name: model,
effort, roles, permissions, sandbox, shell and the context bounds rebuild;
preset, plan mode and tool approval do not, whatever the composer's comment
said. Storage and the interface language are the third answer, and that one
has to say both halves — saved already, in force after a restart — or
closing the sheet reads as losing what was just typed.
Group's id is required, so a settings block cannot be written without
naming itself, and a name the catalogue does not carry fails. That is the
whole of "no setting may be silent about its cost": there is no default to
fall back to and nowhere to leave it out. The appearance page builds its
nine blocks by hand rather than through Group, so ApplyNote is separate
from it and those blocks answer the same question the same way. What counts
as a block is having a heading — Storage draws three frames with none, and
they belong to the block above them.
Three sabotages. Searching only the open page, deleting a catalogue row,
and defaulting the cost to "immediate" each turn their own guards red; the
last one is checked by two blocks alike in title, shape and children that
say different things because the table says different things.
The search is a view and stays one. Its results jump through
settings.section, the id the nav already uses, because arriving from a
search is the same arrival — no second identity for finding a thing. Seal A
stays held and Seal B stays at 98.
Not done here, and not silently: the preset block's hint still explains
that it takes effect immediately, which the label under it now also says.
Trimming duplicated copy is worth doing and is not what this change is
about.
Closing a pane that is still working asked first, and asked by replacing
the tab strip with the question. Three tabs became one sentence, so the one
thing needed to answer it — which of them this is about — left the screen
along with everything else. The answer also acted on what was running when
the question went up, which is not the same set as what is running when it
is answered.
The question is now a bubble under the tab it is about, through the same
viewport seam the context menu already uses, and the strip stays exactly
where it was. Escape and a press outside cancel it, changing nothing, and
put the keyboard back on the close button that asked — found on the tab
rather than held since it was pressed, because the pane it sits on may have
gone in the meantime.
What is still live stopped being something the question owns. Only the ids
are kept; which of them still exist and which are still running are read
off the current tabs on every render and again when the answer comes. A
pane that finishes while the question is up is closed without the sentence
about stopping it, one closed from somewhere else is never handed back to
the host, and a question whose panes have all gone takes itself away rather
than offering to stop what is not there. The wording follows the same
derivation, so it cannot say "3 panes" about two.
Closing panes keeps one identity. The confirmation is a view; pane.close
is answered where it was asked, with one|others|all still on data-value,
and cancelling names no action because it performs none.
Three sabotages, because a confirmation that merely looks calmer is the
easy thing to ship here. Trusting the open-time live set, sending the
unfiltered ids, and putting the strip-replacing shape back each turn their
own fixture red — the last one takes five of the ten with it, which is a
fair measure of how much that shape was hiding.
Two things the census caught that a screenshot would not. The effect that
withdraws a dead question first declared its dependency on present.length,
a value derived in that render and traceable from nowhere else; the census
lost the whole cell's provenance with it and five unrelated handlers in
this file went from read-only to "might write". Depending on the sources
instead — the confirmation and the tabs — is both the honest edge and the
resolvable one. Seal A stays held and Seal B stays at 98.
The English catalogue reached the tree's 800-line ceiling on the way, and
the usage and cost section moves out whole rather than the budget moving.
The dialog is named by the question it renders, which is one key fewer and
a name that cannot drift from what is on screen.
testkit gains scrollIntoView. jsdom implements no scrolling, so the strip
keeping the selected tab in view was throwing inside a requestAnimationFrame
on every one of these guards — outside React, reported as an unhandled error
the file still passes with, which is how a real one would go unseen.
The action census placed a certified primitive's call site by the DOM event
its handler prop is named after. Picker's is onPick, which names no event,
so every Picker call site sat outside the interaction universe — and one of
them switches the model, a kernel write with no identity. Seal A read as
held the whole time. It was true, over a denominator that had a hole in it,
which is the shape of assurance this tree exists to refuse.
What a callback means is now the primitive's to declare. One list says
which components are primitives and, for each, which props carry a
person's interaction and which DOM event inside the component raises them.
onPick is an interaction because Menu says so and its body does it, never
because the name starts with "on".
The declaration is checked rather than believed. primitives.test.ts parses
each primitive and requires a handler for the declared event from which the
declared prop is actually reachable, so a certified callback with nothing
behind it fails. Its own negative control asks the same question about a
prop no body raises and requires the answer to be no.
There were two copies of the primitive list, the vitest gate's and the
census tool's, and adding Seg to one of them is what broke a seal at 1 —
reported as an input proven to write the host that the product names no
action for, which is a true sentence about a bookkeeping slip. There is now
one declaration, both callers pass nothing, and Options has no skip to pass:
the way to keep two lists in agreement is to have one. A third list, CTL,
went with them; nothing had read it.
Three fixtures and three sabotages, because a rule nobody has seen fail is
not a rule. A certified call site becomes a root; an ordinary component
with a prop spelled the same does not; a prop the primitive does not
declare does not. Each was broken in turn — spelling restored, every
component promoted, undeclared props admitted — and each turned its own
fixture red. The tool's own options are held to naming a resolver and
nothing else, which reddens the moment it starts deciding this again.
One of those fixtures was testing nothing and passed a sabotage that
promoted every component in the tree. It resolved its imports against the
product's files, where its ordinary component does not exist, so a test
about ordinary components was a test about unresolved ones. Fixtures now
resolve within their own universe.
The frozen fixture corpus caught the first implementation. Anchoring a
primitive's identity to a literal "/src/" un-certified the corpus's own
Switch, whose two call sites lost their separate actions to one root inside
the component — the exact rule that corpus was written to hold. A primitive
is matched by its path within whichever tree is being scanned, and those
reports are byte-identical again rather than rewritten.
The denominator moves and does not compare across this change: 413 inputs
to 415, unnamed 249 to 250, Seal B 97 to 98. The two arrivals are the
Picker call sites that were never visible. One is the composer's model
switch, which takes model.select — the id the settings sheet has always
rendered for the same intent — and Seal A is held over the corrected
universe rather than the incomplete one. The other is onboarding's, and it
joins the 98 that Seal B is still open on.
Three values decide how a turn executes, and they were kept in two places.
The preset sat in the title bar; effort and tool approval sat under the
box. Someone writing the next message had to look at opposite ends of the
window to know what would happen when they pressed send, and neither end
said the other existed.
They are one question, so they are one surface. The composer's shelf now
reads: attach, model, plan, and the three current values themselves —
均衡 · high · 询问 — which open one panel holding all three. Not the word
"settings": a summary that does not say what is set answers nothing, and
the shelf is where the question is asked.
Model and plan stay outside it. The model is the most-changed and most
recognisable choice on the shelf, and plan states an intent for this turn
rather than a preference that persists.
The settings sheet keeps its full version of all three and is not a second
owner: it is the complete, explained surface, and the composer is the
turn-local projection of the same canonical state.
No identity was invented for the move. The preset keeps chrome.preset,
which the settings sheet has always rendered too — where a control is
drawn was never its identity. Effort and approval reuse reasoning.effort
and tool-approval.mode, which that sheet already owned. One new id, for
opening the panel.
Three fields drawn together must not become one call. The kernel has three
effects and the panel makes three, each with its own pending value and its
own refusal, so a rung this endpoint will not take says so under the
ladder it belongs to and leaves the preset that did land alone. The shelf
itself stops greying as a whole for the same reason: "nothing here can be
changed" was never true, and only the control actually waiting is marked.
Seg is the second interaction primitive after Switch — a group whose call
site owns the action, with data-* passed through to each button and the
answer on data-value. Its handler is called onClick rather than onPick
because the action census places a primitive's call site by the DOM event
its handler stands for, and a prop the DOM has no event for makes that
call site invisible. That is not hypothetical: every Picker in the tree is
uncounted today for exactly this reason, which is a gap worth its own
look. The primitive has to be declared twice, in the vitest guard and in
tools/ui-census, because those two keep separate lists of the same fact —
also worth its own look, and not widened here for anything but a real
primitive.
Three things the move orphaned are removed rather than left: the menu
item's meter, and the level bars and gate ring the two pickers drew with.
Nothing produces them now, and a zero-consumer field is the shape this
tree keeps deleting.
Verified rather than asserted: the interaction proof that covered the
preset in the chrome moves with it and grows the two guarantees the old
placement could not have — that one field waiting leaves the others live,
and that picking one calls one setter and not the others. Seal A of the
action census returns to held; it broke at 1 while Seg was undeclared, and
Seal B is unchanged at 97.
Six kinds of fact share one card: what you asked, what it did, what it
finally said, what it needs decided. They shared the weight too, so a turn
scrolled back through read as one long list of the same row in different
colours, and the answer — the thing the turn was for — was drawn in the
grey reserved for process text.
Four weights now, and only the weight moves. Membership is untouched,
semantic projection is untouched, and no card shows less than it did.
The answer stops being a timeline entry. Its body takes --text where the
transcript's process text keeps --muted, it gets the panel's vertical air
instead of the card's, and its symbol loses the ring and ground that say
"there is a control here". The turn anchor keeps its rule and gets a
paragraph's distance above it rather than a line's. Work rows are one line
each: a long argument gives up characters now instead of folding the row
in two, because rows of unequal height cannot be scanned for structure,
only read one at a time.
The raw tool id leaves the ordinary card, on a criterion rather than a
list. It is shown when it says something the name above it does not — the
interpreter a shell call really went to, the remote tool a capability
resolved to — and dropped when tagFor would only hand back the string
labelFor was computed from. "Read" beside read_file is one fact printed
twice and it was on every card in the record. A list of tools to hide it
for would have to be maintained against a registry that grows; the
derivability test does not. The exact id stays one hover away on the name,
so nothing became unauditable.
The reading measure is deliberately not narrowed. That was settled
already: fencing the prose at 68ch while terminal blocks and diffs stay
full width puts two column widths on one screen, and the tier is carried
by colour and air instead.
Measured against the same markup through the real compiled stylesheet, not
asserted: the answer's body moves from --muted to --text, its padding from
11px to 17px; Read and Search drop a header element each and stop
wrapping; Bash keeps bash and an MCP call keeps its server and remote
name.
What this does not do is fix the entrance animation. Every .call animates
on mount while blocks of 48 mount and unmount as they scroll, so a fact
from an hour ago re-enters as though it just happened. Telling those apart
needs provenance carried to each card — the DOM's shape cannot say it,
since only an unfinished say is rendered outside a block — and that is its
own change.
The protocol said the sample is ordinary use and leaves out benchmark and
fixture runs. Nothing enforced it. The only thing keeping the twelve designed
turns out was that they happened before the freeze, which says nothing at all
about the next scripted run — and the session store already holds 481 project
directories from past automated ones, every future sibling of which would have
walked straight into a sample that calls itself natural.
A driven run lives in a scratch directory. So a workspace under a temp root is
not ordinary use, and its sessions never enter the sample. The check asks the
host for the slug it writes such a path as, rather than looking for words in a
directory name: the encoding is the host's own and reading it back is a fact,
while matching "scratch" or "tmp" would be a guess about how someone names
things.
Seven of 488 project directories survive it, and they are the ones a person
actually works in. The count of what was turned away is printed with the rest,
so a sample that stays empty says why.
Twelve turns from a written task list said singletons were 17% of groups and
two thirds of turns had three or more calls to fold. Those numbers answer "how
good can this be where it fits", and they cannot answer "how often does
ordinary use have anything to fold" — the task list decided how many tools
each turn needed, half of it was routed plan-first when nothing in ordinary
use routes that way without being asked, and every one of the twelve called at
least one tool, which no real day does.
So that assay is closed rather than continued. It is recorded as a reference
condition with its raw trajectory kept outside the tree, and the natural
sample starts from its own freeze, after it, from zero. Folding the designed
turns into the natural denominator would put two sampling mechanisms in one
number and neither question would come back out.
The gate is untouched. It was written before any sample existed and has now
seen one; redrawing it here is exactly what would spend that.
Two things the natural sample reports that the designed one had no room for. A
turn with no tool call at all is in the sample, because a fold that has nothing
to show is evidence about coverage rather than a turn to exclude. And coverage
itself is printed and deliberately not gated: adding it to the verdict after
seeing a sample is redrawing the line, while leaving it out of the report lets
a low singleton rate read as broad reach when a fold might touch half the
turns.
The package's own doc now carries what the twelve turns actually established,
which was not a number: three call lifecycles reach a fold and only two of them
are calls, because Partial=true says arguments are still arriving and never
promises that a completion frame follows.
Twelve real turns broke the partition on the ninth. A group closed while one
of its members was still running, which the semantics pass had said could not
happen — and the member was `conclude_no_changes`, dispatched as a streaming
partial and never settled, because calling it is what ends the round. No full
dispatch, no result, and the id stayed open for the rest of the record, so
every later boundary sealed a group over a call still in flight.
The frame's own contract already said this: a partial marks a dispatch whose
arguments are still arriving and promises a full one when they land. For a
tool that ends the round that promise is never kept. So a Call materializes
from a full dispatch or a result, never from a partial alone.
Ten fixtures missed it for one reason worth recording: the stub provider
answers with complete tool calls and never streams one, so an entire class of
frame was absent from every turn the semantics pass ever saw. The fixture
added here drives ChunkToolCallStart with nothing after it and asserts the
record really holds a partial-only id before folding it — a shape test that
never sees the shape proves nothing.
The rule was written after the sample was collected, which is worth saying
plainly. What had been seen at that point was the legality failure and the
frame shapes behind it: 175 calls, 2 never resulted, both partial-only, no
discarded attempts anywhere. None of the assay's five numbers had been
printed, and the rule is read off the field's documented meaning rather than
off anything the numbers do.
Whether a turn's execution is worth offering as one foldable unit is a
question about ordinary use, and the only honest way to answer it is to watch
ordinary use. Designing tasks to cover the interesting cases would put the
task designer's choices into the granularity being measured, which is the one
thing this cannot afford.
So the protocol is fixed now, while no sample exists to fit it to. The first
twenty eligible authored turns after the freeze timestamp, in the order they
happen — not the last twenty, not a chosen twenty, and not twenty-four because
the answer landed near a line. Eligible means the turn carries a named
authored turn, which only the current schema emits and a synthetic
continuation never gets, and that its trajectory reads complete, because a
prefix cannot answer a question about a whole turn.
A turn with no tool calls is in the sample. The question is how much of
ordinary use has something to fold, and dropping the quiet turns would answer
a different one and flatter the feature. There are no route quotas either: the
mix of one-model and two-model turns is reported as a description of what
happened, never selected for.
The tool refuses to say anything but the count until the sample is whole.
Reading a partial result and acting on it is the sequential decision the
freeze exists to prevent, so there is nothing to read.
The verdict is one gate with both halves required — most groups holding a
single call AND few turns having three or more to fold — and failing it is not
an automatic go: a partition can be coarse and still rare, or common and still
thin, and those are different products.
The fold this measures with is the one the semantics pass settled, moved out
of that test rather than copied: two implementations of a partition drift, and
the assay and the fixtures have to be reading the same rules. The gate itself
runs on samples built to sit on each side of it, because an instrument nobody
has seen produce a number is one nobody has checked.
A partition was being argued about frame by frame, which is how a barrier
landing between a dispatch and its result came to look like a boundary between
two calls. It is not: it interrupts one. So the fold now atomizes first — a
tool call is one Call however many rounds it spans and however many decisions
it waits on — and only then groups.
That reordering settled the duplication on its own. Six of seventy-six calls
appeared in two candidate episodes on a real corpus; admitting a call once, at
its first frame, makes that unreachable regardless of where boundaries fall.
What a misplaced boundary leaves behind instead is a group sealed while a
member is still running, whose result then belongs to no group at all, and
that is what the invariant now names.
The candidate grouped here is not the round. Rounds are a structural authority
and two of every three held a single call, which makes them an internal step
group rather than something to offer a reader. WorkGroup-v1 is one producer's
consecutive assistant-owned work across rounds: the producer cuts, a line the
user typed cuts, a turn cuts; a round does not, a settled say does not, and
the host advancing its own task list neither counts as a step nor cuts.
Membership is AssistantWork, not ModelWork. A provider-executed call is not
something the model issued and is still the assistant working, so it needed a
second predicate rather than a widened first one — collapsing them is how the
taxonomy the issuer axis exists for gets folded back up.
Ten rules, each with a turn the production assembly really produced, and six
sabotages that switch one rule off and require a fixture to notice. Two of the
sabotages did not fire when first written, and both were findings rather than
test bugs: one because atomization had already removed the defect it was
looking for, the other because the fixture had no work after the host's
advance for a boundary to cut from.
Two rules are marked as mechanism given the state rather than production
shapes, because they are: a user-issued call admits under its own guard today
and lands between turns, and a turn that never closes is real in the record —
12 of 80 — but not something this harness can produce on demand.
Nothing here ships. It answers which partitions are legal, not whether the
natural granularity is worth an interaction, and scripted turns cannot answer
that second question.
The record and the stream had never been compared. A frontend rebuilding a
conversation from /trajectory was trusted to see what a connected client saw,
and the only evidence was that both came from the same broadcaster — which
says nothing, because the durable log deliberately keeps less: stream deltas,
phase markers and progress ticks never reach it, so any fact that lived only
in one of those is lost on the way back and nothing noticed.
So the two readings are now taken from the same turn and compared. Six turns
are driven through the production assembly — control, eventwire, broadcaster,
wire log, the real /trajectory handler — with a stubbed provider and nothing
else stubbed: one model saying and calling in turn, two models in one turn, a
host advancing a list beside the model's own calls, a provider-side call that
reports a result and never a dispatch, and an approval and an ask landing
between a call's dispatch and its result.
What is compared is what a partition would be computed FROM — turn identity,
producer, issuer, round, call lifecycle, interruptions, settled says — and
never a partition. Grouping is the thing under study, and comparing it here
would only have proved both readings ran the same algorithm.
The asymmetry is the point: the live reading knows a say's text from its
deltas, the cold one has only the settled frame. Three destructive controls
hold that the gate is reading the fields it claims to: strip the producer, the
issuer, or a settled say's text from the cold reading and it must fail. It
does, on both layers.
The second layer is the desktop's own reducer, fed the same turns through a
committed file the kernel regenerates — a fresh store each time, never one
cleared and reused, so a reload cannot pass by borrowing turn-local state the
live run left behind. A staleness gate fails the file when it stops being what
the kernel emits, because a reducer checked against a shape nothing produces
is checked against nothing.
A tool frame said what ran and never who asked for it. Three provenances
share one id namespace and one shape: calls the model issued, calls the host
minted for it — seeding an approved plan's list, advancing a step, closing a
goal, expanding one delegation call into its items — and calls the provider
ran on its own side. A person's slash command and inline shell line are a
fourth. Reading a real corpus, 5 of 51 candidate execution episodes were
headed by `plan-seed`, the host's own bookkeeping, which any fold counting
steps would have credited to the model.
Nothing downstream can recover this. The shapes that look like provenance are
transport facts: a provider-side call has no dispatch because it never had one
to emit, and an attempt id marks a speculative partial, not an author — the
provider-side result carries one and was not issued by the model. What is left
is matching id spellings, which is what this tree does not build.
So the issuer is set where the invocation is decided, and it is a second axis
rather than a widening of Source: Source says who wrote the frame, Issuer says
who asked for the call, and one executor frame can carry any of the four. It
holds for a call's lifetime — a dispatch and its result cannot disagree about
who asked — and a result-only call carries it alone, with no dispatch invented
to hang it on.
ToolIssuer.ModelWork is where "is this the model working" lives, so an unset
issuer answers false rather than guess: guessing model is what counts a seeded
task list as a step. The gate is checked destructively — flip the host's
issuer to model and the count changes, which is what makes the field, and not
the call's shape, the thing being read.
/trajectory answered with a bare array, and three different states produced
the same empty one: a run nothing records, a log the capacity cap stopped
extending, and a recorded session that had produced no frames. A consumer
reading the last frame as the end of the run was right two times in three and
had no way to know which.
The read model now carries its own coverage. complete means no frame was
refused between the session's start and what is durable now — and an empty
events list under it means the session produced none. truncated means the
frames are a prefix and nothing more. not_recorded means nothing recorded this
run at all, which is what a studio pane is before its first turn.
Truncation is a durable fact or it is not a fact: the refusal happens in one
process and nothing in the bytes it leaves behind records it, so the cap writes
a witness beside the log. A log's own size is not consulted — past the cap the
next frame will be refused, but until one is nothing has been dropped, and
reading truncation off the size reports a session that grew large as one that
lost frames. not_recorded likewise comes from the writer's own precondition,
never from a missing file, which cannot tell a run with no recorder from one
that has not written yet. A log that cannot be read is refused rather than
answered: an empty array is a claim, and a failed read supports none.
The pane says which of the three it is holding, and the exported file carries
it too, since that file outlives the window that made it.
A two-model turn put two producers on one stream and said nothing about
which was which. The kernel knew — the planner's sink has labelled its
events all along — but eventwire had no field for it, so the label died at
the transport. Everything downstream was left with the same guess: read
the last phase marker before the frame. That is an adjacency, not a fact,
and the record does not even keep phase frames, so a rebuilt transcript
could not make the guess at all.
Producers now name themselves. An agent is built for a role and labels the
frames it settles; a forwarder that re-parents another agent's work
relabels on the way through, because in the parent's stream a sub-agent's
call is the sub-agent's whatever role the child plays in its own. The
field crosses eventwire, so it is on the frames the record keeps, and a
card rebuilt from those frames carries it.
Streaming deltas stay unlabelled, and finding out why was the useful part
of this cut. Coalescing merges only deltas that carry nothing but text —
it decides that with a zero-probe, so any new field on a delta silently
turns the whole optimisation off, which is exactly what labelling every
frame did: forty provider chunks reached the frontend as forty events. A
delta is a fragment of a message whose settled frame names its producer,
so naming the fragment says nothing new and costs the stream. The boot
effect test is what caught it, at the boundary it was written for.
That leaves one asymmetry already in the tree: the planner's own text
deltas have carried a source since before this change, so they have never
coalesced. Not touched here — it is the coordinator's direct emissions,
not this seam, and the card takes its producer from the settled frame
either way.
The destructive control runs both ends. Strip the field from the transport
and a real two-model turn fails on the frames themselves; strip it from
the frames and the cards go unattributed rather than falling back to the
nearest phase marker — which would look right in the fixture and be wrong
the moment a frame arrives out of the order the markers suggest.
Tool cards do not carry it yet. The fact is on the frame they fold from,
so that is a projection when episode membership needs it, not another
fact to establish.
A reopened session lost every answer the planner ever wrote. The record
keeps no streamed deltas — one frame per chunk, most of the file, nothing
to read back — so a replay has only the settled `message` frame, and the
reducer could not build a card from one: it knew how to seal a card the
stream had already opened, and nothing else. Feed it the record and it
produced tools with no answers between them.
The frame is the assistant turn in its settled form, so one fold now
serves both directions: it settles the open card when the stream opened
one, and builds the card when nothing did. Measured on the recorded
routes, a two-model turn's replay goes from two items to six — the same
six the live stream drew, planner's plan text included — and the
conclude-no-changes route from two to five.
The frame also wins on content, which it had already earned: it carries
the display-correct text with the host's own markers stripped, and the
reasoning an extension may have replaced, emitted precisely so what is
shown and what is persisted agree. So a stream that lost a chunk is
repaired by it rather than left short. An empty field is not content and
overwrites nothing: a tool-call round settles with reasoning only, and it
must not wipe the answer already on screen.
That closes the fork this series was heading for. The durable execution
trajectory does not need building — it exists, and it already carries the
planner's work; what was missing was a reducer that could read it.
The say card's lifecycle moves to its own file with the fold, and the id
sequence to another. Both files were at the 800-line ceiling, and the
streaming, sealing and materialising of one card is a single concern that
had been living inside the reducer. The sequence had to come out for the
new file to mint an id without importing the reducer back.
Reopening a session with an approved plan in it drew a user bubble nobody
had typed. The host writes a continuation into the transcript to carry
approved execution — "Plan approved — plan mode is off…" — and the rebuild
turned every user-role message with text into a card, so a line the host
wrote came back attributed to the person. Live it was never a bubble at
all, which is the shape of the problem: one message, two truths, and the
one that survives a reload is the wrong one.
Authorship is now declared where it is known. The host composes those
lines, so the host says so: the turn boundary control already hands the
runner — it says whether this run continues a turn already announced —
gains the other fact it had all along, and the landing seam stamps it onto
the message. /history projects it, and the rebuild draws no bubble for it.
Declared, not recognised. There is a prefix table in this tree that spots
host-injected text, and it would have been one line to reuse — and wrong
in both directions: a user who types the sentence the host injects loses
their own message, and a continuation phrased any other way keeps
impersonating them. The control runs both ways at the kernel and again at
the rebuild, and the two cases differ only in the flag, never in what they
say.
The two facts stay apart on purpose. A turn that opens no authored turn is
not the same as a message the host wrote: a user's line only has to read
like one of the host's to open no turn, and it is still theirs. So the
boundary carries them as separate fields rather than reading one off the
other's absence.
At the HTTP boundary an approved plan now leaves exactly one user line in
the record, and it is the one that was typed. Measured on the real thing:
the live/reload census fixture for that route dropped its phantom row.
ParseImageDataURL moves to its own file. provider.go was at its recorded
ceiling and a struct field cannot be added to a file that may not grow;
the parser was the piece with least to do with the message model around
it, and moving it is what made room rather than widening the budget.
Sessions recorded before this carry no declaration, so their host lines
still draw a bubble. Nothing reads the wording to guess at them.
A turn had as many starts as it had model runs. The coordinator opened one
before planning, the executor opened another before working, and a plan
approved mid-turn opened a third — so "a turn began" meant "an agent run
began", and the only thing telling the two apart was whether the event
happened to carry an identity.
The route that made this worse than untidy is production-reachable. When
the planner concludes no changes are needed, no executor ever runs: the
user's message is written straight into the transcript by the coordinator,
and the turn's only start was the bare one from before planning. So a
durable authored message existed that the live stream had never named —
the row got no rewind entry until the session was reopened and the
transcript rebuilt. Two truths about the same message, which is the thing
this series exists to remove.
Control now opens the boundary. It already had both numbers before any
work could produce the message: the index it opens the checkpoint at and
marks the turn in flight with, and the raw authored text it puts in the
context itself. It publishes them as one TurnStarted before the runner is
called, and hands the runner the identity to land on. Four seams take it:
the orchestrated turn, the headless one, a synthetic continuation (which
carries ownership with no identity, because it belongs to a turn already
announced), and the slash-invoked subagent skill — that last one was a
fourth start emitter and a third place that appended the user's message,
found while doing the work rather than in the preflight that preceded it.
Identity is the host's; representation stays with whoever writes the
message. A plan-and-execute turn still persists the handoff as Content
while the user's own words stay in RawContent, and that distinction is
worth keeping. What the seam takes away is the freedom to disagree about
which message the turn was about: the raw authored text comes from the
published identity, and the landing is checked against it. The check
detects and cannot repair — the name is already out — so a break is an
operator notice with a code, and the durable index stays the authority a
reload reads.
persistExecutorNoOp lands through that seam now rather than composing its
own message beside it. It had been setting RawContent empty whenever
nothing wrapped the input, which left the classification reading a
different field on that path than on every other; it agreed with the
others by coincidence, and the coincidence is now a contract.
Suppression is declared, not observed. A run reads a host boundary out of
its context; nothing infers that it has been announced because an event
already reached the sink. A standalone Agent.Run is still its own
lifecycle owner and still announces — that contract is not collateral to
a desktop fix.
The coordinator's filter on planner lifecycle events is NOT dead and was
kept. Under a host boundary the planner announces nothing, but standalone
it still opens a turn over its own session, and that name would reach the
parent as a second answer to which message the turn is about. A test runs
both ways rather than a grep deciding it.
Six production routes are now a matrix rather than an observation:
executor-only, plan-and-execute, conclude-no-changes, an approval the user
denied, planner failure falling back to the executor, and the subagent
skill. Each asserts one named start, no bare one, one end, that the start
precedes every visible piece of work, and that the message it named
classifies as the authored turn it said. Each also asserts whether the
executor ran, so a route that quietly took another branch cannot satisfy
the matrix. The negative control holds the other end: an approved plan's
execution opens neither a start nor a done of its own.
Two deliberate behavior changes come with the ownership move. The text
renderer resets its per-stream state on a phase marker instead of on a
second turn start, so the executor's thinking still gets its own header
now that planner and executor are one turn; a byte-exact dual-model
fixture pins that boundary. And telemetry's turn count changes meaning: it
counted starts, so a two-model turn counted twice and an approved plan
counted again. It now counts authored turns, which is what the metric was
always named after.
Not in this cut: which items belong to a turn, and where an execution
episode begins inside one.
turn_started carried nothing, so a client that mints its own user row had
no way to learn which message the kernel had just written for it. The row
and the snapshot taken for it were paired by position and confirmed by
prompt text — which is why two identical prompts could only be told apart
by luck, and why a steer sitting in the transcript shifted every pairing
after it.
The event now carries the message's provenance: AuthoredTurn, the number
the conversation gives the turn this message opens, and MsgIndex, the
session index it takes. They are two namespaces and neither is the
checkpoint's Turn, which numbers snapshots — the first authored turn is 1
while the first checkpoint turn is 0, and TestCheckpointTurnIsNotTheAuthored-
Turn reads both off one real run so an implementation that sourced one from
the other cannot pass.
One rule answers both projections. ClassifyTurn is what the display-index
sidecar already counted a transcript with, now named and exported, and the
live path asks it the same question about the message it is about to
append. The message is composed before the turn is announced so the
announcement can classify what actually goes out rather than a stand-in
for it, and the prior count is re-derived from the transcript rather than
tracked beside it — a second counter is a second thing to be wrong. A turn
that opens no authored message (a steer, a host-injected turn) names none
rather than minting a number.
The join then goes structural on both sides. checkpoint.Meta carries the
boundary it was opened at, /checkpoints and /history publish it, and
pairCheckpoints is a lookup on that index — no position, no prompt
equality. A row that names no message gets no rewind entry at all, which
is the right refusal: a rewind cannot be undone, and an entry against the
wrong turn throws away work nobody asked to lose.
The client joins by causation, not by adjacency: a send is remembered
until the kernel names a message for it, in the order the sends were made,
and a name that no longer names a row — taken back, or replaced by a
rebuild — is dropped rather than handed to the next turn. Guidance queued
mid-turn never joins that line, because it starts no turn of its own.
Six proofs, at the three boundaries: the agent alone names its turn (that
layer cannot import control, so no checkpoint state can reach the number);
the live number and the durable display index agree about the same message;
a steer and a synthetic turn each mint nothing and leave the number for the
next real turn; the checkpoint boundary equals the index the event named;
and at the HTTP boundary two identical prompts pair with their own
snapshots.
Not in this cut: the other eleven item kinds still carry no turn. Which
items belong to a turn, and where an execution episode begins inside one,
is a separate question — this only establishes the boundary it would be
asked about.
classify follows the callbacks a .then/.catch/.finally is handed, and only
where the fact proves the receiver. The edge is deferred, because a
handler that mutates when the request comes back is not one that mutates
now. .then's second slot is the rejection handler and carries the edge
.catch carries, so which member was written decides nothing. And an
optional continuation keeps MayCall at the hop that may skip it rather
than flattening it — the first draft reached the write and lost the
evidence, which is the failure the optional-call round was about.
Eight roots move, every one UNRESOLVED to READ_ONLY, and every one inside
the thirteen whose only open cause was this selector. No MUTATION became
READ_ONLY and no READ_ONLY became MUTATION. 410 roots, MUTATION 146
unchanged, UNRESOLVED 112 to 104, READ_ONLY 152 to 160; the selector falls
from twenty-one sites to eight, and those eight are exactly the sources
this cut declined to build — a static factory, an async function's return,
a binding typed Promise, a prop call — rather than anything it should have
proven and did not.
The sixteenth invariant holds the boundary: a continuation the walk
executes must trace to a declared return type. Adding an opaque call
result as a source turns it red on both trees and turns PC4 and PC6 into
mutations the corpus is not declared to have. PC6 is the case that
matters — the receiver is PC1's proven type and the member is spelled the
same, and only the declared return type differs.
One thing was wrong for the right reason and is fixed with it. A mutation
reached only through a continuation or a timer was reported as a direct
call on the interaction axis, which is a claim that pressing the control
writes; the family now comes from the edges the walk recorded. It changes
no production count today — no root here writes only behind a deferred
edge — and it is what the day one does will say.
promises.mjs answers one question and refuses to answer a second. A value
is proven to be a Promise by a return type the source declares on a member
of the type its receiver is annotated with, or by being a continuation on
something already proven — a fixpoint over the receiver chain with no hop
limit. Only a literal Promise<T> counts: a union that may not be one, an
alias nothing here follows, PromiseLike, any, and a tree that declares its
own Promise all state nothing. Which type a receiver has comes from the
authority that already answers it, lifted out of receiverKind so the two
readers cannot drift apart.
The order is the point. Taking `.then` off the member and concluding the
receiver was a Promise is a circular proof, and it would buy an execution
edge into whatever that call was handed. Every receiver that stays
unproven is reported with the mechanism behind it — an opaque call result,
a binding the source types Promise, a member the declared type does not
have, a receiver nothing types — because naming a shape is not claiming
it, and the next cut is chosen off that table.
Nothing consumes the fact yet. All twenty-nine reports over both trees are
byte-identical to the revision before this one, which is what will make
the verdicts that move when a continuation becomes an execution edge
attributable to that and to nothing else.
tools/ui-census reads the interface and answers which inputs can change
host state, which of those the product names an action for, and why the
rest cannot be decided. Twenty-two modules over one certified universe:
410 interaction roots, and every verdict carries either a positive
witness or the open edges that stopped it.
Fifteen invariants run in CI. UNDECLARED_MUTATION == 0 is the one this
exists for — an input proven to write with no identity — and it has
reopened three times under real defects rather than sitting decorative:
a memo alias that hid a prop chain, a JSX spread that hid another, and an
optional call the walk could not see. Three more hold holes that are
measured and empty rather than argued: a platform scheduler, a prop
heuristic, and a spread that a later attribute may override.
Judgements read structure. A listener registration, an event parameter,
a promise receiver and a component identity are facts certified once and
consumed by every reader, because the alternative is a member name
deciding what a value is — and this series found that reader disagreeing
with itself three separate times.
_fx is the corpus the rules are exercised against, and its reports are
frozen: the product's name every root by file and line and are stale the
moment a button moves, so only the fixture's can be a permanent gate. The
invariants it breaks on purpose are declared, and it is held to exactly
that set.
Ninety data-action declarations across the interface, and the registry
that says what each id claims to be. Identity is the product's: an id is
<surface>.<intent>, written as a literal at the control and written again
in actions.ts, so the two can disagree and be caught — sharing a constant
would make the check compare a value with itself.
The attribute carries membership only. Which entry a click is about rides
on data-target and which of several answers it gives rides on data-value,
so a row rendered seventy times is still one contract and 「取消」 is
never an identity. An element carrying several handlers takes a scoped
data-action-<event>, because a single declaration there cannot say which
input it names.
Six of these ids exist because a census proved the input writes and the
product named nothing: session.open and remote.open for the workspace and
remote trees, workspace.add, extensions.submit, and file-revert and
rewind's prepare/commit pairs — planning a revert and performing one are
two contracts, and a person who stops between them has done nothing.
roots.ts answers a question two readers were answering differently: the
repository's gate looked at onClick and onDoubleClick, which left every
onChange, every keydown and every DOM listener outside the set it was
meant to be guarding. Certification is two independent questions and
neither may answer the other — what the registration is on, and whether
the event is something a person does to the page — so a data-action says
which action an input belongs to and never whether it is one.
listen.ts is where a DOM listener can carry that declaration. A button
has an attribute and the shortcut table has a field; a listener had
nowhere to put one, so every keyboard entry point was outside the action
vocabulary. The declaration belongs to the registration rather than the
callback: one function registered on two targets is two entry points.
Nothing references either yet. They land first because everything that
does — the vocabulary, its census, and the gate over both — cannot
compile without them.
Every version's notes live in release-notes/studio/<semver>.md and this
one was tagged without them, so the release published the standing text
and a warning. The file lands here for the line's own record; the
published body is set from it separately, because the workflow reads the
notes out of the tagged commit and this is not in it.
studio-v2.13.0 built every package and then failed at "Collect artifacts":
`find: 'staging/cli-archives': No such file or directory`.
The previous change was right about the rule and could not hold under the
download it was written against. Taking the CLI archives by name matched
the reasonix-studio-host.exe the signing flow leaves behind, so it moved
to taking them from their artifact directory — but the download asked for
merge-multiple, which is exactly the option that flattens those
directories away. The path it looked in never existed, and only a tag
runs this workflow, so nothing said so until a release.
Both sets now come from their own artifact. Dropping merge-multiple is
what makes that possible, and it closes the same hole on the other line:
the SignPath flow uploads the unsigned installer it hands over, that file
is named ReasonixStudio-* too, and a flattened staging directory let
whichever move ran last decide which one shipped.
actionlint's shellcheck reads `.deb` inside a single-quoted printf format
as a command substitution that will not expand (SC2016). They are Markdown
for the notes, so the string says so instead: double quotes with the
backticks escaped produce the same bytes and no warning. Verified against
the same actionlint invocation CI runs, with shellcheck 0.11.0; restoring
the single-quoted form reports the issue again.
Nothing in this repository changed to cause it — the runner's shellcheck
did — which is why it appeared on a workflow no commit had touched.
The windows-latest crash moved rather than went away: 1.26.6 found a bad
pointer in the heap during a Green Tea mark; 1.26.8 threw
"runtime.preemptM: duplicatehandle failed; errno=6" — ERROR_INVALID_HANDLE
on a thread handle the runtime owns. That is not a runtime bug. It is what
a process looks like after it closes a handle it does not own.
internal/extension/sidecar closed the Job Object twice. kill() called
proc.KillTracked, which releases the handle, and then finishJob(), whose
sync.Once had not fired yet and released it again. kill() is reached from
four places, two of them `go c.proc.kill()`, so it also raced with itself.
Windows reissues a freed handle value, so the second close lands on
whatever now holds it — a thread handle, and preemption then fails.
internal/extension/sidecar is the package the crash reported.
internal/plugin had the other half: close() is not guarded, so two calls
took KillTracked twice; and its graceful path returned without releasing
at all, leaving a KILL_ON_JOB_CLOSE handle open for the life of the
process and reaping nothing the server had detached.
Rather than ask three callers to remember, the handle now owns its own
release. StartTracked returns a *TrackedJob whose Kill and Finish share
one sync.Once; killTracked and finishTracked are unexported, so no caller
outside this package holds a raw handle to close twice. internal/proc's
own TrackedCommand, which had hand-rolled the same guard, uses it too.
The test counts releases through a substituted release func: off Windows
the real one is a no-op, so a test that watched the handle would pass on
the platform where the bug cannot happen. Restoring the old shape — a
release outside the one-shot — makes it report nine releases where one is
owed.
The windows-latest crash is the GC finding a bad pointer while marking:
runtime.scanObject in mgcmark_greenteagc.go, under gcDrain. Green Tea is
the detector, not the cause — turning it off would move where the
corruption surfaces, not stop it, so this does not do that.
Two things in that binary can produce it and were both behind. The Go
toolchain moves 1.26.6 -> 1.26.8, which carries compiler and runtime
fixes; and modernc.org/sqlite moves 1.57.0 -> 1.58.0, taking libc from
1.74.4 to 1.75.6. libc is the only unsafe-heavy code linked into that
test binary that is not the standard library, and internal/bot reaches
it through historycatalog and projectiondb. Neither upgrade is proven to
be the fix: one crash cannot attribute itself, and golang/go#81238 —
windows/amd64 exception recovery writing below a goroutine stack — is
open, unfixed, and the same class. If it recurs on these versions, that
issue is where it goes.
covergate was red on a third path this had not read: internal/sandbox is
78.0% on linux against a 78.1% floor, while the same tree measures 78.1%
on darwin. The package compiles a different set of files per GOOS, so a
floor recorded on one platform can be unreachable on the one the gate
runs on. Rather than lower it, three statements nothing reached are now
covered — podman's per-user socket, an authority the table does not
govern, and a nil context carrying no escape approver — which takes
darwin to 78.9% and lifts linux above its floor by the same edges.
covergate now names the lines it is short of. A percentage alone left
whoever has to restore it measuring a package by hand on a platform they
may not be on, which is how this one sat red across three runs.
go.mod tidy in desktop/ failed because the root module moved x/crypto to
v0.56.0 and the nested one still pinned v0.55.0. The dependency is
indirect there, so nothing local reads it — and nothing local runs that
tidy either, which is why the root gates passed while the desktop job
did not.
third_party/go-webview2 is left alone: it is a vendored fork with its
own module, CI runs only its tests, and tidying it would rewrite a sum
nobody asked to move.
govulncheck: x/crypto v0.55.0 reaches the advisory through
remote.newSSHClient. Bumped to v0.56.0, which is where it is fixed.
race: matrixSink folds graph deltas in place, and a fan-out publishes
from every worker's own goroutine. The sink now holds its own lock;
agentgraph.Graph is a pair of slices, and the production reader that
folds deltas does it on one goroutine.
covergate: two branches added with the adjudication barrier were never
reached. liveBarrierIDs was only ever asked about asks, so a live tool
approval read as an abandoned obligation; and Ask's refusal when the
barrier cannot be recorded had no case at all. Both are now tests, not
a lowered floor.
macOS: TestDeniedAuthorityIsNotInheritedThroughADescriptor read the
inherited socket once, immediately after dialling, while the peer writes
the marker only after its Accept returns. The positive control lost that
race and the test correctly refused to pass vacuously. The scan now
retries for five seconds, which is also the stronger claim: a clean
sandboxed result means seconds of trying found nothing, rather than one
instant. Reproduced by delaying the peer's write, and the fix holds with
that delay still in place.
The windows-latest crash in internal/bot is not addressed here: it is a
runtime GC fault in a package with no unsafe and no cgo, it passed on
the three preceding runs, and nothing in this tree explains it.
Thirteen more Tier A sites, taken as a cluster rather than in file order so
naming drift shows up while the vocabulary is still in hand: everything that
writes a permission rule, everything that moves the sandbox, everything that
changes what an endpoint is asked to do.
The resolver that found them was wrong, and one of its answers is what said so.
It reported a fold toggle in the rules panel as reaching savePermissions, which
is not something a fold does. The cause was that it followed every identifier a
handler mentions, against a table of locals collected file-wide with no regard
for scope — so a closure parameter named n, or s, or g, resolved to whatever
else in that file happened to share the name. A click reaches a mutation by
calling something, not by mentioning it, and that is what it now follows.
So the Tier A count in the previous change was inflated. Five of the fifty-nine
were that mistake. The number is not the finding here; what the number counts
is, and it had been counting coincidences of spelling.
Two ids stayed two segments rather than three. permissions.add-rule reads as one
surface with one intent, which is the rule; permissions.rule.add reads as a
sub-surface, and inventing those is how a vocabulary starts describing the code's
layout instead of the user's intent.
Four of the thirteen are the sandbox's own controls and one is a permission
rule's removal, so they carry authority-effect: what these claim to change is
what the host is allowed to do, and a promise resolving is not evidence of it.
Nothing proves that yet — the proof column is what the contracts will have to
satisfy, not a claim that they already do.
Naming the two hundred and forty-nine anonymous controls in one pass would have
been labelling, not census. What the risk tiers needed was a fact, and the one
available is what a click reaches: not the button, not its wording, but the port
method behind it and whether that method's own transport posts or gets.
So the resolver follows a handler through the locals of its file and then out
through its props — every place the component is rendered, what the parent
passes for that prop, up to four hops — and lands on the port calls a click can
actually reach. Then the port's implementation classifies itself: a method whose
body reaches post, patch or delete changes canonical state, one that reaches get
does not. A name says nothing here and a return type says almost nothing, since
an enqueue answers with a receipt.
Of the two hundred and forty-nine, a hundred and sixty-five never leave the
page, twenty-five only read, and fifty-nine write across thirty-nine
capabilities. That is the Tier A set, and it is derived rather than judged.
Eleven of them are named here, with the ids the registry now carries: the two
account switches, the ask card's two answers, memory's save, restore and forget,
the config repair, the extension reload, the storage move and the network probe.
The queued line's take-back in the transcript turned out to be queue.cancel
already — the same action the pending strip renders, which is the point of an id
being a semantic class rather than a place.
The ceiling falls to two hundred and thirty-seven and the rest of Tier A is next.
One site in it will stay anonymous on purpose: the switch primitive resolves to
six different capabilities because it is whatever its caller is, and its identity
belongs at those call sites, which already pass it.
A token the endpoint had just turned down was retried unchanged, because the
forced refresh asked the wrong question. It reloaded the stored credential, saw
that the local clock still liked it, and returned — so the retry went out with
the one that had already been refused, and the failure that followed looked like
the server's rather than ours.
The judgement it should have been making needs an identity the call did not
carry. forceRefresh was a bool: it said "refresh" without saying which
credential had been refused, so "the server rejected what I hold" and "someone
else already replaced what I hold" arrived as the same request with the same
argument. No condition written inside could have told them apart. That is why
this is a signature and not an if.
So the ask names the credential that actually went out. Not the one in the store
by the time the 401 came back — that is precisely the one another actor may
have replaced it with, and re-reading it there erases the fact the decision
turns on. Two call faces rather than a nullable at every call site: the ordinary
one, and the one that has a refusal to report.
Under the lock, the stored credential is used instead of refreshing only when it
is both usable and not the one that was refused. Identity alone would send a
replacement that had itself expired; freshness alone is what let a refused token
through, since a server saying no is a fact about the credential that this
machine's opinion of its expiry cannot answer.
Five arms, and each was checked by breaking it. Restoring the old shortcut turns
the refused-token arm and the end-to-end recovery red together. Making a
rejection refresh unconditionally — the fix that looks right — turns the
concurrency arm red instead, a refresh storm caught before it was written. An
expired replacement is refreshed rather than sent. A rejection naming a
credential this client never sent changes nothing. And the ordinary request
still touches no endpoint and leaves the store byte-identical, because this is a
fix to the rejection path and daily traffic should not have got more expensive.
The tripwires from the previous two changes are gone, replaced in place by the
contracts they were holding open: a 401 the transport recovered from is now
proven never to become a failure, which is the negative control any future
classification of terminal auth outcomes has to sit on.
Still not claimed: what a refresh that genuinely fails means for the reader. No
refresh token, an authorisation server that declines, an endpoint that is down,
a 401 that survives a successful refresh — four different things to do next, and
the row goes on offering to reconnect rather than guessing between them.
No production change. This is the slice that decides what the fix has to be,
because the obvious one is wrong and the tests below are what say so.
The credential's identity is the access token. It is the bytes the server was
shown and refused, nothing else in the stored state names a generation, and
none is wanted: a refresh that handed back the same access token would not have
moved the state either. So the question a forced refresh answers is not "is
this token stale by my clock" — which is what it asks today — but "is the one
the server just refused still the canonical one".
Three arms, and two of them already hold. An unrefused token the clock likes is
sent as it is, and a token another actor replaced while we waited for the lock
is used rather than refreshed again — that second one is the concurrency the
existing short-circuit was carrying, and it is now a test rather than a side
effect. Both were checked against the fix that looks obvious: making a forced
refresh unconditional turns the concurrency arm red, which is a refresh storm
caught before it was written.
The third arm is the gap, asserted as it behaves. A refused token that is still
canonical is handed straight back and the endpoint hears nothing — pinned at
the primitive, and again through the production chain, where a real 401 is
retried with the very credential the server just declined. Two requests, two
identical Authorization headers, no refresh. The coarser tripwire from the
previous change is retired into these, which say the same thing with the
witness spelled out.
And the reason a one-line fix cannot do it: nothing tells the refresh which
credential was refused, so the arm that must change and the arm that must not
arrive as the same call with the same argument. That is pinned too. The
signature is where this gets settled, not an if.
What is still not answered, deliberately: whether a refresh that genuinely fails
means the user must authorise again. Invalid refresh token, an authorisation
server that declines, no refresh token at all, an endpoint that is down, a 401
that survives a successful refresh — those are five different things to do next,
and the corrective action stays unclaimed until they are told apart.
The reconnect button said 「重新授权」 when a regex found 401, 403 or the word
auth in the failure text — and that text is what an external MCP server wrote
about itself, which this host then sanitised and truncated to four hundred
graphemes on the way through. A repair the user is told to perform was chosen by
a stranger's prose, and truncation could take the word out from under it either
way.
The status now travels as the number the host held: httpStatusError, read once
at RecordFailure where a failure is known to be terminal, onto Failure and
across the wire to the row. mcpEntry and McpEntry are a declared mirrored pair
now, so a status one side sends and the other cannot read fails wire-parity in
both directions.
It arrives as a fact and stays one. The row prints HTTP 401 beside the transport
and offers 「重连」, because whether a 401 means the reader must authorise again
depends on whether the automatic refresh actually ran — and it does not, for a
token the server rejected while the local clock still likes it. Claiming
otherwise would swap a regex nobody trusted for a typed judgement everybody
would. So no reason is derived, no enum is introduced, and 401 and 403 are not
folded together on the strength of HTTP folklore. Fewer claims than the old row
made, and every one of them true.
The four counterfactuals are what this is for. Prose carrying every word the old
regex looked for buys no repair offer; a typed 401 next to the detail "banana"
prints the status and still claims nothing; the detail is displayed and never
branched on; and a failure that was not an HTTP one says nothing about a status
at all.
Two guards came out of breaking it. wire-parity compares type declarations, so
deleting the assignment that fills the field passes every check in the tree —
that arm is now a real 401 driven through a host, a controller and the endpoint,
and it fails with the sentence the row would have been reduced to reading. And
the forced refresh that does not force is a tripwire in internal/plugin: it
passes today by handing back the refused token, and the day it fails is the day
someone fixed the recovery and owes the real negative control.
plugin.go was one line over its budget with the field in it, so the failure
record moved out whole — the type, RecordFailure and its two neighbours — into
failures.go. The file gives back sixty-six lines it had been carrying.
Five places turned a non-2xx answer into fmt.Errorf("... http %d ..."), and the
host knew the status at every one of them. Downstream nobody did: a failure
record keeps prose, the settings row above it keeps a sanitised and truncated
copy of that prose, and the frontend was left running /401|403|unauthorized/
over text an external server had a hand in writing — recovering, by regex, a
number this package had held one frame earlier.
So the status travels as a number. Error() renders exactly what it rendered
before, because everything that only displays this — diagnostics, the redaction
pass, the row — should see no change at all; what changes is that reading it no
longer means parsing it. Only the identity was added: no Method field, no
classification, nothing without a reader yet.
The session-expired answer keeps its own identity, and that is the arm this
change could have swallowed: a 404 carrying rpc code -32001 is something the
host silently re-establishes rather than a failure to report, and it is now
pinned as not also reading as a plain status.
Nothing classifies on this yet. Deriving a reason at RecordFailure is the next
step and it has a blocker of its own, found by trying to write its negative
control: the reactive refresh does not fire for a token the server rejected but
the local clock still considers valid, because refresh() returns early on
oauthAccessTokenUsable before it looks at whether forceRefresh was asked for. So
a 401 reaching the terminal path today does not yet mean "the user must
authorise again", and a classifier built on it would say so anyway. That is a
credential-path behaviour change and its own decision, not a detail of this one.
Seven exits in catalog.go answered 400 for everything, and behind each of them
were at least two different things: a skill nobody declared and an activation
file that would not open, a server that would not start and a lock another
process held. The endpoint was not the owner of any of it — it was reading
whatever error arrived and picking one status — so a failed disk told the user
their request was wrong, and a frontend had nothing to tell the two apart by.
The census came first and it changed what this fixes. There is no stable domain
family here to code: exactly two domain conditions exist, both fmt.Errorf, and
one of them was spelled out in three separate files. And they are the same fact
— a named thing is not there — which this tree already carries an identity for.
So the domain half needed no new codes at all. It needed the owners to say what
they meant: skill.NotFoundError where skills are resolved, config.ServerNotFoundError
where configured servers are, and serve's second copy of the MCP judgement
deleted rather than typed a second time.
Deliberately not one ErrUnknownCapability. Skills and MCP servers both happen to
have an unknown-name condition today; that is a similarity in wording, not a
shared owner, lifecycle or namespace. If a third and fourth turn up with the
same lookup contract, that is when it is a fact worth merging.
The activation store now says which way it failed. A malformed file is
UnparsedFile — the identity that already carries a path, a line and an excerpt,
because it is the one internal-looking failure a person can go and fix — and
read, write and lock failures are one sentinel, because they are one answer to
whoever flipped the switch: it did not stick, and none of them is their doing.
Notably the malformed arm is fixed by this alone: reverting the transport
classifier leaves that test green, which is what "the owner is where this
belongs" looks like from the outside.
The join in SetMCPServerEnabled kept one fact and lost the worse one. A server
that will not start and whose switch was put back, and one whose switch could
not be put back, are not the same place to be left standing — the second is
persisted state disagreeing with the runtime, and it is now checked before the
failure it accompanies rather than folded into it.
Dependency answers 409 rather than a status invented for it. The request was
fine and the world does not satisfy it, which is what this tree's other "not a
fault" refusals answer; whether a server that will not start deserves a class of
its own is for the MCP failure taxonomy to settle, and that is its own probe.
An unclassified failure is now internal rather than a bad request. A failure
nobody named is not evidence that the request was wrong, and the old default
said it was.
One stale claim came out of the same file: skillEnabled's doc still said the
runtime serves the old prompt index until a rebuild, which stopped being true
before this branch started and was fixed in four other places.
Nothing in this tree could say which actions Studio offers. A hundred buttons
answered to their own handler and to nothing else, so "does every button work"
had no subject to range over — the question needs a set before it can have an
answer, and any set kept by hand would be wrong within a month.
The census found 280 interactive sites across seventy files, and three things
worth having found. Only sixty of them are anything but a plain <button>, so a
check that looked for buttons would have missed a fifth of the surface. Five
kernel capabilities are driven from two components each — preset, plan mode,
pickFolder, probeProvider, checkProvider — and only the first was inconsistent,
which the previous change had already fixed; the others were checked one by one
rather than assumed. And the wording is useless as identity: 「取消」 is
seventeen buttons reaching eight destinations, 「关闭」 five reaching a panel, a
dialog and the window itself.
So an id is <surface>.<intent>, written as a literal at the control and again in
a registry that production may not import. Two spellings that can disagree is
the entire reason the check is worth running; one shared constant would compare
a value with itself. The instance rides on data-target and the answer on
data-value, so a row rendered seventy times is one contract, and an approval is
decision.tool with a verdict rather than three ids named after button text —
the kernel takes one decision with an answer, and the id follows the port, not
the label.
A control that is genuinely two actions may branch, as long as both are written
down: send and stop share a button, and Escape is the same pair on one key. The
window's shortcuts became a table for this reason. They were a chain of ifs,
which is a set nothing can enumerate; now each names the action it performs, and
it is the same id the control on screen carries, because they are the same thing
asked for two ways. No action here is reachable from the keyboard alone, so
there is no flag saying one is — the day that changes, it is a field with a
reader.
Twenty-five actions, thirty-four sites. The remaining two hundred and forty-nine
are counted and ceilinged rather than left uncounted: a registry that covered an
eighth of the surface while nothing said so would read as the whole set, which
is the failure this was built to prevent. The ceiling may fall and never rise.
Every direction was checked by breaking it: an unregistered id, a registry entry
nothing renders, an id assembled at runtime, one more anonymous button, a
production file importing the oracle. A sixth arm came out of that pass — the
parser recovers from some breakage rather than throwing, and a file that stopped
parsing would contribute no sites while every count above it read as an
improvement. Hard breakage throws and fails the run; the recoverable kind is now
named per file.
The tree spent two changes giving refusals an identity — dotted codes at the
HTTP boundary, a sentinel family behind them — and then twenty-five panels
printed the caught error's own message, which is the English that rode along for
the log. A coded refusal arrived untranslated; worse, a kernel that was simply
not there arrived as an internal path and a status number, because HttpError's
undetailed case is exactly what message cannot say.
Every one of them was the same expression, and every one of them was a sink a
reader looks at: an errbar, a .why line, a panel's failure row. No developer
sink and no control-flow read among them, so the migration is uniform —
reason(), which is a superset: it says a coded refusal in this window's
language, gives the undetailed case a sentence of its own, and falls through to
exactly what these wrote for everything else. The twenty-fifth was found by the
guard rather than by the census: it is main.tsx's boot failure, a .then's
rejection half, and the only thing on screen when the kernel cannot be reached.
reason() is pinned as the boundary it now is. The gate among those is that
rewording the kernel's English must not move what a reader sees for the same
code — without it the codes bought nothing and wording authority never left the
kernel. Language is pinned rather than defaulted: with nothing stored the window
follows the machine, and on an English runner every assertion about a Chinese
sentence would have been about the runner.
The guard reads structure, not spelling. What counts as an error is a catch
binding, a .catch callback's single parameter, or the rejection half of
.then(ok, err) — nothing else is known to be one, and a rule that guessed from
a name would be reading spelling again. It carries its own regression in both
directions: five shapes it must find, and four it must leave alone, including a
field that merely happens to be spelled message. Ceiling zero.
@babel/parser is a direct dependency now. It was already in the tree under the
React plugin, but pnpm does not expose what a package did not ask for, and the
installed TypeScript is the Go port, whose only parse entry points are behind
an unstable path — a CI gate is not the place to hold one of those.
The skill seed says what it stopped short of saying: a coded refusal reaches the
panel as this window's sentence, and a dead kernel as one sentence about the
request rather than the route it took.
Two things this does not close, both older than it. ServerRow decides whether a
failure was an authorisation problem by matching /401|403|unauthorized/ against
the message — HttpError.status has carried that all along. And catalog.go still
refuses skill and MCP switches with writeErr prose; those are not a declared
sentinel family, so the inbox treatment does not transfer to them.
Every UI assertion in this tree was renderToStaticMarkup or a Playwright guard,
and the gap between them is where a control's contract lives. Nothing could ask
what happens between the click and the answer — pending, refused, clicked twice
— so the three fixes that just landed were pinned by whichever end could be made
to reach them, and one arm could not be reached at all: the queue's positive
case needs an inbox_changed the bench's own subscription swallows.
jsdom is chosen over the alternatives for its DOM and event semantics, not its
speed: nothing here measures layout, and the browser guards keep every question
that depends on one. It is opted into per file rather than globally, so the
thirty-six static tests keep running under node and none of their behaviour
moves on the way in.
Three seeds, one per fix. The queue opens on the whole instruction and not on
the row, refuses to open at all when the body cannot be read, says why in this
window's language, and does not let one failure outlive its click. The preset
asks once, marks the call it has out, turns down a second while the first is
unanswered, hands the selection back to the kernel's own answer, and on a
refusal keeps the old one and asks for no re-read. The skill switch names this
skill at this project's layer, holds still while unanswered, and reports a
refusal without flipping.
All three were checked by breaking their subject: swallowing the read again
fails three assertions, dropping the preset group's disabled fails one, removing
the switch's busy fails one.
The skill seed stops short of asserting how a refusal is worded, and says so
where a reader will find it. That row hands on err.message rather than going
through reason(), so a coded refusal arrives untranslated and a dead kernel
arrives as a path and a status — and so do some twenty other catch sites,
including the settings panel's own helper. It is one pattern and belongs in one
change, not in whichever guard happened to walk past it.
The inbox store refuses eleven distinct conditions and the boundary named one
of them. Five shared a status and were told apart only by reading English, which
no frontend does; three — closed, schema-readonly, idempotency conflict — had no
case at all and went out as 500, so a known answer about the request was
reported to the user as their machine having failed. This is the rule the tree
already holds everywhere else: an error a caller must tell apart carries an
identity, and across HTTP that identity is a dotted code.
So each condition has its own case and its own code, and the sentence rides
along as the English fallback a log keeps. Statuses are unchanged on purpose —
not_found answering 409 is arguable, but the code is what carries the identity
now, and moving a status is a wire change no caller asked for. The default
branch still delegates to writeErr, which renders an identity a deeper layer
assigned and otherwise falls back to prose: for a condition this package cannot
name, prose is a diagnostic, and inventing a code would be the same lie pointing
the other way.
Two guards, because neither is enough alone. A test runs every sentinel through
the writer wrapped the way the store hands one over, and fails a code that is
missing, wrong, or shared by two conditions — but its table is hand-kept, so it
cannot notice a twelfth sentinel. repolint reads the family out of its own
declaration and the switch out of its AST: a sentinel with no case, or one whose
branch writes prose, fails there. Both were checked by breaking them, in all
four directions.
The frontend now has wording for all ten, which is what closes the loop: the
codes guard already required it, and could not have asked before, because it
reads codes at their emit site and there were none to read.
The chrome's 均衡/交付 pair sent the call and dropped the promise: no pending
state, no catch, and the selection moved only if onChanged happened to run. A
call that never lands therefore left the pair reading as the state it did not
reach, and the rejection went nowhere — a click with no answer at all, which is
the one outcome a control must not have.
The settings panel drives the same capability and has always handled it: busy
while the call is out, the refusal shown, the old state kept. That the two
disagreed is the defect; the chrome now holds the same two facts. The preset
being asked for is marked while it is out, the group refuses a second click
until the first settles — a pair of one-of-two buttons has no meaning for two
concurrent answers — and a refusal appears next to them instead of being
swallowed.
What can refuse today is narrow: /preset turns down a malformed body or a preset
that does not exist, and neither is reachable from a fixed list of two. Transport
is what actually fails here — a kernel that is gone, a pane whose runtime went
with it — so this is a dead click and an unhandled rejection being closed, not a
refusal path that was going unreported. It is written the way the settings panel
writes it because a second shape for the same capability is how the first one
came to be missing this.
The switch in settings has been live for a while: SetSkillEnabled writes the
activation store, the live store consults it per call, so the session that flips
one loses it at once — a slash invocation stops resolving, and the next eligible
turn owes the model a catalogue without it. Both halves are pinned in
internal/boot, one by invocation and one by projection.
Four places still described the old mechanism. Two of them were on screen: the
skills group told the reader changes enter the model's index "the next time you
start a session", and the discovery-off variant said the same in fewer words.
So the panel asked for a restart the product had stopped needing, and a reader
who took it at its word would keep a skill they had just switched off — the one
reading of it that is worse than saying nothing.
The other two were comments, and they are what let the screen drift: AgentPort
told the next reader the switch reaches the model on the next rebuild, and
skillSet justified its absence of a lock with "a preference a rebuild picks up".
The lock argument holds and is kept — SetSkillEnabled touches none of those
fields — but the reason it gave was the same wrong mechanism, and the true one
is why there is nothing to synchronise.
The pending strip's 「改」 reads the whole instruction back before it opens an
editor, because the row shows a preview and saving the preview back would file
a cut-off line as the entire message. That read could fail, and the failure was
spelled `.catch(() => "")`: an entry the kernel no longer holds — dispatched
between the render and the click — opened a box with nothing in it. Empty is a
state a body can genuinely be in, so nothing about the screen said the read had
failed. Whatever the user then typed replaced, in full, a line they had never
seen.
So the editor stays shut. The row keeps its own text, and the reason the read
failed is on the row rather than in the box. Two layers collapsed the same way
and both are closed: the port returned "" for an answer carrying no envelope,
which is a shape the kernel does not send and therefore an answer we do not
understand, not an empty instruction.
The fixture refused where the kernel refuses. MockPort.readQueued answered ""
for an id it does not hold, so the path a reader actually hits could not be
reached from any guard — the seeded rows ?queue= draws are exactly that state,
a row still on screen whose entry is gone.
perf/queue.mjs pins it in the browser, and it was written against the old code
first: opening an empty box, losing the row's text and saying nothing were three
separate failures before, and are three passes now. It also records what it does
not cover. The positive arm — a body that does read back opens the editor with
it — needs an inbox_changed to reach the panel, and BenchPort owns the
subscription the fixture emits into, so that arm belongs to a component-level
harness rather than to a change in the bench's event model.
Three ledger states read identically through the readiness result: a review
report filed by a run granted no such authority, one the host could not join
back to any run, and no report at all. Missing said structured_review for all
of them — or, in the fixture that isolates it, said exactly the same list for
all of them — and the classification the ledger already computes existed only
inside a sentence written for the model.
So the proofs are their own dimension beside Missing rather than an entry in
it. Missing names obligations that are unmet; Proofs names candidates that
cannot close one, and only the second is something a person can act on: "file a
review" and "the report execution-3 filed carries no grant for this" are
different instructions. An obligation with no candidate at all has no entry,
which is how the third state stays distinct from the other two.
The gap carries the run that filed it, read in the same walk that classifies it
— two passes over the ledger could disagree about which receipt they were
describing, and the id is the half that makes the gap actionable.
The parity this needs is not about wording. The completion gate and the
readiness projection share one evaluator today, and the guard is what fails if
either grows arithmetic of its own: for one fixture, whether the gate refuses
and whether the projection says ready must be the same answer, over the same
missing ids and the same proofs. Reason is excluded on purpose. Both halves were
checked by breaking them — folding the proofs into Missing fails orthogonality
and parity together, and letting the projection decide readiness on its own
count fails three arms of the parity table.
Nothing is exposed to a port, the wire or a window yet. Two lifecycle questions
have to be settled before a read called "current" can be published: the evidence
ledger is constructed empty per agent with no rebuild path found, and the
acceptance-criteria input is turn-local, so a read taken outside a turn answers
from the last one's flag. Both are probes of their own.
agent.go crossed its budgets on the way, so the result type moved next to the
evaluator that produces it rather than the budgets moving.
A falsifier ran first, because the question was not which field replaces the
label but what the label was standing for. Eight arms through the reducer,
recording the frame that ended the turn and the state the session was actually
in: a new turn already clears the label, and nothing in the background moves it,
so what it stood for was the current turn's ending rather than a memory that one
had ever ended. That answer is what makes a state machine in the reducer the
right owner, and it ruled out asking /status for a Finished bool.
The same matrix found a defect the label was hiding. It asked only whether an
error was attached, so a turn that ended because its obligations were not met —
outcome final_readiness, no error — read exactly like one that finished the
work, tick and all. The comment three lines above it already said the opposite:
anything but a clean finish keeps the run amber rather than claiming the tick.
The code now agrees with it.
So terminal is typed and not a flag: completed, failed, cancelled, incomplete.
Cancellation is separated from a dropped connection by the flag the kernel sends
for exactly that, which nothing was reading. runState asks for the terminal
rather than a boolean, and only a completed one claims the tick — the other
three stay amber, which is what they always meant.
Two rules make it a state instead of a history, and both are pinned: a turn
starting clears it, and nothing behind the session moves it in either direction.
Reverting the first makes an hour-old tick sit over running work and turns that
arm red; folding the readiness outcome back in with a clean finish turns the
other one red.
The counterfactual is the same one the decision list got, in both directions.
The label may say 已完成 with no terminal fact and the turn is not done; it may
say anything at all over a completed one and the turn is. Neither selector can
see it — with this, no selector in the pane takes a label at all.
Five labels in the rail stayed in the source language in an English window. The
table naming them was built at module scope, and t() answers out of a dictionary
that boot() installs — a module body runs before that, so the labels captured
the empty default and never followed the interface again. Switching the language
reloads the window, which meant the same thing happened on the way back: the one
place in this tree where the fix is not "re-render on change" but "do not
compute this until you are drawing it".
They are computed in a function now. The literals stay inside t() at the call
site so the catalogue scanner still sees them — the alternative, a table of
keys resolved later, is the shape that made t(TABLE[key]) invisible to it before.
A scan of the whole tree for the same mistake found no second instance: two
other candidates are a memoised component and a regex with a tab escape in it.
perf/lang.mjs was four more red beside it, and none of those were the product.
It looked for three panel headings — Metrics, Pending changes, Agents and tools
— that no longer appear anywhere under src/ui and survive only in the catalogue,
so the oracle had been asking after names the panels stopped using. It now names
what they render.
The flip itself is pinned where it broke: the legend is read in both windows, its
labels must be wholly English in one and wholly Chinese in the other, and its
numbers must be identical across the pair — translation moves the labels and
nothing else. Restoring the module-scope table turns that assertion and the
stray-Chinese one red together.
One guard bug came out of the same edit: the check that rendered Chinese goes
through the catalogue treats a fat arrow as a tag opening, so any arrow
returning Chinese before the next "<" reads as markup. It no longer matches
after "=".
perf/models.mjs threw where it should have failed. Its wait for the connection
editor timed out and the stack went to node, so the exit code and the message
both stopped belonging to the guard — and "this screen is not this shape any
more" is precisely what it exists to be able to say. Missing targets are named
failures now, the way side.mjs's became.
The reason it could not find them was the same one verify.mjs had: the oracle
matches Chinese against the DOM and the page was opened in whatever language the
machine runs in. Three guards were in that position — models, look and panes —
and two of them pass today only because their Chinese comparisons happen to sit
on paths that do not decide anything yet. All three now open a context with a
locale, which is what locale.mjs has always done.
Checked both ways: pointing the wait at a selector that does not exist reports
one named failure and exits 1 rather than throwing, and the three guards pass
with the locale pinned.
Whether the run reads as moving was settled by comparing the label on screen
against two Chinese literals. Both are also translation keys — one of them is
"Waiting for approval" in the English catalogue — so a rewrite of the wording
was a rewrite of the verdict, and the presentation owned a fact the kernel
already publishes.
It publishes it better than the string did. Decisions() answers with typed
entries whose Kind names the owner that resolves them — tool_approval,
plan_approval, recovery_approval, ask — and all four need a person, so the
condition is the list's length rather than anything inside it. Which kind it is
says who answers, and that is what an explanation would render; this only says
that someone has to. Absent is false and never a fallback: a kernel that does
not answer leaves this window unable to claim anyone is waiting, and quietly
reading the label instead would put presentation back in charge with nothing
saying so.
The guard is a counterfactual in both directions, because only one direction
proves anything on its own. The old wording present with an empty list must read
as running — that is what says the string has lost its authority. A typed
decision present with a label that reads like progress, or like nothing, must
read as halt — that is what says the typed fact carries the verdict alone. Every
kind is driven through the second, so narrowing the condition to some of them
fails; every label is driven through both, so no test pins a word. Neither
selector can see the label at all, which is the strongest form of the claim.
runState is separated out so it takes facts and never a label. One label test
remains at the call site — whether the turn finished — and it is left visible
rather than folded into a function that would then be wording-free only in name.
It is the next instance of this, and it needs a canonical source of its own.
Two fixture repairs ride along, both the same shape as the last round's. The
mock never published decisions at all, so the whole chain would have measured as
"nobody is ever waiting"; it now sets the list where it raises the card and
clears it where it answers, and driver-fed frames go through the same door as
scripted ones. And verify.mjs now asserts the chain end to end: the card and a
halted run appear together, which is what proves the projection reaches the real
Pane rather than only the selector.
The status read is pulled forward too. Nothing but the 250ms poll would have
noticed a prompt opening, so the glow outlived the card by up to a quarter
second; a prompt event now re-reads /status, the same content-free event plus
authoritative pull the queue already uses.
mock.ts crossed the 800-line ceiling on the way, so the memory shelf's fixture
data moved out beside the other six mock_* modules rather than the budget moving.
Three owners decide whether a column is on screen, and they are kept apart
because collapsing them is the only way this feature can go wrong. What the user
chose is theirs; what the viewport allows is the layout's; whether the
surroundings are put away for a moment is this. They are multiplied where they
are used — effective = wanted && allowed && !focus — and focus never calls the
setters for the other two. Writing a temporary state back into a preference is
how "leave focus" stops restoring anything.
So focus stores one boolean and nothing else. Not the previous layout, not the
width it was entered at: both would be a saved projection, and the point of
keeping the owners separate is that everything is asked again. A window narrowed
while focused leaves focus with the columns the new width allows, not the ones
it had before — the responsive rule never stopped running.
The columns are collapsed, not unmounted. Taking them out of the tree would lose
the sidebar's scroll, the inspector's open sections and whichever panel was
selected, and this is a state you step out of. Collapsing goes through the same
path the existing close does, so the transition, the borders and the fade are
the ones already there. inert is the other half: a column that is only hidden to
the eye can still be tabbed into, and a guard that checks pixels would not
notice.
What stays is everything belonging to the turn in front of you: the transcript,
the queue, approvals and asks, the composer, the stop button, and what the run
is doing. Focus is not a reading mode — it is the same session with less around
it. The run header loses its description and its timestamp through the rules the
short-window fold already uses, rather than a second header component that would
drift from the first.
Escape follows the convention useDismiss set: a transient surface takes the press
in the capture phase and stops it there, so the window's handler only sees a
press nothing else wanted. Stopping a turn stays ahead of leaving focus, because
doing both on one press would be neither. The overflow bubble now stops it too —
it was listening in the bubble phase, which would have closed the bubble and
dropped focus mode together.
perf/focus.mjs holds it, and the two easiest things to fake are the two it was
checked against. Removing inert leaves every assertion about pixels green and
fails only the one that puts focus into the hidden columns. Making the toggle
write the columns closed turns four of them red at once, including the one that
reads the preference straight out of storage. It also pins the geometry both
ways: the transcript grows from 884px to 1394px on the way in and is 884px again
on the way out, which is the whole promise stated as a number.
Both were found while checking that the composer-budget change had broken
nothing. Neither had.
side.mjs crashed rather than failed. It read .why out of the MCP rows, and the
panel no longer has one — the reason moved into a title and the row now carries
a name and a way out — so getComputedStyle was handed null and the script threw
before any assertion ran. A guard that dies says nothing about what it saw, and
"the panel is not this shape any more" is exactly what it should be able to say,
so a missing target is now a named failure and the wait for one is too. Its
subject is unchanged: endpoint-authored text does not get to widen a fixed
column. What it asserts about has moved to the name, which is what the row
renders now, and to the way out beside it, which is the only thing on that row
you can press and therefore the thing that must not be squeezed away.
verify.mjs was five red on a clean checkout, and every one of them compared a
string on screen against a Chinese literal while opening the page in whatever
language the machine happened to be in. locale.mjs has always opened its context
with a locale for this reason; this one never did, so on an English machine a
whole group of plan-gate assertions failed over wording that was in fact correct.
Pinning it left one, and that one was the fixture too. data-plan is read from
/status, and MockPort's planDecision was an empty method: approving a plan could
not turn plan mode off in the harness no matter what the product did. The three
plan outcomes are three different kernel transitions rather than an allow/deny
pair, so the mock now makes the distinction it always described — revise stays,
the other two leave. Verified on an unmodified origin/studio worktree: five red
before, none after, with no change to any product file.
So neither is UI debt, and neither was fixed by moving an oracle to meet the
code. The fixture is dev-only and never reaches a shipped bundle.
The queue was the instance; this is the class. Everything stacked around the
composer — the pending queue, extension views, the error bar, runtime notices —
shared a container that is flex: none and therefore takes whatever height its
children ask for. Only the extension rail had ever bounded itself. Fixing the
queue alone left the next child to do the same thing.
So the two regions are named and share one number. Above the box, .composeaux
holds the queue and the extension rail; below it, .composenotes holds the error
and runtime bars, which arrive unbidden and are dismissed one at a time. Both
read from a single --aux-budget on .compose, split .72/.28, because the
invariant is singular: the transcript must not be squeezed out. Two independent
ceilings do not compose — the first version of this had them at 30vh and 16vh,
and 64 queued rows with twelve notices still measured the transcript at 36% of
a 900px pane.
The queue's own ceiling is gone with it. What it needs is not a height but a
shape: the header stays put and the rows scroll, so the count and the pause
control are still there while you read what is waiting.
Height now folds the way width does. Everything around the transcript is
budgeted as a fraction of the window, and on a short one those fractions are
the transcript; under the existing "side" fold the metrics column is one of
them, sitting under the flow with 40vh of its own. A window 720px or shorter
reports "short", which tightens the composer budget, caps that column further,
and takes the description and the timestamp out of the run header.
The queue's preview carried a native title, whose delay, placement, size and
scrollability all belong to the browser — a long one is an uncontrollable sheet
over the page, which is how it appeared in the report this came from. Dropping
it alone would have taken the full text away from settled rows, which have no
edit button to read it back, so it is replaced rather than removed: Overflow
shows the whole string, and only where the string is actually cut. It is bounded
and scrolls inside itself, its text can be selected, it closes on Escape, blur
or any scroll, and it takes a tab stop only on the rows that have something
behind them. Long titles and job commands can use it next.
It renders through a portal for a reason worth writing down: a finished entry
animation with fill-mode: both leaves transform as the identity matrix rather
than none, and an identity matrix is still a containing block for a fixed child.
Both .queue and .qi carry one, and the bubble's inline left/top were correct
while it rendered 675px below the window.
perf/budget.mjs is the guard, and it reads geometry rather than class names: 64
queued rows (the kernel's own admission ceiling) plus twelve runtime notices, at
three window sizes, asserting the transcript keeps 40% of the pane, the textarea
stays wholly on screen, and the region that gives way is the auxiliary one. The
floor is not a product truth — it is "never zero again", with the measurement
that motivated it at 48%. Removing --aux-budget puts 1440x900 back to a 0%
transcript and a composer off the bottom of the window, which is the report this
came from.
It guards the bubble on the same terms. One seeded row is short, and must draw
nothing; one is longer than any preview the kernel will ever produce, because
previews are cut at 120 runes and the bubble's own ceiling would otherwise never
be reached — a bound no fixture can cross is not a bound anything checks.
And .qi was outside the reduced-motion list while carrying an entry animation,
so a burst of rows was a burst of movement for a reader who asked for none.
A failing cargo build finished thirty-two background jobs in a few seconds. Each
one became its own queued turn whose text was the composed <background-jobs>
block, and the pending-queue panel — which had no height of its own — rendered
all of them. Measured against the real stylesheet in a 900px pane with the 41
rows from the report: the transcript is 466px with the ceiling this adds and 0px
without it, the composer pushed off the bottom along with it.
Three places treated the host's own account of a job as something a person had
said. backgroundCompletionPrompt built one string and handed it to both Display
and Submit, and Display is persisted as the turn's RawContent — so the queue row
and the transcript were given the markup meant for the model. UserMessageText
returned RawContent verbatim on the grounds that it holds what a person typed,
which is true of every producer but this one; the comment at its ACP call site
already claimed it stripped. And the page's own control-block regex named three
of the thirteen tags the kernel prepends, so the stripping that did run missed
this block anyway.
That last list has now drifted twice — internal/history/strip.go records its own
copy having named five of eleven — so the two are held to each other by repolint
under wire-parity, compared as sets and failing both ways. A tag the page cannot
strip is markup it prints at the reader; a tag only the page knows is a copy
that has gone stale.
The burst is a separate fact. A completion gives its session a turn so the work
it unblocked continues without waiting for the user, but thirty of them are one
interruption, not thirty. While a continuation is still unread, later
completions are refused through the error path publishCompletion already had,
and the manager keeps its note — which the next turn's <background-jobs> block
folds in whole.
The queue's ceiling is layout, not semantics: 30vh at most, and what does not
fit scrolls inside it. Its item count was already bounded at 64; its height was
bounded by nothing, and the two are not the same limit. The input box is the one
thing nothing may push off the screen, and the transcript is the second.
The last open row in the projection rules. Standing instructions rode the turn
already — they were never in the prefix, which is why classifying them as prefix
configuration would have been a move rather than a description — but they
reached a live session only through the writers that published them. An edit by
an editor, a script or a branch switch was in the canonical set and not in the
next turn.
They are now rendered from disk each turn and compared with what the model has,
the same shape the skills listing took. Discovery is the narrow one: the
instruction documents, not the fact store and its recall index, at 272µs p50
against a turn measured in seconds. A session that never resolved a workspace
renders nothing rather than discovering from the process directory, which is
what it was accidentally doing the moment discovery moved onto the turn.
Two rows this closes are not edits. A removal is owed once as a removal: silence
would leave the rules the model already holds reading as current, which is the
failure a deletion is most likely to cause and the one nothing would report. And
a rewrite of the same bytes is not a change — the comparison is against the
rendered block, so touching the file costs nothing.
Delivery, not composition, settles a debt. A turn can still be blocked by a hook
or refused by an extension after it composed, and clearing the debt there would
leave the model holding state nobody sent it; runSettled is the hand-off point
because everything that can refuse the turn has already run. A provider failure
after that is not a lost delivery — the composed message is in the session and
rides the next request, which was measured rather than assumed.
Two tests changed because they measured the old contract. Both composed twice
without running a turn and expected the second compose to be silent; under
delivery-settles they correctly owe it again, so one now pins exactly that and
the other settles explicitly where a real turn would.
13a made the durable skill switch a live registry input, which is the same rule
the out-of-band file write already forced and worth stating once rather than
rediscovering per input: a switch flipped, a file edited past every API and a
plugin dropped into a directory are one question, and the registry answers it
from canonical state.
Its second half matters as much and is easy to lose: a change no projection
renders is not a change. Without it, "detect every mutation" invites mtime and
event streams back in, and both re-send listings nobody's model would read
differently — freshness bought out of the cache stability it rides on.
The section also stops implying the original hypothesis was right. Moving memory
and skills out of the prefix was the plan this phase started with; measurement
found them already there and freshness ownership missing instead.
Enable/disable is registry configuration, not a build-time constant, so a user
who turns a skill off should not have to restart an agent to be rid of it. The
fix is not a republish after the setter — 12b settled that the registry answers
for itself — it is that the disabled set stops being a snapshot. Options take a
function, resolved once per discovery pass, and the pass is what every surface
already goes through: the listing, slash resolution, run_skill, Inspect.
Everything downstream follows without being told. The catalog is rendered from
the registry each turn, so a toggle changes the block and the block is owed; a
toggle that changes no listing — turning on what is already on — writes its
durable row and owes nothing, because the debt is against what the model would
be sent and not against the file that decides it.
The boundary is dispatch. A child already running keeps the skill it was
dispatched with: resolution happens once, the run holds what it resolved, and a
registry consulted again mid-run would cancel work the user asked for. The arm
that pins this fails without a witness that a child actually ran, since a turn
that dispatched nothing would otherwise satisfy every other assertion in it.
The two surfaces now say what is true: restartRequired is false and the CLI
notice says the change is in effect from the next message. That order is
deliberate — the promise moved after the behaviour did, not before it, which is
how it became false in the first place.
Cost of asking per pass rather than binding once: 23µs with no overrides, 63µs
with twenty, against the 166µs-2.4ms the listing already costs to render and a
turn measured in seconds.
The listing's freshness was already owned by the registry, but the state behind
it was three inline lines on skillSet: a pointer, a comparison, a store. That
names the operations and not the fact, and the fact is the part another
projection will need — the standing-instructions block is the same shape and is
the open row in the rules.
projectionDebt holds one thing: what the model has of a block that is delivered
once. Rendering is the caller's, and so is invalidation, which is the boundary
worth keeping — a debt that decided for itself when to invalidate would be back
to guessing at canonical state it does not own.
The delivered value is the version rather than a digest of it. A digest is a
second representation that can drift from the thing it stands for, and the block
is a couple of kilobytes; there is nothing to buy by hashing it.
12a and 12b were one question asked twice. The prefix design was already right;
what was missing both times was the rule for when a once-delivered projection
becomes owed again, and both times the answer had been left to whoever happened
to write the state.
The four rules are what the matrix in internal/boot/context_projection_test.go
now holds, written down so they bind the next dynamic fact rather than being
rediscovered by it. Prefix ownership names pinned memory as the one declared
exception rather than leaving it as an unexplained violation, which a rule
phrased as "no canonical fact may move the prefix" would have made it. Freshness
says what "eventually" is not. Ownership is the one this phase actually cost:
the owner of a fact owns the invalidation, because a projection kept fresh by
callers remembering is one forgotten call from stale. Determinism is already
true and is frozen before something makes it accidentally false.
The open row is stated rather than quietly carried: standing instructions still
reach a live session only through the writers that publish them, so an edit to
REASONIX.md made outside them waits for the next build. That is measured, not
assumed — the same probe that closed the skills row shows this one open — and it
is the shape the listing had before it started asking. Fixing it is a decision
about memory, not a consequence of this phase.
The cache-first convention loses "memory" from its parenthetical: the index left
the prefix some time ago and only pinned bodies remain, so the list was naming a
fact that had moved.
Falsifying the activation lifecycle turned up something else. `/skill disable`
and the Studio switch write a durable override, `SkillEnabled` reads it back,
and the panel duly shows the skill as off — while discovery is configured from
`skills.disabled_skills` alone, which that switch has never written. The skill
therefore stayed in the model's listing and stayed runnable. Not until the next
turn, or the next session: permanently. Both surfaces answer `restartRequired`
and the CLI says "restart or refresh the session", and a restart did nothing
either, so the promise was not late — it was false.
Discovery now reads the durable decision: the hand-written config list, plus
what the switch turned off for this workspace, minus what it turned back on.
The switch answers by name, so a name the user turned on beats a config file
that declares it off, which is the order every reporting surface already used.
The arm is written as the lifecycle contract rather than as a freshness row,
because that is what it is: the change takes effect on the next build, both
surfaces say so, and the live session's silence is the boundary. Its second
half is what gives the first half meaning — after a rebuild the skill is gone,
so the live session not moving is a boundary rather than a switch doing
nothing. If that boundary ever moves, the arm fails and the two surfaces have
to stop promising a restart.
Whether the switch should apply to the live session is now a product question
and no longer an implementation one: 12b left the listing being rebuilt from
the registry each turn, so the only thing between here and immediate effect is
the store's construction-time disabled set.
One measurement note, because it cost a debugging round: the index preamble
names a built-in as its own call example, so a test matching a bare skill name
in that block matches the boilerplate. The arm matches the entry line.
The listing was owed by being told: publishCatalog on construction, on a
completed fold, on a command reload, and — after the last change — on each of
the three skill writers. Every one of those is a caller remembering, and the
probe beside this had already shown what the remembering misses: a skill file
written by an editor, a script or the model's own write tool is in the canonical
registry and announces nothing.
So the question moves to where the answer lives. owedCatalog renders the listing
from the registry and compares it with what the model was last sent; the writers
stop announcing themselves entirely, because there is no longer anything to
announce to. A fold does not re-publish either — it forgets what the model has,
which is the truthful statement: the bytes it was sent are no longer in the
context it samples from.
That the comparison is against the rendered listing rather than the files is
what makes the reverse hold. A touched mtime and an edited body both change the
registry's inputs and neither changes a line the model reads, so neither
re-sends anything. Freshness bought by re-sending on every filesystem event
would pay for itself out of the cache stability the block rides on.
The cost of asking instead of being told is the walk, measured before this was
written rather than assumed: 166µs on a workspace with no skills of its own,
2.4ms at fifty, against a turn that costs seconds. The old comment said a fresh
List() per turn was what the once-only delivery existed to avoid. It was
avoiding 0.1% of a turn.
12a fixed the skills listing by having each writer announce itself, which is
correct and does not scale: the same probe showed a skill file written past
those writers — an editor, a script, the model's own write tool — is in the
canonical registry and still owes nothing. A contract that reads "every writer
remembers to announce" is one forgotten call from the defect it just fixed.
So this measures the three candidates rather than picking one. Rebuild the
projection and compare it; fingerprint path, size and mtime; or trust that every
write announced itself. Owed is measured, not declared: the block is rendered
before and after each transition, and owed means those differ. Under that
definition rebuilding the projection is not an estimate of the truth, it is the
truth, and what the arms establish is where the two cheap detectors diverge
from it.
Both diverge, in opposite directions. Metadata misses a change whose length and
mtime are preserved, which is not exotic — a branch switch restores content and
stamps it with the mtime the file had — and it fires on a touch and on a body
edit, neither of which changes a line the model sees. Observed-write is blind to
every out-of-band write by construction; it can be an optimization, never the
owner of correctness.
The cost argument for the cheap ones then mostly evaporates. Rebuilding the
projection costs 166µs on a workspace with no skills of its own, 668µs at ten,
2.4ms at fifty and 6.4ms at two hundred; metadata saves 25% of that at two
hundred and 60% at ten, because the walk is the cost and reading the files is
not. A turn costs seconds. Paying the truth once per turn is noise, and it was
avoided on an assumption nobody had measured.
Two measurement traps are worth naming. Timing a detector with its own
accounting inside it measures the accounting: attaching the file/byte counter to
the projection detector reported it 2.5x slower than it is. And pointing the
project root and the home root at one directory walks it twice, which doubled
every number until they were separated.
Canonical host state — the memory store, the skill registry — belongs to its
own owner, and what reaches the model is a projection of it onto each request.
Nothing measured that end to end, so this file does, through the real Build
assembly against a recording provider: five rows, each reading bytes that
actually reached the wire.
The two failures are named apart because their fixes are opposite. A
cache-boundary violation is canonical state reaching the system prefix, where
changing it re-sends every byte after it. A freshness violation is canonical
state not reaching the next turn, where the model acts on a registry the host
has already replaced. Both would otherwise be reported as "stale context",
which says nothing about what to do.
Four rows hold. The same canonical state projects byte-identically in a second
session, so a difference elsewhere is the change under test rather than the
assembly's own nondeterminism. A memory write reaches the very next request,
leaves the prefix alone, and survives the session that made it. A fold re-owes
the listing it summarised away, and re-owes the registry as it is now rather
than replaying the bytes it dropped. Pinning is the declared exception, stated
here so moving it later is a decision and not drift: a pinned body folds into
the prefix, which costs one cold start and is what pinning means.
One row failed. A skill written through the controller's own writers is in the
canonical registry immediately — RunSkill finds it by name — and the listing is
owed once, so nothing told the model it exists until a fold or the next session
happened to re-owe it. The write re-owes it now. That is on the write and not
on the turn deliberately: the listing costs a disk walk, and paying it per turn
is what the once-only delivery was built to avoid.
Getting the measurement right took three definitions, and the two that were
wrong are the useful part. Read the whole history and a listing delivered on
turn one is present forever, so every row passes while measuring nothing. Read
the last user message and under context pressure it is a host notice appended
after the turn, not the turn. Only the message carrying this turn's own text is
this turn's projection. A fourth trap sits next to those: the host makes
provider calls of its own, so a cursor carried between turns reads the
compaction summarizer's prompt as the model's context.
Known gap, measured and not closed here: a skill file written by anything other
than those writers — the model's own write tool, an editor, a script — is in the
canonical registry and still does not re-owe the listing, because nothing
observes the write. Closing it means either a fingerprint walk per turn or
routing observed write paths back to the registry, and that is a different cut
from this one.
The skill write methods move to skill.go rather than widening controller.go's
budget by the twenty lines this added.
`go build ./tools/repolint` writes the binary into the working directory, and
two of those — repolint and covergate — had been committed. Nothing builds them
that way on purpose: every caller, Makefile target and CI step runs them with
`go run`. So any probe, agent or script that builds one produced a diff on a
tracked file that had nothing to do with what it was doing.
Untracking them is half of it. The other half is that the same accident is
available to all thirteen commands in the root module, and only three were
ignored, so the ignore list is completed from the package list rather than from
the two names that happened to get caught.
`build-artifact` holds the two lists together: every main package in the root
module must have its output name covered by a root-anchored .gitignore entry.
It reads the package list, so a command added tomorrow fails before anyone
builds it, and it passes on a clean checkout where there is nothing lying around
to observe — a rule that only fired on a dirtied tree would be silent in CI,
which is the one place this needs to hold. A pattern that is not root-anchored,
or that names a directory, does not count as covering the drop.
The walk stops at a nested go.mod: a command in another module builds into that
module's directory, and the root .gitignore is not what covers it.
review_report's `kind` carried two facts at once: which review this was, and
which obligation it closed. The first is the worker's to state — it is the
payload it was asked for. The second never was, and reading it out of the same
field made the label the capability: a run contracted for one kind could submit
the other, and every gate downstream accepted it, because by the time a gate
looked there was nothing left but the word the model had written.
So the permission is issued before the run and stamped from outside it.
ReviewAuthority says which obligations a report from this execution may close;
the host binds it to the report tool at mount time, the receipt records it off
the mounted instrument, and ReceiptProves asks that question instead of reading
the payload. The kind stays, as the delivery fact it always was: a submission
naming a kind other than the one assigned is refused at the tool, before a
receipt exists, rather than downstream where a gate has to unpick it.
Authority is separate from Delivery all the way up — on the skill, on the
profile, in the spec — because a worker can owe a report it may prove nothing
with, and one did. Both come from the worker's own declaration, so no entry
point widens either by asking differently, and the built-in security reviewer
declares only the security obligation: whether a security review also answers
for an ordinary one is undecided, and an undecided grant is not asserted.
Two consequences are deliberate. The report tool leaves subRegistryFor and is
mounted where the execution id exists, since a permission issued to a run that
does not exist yet is not one — there is now no reachable state in which the
instrument is present unbound. And read_only_skill, which runs outside the
delegation lifecycle and has no execution to name, gets a grant with no
authority: the verdict is still owed, a block from it still stops delivery, but
evidence nothing can be joined back to does not close an obligation.
The gate says which of these happened. ReviewProofGap separates "no report",
"submitted by a run the host cannot name" and "submitted by a run granted no
such authority", and the refusal names the one that occurred. Without that the
model reads a demand for a review it believes it just delivered, and the rule
it invents to explain the contradiction outlives the turn.
Reporting is accepted once rather than called once: a refused attempt records
nothing, so a run that got the schema or the kind wrong can still correct
itself, while one that already has an accepted verdict cannot file a second.
Split returned one flat map for every frontmatter block, collapsing nested
mappings onto their leaf keys: `metadata:\n type: user` and a top-level
`type: user` were the same fact by the time any caller saw it. That is fine for
the vocabularies it was written for — they are flat — and fatal for a namespace,
because the one thing a namespace is made of is which key a field was written
under, and flattening is exactly the step that drops it.
So the parse keeps the shape the author wrote. Document holds fields in order
with their kind, Lookup walks a path, and Has answers whether the author reached
for a namespace at all — an empty mapping, an empty sequence and a bare key all
count, three states the flat map cannot tell apart from absence.
The flat view is not deleted, it is demoted: Split becomes SplitLegacy, defined
as Parse followed by LegacyFlat, so the historic vocabularies keep their exact
behaviour including last-write-wins and the argument-hint bracketing. Nothing
about their parse changes; only the direction of the derivation does.
A rename alone would not hold. The reason the old shape survived this long is
that reaching for the flat map is the easy call, so `flat-view` names the ten
files allowed to make it. A vocabulary that migrates to the document comes off
the list and the boundary only tightens; a new caller fails. Asking instead
whether a read "looks new" would judge intent, which the source does not record.
11a proved one member of this enum live after the plan had it down as cleanup.
That made the method the finding: a name that reads like history is not evidence
of anything, and the same doubt applies to the six members beside it. So the
family is classified by evidence, once, and the scope stops there.
Six now have a witness — nothing between head and tail, one transaction with
none of it closed, a reachable region that ends inside the body, something new
that is not worth folding, a pinned head already over the trigger, and an
extension that rewrote the fold to nothing. Each is a concrete state, not an
argument that the branch exists.
Two of them are worth reading twice. fixed_prefix_above_trigger reports its
verdict together with a rejection error, so refusing to fold and failing to are
one answer to "why was nothing folded" and the reader takes the verdict either
way. fold_empty_after_hooks needs raw JSON rather than a marshalled payload: the
messages field is omitempty, so a Go value cannot express an empty fold at all,
while an extension is a separate process and sends its own bytes. A witness
built from the host's own struct would have concluded the branch was dead.
input_unchanged is stated and not reached. It fires when the current view hashes
to the one a previous applied fold consumed, and a fold changes that view — so
the match needs the projection to stop being used while the canonical and the
receipt both survive, which is what a resume does and what a second process
would be needed to show. It is recorded as unwitnessed with the reason rather
than as dead, because failing to reach a verdict is not evidence that nothing
reaches it. That distinction is the whole point of the exercise.
The classification is data rather than prose: a member with neither a witness
nor a stated reason fails, so a verdict added later cannot arrive unclassified.
Nothing is deleted — no member of this family turned out to be dead.
11a asked whether NoopNoNewClosedPrefix is still something production produces,
because the plan had it down as cleanup. It is. Deleting it would have removed a
live branch on the strength of a name that reads like history.
Reaching it took three tries, and the two that failed are the useful part. With
no growth after a fold the attempt never happens: the prompt is back under the
trigger. With growth big enough to reach the trigger again, the foldable region
starts past the body and the verdict is the economics of folding it. The state
that reaches this one is narrower than either: a fold, then a small increment,
with a recent-tail budget wide enough to reach back past the tail and into the
body the checkpoint already holds. The tail is measured in tokens, so the window
is what decides how far back it reaches — which is why the fixture varies the
window rather than the message count.
That also explains why the two neighbouring verdicts are not substitutes for it.
NoopInputUnchanged answers when nothing changed and cannot answer here; the
input did change, by one message. NoopFoldBelowEconomics answers when there is
something new to fold and it is not worth folding. This one answers when there
is nothing new inside reach at all, and the three would be one sentence if the
verdict were a sentence.
The test covers the two reachable verdicts it has a fixture for rather than
claiming the whole vocabulary. Its value is the shape: a code is proven live by
reaching it, and a code that resists reaching gets investigated before it gets
deleted.
10a found the typed-review requirement had no owner: neither the skill nor the
profile could express it, and what decided it was a switch on the worker's name
consulted by one compiler. That made two independent errors at once — a reviewer
renamed lost its obligation, and an ordinary worker that borrowed the name
gained one — and left task(profile=review) with nothing to inherit.
So the fix is a declaration, not parity. DeliveryContract lives on the
definition, the built-in reviewers declare their own verdict there, and it
projects into the execution spec the same way a tool ceiling does. Both entry
points read only that projection. The name switch is deleted rather than moved:
putting it in the task compiler too would have made the accident look like a
design.
task(profile=review) therefore changes behaviour and is meant to. The same
reviewer owed different things depending on which button started it, and nothing
about the product justified that — only the compilation path did. Moving the
rule from wording to structure fixes the false negative and the false positive
together; the parity is a consequence.
The contract is declared by built-in definitions and deliberately not parsed
from user frontmatter. Where the fact lives and who may assert it are different
questions, and if a security verdict ever counts as verification evidence, a
line of YAML should not be enough to claim it. That one stays open on purpose.
The guard is the falsifier inverted. What proved the defect — a renamed reviewer
losing its obligation, an impostor gaining one — now proves the fix, through both
surfaces, and the built-ins are read from the store the way a session reads them
so a definition that dropped its declaration fails loudly.
Two files were extracted rather than widening a budget: the contract to its own
file, and the frontmatter key vocabulary out of a 1400-line loader.
10a asked which layer owns the requirement that a reviewer answer with a typed
verdict — the skill, the profile, the worker, the compiler, or the delivery that
enforces it. The answer is none of them.
Neither skill.Skill nor agent.ProfileDefinition has a field that could express
it. That is checked over the types rather than one value, so a field added later
is found whether or not anyone sets it. What remains is a switch on the worker's
name, and the cross-wiring shows the name is the whole of it: an ordinary worker
that borrows the name acquires the obligation, and the reviewer under another
name loses it. Only one surface consults that switch, so the same worker owes a
verdict through run_skill and owes nothing through task(profile=).
The measurement is what each child is actually handed. review_report is attached
exactly when the requirement is set and from the same field the gate reads, so
offering the tool and owing the verdict are one fact, observed without exporting
anything for a test.
This reframes the divergence recorded when the runners converged. It is not a
parity gap: there is nothing for task(profile=review) to inherit, because the
requirement was never a property of the reviewer. It is something one compiler
adds on recognising a word — the phrase-table shape retired everywhere else in
this tree, still standing here because nobody had asked it for its source.
So the tempting fix is the defect. Adding `if worker.Name == "review"` to the
task compiler would not close a gap; it would put the same undeclared derivation
in a second place and make the accident look like a design. An owner has to exist
first, and choosing one is the next cut's question — this one only establishes
that the candidates a reader would consult cannot be it.
The six cells are logged rather than asserted individually. What the table
establishes is where the requirement enters, and a per-cell expectation would be
asserting the answer it exists to find; the two hard assertions are the ones that
would have to change for the finding to stop being true.
9b gave a host-started execution an identity of its own, and left one entry
point into that change unmeasured: the controller's synchronous call, which 9a
had deliberately excluded because its cancellation and session ownership need
not match a slash invocation's. Excluding it from the measurement is right;
leaving it unverified after changing what it produces is not.
Three arms, entered the way that surface's callers enter it and stopped by the
owner it actually has — the caller's own context, never the controller's gate,
which never admitted the call and holds nothing for it. Two premises had baked
in the interactive surface and were corrected: readiness read the gate for a
call the gate had never heard of, and the arm required a synthetic dispatch id
that a synchronous call does not mint. Each surface's premise is now its own,
which is the point of measuring them apart.
Every provenance row matches: the same host-owned execution, the same empty
lineage, the same journal, the same store join, the same restart. Three things
differ and each follows from what the surface is — who owns the stop, whether a
sink exists to draw on, and whether a synthetic id was minted for the screen. So
the contract is narrower than "identical" and stronger than "both work":
Host execution provenance is surface-independent. The live delta stream, the
synthetic dispatch id, and cancellation ownership are surface-specific.
The delta stream belongs in the second sentence rather than in a parity failure
because the authority holds the node on both: the snapshot is rebuilt from
durable facts, and the stream is only where a sink happens to be. The arms
therefore report the two together, so the surface-specific half is visible
instead of read as an absence.
Across 63 arms nothing is violated and no arm is invalid. Four other rows moved,
all in the canonical-transcript and capture-timing family measured as flaky
before; derive-answered moved back to the value three same-build repeats found
dominant, confirming that reading.
9a showed that a host-started execution had no name that could outlive the
process. The store's ref does not exist while the scheduler is holding work
back; the synthetic slash id may never be persisted, because a reader finding it
would take it for a call the model made; and the parent call must stay empty,
because there is none. Three candidates, none of them able to be the answer, so
the answer is a fourth thing.
SubagentMeta now carries ExecutionID beside ParentToolCallID. They are different
questions — which execution this is, and which provider-visible call it descends
from — and they were one field only because every durable execution so far came
from a tool call. A model-delegated run still has them equal. A host-started run
has the first and not the second: an execution the host mints before the work is
opened, a root node with no spawn edge above it, and an empty lineage.
That distinction also removed a conflation in the opener. Descending from a call
and having somewhere to draw are separate facts, and treating them as one made a
run outside any run loop unopenable. It is durable work; it gets an execution.
The picture goes wherever a sink exists.
Reads are lenient, writes are strict. A record naming its own execution is
joined on it; one written before that did is aliased to its parent call only
where the journal opened an execution by exactly that id, because the journal is
what confirms the older writer used one id for both — a parent id alone proves
only what it meant by lineage. A parent naming no execution stays unknown and is
joined on by nothing: a single task once stored the call while the journal opened
the node, and a prefix rule would have joined those two wrong. Six shapes are
pinned as a table. New writes refuse an unnamed execution outright, since that is
the one record no later reader can place.
Nothing historical is rewritten, and this does not promise it will be. The safe
legacy subset resolves losslessly on read; the unsafe one — a host-started record
from before this, which never had an execution — cannot be recovered by any rule
that is not inventing history. Resolving on read forever costs a map lookup and
claims nothing.
9a's four arms rerun exact: what was record-only and LOST-SILENT is now an
execution the journal opened, a root node on the graph, and a restart that can
place the child. Both oracles still hold in every arm — no persisted lineage
names a host event id, and every host-started parent is empty. The frozen matrix
gains the host row and joins on the execution rather than the parent, and across
60 arms nothing is violated.
9a measures one surface and its name says so: a person typing /<skill> into a
live session, routed through Submit to the controller's slash path. The headless
counterpart is deliberately not measured beside it — caller-owned, with its own
cancellation and session ownership — because reading one for the other is how a
real number gets the wrong subject, which has happened twice in this series.
The fourth arm is queued rather than restart. Restart is an axis every arm
already has; what no other arm can answer is whether an identity exists before
the child does, and only work the scheduler is holding back asks that.
Four identities are printed apart, because this is the first surface where they
may not coincide: the synthetic dispatch id the host mints so a child's activity
can nest on screen, the store's own artifact ref, the provider-visible parent
call, and the execution a journal would open. For a model-delegated run the last
two are one string, and that has only ever held because a tool call produced
every durable execution there was.
What it found is narrower and sharper than "a slash skill records nothing". The
store is not empty: since the runner converged, a slash-started child is marked
running before it acts and carries a correct terminal afterwards — completed,
interrupted, cancelled, each measured. What is missing is the execution. Nothing
was ever opened, so nothing places that child, and the arms say exactly that:
record-only, a reader can see a child of this name was cut and cannot say which
invocation it belonged to. LOST-SILENT is reserved for the queued arm, where
work the scheduler had admitted into its domain and then refused leaves nothing
at all.
That is what makes the queued arm decide a linearization. An identity for this
class would have to exist before a child artifact does, and the three candidates
fail by exhaustion rather than by assertion: the synthetic dispatch id may never
be persisted as lineage, the child ref does not exist while the work is queued,
and the parent call must stay empty because there is none. Both oracles held in
every arm — no persisted lineage named a host event id, and every parent was
empty.
Two labels were corrected while building this, both mine. A restart that still
holds a child record is not silence, and calling it LOST-SILENT would have
reported a surviving record as a total loss; and the rebuilt column credited the
holder fleet's nodes to the invocation until it was filtered to the execution it
belongs to.
Nothing is implemented. These arms establish what the candidate identities
cannot do; what replaces them is the next cut's question.
Every surface that spawns a child now belongs to one of two classes, and this
records which — not as a summary of the arms that established it, but as a gate
a new entry point has to pass to join either.
durable delegation task, fleet, parallel_tasks, run_skill (model-invoked)
opened before visible, started before it may act,
stored once it has, reconstructable afterwards
ephemeral research read_only_task, read_only_skill
same scheduler, and no claim a snapshot cannot justify
run_skill is listed as the model-invoked entry point only. A slash invocation
reaches the same runner without a provider-visible parent call, so it is not a
delegation and the table makes no claim about it; saying otherwise would let the
matrix outrun what was measured.
The guard holds the classification where a completed run cannot: what the store
answers at the one instant a child is inside the provider. A check made after the
fact cannot tell a recorded execution from an unrecorded one that happened to
finish, because completion writes a record either way — the first version of this
test had exactly that hole, and a fan-out item that skipped the store passed it.
Two mutations are runnable now and each turns exactly the rows that would drift:
an ephemeral entry point that opens a delegation again, and a fan-out item that
records nothing while it runs.
Two things are left open on purpose rather than tidied away. A slash-invoked
skill records nothing at all; the contract that produced that is narrow and real
— a synthetic event id must not be persisted as though the model had issued the
call — but it is not the claim that host-started work deserves no provenance, and
only the first has been established. And run_skill(review) requires a typed
verdict where task(profile=review) does not; that is about what a profile name
carries, so unifying a lifecycle was the wrong moment to decide it.
Step 8 seals as: every model-delegated durable subagent surface now shares one
lifecycle authority; the ephemeral read-only surfaces are explicitly outside it;
host-initiated top-level execution is not a delegation and its provenance is
deliberately left unresolved.
8d-4 asked whether the execution authority can account for what the two
ephemeral entry points draw, and found them disagreeing. read_only_skill drew
nothing. read_only_task drew a group and a worker that Controller.ExecutionGraph
could not produce, because it is rebuilt from durable facts and an ephemeral run
writes none — so a reader that lost the stream and started from the authority
again lost both nodes while the child they named went on holding a slot.
That is not a lighter kind of node. The graph is a projection of durable facts:
a reader starts from the snapshot and returns to it after every gap, so what the
snapshot cannot produce survives only until the next resync. The node was there
because unifying the lone-delegation path gave every delegation a picture
without asking whether the authority could account for an ephemeral one.
So the picture goes where the record already went. An ephemeral run opens no
delegation at all: no node, no journal, no store, and no lifecycle to hold a
flag about which halves it skips. The flag is gone with it — an entry point that
opens nothing has nothing to make conditional, and three call sites stop asking.
The caller still sees what it delegated. A tool call and its status are honestly
live-only surfaces that claim nothing a later reader is owed, and the test
asserts both halves: no node is drawn, and the parent is still told.
What this does not do is answer who currently occupies a scheduler slot. That is
a real question and a different one — an ephemeral run does hold capacity — and
it belongs to a read model that can say plainly it does not survive the process,
not to a graph whose whole contract is that its contents do.
Both arms now read identically across all five rows, and across 56 arms nothing
is violated. The four other rows that moved are the canonical-transcript family
whose values were already measured as timing-flaky, and each moved back to the
value three same-build repeats found dominant.
8d-2 classified the normal skill runner as a shared delegated execution: it asks
the same scheduler, runs a real child, keeps transcripts and supports
continuation. What it did not do was leave a trace of any of it — an executing
skill was named by no graph, no journal and no store record — and a stop that
reached its child was filed as a failure. Both followed from the same thing: it
had built a second execution owner beside the one every other delegation uses.
So the fix is not to give it a lifecycle. It is to stop it having a loop. A
skill now compiles to a ProfileExecSpec and hands it to RunProfileSpec, which
already owns admission, the child's own run, and how an execution ended. The
runner keeps what only it knows — the body, the workspace facts a child cannot
discover for free, the tool ceiling, the whole-workspace claim a writer skill
carries, the typed verdict a reviewer owes — and nothing about how an execution
is admitted, carried out or ended.
Three semantics had to survive the move, and each has a test rather than a
promise: the prefix is the body plus the workspace facts, not the body alone; a
writer without declared paths still claims the whole workspace so it serializes
against fleet and task writers; and a reviewer still owes a typed report, which
the spec now carries as a worker property because it follows from which profile
this is and never from what one caller asked. That last one is deliberately not
derived from the worker's name: doing so would have handed the same contract to
task(profile=review), which does not have it today, and a convergence must not
change a delivery contract on the way past.
The cancellation defect is fixed by deletion. The legacy runner classified every
error as failed; RunProfileSpec already had the one classifier that tells a
deadline from a cancellation from a failure, so removing the duplicate makes
skill-cancel read cancelled where it read failed. Nothing was written to address
the symptom.
Lineage keeps its existing contract. A host-started run carries a synthetic call
id so the child's UI can nest under it, and that id must not be persisted as
though the model had made the call — so the spec says the run is top-level and
it opens no delegation and is stored under no parent. Whether a slash-invoked
skill should instead join its own host-emitted dispatch is a question this cut
does not answer; it leaves that path recording nothing, as before.
Two gates: a skill must leave the records every delegation leaves — an opening,
a slot grant, a settlement, and a child joined to that execution — and a
host-started one must be filed under no call, including when a synthetic one
exists. Reintroducing the private loop as a mutation turns the first red.
The probe's own criteria are corrected where they were written for the world
before this. A refused item's negative control is about the store alone: an
opening is the orchestration recording that work entered it, which a refused
item did, and demanding journal silence would forbid the record that tells a
restart it was held back rather than lost. The identity row now checks the join
rather than one spelling of it, because a record's parent is the execution's own
identity and comparing it to the bare call id fails the chain that makes them
joinable.
Across 54 arms nothing else moves and nothing is violated. The read-only entry
point is untouched: every one of its rows reads exactly as before, and whether
an ephemeral run that holds a scheduler slot should be drawn stays open.
8d-2 classifies rather than compares. Whether a runAs=subagent skill belongs to
the delegation class the task and fan-out arms established, or is an execution
class of its own, leads to opposite work — converge it onto the shared owner, or
declare an exclusion — and the answer cannot come from which plumbing happens to
exist today.
Two runners are measured apart instead of averaged. The tool a model calls
prepares a transcript, supports continuation and saves a terminal; the read-only
entry point builds a session in memory, refuses continuation and stores nothing.
Asking the second for durability would be demanding it break its own contract,
so those arms ask what it is instead, and answer in a classification —
ephemeral-seen or ephemeral-unseen — rather than a pass.
Seven dimensions, one row each, because a skill can share one domain and not
another: scheduler, graph, journal, store, cancel, restart, identity. The
scheduler has no refusal hook to read, so admission is established as an A/B —
the call is out, unanswered, the ceiling occupied and no child of its own has
reached the provider, against the same dispatch with capacity free whose child
is inside it. Only the slots check is reached that way, and the README says so
rather than letting a writer claim be read as measured.
Identity reads the two entry points apart. A model-invoked skill has a call to
join to; the controller's own drops that id deliberately, so an empty one there
is top-level provenance and not a lost join — both run in one death so the row
compares two lineages rather than a value against an expectation. The cancel row
judges the terminal against an observed cause, never wording: the child's own
context closed, which is what a cancellation does to it and a failure does not.
The queued arm is the negative control and bounds any convergence: an execution
the scheduler never admitted produced nothing, so a change that satisfied the
running arm by preparing a transcript at dispatch would break it.
Three labelling faults were caught while building this and are fixed here rather
than reported later: a journal and a store that were empty on both sides read as
persisted-direct, a restart row credited the holder fleet's interruption to the
skill, and the stop row named a guarded turn caller-owned. Absence now has its
own verdict, evidence is filtered to the execution it belongs to, and the graph
row carries the whole graph's node count so "the filter found nothing" cannot be
read as "there was nothing to find".
PROBE-PARALLEL sat inside PROBE-PARALLEL-IDENTITY, and sentinels are matched by
substring, so the identity arm's prompt opened the cancellation fan-out as well
as its own. The arm then reported a scenario nobody wrote: five extra workers it
never dispatched, appearing or not depending on where the death fell relative to
a fan-out that was never part of its design.
It surfaced as a verdict that moved with an unrelated change, which is the worst
way to find it — a real reading in an arm measuring something else. Removing the
containment returns the row to exact on three runs out of three and takes the
uninvited fan-out out of the arm entirely.
Care had already been tried and was not enough: the child sentinels carry a
comment about exactly this hazard, chosen after it bit once, while the parent
sentinels had no guard at all. So the rule is a test over every sentinel in the
probe rather than a second comment, and it is the containment that is checked,
not the spelling.
8d-1 measured one store answering differently about executions it holds the same
evidence for. A fan-out item whose slot the scheduler had granted, whose child
had reached the provider, and whose start the journal had recorded was absent
from the sub-agent store entirely — live and after a restart — while a lone
delegation in the same death, the same store and the same join read running and
then interrupted. The store is what list_subagents, read_subagent_result and
adopt_ref address, so that item was work nobody could ask the host about.
The cause was where the store's record hung, not what the fan-out is. A lone
delegation marked it from the lifecycle that opened it; an item whose group did
the opening had no lifecycle, so it reached the same runner and none of the same
record. The boundary now belongs to the run rather than to whoever opened it:
every delegated execution crosses beginExecution once it holds a slot and has a
transcript, and there it is recorded, then drawn, and only then may act.
Nothing else moves. The group still owns dependency, adoption, skipping and
settlement; an item the scheduler refused is owed no record and still gets none,
which is the proxy this line of work removed and must not reintroduce. What did
have to move is the picture: the slot grant used to draw a fan-out item running,
which put the drawing ahead of the record, so both entry points' start hooks now
write the journal and nothing more. The item's node travels with the sink it was
drawn on, because a fan-out item's own sink forwards tool events and drops graph
deltas — the picture is reachable only through the group's.
A refused record stops the run at both entry points, and that is now asserted
rather than reasoned about: the child must not act, nothing may be drawn running,
the slot must come back, and the journal keeps the start it honestly wrote. Two
mutations were run against it — the boundary skipping the store for an item whose
node someone else drew, and drawing before recording — and each turns the suite
red, the first only on the fan-out side.
The active-store arm's two cells flip as specified: an executing fan-out item
reads running then interrupted where it read no record twice, list_subagents
shows it, and the refused item stays absent. Across all 47 arms nothing else
changes but the two fan-out arms whose store row now sees the child that was
executing, and parallel_tasks converges on the same contract.
8d-1 asks the narrower question rather than the parity one. Not "does a fan-out
item get what a lone delegation gets", which would be a finding about two code
paths, but: once the scheduler has granted a slot and the child has reached the
provider, is that execution something the sub-agent store can be asked about?
The store is what list_subagents, read_subagent_result and adopt_ref read, so an
execution missing from it is missing from every recovery surface there is.
One death holds four populations under a ceiling of two. The delegation goes out
first and holds a slot to the end, which is what keeps capacity from returning
under the fan-out; the fan-out's first item takes the other, settles, and frees
it for exactly one of the two behind it. Which of those two wins is the
scheduler's, so the arm reads the populations off the journal rather than off the
ids the dispatch declared — naming them would have made a race the premise.
The finding is a conjunction and each part is its own column: the journal proves
the slot was granted, the child proves it arrived at the provider, and the store
is asked about that execution. Any two of them are not it. A grant with no
arrival is an execution nobody has shown happened, and an absent record for work
that never ran is the correct answer.
Two rows are the arm's own falsifier: the settled item and the lone delegation
run the same acknowledgement check against the same store and the same join, so
a green there is what says the check can see a record when one exists. A third
bounds any fix — an item the scheduler refused is owed no record, and a change
that recorded every opening would satisfy the row under measurement by
reintroducing the proxy the delegation arms just removed. A fourth pins
reconstruction: no node comes back running, and both cuts keep their class.
Measured: the settled item is completed in both processes and the delegation is
running then interrupted, while the executing fan-out item is no record in
either, and list_subagents shows the delegation and not the item beside it. The
refused item is absent as it should be, and the rebuild names both cuts without
a ghost. The arm needed the auto gate the other delegation arms already have;
under the denied default a fleet is refused before any child starts.
The last cut reported that a turn's stop reached work already handed to a
background job. It did not. That arm dispatched a foreground delegation: the
task call only sets run_in_background for arms the probe lists as backgrounded,
and this one was not on the list, so the row said "work already handed to a job"
about work that had never been handed anywhere.
Three arms now read both trees at one instant, and they agree:
parent stop, foreground turn ends — child ctx closes record settled
parent stop, backgrounded turn ends job runs child ctx open record still open
the job's own stop turn active job gone child ctx closes record settled
The handoff boundary holds. A stop aimed at the turn does not reach the tree the
turn gave away, and the job's own stop does — which is the ownership this step
built, now measured from both sides rather than assumed from one.
Each reading keeps five facts apart, because a context that closed and a call
that returned are different events: work whose caller stopped waiting leaves the
same absence behind as work that was cancelled, and only one of those is a
cancellation. The two positive controls are what make the middle row mean
anything — without the job-kill arm, a reading that could never see a job's
context close would report the same green.
One question was dropped rather than answered: a second backgrounded run
dispatched after the stop, to ask whether the manager's own root survived. It
reported "refused new work" for a reason the probe could not explain, and an
unexplained failure inside a measurement path is exactly the proxy this line of
work keeps removing. The question is already answered directly — a job still
running with its child's context open is the root — so the experiment went and
the observation stayed.
Two retractions in three cuts, both the same class: the arm was measuring
something other than what its row named. First the wrong owner, now the wrong
subject.
The last cut reported a cancellation defect. It was measuring the wrong owner,
and this A/B retracts it.
A turn the controller admits itself — what Send opens, and what a person's Stop
reaches — carries the cancel the gate holds. A synchronous Run is never admitted
through that gate: the controller holds no cancel for it, and the caller's own
context holds the only one. The probe had been driving Run and then calling
Controller.Cancel, which claims nothing there, and reading Running(), which
answers for a gate that was never told about the turn — so "the turn ended while
its work ran on" was two facts about two different things.
Read the right way round, the interactive surface is correct. An ordinary shell
the turn is waiting on ends the moment the stop arrives. A delegation stopped
while the scheduler still held it back settles with no store record, and one
stopped while its child was executing settles with the child's own cancelled
terminal — the table this step was aiming for, on the path a person actually
uses. On the other surface both halves hold too: the controller leaves the
caller's work alone, and the caller's own cancel ends it.
One arm is red, and it is the one that matters most. Work already handed to a
background job — which the tool result tells the caller runs across turns — is
gone the instant the parent turn is cancelled, with the probe confirming it was
live when the stop was issued. That contradicts the ownership boundary the
handoff exists to draw. The mechanism is not located here: a job's context is
rooted in the manager, not the turn, so something else in the child's chain is
carrying the cancellation, and finding which edge is the next cut's job rather
than a guess in this one.
The readings now say what surface they came from, so neither answer can be read
as the other's again.
8c left one reading unexplained: a cancelled turn ended while its foreground
delegation stayed open and its child kept running. That could have been three
different defects, so this is the probe that tells them apart rather than a fix
aimed at the first guess.
Four readings, and they localize it. A plain shell — `bash sleep 30`, a tool
that derives its context the way every tool does — is still running three
seconds after the stop, with the turn already ended. So the fault is not in how
a delegation derives its context: an ordinary tool loses the same cancellation.
The delegation arms agree from both sides of the slot: one stopped while queued
and one stopped while executing are both left open after the turn is over.
The fourth is the negative control and bounds any fix. Work already handed to a
background job keeps running when a stop is aimed at the turn — which is
correct, and is what a cancel that reached everything the session knows about
would destroy. A fix passes this arm only by cancelling what the turn owns and
nothing further.
The delegation arms now carry this as an invariant instead of a premise: once
the turn has ended, nothing it owned may still be open. An open record implies a
live owner, since nothing else closes one, so the child's liveness rides in the
reading as evidence rather than standing in as the test — a delegation still
waiting for a slot has no child at all and is just as much still owned. That
also fixes a hole in the first version of the row, which read a queued
delegation's absent child as work that had ended.
No production change: this says where to look, and the next cut says what to do
about it.
8c asked one question: on each side of the slot grant, who owns the ending. The
answer the code gave was wrong on the near side. A backgrounded delegation
killed while it was still queued wrote a failed child record — and the store
outranks the lifecycle on a rebuild, so a cancellation before anything ran came
back as a failure that never happened. The journal said it plainly at the same
time: opened, queued on slots, settled, never started.
The cause was not vocabulary. A background run has its transcript before it has
a slot, so "a run object exists" had come to stand in for "a child executed",
and every early exit on that path wrote a terminal for it: a refused admission,
a writer registration that failed, a store that would not mark it running. None
of those is an execution outcome. They now return their error and leave the
store alone, which the journal's opened-queued-settled already accounts for.
Four arms hold the boundary from both sides. Backgrounded, a delegation killed
while queued now leaves no child record and rebuilds as cancelled; one killed
while running keeps its own cancelled terminal and rebuilds exactly. The rows
carry a cross-authority check that refuses the combination neither layer may
produce — a child record for work the journal proves never started — because a
state comparison shows that only as "cancelled came back failed".
The two foreground arms do not establish. Stopped through the turn's own cancel,
the turn ends — running=false, no cancel pending — while the delegation is still
started and never settles: its child keeps waiting on a context the cancel did
not reach. That is a separate question from ownership and is left open rather
than guessed at; the arms report it as their premise failing, with the reading
that produced it. Cancellation at the delegation's own context settles and
records correctly, which a unit test now holds.
8a and 8a.1 measured two failures with one cause. A single task reached the
same runner a fan-out item does and none of the same records — nothing on disk
for a restart to read — and it drew itself running before it had asked the
scheduler for anything, so a delegation the ceiling was holding back appeared,
to the graph and to the parent, as work in progress. Both came from the same
place: states were being inferred from where control flow stood rather than
projected from what the scheduler and the child's own ending had proven.
The lifecycle is now one thing that decides nothing. It opens after every
deterministic refusal has answered — a prompt that would not settle or a
runtime that would not resolve is not work orchestration ever held — and writes
the opening from the same delta the graph is drawn from, journal first. The
node opens pending. Queued and its cause come only from the scheduler's first
refusal; running only from the slot grant, and behind it the store's own record,
so nothing shows a run executing that the store has never heard of.
Two proxies are gone. The foreground no longer announces running before
acquiring a slot, and a background run no longer reports queued because a job
was registered: that word now means the scheduler refused, and an immediate
grant goes straight to running. What tells a caller its work was handed to the
background is the tool result, which says so in words.
A backgrounded delegation is on the graph like any other. Hiding it was the
lexical lifetime of the old opener, not a semantic: run_in_background decides
whether the parent waits, not whether the delegation exists. Ownership moves
with the handoff, exactly as the progress tracker's already does — the caller
settles what it still owns, the job settles what it took.
The store's parent is now the execution's own node. That join is what a rebuild
reads, and with the journal keyed by node and the store by call, a completed
lone delegation rebuilt as skipped: the outcome could not be found. The two
spellings are one identity again.
read_only_task keeps its promise: ephemeral entry points write no journal, so a
research child stays out of the history a restart rebuilds from, while its
caller still sees what it delegated.
Six mutations were run against the new tests: publishing before recording,
opening the node running, marking the store running before the slot, settling a
handed-off run at the outer return, telling the parent running before the slot,
and recording an ephemeral delegation. Each turns the suite red. The five
process-boundary arms now read pending→queued(slots)→before-start and
pending→running→during-execution on both entry points, and a completed
delegation rebuilds exactly.
The boot-wired skill runner prepares its own transcript rather than going
through this path, so it inherits none of it yet; that is 8d's question, not a
gap this closes quietly.
The four arms before this all asked what a restart can say. This one asks about
now: fill the session's ceiling, delegate once in the foreground, and read the
picture while the scheduler is refusing the delegation admission. A graph and a
parent status are claims about the present — a restart cannot correct one,
because by then it describes a moment nobody can observe again.
It is drawn as running. The node reads probe_task/sub-1:running and the parent
is told running, while the child has not reached the provider at all and the
fan-out holding the ceiling has queued=slots on disk. The lone path calls
trk.running() and publishes its node before asking for a slot, and its scheduler
hooks are nil, so nothing later corrects either.
The premise is established from both sides rather than assumed: the ceiling is
proven full by the control fleet's own journal, and the delegation's child
leaves a record when it reaches the provider, so "it never started" is read
rather than inferred. The arm then settles for two seconds and asks again — a
child that was merely slow to start would have arrived, and the death would be
measuring a race instead of a refusal.
The same row is carried by the background queued arm, where it holds: that path
draws no node at all and its parent status is the job's registration rather than
a scheduler verdict. Two different pictures of the same refusal, and only one
of them says something untrue.
A single task is not a second executor. It reaches the same RunProfileSpec a
fleet item does, asks the same scheduler for a slot, and draws its node through
the same publication. So the question these four arms ask is not whether a lone
task has a graph — it does — but where that shared chain stops being wired to
the durable authority the fan-out arms established. No production code changes:
this is the reading, taken before anything is moved.
Four deaths, because they can answer differently. A delegation that finished in
a turn that closed loses nothing to interruption. One killed mid-execution is
the fan-out arms' death, one entry point over. And the two background arms are
the ones the foreground cannot stand in for: a backgrounded run hands its
execution to a job and asks for a slot inside it, so the parent call has already
returned when the refusal lands, and the terminal belongs to the job.
What the matrix says, across all four:
durable opening, queued, started, settled — nothing, in every arm. The
journal is never written for a delegation that did not come from a fan-out.
the rebuild — nothing: no node, no grant, no worker, no wait, no
interruption. A restart reads a session that delegated nothing, even in the
arm where the store still holds a completed child.
the live graph — a foreground run draws its node; a backgrounded one draws
none at all, which is the early return openDelegationGraph takes for a run it
cannot settle. The live parity is already asymmetric.
the sub-agent store — the one layer that survives, unevenly: a completed
foreground child persists directly; a background child is recorded running
and reads back interrupted; and a foreground child killed mid-execution
leaves nothing at all, because nothing is written until it settles.
the identity join — the store's parent call, the call the model made, and the
node's parent are one identity in three arms, and the fourth is only absent
because that death has no store record yet. Step 8 does not need an identity
invented for it.
The queued arm fills its ceiling with a fan-out, and that fleet rides along as
the positive control: same session, same scheduler, same journal, and every
transition recorded. What these rows report missing is missing at the entry
point, not in the machinery.
Two things the harness needed to ask honestly. Rows are filtered to the
delegation under measurement, or the control fleet's own record would have read
as the lone task's and reported the gap closed. And the arm whose turn has to
end signs the host's steps off with complete_step, one per round: a turn that
called a tool cannot deliver while the list is open, and a todo_write that marks
an item completed on its own is refused by design.
read_only_task is deliberately outside this: it declares itself ephemeral, so a
journal entry from it would break a contract rather than close a gap.
Step 6 proved the graph can be rebuilt and 7d proved the view folds it. Both
are value comparisons, and the defect this line of work exists to prevent
agrees with them on every value: a history replayed as live transitions settles
on exactly the right graph and tells the user that work which ended in a dead
process is starting now. Only a sequence separates the two, so `ui-graph-mixed`
records one.
The arm dies holding all seven states at once — a settled fan-out beside a
mid-flight one, which is the only way a skip and a running item coexist, plus a
ceiling of one so something is queued and never admitted. The resumed process
then serves that session on a loopback listener and runs the real client
against it: the production port, the production store, bundled out of the
frontend's own sources with its own toolchain. The probe plays only the part
the shell plays — forwarding the kernel's frames onto a bus with no reconnect,
which is the transport the bootstrap was written for.
Seven rules follow, each a rule rather than a comparison: the first picture is
loading then a snapshot; every execution the dead process opened enters through
that snapshot; none of them is ever drawn as pending, queued or running, not
for one render; the interruptions the view names are the ones the host derived;
work dispatched after the resume arrives as a delta; nothing is introduced
twice; and no delta names work the dead process opened.
That last rule is the one a first-appearance check cannot reach. A republished
history moves no visible state — the fold is idempotent, the snapshot arrived
first — and is still the kernel saying that finished work is happening. It is
also what makes the sabotages fail where they should: `-sabotage publish` fires
a resume that republishes what it rebuilt, and only after the client has read
the snapshot, because what a resume publishes before that is numbered below the
watermark the client resumes past and the bootstrap absorbs it. `-sabotage
trajectory` restores the line 7d deleted, the one that built the graph out of
the recorded trajectory: it fails the republication rule and the ghost rule
together, putting pre-death nodes back on screen as pending and running.
Staging the second one needed the dying process to record what a window
records. A wire log is written by the server, and a headless construct never
had one, so the trajectory it left behind held none of its own frames and the
sabotage was feeding an empty file. The construct now attaches the same
recorder a window attaches, which is what the process being modelled has.
The nine fan-out latches became one named state keyed by sentinel. Each new
fleet was adding another flag to a struct that already carried twelve, and the
one meaning that is not per-sentinel — the arm's own fan-out has gone out, so
the terminal arms hold the turn open — stays a field of its own.
Runs: clean holds=7, publish VIOLATED=1, trajectory VIOLATED=2. The judgement
itself is held by uirows_test.go, because a full arm is three processes and a
live kernel, which is the wrong place to discover a verdict was computed
backwards.
The panel used to build its graph by replaying the trajectory's deltas, which
is what made a resumed session look like a run that had just happened: every
node arrived as a transition, in the order the frames were written. It now
reads /execution-graph and folds the live stream onto that answer. The
trajectory keeps feeding the trajectory pane; it feeds the graph nothing.
Snapshot and delta are kept apart on purpose. A snapshot replaces the model —
the graph, the interruptions, the unrecorded identities and the session it
describes — because the last three have no delta at all: nothing in the stream
can add or retire an interruption, so a merge would keep one the rebuild has
since resolved. A delta carries nodes and edges and nothing else, which is what
stops a live frame from arguing with the authority about the rest.
Two races, two mechanisms, because they are not the same problem. A session
change bumps a generation the read carries, so an answer for a conversation the
view has left cannot be adopted by the one it shows now — "the newest answer
wins" is exactly what loses that race. And the session the answer names decides
what happens to the deltas held while it was in flight: numbered past the cut is
not enough when they describe another run.
The held deltas are this model's own boundary, not the transport's. A first
bootstrap is covered by the stream holding its frames; a gap happens with the
stream running, so the store holds what arrives while it re-reads and then folds
only what the snapshot cannot already account for. A delta numbered at or below
the cut is dropped rather than folded: an older publication would take a settled
node back to what it said on the way there. The watermark is that read's cut and
nothing else — no graph cursor is kept, and none should be.
A session switch clears rather than dimming the old graph. Some hundreds of
milliseconds of "loading" is worth more than the same milliseconds of a picture
that belongs to a conversation nobody is looking at.
What the panel now says out loud: executions whose owner disappeared stand
beside the graph with the two kinds told apart and neither offering to resume;
a node whose worker layer was never recorded says so, rather than showing the
same blank an inherited identity shows; and the queue's refusal is worded as
what was recorded when the node queued, not as what it is waiting for now. The
state also records whether a snapshot or a delta last moved it, which is the
difference a view needs before it can animate anything.
The mock port answers the same contract: it numbers its frames, holds them
while a subscriber reads its snapshot, and answers with the fold of what it has
published. Otherwise the snapshot path would exist only against a real kernel,
which is where it is hardest to see fail.
Two gates were widened to hold this. The four types the desktop re-declares by
hand are now declared mirrors, so a field the kernel sends and the page cannot
read fails; and the route guard's regex could not see a typed read at all —
this.get<T>("/x") matched nothing, hiding 24 of the client's 60 paths from the
check that exists to keep the shell's table honest.
Seven mutations of the store and three of the view were run: dropping the
resync buffer, the watermark cut, the generation check, the foreign-session
rule, merging a snapshot instead of replacing, keeping the old graph across a
reset, answering zero for a failed read, drawing the identity marker without
the list, drawing the old graph while loading, and never rendering an
interruption. Each turns the suite red.
A read model that bootstraps from its own authority needs one thing from the
transport: everything after the frame its snapshot names, exactly once. That is
what the broadcaster already numbers and holds — SubscribeFrom for a reconnect,
Replay for the shell's bus, which has no connection to re-establish. So the
graph gets no cursor and no replay of its own; subscribe takes a bootstrap read
and answers with the same one stream.
The cursor stays the stream's. 101 may be a graph delta, 102 an approval, 103 a
delta again — a cursor that only advanced on the frames one model folds would
read 102 as a hole it never had and ask for everything after it a second time.
The bus is already delivering when a page attaches, so frames are held from
before the transport is wired until the replay lands, and merged with what the
replay brings by number. Both paths reach the same frames: the log holds
everything after the cursor, the frame that exposed the gap included, so a
replay answers with a copy of it. Folding both is what put the same tool result
on screen twice, and the cursor now settles it — a numbered frame at or below
what has been folded is the same fact arriving the other way.
A watermark and a gap frame both state a position, and while a bootstrap is
stating one from a snapshot neither may baseline the cursor: taken here it
would sit ahead of frames still held, which are then dropped as duplicates of
nothing. The hole itself still reaches the caller, because a gap is a transport
fact and which authority each model re-reads to close it is the caller's — the
transcript for one, the run graph for another. The comments that said /history
have been corrected to say that.
Inside Studio /execution-graph answered index.html: 7a registered the route and
taught the dev proxy about it, but not the shell's own table, which the shell's
route-parity test had been failing on along with /adjudications and
/context/window. All three are routed now.
Seven mutations were run against the tests: dropping the replay, dropping the
buffering, dropping the dedupe, advancing the cursor only on graph frames,
letting either meta frame baseline during a bootstrap, and never releasing a
failed one. Each turns the suite red.
Step 6 proved the graph can be recomputed. This is how a reader gets it:
Controller.ExecutionGraph rebuilds from the journal, the store and this
process's own claims, and nothing is emitted. A reader asks; it is not sent
a stream of transitions that already ended, which would tell it a child had
just been spawned and had just completed when neither happened.
The snapshot carries what a graph alone cannot say. Executions whose owner
disappeared ride beside it rather than inside a node state, because the
vocabulary has no word for work nobody is running. So do the executions
whose worker layer was never recorded: their model reads empty for a
different reason than an inheritance does, and showing both alike would
claim an observation the host never made.
Over HTTP the watermark is read before the rebuild, and that order is the
whole contract. Read after, a transition landing in between is numbered
below a watermark the client then resumes past, and the frame is lost with
nothing later to reveal it. Read first, the same transition is replayed onto
a snapshot that may already hold it — which the fold absorbs, because a node
is upserted and an edge added once. Duplicates are safe; gaps are not.
The test drives the real handler and settles a worker during the rebuild, so
inverting the two reads turns it red rather than leaving it a comment about
intent. The snapshot also names its session: frame numbers keep climbing
across a switch while the replay tail is cleared, and a client that merged a
new snapshot with the previous conversation's deltas would fold two graphs
into one.
/graph gives a headless run the same answer. That is not symmetry for its
own sake — after the process that ran a fan-out is gone, this is the only
way to ask what it did, and frontend parity was what pointed out the gap.
GraphDelta is unchanged. It stays the low-latency projection of the same
facts; the snapshot is the authority.
A node's model and effort survived a restart only when a caller had named
them, and the reason was not that the fact was unrecoverable — the store has
a model for every child that ran. It has a different one. The store resolves
inheritance; the graph's field does not, and an empty model there says the
worker layer named nothing and the parent's value stands. Filling one from
the other would have made the rebuild more specific than the picture and
deleted that.
So the opening records it, taken off the same delta the graph is drawn from
rather than resolved a second time, and the rebuild reads it from there and
never from the store.
It is stored whole, present even when both fields are empty, because absence
and "named nothing" are different answers that both read back empty. Only
presence separates them, and without it a sidecar written before this would
report as an exact reconstruction of an inheritance nobody had recorded. An
older entry that has none leaves the identity unknown; it does not borrow the
store's, and it is not migrated.
Measured, all three fan-out arms: states, topology, grants, wait causes, the
interrupted set and identity are exact. The identity arm's four shapes each
come back as they were drawn — an inherited model stays empty beside a named
effort, and an adoption stays empty on both.
Step 6 closes with no vocabulary added beyond this one field.
The rebuild was lossy on model and effort, and the reason given for it was
wrong. This arm names a worker four ways across both producers and reads
every layer:
item graph store
names nothing none/none probe/scripted/none
names a model and effort probe/alt/high probe/alt/high
names only an effort none/low probe/scripted/low
adopts, runs nothing none/none no child at all
fleet and parallel_tasks agree cell for cell. There is no producer
disagreement: the earlier reading that one filled the caller's request and
the other the resolved identity does not survive naming a model and looking.
Both go through the same resolution; what differs is the layer they report.
The graph shows what the sub-agent layer resolved, where empty means inherit
the parent, and the store shows the final identity with those blanks filled.
Which makes the remaining loss one item shape: a caller that named something.
Everything the graph shows for those is in the store, and taking it would
make the rebuild more specific than the picture — an inherited blank becoming
an explicit value, which is how the first attempt at this ended up knowing
more than what it was rebuilding.
So it is a choice, not a gap, and the arm exists to state it rather than
settle it. Either a node's model means the final identity, and the producers
fill it from the store's layer with nothing new recorded; or empty keeps
meaning inherited, and that is a fact only the journal could carry.
Two probe defects fixed on the way: a second model reference, because with
one every layer of the resolution collapses onto the same string and none of
this is visible; and a wait that stopped at the first producer to settle,
leaving the other two unread.
The graph a process draws dies with it. What outlives it is the execution
journal and the store's record of the children that ran, and those two now
fold into the same vocabulary the live graph is drawn in.
It recomputes rather than restores. Nothing reads a file, emits an event, or
knows what an agent is: the inputs are read models the caller loaded, the
output is a value, and the same inputs always give the same picture.
Two states are never rebuilt. An execution that was running or waiting when
its owner disappeared does not come back as running or queued — the owner is
gone and either would describe work nobody is doing. They come back as
identity and topology with no state, named separately as interruptions and
split by whether they had reached a slot.
Measured against what the dying process drew: states, topology, grants, wait
causes and the interrupted set are exact in all three fan-out arms.
One gap remains, and it is narrow: the worker override a caller named for an
item. The store keeps the identity it resolved, which is a different fact —
filling one from the other would put a third meaning on the field — and the
journal records neither. It is also not consistently meant before a restart:
fleet fills it with the override and parallel_tasks with the resolved
identity, so what a rebuild should agree with depends on the producer.
Two probe defects fixed while establishing this. The identity comparison was
green because the arms never named a model, so both sides agreed a field was
empty; it names one now. And PROBE-CHILD-FAIL is a prefix of the sentinel
meant to delay the second failure, which sentinels match by substring, so the
two skip arms had been differing by whatever the runtime chose rather than by
construction. The cause rule survived that — it reads the order that actually
happened — and the arms now hold the second failure until the first is
recorded, and repeat.
The skip-cause row reads three ways: what the picture named, what this
benchmark works out on its own, and what the production fold concludes. A
probe that only asked the implementation would agree with it by construction.
Three arms ask whether skipped, its cause, and the context edge need
records of their own. None of them does.
They stand on one join: a child's metadata names the execution it ran for,
so a restart can ask the store what each item ended as. Answered is then
computable without the graph — an adoption says so on its own opening, and
everything else is the store's terminal.
Skipped state derives. An item released without ever starting, ordered
behind something that did not answer, is exactly the set the picture drew,
in both skip arms and empty in the arm where both upstreams answered.
Context derives, including through an adoption. The dependent receives from
one completed and one adopted upstream and the prediction matches edge for
edge. The adopted half works only because the source rides the opening:
without it that upstream would read as unanswered and the edge would go
missing — which is what the arm before this one measured.
The cause derives too, but not the way it looks. The skip arms leave
identical durable facts and the picture names a different upstream in each,
so declaration order is refuted outright. Earliest release holds both times,
and not by luck: a fan-out cuts a branch when it processes the first result
that did not complete, and the journal releases an item in that same
handler. The order it records is the order the choice was made in. The cause
is a historical fact that is already written down, in the timestamps.
The answered arm waits on a delivery edge rather than a count of completed
items — the warm-up fleet alone satisfied the count, and the observation was
taken before the fan-out under test had started.
An adopted item survived a restart as adopted and could not say what it
adopted. The disposition rode the opening — an adoption is declared before
anything runs — while the source lived only in the edge the graph drew, so
a restart could see reuse and not what paid for it.
The source now rides the opening too, taken from the same delta the adopt
edge comes from. That is what keeps the two from naming different sources:
there is no second place to compute it from, and no terminal transition was
added for a fact that was already true when the item opened.
It is carried through as the graph spells it. What kind of thing a source is
belongs to whoever reads the graph back; a journal that parsed it would be a
second vocabulary for an identity it does not own.
An opening is held to one story about itself: an adoption must name a
source, and an item that is going to run must not carry one. Only new writes
are held to that. An older entry recorded before the source was captured
stays readable as an adoption whose source is unknown — lossy history rather
than corruption, and nothing else in the record could be read to guess it,
the same reason a historical failed status is not reclassified.
Three timestamps lost an omitempty that never worked. It does nothing for
time.Time, so a zero value was emitted as 0001-01-01 under a tag promising
it would be dropped, and a consumer reading the field saw a transition that
had not happened. It read that way here first.
The probe's judgement is unchanged: the adoption-source row flips from lost
to persisted-direct on its own, while the adopted item still records no
queue, no start, and no child in the store.
The run graph tells cancellation from failure. The sub-agent store, which
owns what happened to a child, did not: every error path saved a child as
failed and SubagentStatus had no cancelled to save. The probe measured the
result as graph cancelled=2 completed=1 failed=1 against store completed=1
failed=3, with the journal — which records orchestration, not outcome —
unable to help. The distinction was not un-persisted, it was unkept.
The store now keeps it. A cancelled run persists everything a failed one
does; a transcript is as worth reading when work is cut short as when it
goes wrong, and only what it says happened differs. One status covers both
ways a run is stopped, because the graph maps a cancelled context and an
expired deadline onto one state; which of them it was rides beside it, so
the two owners share a vocabulary instead of splitting one.
Only the two seams where a child actually ran may read a context error as a
terminal outcome. The other four SaveFailed callers — a failed writer
registration, a panic, a refused slot, a transcript that would not save —
are host failures whose chains can carry a cancellation without the work
having been stopped. They keep calling SaveFailed, which takes no error and
therefore has nothing to classify: the negative control holds by shape
rather than by judgement.
Old sidecars are not migrated. A historical status=failed was written by a
store that never knew this distinction, and the same error text can come
from paths that were not cancellations; reclassifying on it would invent
provenance nobody recorded.
The probe's judgement is unchanged and flips on its own, VIOLATED to holds.
Its journal row is part of that gate: teaching the journal about
cancellation would have made the comparison green while breaking the
boundary it exists to protect.
One group reaches all three executed terminals, and the two owners of that
fact are read side by side:
graph: cancelled=2 completed=1 failed=1
store: completed=1 failed=3
journal: all four items open+started+settled
The graph draws cancellation apart from failure. The store, which owns what
happened to a child, folds it in — every error path saves a child as failed
and SubagentStatus has no cancelled to save. The journal cannot help: it
records orchestration, not outcome, and all four items left the same shape.
So the distinction is not un-persisted, it is unkept. No owner has it, and
no journal record could recover it — writing one would create a second
authority for a fact the store already owns, with nothing to settle the
first disagreement.
The arm reuses the terminal family's shape: the fan-out runs, the turn is
held open, and the process still dies inside it. Cancellation comes from
the turn's own context, since the synchronous headless Run does not pass
through the gate Controller.Cancel operates.
SETTLED says an opening is no longer active and nothing else. Four arms
ask what that costs, by putting lifecycles that look identical beside
meanings that are opposite.
Adopted survives, and not by accident: the disposition rides the opening,
because an adoption is declared before anything runs. Its source does not.
The reference whose answer stood in is drawn as an edge and recorded
nowhere, so a restart can say an item was adopted and not what paid for it.
The collapse is elsewhere. open+started+settled covers completed, failed
and cancelled alike. Skipped is distinguishable today only because nothing
else produces open+settled — a distinction by absence rather than by
record — while a cancellation before admission is distinguishable for a
real reason: it left a queue record.
One population turned out not to exist. These arms expected two routes to
skipped, and parallel_tasks' is unreachable: running[idx] is set when an
item is dispatched, not when the scheduler admits one, and every item is
dispatched in one pass, so a cancellation finds all of them running and
marks them cancelled. The arm was renamed to what it reaches instead of
being constructed into the shape it was supposed to have.
Context needs no record of its own. Two samples — an upstream that
answered and one that failed — both show the delivery edges matching what
an ordering edge with an answered upstream predicts. What it does need is
that upstream's disposition, which is exactly what is not durable: after
the boundary the prediction goes empty, because the answered set comes
from the graph and not the journal. Context belongs behind whatever makes
a disposition durable, not beside it.
Controller.Cancel does nothing to a synchronous headless Run — that path
does not pass through turn admission, so the gate has nothing registered
for it. The arm cancels the turn's context, which is how a headless caller
interrupts anyway.
A ready item the scheduler turned away came back correctly classified and
unexplained. Four falsifier arms showed why nothing else could answer it:
the refusal exists only at the moment it is made, and by the time anyone
asks, the constraint is gone.
OnQueued is that moment, and the record goes ahead of it — the third seam
in the same shape as the first two, and fallible for the same reason. A
request whose wait could not be recorded is withdrawn rather than shown
waiting, with the care the cancellation path takes: capacity may have been
granted since the refusal, and a slot nobody releases never comes back.
All three causes are kept. The scheduler knew whether total capacity, the
writer ceiling, or a path conflict turned the item away, and a journal that
folds that into "a ceiling refused it" cannot get the distinction back. A
reader wanting capacity-versus-claim can fold them at the read surface; the
record does not fold them first.
The cause is the one that queued the request, never the one holding the
item now. The transition arm measured the difference: it freed the ceiling
the refusal named while the item stayed queued under a different one, and
the report never moved. So the record is named for entering the queue, a
later cause cannot rewrite the first, and a queue record arriving after the
item started or settled is refused.
A queue record also proves the dependency gate was crossed, which a declared
ordering alone never could: an item reaches the scheduler only once its
upstream is answered. The mixed arm's blocked item reads "open" and nothing
else; a refused one reads "open queued(slots)".
Measured, all four arms: the cause is read back intact after the restart,
and the item blocked by a dependency still records no refusal at all.
STARTED settled the classification: an item that never reached a slot comes
back as interrupted-before-start. It did not settle why. Four arms ask that,
and none of them changes production code.
They are four rather than one because canStartLocked decides in a fixed
order. An arm that let an earlier check fire would report that refusal as
the later one, so each clears everything above what it measures: the slots
arm refuses a reader, which is not a writer at all; the writers arm leaves
total capacity free and gives its two writers disjoint paths; the claim arm
leaves both ceilings free and overlaps the paths. Ceilings come from a
project reasonix.toml, which is where a person sets them.
The claim arm needs two fan-outs. A single fleet's preflight refuses
concurrent writers whose claims overlap, so the holder is dispatched in the
background and the refused writer comes from a later fleet. It and the
transition arm wait on a signal the holder's own child sends once its slot
is granted — reaching a provider call is the first moment the slot is
provably held, and dispatching before it lets the refused item start.
Measured: each refusal is reached in isolation, reported exactly once, and
the restart still classifies the item correctly — while which ceiling
refused it is gone. Nothing carries it and nothing can re-derive it: the
constraint no longer exists by the time anyone asks.
The transition arm answers what a cause means. It frees the ceiling the
refusal named while the item stays queued, now held by a different one, and
the graph still reports the first. One report, not two: the cause is the one
that queued the request, not the one holding it now — so a durable record of
it belongs under a name about entering the queue, not about waiting.
An item that never started is explained by what it was held behind, and
that explanation died with the process. The mixed arm could say fleet-3
was interrupted-before-start and nothing else: the edge naming what it was
ordered behind lived only in the plan the dispatching call held.
The plan is already decided when the fan-out opens, so the ordering rides
the opening rather than waiting for a record of its own. Both the graph
and the journal are now derived from one delta, which is what stops them
drifting: an ordering edge the graph draws is one the journal can be asked
about after a restart, and there is no second place to forget.
Only Depends is read. An adopt edge names reuse and a context edge names
delivery; neither holds an item back, and reading either as ordering would
explain a start that nothing had blocked.
A dependency is deliberately not recorded as scheduler state. An unmet
dependency is why an item is not yet ready; a slot is what a ready item
waits for; agentgraph keeps pending and queued apart for that reason, and
collapsing them into one "waiting" would lose the distinction the
vocabulary was built to carry.
What it still cannot say is written down rather than implied: a declared
dependency does not prove the dependency went unmet. An item whose
upstream finished, which then queued and died waiting for a slot, reads
the same. Separating those needs a durable record of entering the queue,
and the arm that would prove it worth having does not exist yet.
Measured: the mixed arm's restart reads fleet-3 <- fleet-2 unchanged
across the boundary, and still classifies fleet-3 before-start against
fleet-5 during-execution.
An opened delegation and a running one reached the next process as the
same fact. The mixed arm proved the cost: a restart inherited two
interruptions, one that had been executing and one its dependency had
blocked, with nothing on disk able to tell them apart — so the block the
host wrote had to say it could not tell either.
The slot grant is the linearization point, and it is already a shared
seam: fleet and parallel_tasks both reach it through the hook only the
scheduler can fire. STARTED is persisted and synced there, ahead of the
running delta and ahead of anything the child does. OnStart becomes
fallible to make that enforceable rather than merely intended — a start
that cannot be recorded hands the slot straight back and the run never
acts, the same refusal an unrecordable opening already gets.
Settling without ever starting stays ordinary. A branch its dependency
cut is opened, never started, and released when the group ends; treating
that as corruption would reject a path every failed fan-out reaches. A
start with no opening is ignored, a second start does not move the first,
and one arriving after the settling is refused.
Interrupted is still never written, and neither classification offers a
continuation. They differ only in what may already have happened, which
is what the next request is now told instead of "the host cannot tell".
Measured: the mixed arm's restart reads fleet-3 interrupted-before-start
and fleet-5 interrupted-during-execution; the completed arm inherits
nothing; nothing reads as running once its owner is gone.
A turn reaches the transcript only when it ends, so a process that dies
inside one takes the whole turn with it: the request, the dispatch, and
every item the fan-out opened. The resurrection probe measured the result
as LOST-SILENT — the item that was executing had no record anywhere, not
even one saying it had existed.
internal/execjournal writes an opening before the dispatch becomes
observable, the ordering an adjudication barrier already uses. An entry
carries what is known at that moment: the item's identity, the group and
turn it belonged to, its grant, and whether it will execute at all. It
carries nothing about how the item ended. The sub-agent store already owns
that answer, and a second durable copy would be a second authority to
reconcile the first time the two disagree.
Interrupted is never written. It is derived: an open entry with no live
owner in this process. Recording it would mean the dying process wrote
down what it could not know, and a record that claims resumability is
worse than the loss it replaced — the probe ranks a ghost above every
reconstruction for that reason. What the next request is told says only
that work was opened and never settled, and that some of it may never have
started, because an item waiting on a dependency journals exactly like one
holding a slot and the host cannot tell them apart.
The live set is process-wide rather than per-assembly. That is the scope of
the question it answers: two assemblies in one process are still one
process, and a set per assembly would let each report the other's running
work as interrupted.
Measured, all three fan-out arms: the item still executing moves
LOST-SILENT to interrupted-explicit, settled items stay
reconstructed-lossy, and nothing reads as running after its owner is gone.
IsSessionTranscriptName excluded four suffixes by name and missed
.adjudication.jsonl, so every session that recorded a barrier was listed
to the user as a second conversation beside itself — one holding barrier
records rather than messages. Nothing reports this: a directory scan
classifies by name and a wrong answer just appears in the picker.
The chain of conditions is why it was missed. Each new sidecar had to
remember to add itself to a check written somewhere else, and the failure
for forgetting is silent. One list, walked by the check, makes the next
one safe without anyone remembering this file, and the test derives its
cases from that same list rather than restating them.
Three arms drive a real fleet and kill the process at three points in its
life: every item settled, one item still executing, and every reachable
state at once. Phase B loads and inspects without calling a model, so each
reading is what the host can prove before a provider call.
They classify rather than pass or fail, over two populations, because one
label covers the better half: items that had settled own durable child
records, while the item still executing has never been written down. The
readings are reconstructed-lossy and LOST-SILENT respectively, and the
ghost row — anything still drawn as running with no owner — is green only
because nothing is stored at all.
Underneath both sits the row that explains them: the turn that dispatched
the fan-out is absent after the restart. A turn is appended when it ends,
so a process that dies inside one takes the request with it, and a graph
reconstruction would have nothing to attach to even in principle.
skipped is deliberately not among the states the mixed arm demands. A
fan-out publishes a skip only in its closing outcome delta, so nothing
reads skipped while anything is running; the item whose dependency failed
sits at pending, which is what the arm dies holding. Constructing the pair
would have measured a state no live fan-out can reach.
The graph renderings are sorted: the fold keeps first-seen order and two
processes reach it by different routes, so an unsorted comparison reported
a reordering as a changed graph.
The kernel has known since the barrier landed that a run stopped waiting on a
person. Nothing outside it could see that, so a restart showed a conversation
that simply ends. This is the read surface, and only the read surface: no
button, no route that takes an answer.
Snapshot is truth, the frame is only invalidation. GET /adjudications returns
the whole thing — active and history, both present even when empty — and
adjudications_changed carries no payload. A client that missed a frame is
corrected by the next read instead of holding a list assembled from whatever it
happened to see, and a reconnect needs no replay: the notice is on the skip
list because telling a fresh window to re-read what it just read says nothing.
The frame is also the only way to announce a transition that writes nothing.
"Interrupted" is not a record; it is what an open barrier means once nobody is
waiting on it, so the same journal reads differently either side of a process
death. A client cannot derive that — it does not know who is waiting — which is
why state comes from the kernel and not from a flag on a decision.
Which is also why this is not a field on /status. A barrier has a lifecycle, a
disposition and a successor, and the overview is read on every tick.
The barrier id goes out as provenance and nothing accepts it back. An
interrupted barrier has no owner to answer to, so a route that took one would
rebuild exactly the ghost the kernel refuses to offer; a test posts one at
/answer and /approve and checks it stays active. The types stay apart on the
far side too — AdjudicationEntry is not a Decision with a flag.
Parity is one commit, not four. Route, dev-server proxy, wire kind, replay
classification, port method, fixture and the frontend union move together,
because each of those lists is a place this could have shipped half-wired and
only failed on a real desktop.
The CLI reads it too. A terminal resume prints why the last run stopped, which
is the same fact Studio will show — and the alternative was declaring the
capability serve-only and letting the parity ledger carry the difference.
The provenance surface is the sibling of the answerable one, so it sits in
SessionHistory rather than Approvals: what the host asked and how it ended is
history, and the frontends that drive one need not drive the other.
An interruption had no way to stop being current. Open with no owner made it
interrupted, and the only dispositions that ended one belonged to the waiter
that died with the process, so every later request carried context about a
question nobody was going to answer. Three successor arms measured the same
thing three ways.
A turn ends it by taking it over. The edge names which turn, so the journal
answers why the question stopped being asked with a cause rather than with
"someone saw it" — acknowledgement records that a person looked, supersession
records that work moved on, and only the second is a fact about the system.
Which turn is decided by causality, not by reading the message. A turn that
receives the interruption in its request is its successor whether the user
answered the question or asked about something unrelated; guessing at intent
would put a language judgement in a provenance edge.
The handover is recorded from markInFlightTurn: the turn is identified and
durable by then, and the model has not been called. Only barriers the turn is
actually given are claimed, so a barrier nothing showed it is not one it took
over, and a session holding two would hand over exactly what the request
carried.
The successor is read off the in-flight marker on disk rather than remembered,
which is what makes the window safe. A crash between the edge and the response
leaves that marker in place, so the retry — in this process or the next — gets
the same context; the marker clears when the turn commits, and nothing after it
carries the interruption. So a barrier is never both un-inherited and invisible.
nobody does anything still interrupted, 1 block, journal: open
a turn about something else settled, 0 blocks, superseded by that turn
a turn that reads like an answer same, and the write it held back still
did not run
That last line is the one this could have broken. Context continuity is what a
successor inherits. Execution continuation is not, and no edge grants it.
Nothing is exposed over the wire. The read model now has a fourth disposition,
which is exactly the shape that would have had to change under four callers had
it been published a cut earlier.
The derivation has no exit. A barrier is interrupted while it is open with no
owner, and the only things that close one — resolved, cancelled — belong to the
live waiter that died with the process. So the question was whether that
matters in practice, and three successors to the same interrupted barrier
answer it the same way:
nobody does anything still interrupted, 1 block
a turn about something else still interrupted, 1 block
a turn that reads like an answer to it still interrupted, 1 block
The first is correct and the other two are the cost: an interruption outlives
the work that replaced it, and every later request pays for context about a
question nobody is going to answer. Naming it sticky rather than failing it,
because what should end it is the next cut's decision, not this one's.
The answered arm is the reading worth having. A turn that reads like an answer
gets the interruption as context, and the write that question held back still
does not run. Context continuity and execution continuation come apart exactly
where they should, and now that is measured instead of argued.
These arms need a middle process that runs a model — nothing else stands in for
a person carrying on — so the rule moves rather than bends: the phase that
judges what the host knows is still the model-free one after it.
The journal also gets a fold instead of a scan. Only an open record starts an
entry, so a terminal one alone invents no history; the first terminal wins, so
a duplicate cannot restate a settled barrier; a reopen after a terminal is
refused; a torn tail is read past, because that is what a crash leaves.
InterruptedAdjudications now reads off that fold, which is where a later
disposition for a dead continuation will have somewhere to go.
Nothing is exposed over the wire yet. The response shape would have to change
again the moment that disposition exists, and it would change in four places at
once.
The barrier made the interruption durable. Nothing read it. A restart carried
the fact and neither the model nor anyone driving it could see one, so the next
turn began as if the previous run had simply ended.
It reaches the model as provenance and nothing else: what was being asked, that
the suspended response cannot be resumed, and that nothing it deferred ran. No
identity comes with it. An interrupted barrier has no owner left to answer to,
so handing back something that looks answerable is how a model is invited to
continue work whose continuation died — the ghost the previous commit refused
to build. It stays out of Decisions() for the same reason.
It is derived on every request, with no record of having shown it. The task
identity taught that lesson: "already shown" answers for some earlier request,
not the one being built.
Where it rides is not where it was planned to. Controller turn blocks look like
the natural home, but composed text becomes the canonical user message —
StripComposePrefixes exists because frontends have to take those blocks back
out for display — so a block registered there is transcript, and a later fold
would freeze it into a body. That is precisely the shape the last four commits
removed. It rides the request instead, through a narrow port the host fills:
control owns the fact, the agent only asks for it while building a request, and
nothing stores the answer.
So the ordering that fell out of the projection work now has a third layer that
belongs to neither of the first two:
frozen body + canonical tail history, foldable
host request context provenance, derived per request
todo identity tail host state, derived per request
Measured, the arm gains a row and loses none:
what the next request tells the model 0 blocks -> 1 block
the effect the decision held back did not run -> did not run
A settled barrier projects nothing, an interruption is stable across repeated
loads, the block says what was asked without offering a handle for it, and
composing a turn does not carry it — that last one is the test that keeps it
out of the transcript it was nearly written into.
A question the host puts to a person is a historical fact, and the only one in
this system that cannot be re-derived. The task list is current state, so a
restart recomputes it; a wait that happened is not, and once the process
holding it dies nothing about the workspace says it ever did. The falsifier
showed the consequence: an ask open at death, 21 messages in memory, 19 on
disk, and a restart with no way to know a turn had stopped on a person.
So the barrier is written down, and written down first. The record precedes
registration because registration is what makes the question answerable, and a
crash after that must not leave someone having been asked something the host
has no record of owing. Durable before observable is the whole invariant; the
record is appended and never rewritten, so how a wait ended stays readable
beside the fact that it started.
What is deliberately not persisted is the continuation. No blocked tool call,
no remaining reply, nothing that would let a later process pretend it can
resume the suspended response. The contract is that work was interrupted, not
that it can be picked up, and a restored card with no owner behind it would be
worse than an absent one — a question a person can answer into nothing.
Interruption is derived, never written. An open record plus no owner waiting on
it in this process is what makes it interrupted, so the answer does not depend
on a dying process reaching one more line of code. It also means the reading is
stable: a second restart derives the same thing, where a terminal record
written on resume would have made the obligation disappear after one load. The
same fact is why a live wait is not reported as interrupted — this process is
the owner.
InterruptedAdjudications is not Decisions, and the two do not share an
identity. One is a live obligation with someone waiting; the other is evidence
that a wait happened. Offering the second as the first is exactly how the
measured LOST-SILENT becomes a ghost.
The arm moves one cell and the safety row does not move at all:
what the restart inherited LOST-SILENT -> interrupted-explicit
the effect it held back did not run -> did not run
The transcript still loses the unfinished round, and that is left alone. The
fix is not to write half an assistant turn into canonical history; it is that
the host owns the fact separately, the way it owns the goal and the task list.
Decisions are a projection of what each owner is waiting on, derived fresh from
approvalManager's pending maps. Those maps are process state, and a new manager
starts empty, so a question open at the moment a process dies is gone by
construction. What has never been established is what the host believes
afterwards.
The arm does not test that a card comes back. "The same question must survive"
is a requirement nobody has argued for: the goroutine parked on it did not
survive either, and a restored card with no continuation behind it is a
durable-looking state that cannot be answered — worse than an absent one. So
the restart is classified rather than graded: resumable, interrupted-explicit,
or lost-silent, and only the last is a defect.
The reading is lost-silent. The process died with an ask open and 21 messages;
the next one loaded 19. The round carrying the question never reached disk, so
there is no unanswered call, no interruption record, and nothing that says a
turn was cut while waiting on a person. Not a fact recorded and then dropped —
one that was never written.
The row that has only one acceptable answer holds. The scripted reply asks and
tries to write in the same round; calling ask ends the round, so that write is
the effect the decision is holding back. It did not run while the answer was
pending and did not run because a later process loaded the session. Whether the
question survives is a design choice. Whether what it blocked stayed blocked is
not, and a recovery path that let it through would be the more serious defect.
The arm exits instead of shutting down, because a clean close resolves or
cancels the question, which is exactly what a process dying mid-decision does
not do. It wires the interactive approval gate the way chat and desktop do:
without it the ask tool decides for itself and nothing ever blocks, and the arm
would have measured a question that was never asked. It invalidates itself when
no decision was open at the moment of death.
The gate found two notes and one of them was stale. A fold froze the note into
its body; the next fold carried that body's remainder forward, which is what a
body suffix is for — historical material with no canonical counterpart. A step
identity is not that. It is what the host holds now, and a frozen copy outlives
the state it names: the model was shown ids the host had already dropped, and a
restart reproduced them exactly.
So the note is derived for each request and stored nowhere. Owed is recomputed
from the ids the host holds against the history that request actually carries,
which is the judgement withTodoIdentityProjection already made — only against
the wrong thing, at the wrong time, with the answer kept.
todoIdentityShown is deleted rather than redefined. It recorded that some
earlier request showed the ids, which cannot say whether this one can: the same
mistake as validating a projection by a transcript version, a scalar witness
standing in for a fact about content. With the derivation in place there is
nothing for it to answer, and nothing to persist across a restart either.
Both storage paths are gone with it. The compaction producers no longer carry
host state into a body, and the run loop no longer writes the note into the
canonical transcript. What replaces them is one seam:
modelVisibleHistory() frozen body + canonical tail
modelVisibleMessages() that, plus what the host derives for this request
A fold plans on the history. The request carries both. So the note can never
become digest input, kept history, a body suffix, coverage, or sidecar
material, and admission still prices it — a note that cannot be folded is not
free, and counting only the foldable part would make every fold look cheaper
than the request it produces.
The gate now holds, and not vacuously: with the ids folded out of history the
request carries exactly one note, after the live tail, naming the ids the host
holds now — and the same on the far side of a process boundary, derived rather
than restored.
Two things this surfaced. The loop fixture ended a round on "the last message is
a tool result", which a tail note makes false; it now looks past host state,
because that note says nothing about whose turn it is. And the gate itself
demanded a note unconditionally, which would have passed a migration that
appended one to every request — it now reports whether the history still showed
the ids, and expects no note when it did.
todoIdentityProjection calls itself a turn-tail note owed when the host holds
step ids the conversation no longer shows. While the frozen body also held the
recent tail, "tail" and "end of the body" were the same place and the claim was
untestable. They are different places now, so the arm tests it — along with the
two things the note also claims by existing at all: that there is one of it,
and that it names the identity the host holds now.
Identity is moved while a fold sits between the model and it: write a list,
fold, grow, rewrite the list, fold again. One run then separates placement from
duplication from staleness, which three simpler scenarios would not. The
rewrite keeps the in_progress item and replaces the pending work, because the
host refuses to drop an item in flight — the first attempt replaced the whole
list and was rejected, which is a rule about task state, not a probe detail.
All three claims fail, and the process boundary does not change the answer:
notes in the view 2 exactly one reaches the model VIOLATED
where the note sits [6 11] rides the live tail VIOLATED
body ends at 12, view is 22
identity carried 01,02,03 names the host's current ids VIOLATED
01,21,22
host: 01,21,22
The first note is stale: 02 and 03 are ids the host no longer holds. It was
frozen into a body by one fold and carried forward by the next, which is what
the body suffix is for — historical material with no canonical counterpart. A
step identity is not that. It is state the host holds now, and freezing a copy
of it makes the copy outlive the state.
No implementation moved. The gate says which of the three answers we were
guessing at is true: the note is duplicated and stale, not merely misplaced, so
the fix is not a later append position.
Also completes the arm summaries, which listed seven of the eleven verdicts —
contiguous, HOLE, holds and VIOLATED were all missing, so an arm with three
violated contracts summarised as clean.
A fold froze the whole view — stable head, digest, kept history, and a copy of
the recent tail — then declared coverage to be the entire transcript. Nothing
was ever spliced, so the projection and the canonical transcript were never two
things: one owned everything the model could see, and the boundary between them
was a number that could only ever equal a length.
Now the body keeps what only it can hold and the transcript keeps the rest. The
fold's boundary goes through mapFoldBoundary, the body is head + digest + kept,
and the view is that body plus canonical[Covered:]. A boundary landing inside
an older body carries that body's remainder forward, because those messages
have no canonical counterpart to splice them back from — the half the second
fold could lose, and the reason the two halves land together.
Everything that reads the fold's output reads the spliced view, not the body:
token accounting, the acceptance test that decides whether a candidate is worth
installing, and the output fingerprint. Measuring the body alone would have
made every fold look dramatically cheaper while the request it produces stayed
the same size, and the acceptance gate would have believed it.
The compress tool keeps claiming the whole transcript, and says why: it masks a
range instead of cutting a prefix, so its body holds messages from both sides
of the digest and a shorter claim would splice copies of them back in.
Measured, folds now leave a live tail where there was none:
fold 1 body 15 -> 7 covered 19 -> 11 spliced +6 -> +14
fold 2 body 17 -> 11 covered 25 -> 19 spliced +0 -> +6
with the marker oracle still reporting one contiguous run of assistant work
reaching the newest turn, and both negative controls still dropping.
Two things the split moved that were only visible because something checked:
covered-rewind stopped being a control. It aimed at a middle checkpoint, which
was below coverage while coverage meant the whole transcript and above it
afterwards, so the arm quietly began testing the case its sibling already
covers. It now reads the boundary out of the sidecar, and both rewind arms
report which side of the fold they landed on and invalidate themselves when
that is not the side they claim.
A fold can now reach the tail the previous fold kept, because that tail lives
in the transcript rather than inside the body. So growth that never closes is
no longer "nothing new to reach": the newly reachable region is real history
and the verdict is what folding it would cost. NoopNoNewClosedPrefix now marks
the narrower case where the live tail holds nothing closed at all, and no test
reaches it any more.
Two places answered "where does this projection's coverage end". The planner
knew, and the writer worked it out again from len(commit.canonical). They
agreed only because a fold currently freezes the whole view into the body, so
coverage and transcript length happen to coincide. The moment a fold claims
less than the whole transcript, a planner saying 19 and a writer saying 25 are
both authoritative and the sidecar records the wrong one.
So the commit carries the boundary and the writer has no answer of its own.
CoveredCount is what the fold decided, CoveredPrefixHash covers exactly
canonical[:covered], and neither is derived from a length any more. A commit
that names no boundary, or one outside its transcript, is refused rather than
recorded: with the fallback gone, a zero would otherwise persist as a
projection nothing can validate.
The value is unchanged. Both planners still claim the whole transcript, and
say why on the line that does it — nothing is spliced in behind the body while
it still freezes the recent tail. Moving who decides and changing what they
decide are separate commits: this one is a no-op by construction, and the nine
arms of benchmarks/runtime-resume report cell for cell what they reported
before it.
The test that matters is the half-migrated shape: a count that has moved to the
fold boundary beside a hash that still covers the whole transcript would leave
every projection valid against a prefix it does not describe.
A second fold reads the working view — frozen projection body, then
canonical[priorCovered:] — and has to record where it landed in canonical
terms. The two systems agree only past the body: the digest at its head stands
for a range of canonical messages that no single view index names, so a
boundary inside the body cannot be converted by subtraction at all.
Today nothing has to convert anything, because a fold declares coverage to be
the whole transcript and freezes the entire view into the body. Taking the live
tail back out is what creates the second coordinate system, and this is the
translation it will need, landed on its own so the arithmetic is settled before
any producer depends on it. Nothing calls it yet; behavior is unchanged.
Values in, values out. It reads no Agent, Session or projection: what is under
test is a coordinate mapping, and a helper that reaches for runtime state to
answer is one that hides the mapping instead of stating it.
The two answers it gives are coverage and the body remainder that must survive.
A boundary inside the body keeps coverage where the previous fold left it and
returns body[start:] to stay frozen — history a digest already folded is not
uncovered by a later fold, and the part of the body the new digest did not
consume has nowhere else to live. Past the body the systems track offset for
offset. The empty suffix needs no flag: it is the range starting at the body's
end, so no pair of fields can disagree about whether one exists.
The table is the contract, and it is judged on the translation alone — coverage
and suffix range. Token counts, projection reuse and marker continuity answer
later questions, and any of them could let this pass for a reason that is not
the mapping.
A rewind threw the compaction projection away without looking at it. The same
truncation reaching the transcript by any other route kept it: the covered
prefix is untouched, the covered hash still matches, and the projection goes on
serving. Only the path a person actually drives lost it, because
ApplyConversationTruncate decided for itself that a shorter history meant a
changed lineage.
That decision was not the caller's to make. Coverage became a stated contract
one commit ago — CoveredCount plus CoveredPrefixHash, held by the projection
subsystem — and a caller that answers the same question separately is how a
tree ends up with two contracts that drift. So the rewind asks instead:
RevalidateProjection drops the projection exactly when it no longer covers the
current canonical transcript, and control never sees a count, a hash, or a
lineage key.
The truncation that lands exactly on the fold boundary is the case worth
naming. It leaves no live tail at all, and the instinct is that a projection
with nothing after it is the least trustworthy kind. It is the opposite: the
hash then proves the whole provider-visible transcript is the history the
digest folded. The same instinct, encoded as a version check, is what lost
projections across restarts until last week.
Rewind-restore is the same call for the same reason: it replays a longer
history that the folded prefix still sits at the head of.
Measured through benchmarks/runtime-resume, one cell moves and both controls
hold:
tail-rewind dropped -> kept
tail-edit kept -> kept
tail-truncate kept -> kept
covered-rewind dropped -> dropped
covered-mutation dropped -> dropped
revalidate_projection_test.go states the four-row table the caller now gets:
truncation inside the tail and truncation onto the boundary keep it, truncation
below the boundary and a rewritten covered row drop it.
The next cut treats every tail arm as one expected red with one known cause.
Measured, they are two causes, and only one of them is about coverage.
A tail change that reaches the transcript — a row past the fold edited, or the
whole tail dropped — leaves the covered prefix untouched, so the covered hash
still matches and the projection keeps serving. Both arms are green. The same
truncation driven through Controller.Rewind is not: ApplyConversationTruncate
calls InvalidateProjection unconditionally, and the projection is gone before
any coverage question is asked. That red is a caller discarding evidence it
never examined, not a validity rule getting the answer wrong, and it does not
depend on the live-tail split to fix.
covered-rewind is the control that has to exist before that invalidation can
become conditional: a rewind landing below the fold removes history the digest
folded, and no coverage check may excuse it. It targets a middle checkpoint
rather than the first — rewinding to the first empties the conversation, and a
session holding only a system row is never persisted, so the restart read back
the transcript the arm had just removed. That is a different rule answering,
which is exactly the confusion the arm exists to avoid.
The projection-in-use row now turns on whether the next request would ride the
projection, not on the token counts printed beside it. A tail edit legitimately
moves those, and letting them decide reported a surviving projection as a loss
— the same class of mistake as the one-sided marker, caught the same way.
exact in use append-after-fold in use
refold-into-body in use system-swap in use
tail-edit in use tail-truncate in use
tail-rewind DROPPED covered-rewind DROPPED (control)
covered-mutation DROPPED (control)
The tail arms of the next cut all have the same known explanation already —
CoveredCount claims the live tail as frozen coverage — so writing them first
buys answers we have. This arm asks the one question whose answer was unknown,
because it decides how much the next cut has to do: a second fold reads the
provider-visible view, stored body plus live tail, and has to record its new
boundary in canonical terms. The body has no canonical counterpart to map onto.
It does not need one today, and that is the finding:
fold 1: body=15 covered=19 spliced=+6 view=21
fold 2: body=17 covered=25 spliced=+0 view=17
The second fold sets CoveredCount back to len(canonical) and freezes the whole
view into the body, so nothing is spliced and no boundary is ever translated.
The splice only ever covers growth after a fold, never the fold itself, which
is what summaryProjectionState writes by construction. So studio is not losing
anything here — it avoids the problem rather than solving it, and taking the
live tail out of the body is what creates the requirement. This arm is the
guard for that: afterwards spliced must exceed zero while the assistant work
still reaches the newest turn.
The oracle nearly passed for the wrong reason. Tagging a turn once let the
surviving user turn hide the reply folded away beside it, and the first run
reported every turn intact for a fold that had removed four replies. Turns are
now tagged on both sides, the judgement runs on the assistant side where a fold
actually cuts, and the shape it accepts is narrow: an optional pinned head,
then one run of replies reaching the newest turn. The scripted digest carries
no tag, so a summary cannot stand in for a message that should have survived.
refold_test.go holds the oracle to that. A test that cannot fail proves
nothing, so the shapes only a loss produces — a gap inside the kept tail, two
gaps, a tail stopping short of the newest turn, an empty view — are asserted to
be caught.
The README also records what studio shares with main-v2 f60ab17b0 (#8923) and
why that line is ported by contract rather than by file.
A projection that covered the whole transcript did not survive the process that
built it. The sidecar was intact, the covered-prefix hash matched, the lineage
key matched — and projectionCoversTail still refused it, because with n ==
total the only branch that could say yes was a transcript-version equality, and
transcript version is an in-process counter a reload restarts. The append-only
fallback n < total was the sole route across a restart, so a session that was
compacted and then closed lost its projection and reverted to the full
canonical transcript, while a session that happened to take one more turn after
the fold kept it.
That is backwards. The hash is the stronger evidence, not the weaker: it
fingerprints provider-visible canonical[:CoveredCount], so a match says the
history the digest folded is still exactly there. n < total merely adds that
some of the transcript is a live tail the projection splices in anyway. Under
the old rule, having unfolded messages made a projection trustworthy across a
restart and having none made it suspect.
So the version leaves the judgement rather than gaining a restart special case.
projectionValid, projectionContentValid and projectionCoversTail no longer take
transcriptVersion at all — left in the signature it is an invitation to reach
for it again as a cheap pre-check, which is how it got here. The schema fields
stay for compatibility, diagnostics and compaction transaction metadata, and
now say in the type what they are not: durable identity for a projection's
content.
The guard that remains is the one that was doing the work. A rewrite inside the
covered region changes the hash and the projection is rebuilt; a covered count
past the end of the transcript is refused; a legacy sidecar with no hash is
refused. What is gone is a second witness that could only ever agree with the
first, and could not be produced at all by a new process.
Measured through benchmarks/runtime-resume, whose four arms move exactly as the
contract predicts — the safety control included:
exact projection lost -> reused
append-after-fold reused -> reused
system-swap reused -> reused
covered-mutation rebuilt -> rebuilt
projection_authority_test.go states the rule as a table run under four stored
transcript versions, so a verdict that starts depending on one again fails
rather than waits for another restart to reveal it.
Nothing in the tree could say which runtime semantics survive the process that
built them. Every claim about resume was an argument from where a value is
written, and a test that nils an Agent proves less than it looks: package-level
singletons, live sinks, registries and caches all stay standing, and any of
them can revive state a real restart would have lost. So the boundary here is
the OS process. Each phase is a child that exits before the next one starts.
Phase B never calls a model. That is the point, not an optimisation: a model
handed the transcript can reconstruct a step id or a goal the host has in fact
forgotten, and the row would go green while the host could prove nothing. Boot,
load, inspect, stop — so a PASS means the host knew it before a provider call.
The verdicts are not booleans. "A named artifact holds this verbatim" and "a
fold over canonical artifacts happens to agree" are different durability
claims, and a row the construct phase never established supports neither; it
reports not-measured, which is what kept a rejected todo_write from reading as
a lost identity on the first run. Open decisions and the run graph are
not-measured for the same reason and say so, rather than being filled in with a
test seam that would answer a question nobody asked.
The result the arms were built to isolate:
exact fold, then die projection NOT in use
append-after-fold fold, one more turn, then die projection in use
system-swap pinned memory moves the prefix projection in use
covered-mutation SaveRewrite edits a covered row projection NOT in use
Same sidecar, same covered-prefix hash, same stored transcript version 18. The
only difference between the first two arms is 19 messages against 21 — n ==
total against n < total. A session compacted and then closed without another
turn loses its projection at the next process; one that got a single further
turn keeps it. The third arm falsifies the reading this started from: the
composed prefix grew 3376 to 3707 bytes and the projection survived, because a
resumed session carries its persisted system row and the covered hash never
moved.
The fourth arm is the safety control and must stay red. It is the only thing
standing between "restore the projection across a restart" and "restore it over
a transcript that was actually rewritten".
Levers are production-reachable — a saved memory fact, a SaveRewrite — never a
poked field, and each arm demands a clean root: a reused one puts the lever's
effect into the construct phase, where it reads as a lever that did nothing.
macOS self-update has never worked on the Electron shell. applyMac re-executes
os.Executable() with --reasonix-mac-update-handoff and waits on a pipe for the
child to report ready; this host's main declares its own flags and parses them,
so the child met an undefined flag, exited 2, and the parent read EOF:
macOS update helper did not become ready: EOF
MaybeRunMacHandoff's doc has always said every host's main calls it before
startup. The Wails shell does, at main.go:133. The Electron one imports the
package and never calls it — 2.11.0 was the first Electron release, so 2.11.0 →
2.12.0 is the first Electron-to-Electron macOS update, and the first to run it.
The failure is safe: the transaction is cancelled and staging cleaned, so the
installed app is untouched and the message says so. It is also not fixable by
updating. The process that starts the helper is the one already installed, so a
mac on 2.11.0 will keep failing no matter what later releases contain; the fix
arrives only in a build installed by hand, and works for every update after it.
The contract now has a test instead of a sentence. hostMains is declared rather
than discovered — nothing about a main's shape says it is a host's, and this
one was missed by a reader with the comment in front of them.
Two spellings of the same version. `git describe` on this line answers
studio-v2.12.0, and that string went into main.version for every local build
while the release injected v2.12.0 — the tag with its line prefix stripped. The
prefix belongs to the release line, not to the version, and leaving it on broke
both readers of that field: the pattern that decides whether a version names a
published release rejects it, and ParseVersion splits on the first dash and
comes back with nothing. So a locally built CLI could not install from a
release it does in fact have, and installed on a remote it read as versionless
— which the floor waves through, since a version nothing stated is not a
version below it. The Makefile strips what the release strips.
The stray asset is mine. Staging picked the CLI archives out with
`-name 'reasonix-*'`, and the Windows signing flow leaves a
reasonix-studio-host.exe in the same directory: it matched, and 2.12.0 shipped
a 34MB internal component next to the archives, where it reads as a CLI someone
might download and cannot run. Taken from staging/cli-archives now — the job
that produced them — because origin is what was meant and the name was only
ever standing in for it.
The downloaders are bounded. All three had no timeout of any kind, which was
invisible while the routes that use them refused before reaching the network.
On a machine that reaches TCP 443 and never completes TLS — measured on a real
one here, against both GitHub and the Cloudflare mirror — the first route auto
tries would have held every connect for as long as the OS allowed before the
route that works was tried. curl bounds connecting and stalling but not total
time, so a 40MB archive over a slow link is still a download and not a failure;
wget takes the same pair; Invoke-WebRequest has no connect timeout at all, so a
short HEAD runs ahead of it.
FetchCommand and LocateCommand emit shell that no Go test ever executed. The
line they exist for had never published an archive for them to fetch either, so
the whole path — download, digest check, extract, locate, read the version back
— had been reasoned about and never once run. That is the shape of a defect
that passes every review and fails on the first real machine: a quoting slip, a
`find` that matches nothing, a digest line whose checker spells it differently.
Both scripts now run under /bin/sh against an archive actually served over
HTTP, and the test asserts what the caller believes afterwards: the binary is
there, it is executable, the staging directory is gone, and the version the
probe reads back is the one the archive carried. That last assertion is the
claim "the remote runs the version this side asked for", which nothing checked
end to end.
The archive holds a shell script answering --version and `serve --help`, not a
real CLI. A 40MB binary would test the archive's size; the subject here is the
script that installs it, and the payload only has to answer what the probe
asks. The digest case is what proves the check is real rather than skipped: a
mismatched archive fails the script and leaves no binary behind.
PATH is cut to /usr/bin:/bin so a reasonix on the developer's own machine
cannot be probed instead of the one just installed — which would have made this
pass while testing nothing.
Skipped on Windows: that side is WindowsFetchCommand, and it needs the same
treatment against PowerShell before it can claim to have been run.
Every remote kernel's log opened with a failure. The startup balance
diagnostic ran unconditionally, and a bootstrapped serve holds no provider
credentials of its own — they arrive over the broker tunnel — so the lookup
answered 401 every time and wrote it down:
balance: error — wallet credential rejected: status 401
The waste is one round trip. The cost is the line: that log is opened during a
fault and nothing else, and the first thing the reader meets there is a
standing error with no relation to what they came for. A diagnostic that always
fails is not a diagnostic.
The judgement is the broker, not who started the process. --port-file was the
first thing I reached for, since the token share line already reads it, but the
two are different facts: --port-file says a program is waiting for the bound
address, and that program may well have credentials. TestServeStartsWithMissing
ProviderKey caught it — it launches through a port file with no broker, and
asserts the diagnostic runs, because a balance lookup left hanging must not
hold up the serve. Judged on the resolver, both keep their meaning: the test's
serve reads its own config and still reports, a brokered one does not try.
Verified all three ways: brokered writes no balance line and still binds, a
plain serve reports ¥19.68, and the hanging-lookup test passes untouched.
The new frontend was reachable one way: through reasonix-studio-host, behind a
loopback gate that binds 127.0.0.1 and cannot be widened. Anything else that
opened a kernel — reasonix serve, a bootstrapped remote, a phone on the same
network — got the page embedded in serve, which is the old one. Asked to look
at a workspace from a phone, the answer was "that is the 1.x UI", and it was:
the same kernel, a different page, with no way to ask for the other.
The mount is now the hub's, so both hosts inherit it. HubOptions.Page is served
under /_studio/ and everything else is the kernel's — the inverse, a list of
the kernel's routes with the rest falling through to the page, is what has to
be edited every time the kernel grows a route.
It sits inside the auth gate, which is the one thing that had to change in
moving it. The window wraps the page around Handler(), outside hub auth, and
that is sound there: a loopback gate answers first and hub auth is cleared for
it anyway. A serve bound to 0.0.0.0 has no such gate, so a page mounted the
same way is one handed to whoever reaches the port. Handler() now wraps it
between auth and CSRF: through the credential, past the guard that only ever
concerned writes. A test asserts the page refuses an uncredentialed GET,
because that property is invisible in the code that reads correctly either way.
reasonix serve warns and carries on when --page names a directory holding no
page, where the window fails. The window has nothing else to draw; the kernel
has its own page, so a mistyped path should cost the better page and not the
serve.
No baseline was widened for it. runServeWithOptions was one line under its
budget, so the flag it needed came out of the two lines that spelled
`sessionIDValue := ""; sessionID := &sessionIDValue` — a named zero that
existed only to be addressed.
The download route pulls the archive here and pushes it over SFTP, which is the
route for a machine that cannot reach the release itself — an internal network,
the case where you are not installing on one machine but on several. Each of
them paid for the same 16MB.
DownloadCLI now takes a cache directory. A verified copy is kept under
<cache>/cli/<tag>/<goos>-<goarch>, so the second machine on a platform costs
nothing and the package size stays where it is, which is the trade the other
option — shipping the CLI inside Studio — gets backwards: it would add ~30MB to
every install to save one download, and only for same-platform remotes.
The copy is checked against a digest stored beside it. That is an integrity
check on this machine's own disk and it is written down as one: whatever can
write the binary can write the digest, so it catches a truncated write or a bad
sector and claims nothing about anything with access to the directory. A
mismatch is a miss — it downloads, which costs exactly what no cache costs.
Kept as one entry point rather than DownloadCLI beside CachedDownloadCLI. Two
of them left the first with no caller but the tests, which repolint reports as
an orphan, and it is right to: a second spelling of the same operation is a
choice at every call site about something the callers have no opinion on. The
cache is a parameter, and "" is no cache.
The unreleasable-version check runs before the directory is built from the
version, so a source build refuses without having named a path.
The probe asked one flag. `serve --help | grep port-file` decided a located
reasonix was drivable, and that answer stood for a set: the launch also passes
--token-file, --pid-file, and the broker pair that arrived a release line
later. A kernel carrying only the older half answered the probe yes, was
launched with --provider-broker, and exited on a flag it had never defined.
What reached the reader was `serve never reported a port` after a 20s wait —
a machine, a timeout, and an instruction to read a log that cleanupFailedLaunch
had already removed. Nothing pointed at the kernel being from another line,
which is the one thing that was wrong and the one thing this side could see.
LaunchFlags is now the single list both halves read, candidate carries the set
it was answered rather than a bool, and a test asserts the probe's flags equal
the launch's for both shapes of the command line. One flag standing for a set
is an assumption about release history; the list is not.
The same shape twice more. cleanupFailedLaunch and Stop each kept a copy of
what a serve record is made of, and the broker token was added to neither, so
every failed launch left this machine's provider credential on the remote —
removeServeState is now the one list. And `remote test` wired different Options
from `remote connect`, so it called the release route closed for want of a
resolver connect goes on to pass, and called the download route open when the
version would refuse it.
Under all of it the studio line published no CLI at all. releaseasset resolved
/download/v2.11.0/ while the tag is studio-v2.11.0, and the kernel called
itself "dev" because build-host.js injected no version, so both routes that
name a release refused before reaching the network and npm was what remained —
where the package belongs to the 1.x line, below the pane floor. The line now
ships the six archives and their SHA256SUMS, releaseasset.Line carries the tag
namespace, and the version reaches the binary. Line is its own type rather than
update.Line: that one is an install layout, and a single type answering both
questions is how a tag prefix ends up deciding where a .deb installs.
Injecting a semver also makes the floor real for the first time. ParseVersion
could not read "studio-v2.11.0" — it splits on the first dash — so the version
came back empty and meetsMinVersion waved it through as unknown. Every kernel
on this line has been passing the 2.0.0 gate without being read.
Attribution follows: ErrNoReleaseForBuild says a build has nothing published to
install from, ahead of the per-route codes, because a reader told to install
curl would install it and still have no route. The npm route now reports a
version below the floor as exactly that instead of as a PATH that needs fixing.
It keeps its place in the auto order — dropping it would hard-code which line
npm publishes, and that is a fact that can change.
A relay forwards somebody else's model under its own name, so no probe and no
catalogue can say what that model holds. Until someone says, the gauge has no
denominator and automatic compaction is off — and the panel that shows this
could only point at the Connection screen.
It is worse than a missing number. This config has
name = "yyds"
models = [11 models, claude-* and gpt-5.6-*]
context_window = 200000
one figure typed once for eleven models with different ceilings. So the field
is offered against a declared window too, not only a zero one: the denominator
in "24.8k / 200k" is a button, opening the same field prefilled. A dashed
underline marks it — an entry that only appears on hover reads as absent.
POST /context/window writes the window against the model in use, as
model_overrides.<model>.context_window, and leaves the endpoint-wide figure and
the other ten models alone. Zero is the stored "inherit", so clearing it falls
back to the endpoint rather than to no window. It rebuilds in place, because
boot binds the window into the agent and a live session keeps what it was
assembled with — the rule saveShell and savePermissions already follow.
It goes through serve rather than the controller, where editProvider and
setProviderThinking already live: source config is a settings surface only this
frontend drives, and putting it on the controller would book three
frontend-parity edges against cli, acp and bot for capabilities they do not
have a screen for.
Mid-turn the write lands and only the rebuild is refused. That is not a failed
save and it is not a model switch, so it is neither rebuild_failed (which reads
as a malfunction) nor busy.switch_model (which tells the reader to stop and
switch models). It is context.window_after_this_turn: saved, counting from the
next turn. codedRefusal reads the identity off the error to tell them apart —
the code, never the sentence.
In a 296px metrics rail the caption under the hit rate rendered one character
per line, a vertical column beside the number. Removing its second line — the
"越高越省" hint — was the obvious fix and would not have worked.
.big lays out four things on one line: the 28px rate, the caption, and two
pills. .pill is flex: none and the rate has no break opportunity, so the caption
was the only shrinkable item in the row and absorbed the whole overflow. Two
pills fit only when one of them was absent, which is why this appeared when
正文变了/正文未变 joined 前缀变了/前缀未变 — the caption had been the slack all
along, and the second pill spent it.
The caption is now rigid (flex: none, nowrap) and the two pills wrap as one
group, so a narrow rail moves both below the number and a wide one brings them
back up. The hint line is gone as asked — the block heading already says 前缀缓存
and the numbers below it say 命中/未命中 — and its catalogue key goes with it.
.big has one user, so none of this reaches another panel.
An English window rendered them in Chinese. i18n.test.ts had been failing on
them for a while — it names the file and the key, so nothing was hidden, only
unpaid.
Seven are ordinary omissions: the body half of the prefix-cache pills (前缀变了
already had "prefix changed" while 正文变了 had nothing), its carried-message
tooltip, and four in the rail's MCP block that arrived with pending servers.
Each takes the wording of the sibling beside it, so a pair reads as one
judgement about two objects: prefix held / body held, Fix / Approve.
The eighth is not an omission. en_graph.ts still holds the sentence Graph.tsx
used to show — "这一轮没有派出并行的子代理。fleet 或 parallel_tasks 一开跑…" —
and the panel was reworded to cover any dispatch, not only a parallel one. So
the key was replaced rather than added, and the English rebuilt on the new
condition: the waiting/parallel/reused clause now speaks only for a group.
That is the gap this test cannot see. It checks that every key the interface
asks for has wording; nothing checks the other direction, so a translation
whose source text was rewritten sits in the catalogue looking present.
An on-demand connect failed with `MCP startup launch failed after 5ms: context
canceled` — no approval asked, no process started, five milliseconds in. The
launcher was fine the whole time: `doctor capabilities --live` reaches the same
server and reports runtime=probed tools=68.
ensureServerToolsForSpec deliberately launches under the runtime's lifeCtx
rather than the tool call's, so a slow healthy server keeps starting after the
call that asked for it returns. That context comes from boot.Build's ctx, and
serve hands it an *http.Request one: switchWorkspaceLocked takes r.Context(),
switchModel takes r.Context(), and every pane the hub opens takes r.Context().
Each is done the moment its response is written, so from then on every on-demand
connect in that session launched under a context that was already cancelled.
The initial process boot passes signal.NotifyContext, which is why MCP worked
until a workspace was switched and then never again.
boot detaches cancellation at the one place that knows what the context is for,
rather than plumbing a lifetime through three callers that would each have to
remember. Host.Close still cancels every child it started, so teardown is
unchanged — the cancellation removed here was never what performed it.
Seen live: a map_editor session, on a workspace the desktop had switched to.
use_capability's own description tells the model to list, then inspect one
before calling. list shipped every entry's full text: 16 KB of description in a
24 KB listing, and once MCP servers joined it the reply reached 41 KB and
spilled past the 32 KiB cap. A model that asked what it had was handed a pointer
to a file — which is what a session in map_editor did, before going to read
Unity package sources to answer a question about its own configuration.
A row now carries the first sentence, bounded at 160 bytes. Measured on that
session's own recorded listing: 46 entries, 16,335 description bytes to 4,318,
and the whole reply back under the cap. inspect still answers with everything,
which is where the model was already told to look.
The bound cuts on a word, and on a character boundary when there is no word to
cut on — a CJK description is one rune per three bytes, and the first draft of
this left a lead byte with its continuation bytes gone. It reuses the trim
written for the shell-output decoder rather than deriving the rule twice.
Also: a search that succeeded and matched nothing reached the model as an empty
result, which reads exactly like a call that broke. silentExitNote already
existed for that on the failing side — a non-zero exit that printed nothing —
while the succeeding side, the more common one, had nothing. Same note, same
predicate: only for a call that printed nothing and could not have written.
The dependency barrier stops the rest of a tool batch when a mutating call
fails. ToolCallMutates counts MutationUnknown as mutating, and the read-only
classifier is Unix-shaped, so on Windows an ordinary probe the host cannot
read — netsh, ipconfig, curl.exe — was a mutation. Refuse one, or let it time
out, and every later change and the verification were dropped with "an earlier
modification in this tool batch failed or was blocked". No modification had
failed, and the model was told to fix a change it never made.
Across 1684 recorded tool results, 57 of these skips. 22 came from the criteria
capture that could not read D:\System Volume Information — already fixed — and
32 in total came from calls that never executed at all.
The barrier now says how far it reaches. A failed modification still stops
everything: it may have left the workspace half-applied, so what follows may be
built on a change that never landed. A call the host stopped before it ran
changed nothing, so later edits work from a known state — but the check does
not, because it was asked for against a plan one step of which never happened,
and passing it would mean nothing. That case stops verification alone, and says
so in its own words rather than borrowing the modification message.
A writer the host can name keeps the full barrier whether or not it ran. So does
a target it could not classify at all, which is where this fails closed.
Two things this did not do: toolOutcome.executed is never assigned, so the
`if outcomes[i].executed` branch that would set surfaceWriters is dead — the
barrier reads ShellExecution.MutationRisk instead, which is populated. And the
underlying cause is still the classifier's Unix shape; this bounds the damage
rather than removing it.
Extracting the pre-mark into barrierSkip took executeBatch's complexity and size
down far enough to pay for the new level and leave budget behind.
The trust gate landed with three paths that started a repository-declared server
without answering for it — /mcp connect, ReconnectMCPServer, and the manager's
enable action. They are user actions, so nothing started silently, but they
acted as approval without being it: the server connected once and IsEnabled
still said no, so the next session had it off again and the button read as
having not worked.
An explicit connect now records the decision it represents. The approval is
project-scoped like every other one, and a failure to write it is logged rather
than failing a connection the user asked for.
The manager showed pending as "deferred", which means the opposite thing —
deferred connects when needed, pending will not connect at all. It has its own
line now, and its action says "Approve and connect" rather than "Connect",
because naming the effect and hiding the choice is what this state exists to
stop.
TestConnectConfiguredProjectMCPIsTrustedByDefault asserted the belief this
series removed. It is now TestConnectingAProjectMCPRecordsTheDecisionItRepresents
and checks the server waits beforehand, stops waiting after, and that the answer
survives into a second controller.
Still open: the negative answer. "Disable for this session" is offered on a
pending row, but a durable refusal — the thing that stops it asking again — has
no action of its own.
A .mcp.json is checked in, so whoever wrote the repo chose the command and its
arguments. Reasonix started it at the next session in that folder with nothing
asked, and MCPConfigSource.UserAuthorized() reported it as already authorized.
A project reasonix.toml's [[plugins]] is the same file with a different name and
had the same treatment; gating only one of them would be a claim that outruns
its enforcement, since a PR could simply use the other.
The activation store already held per-project enable rows — the missing piece
was the default. IsEnabled now resolves a recorded decision first and, without
one, keeps a repository-declared server off. Everything else is a file only the
user writes and still follows auto_start, including the two ~/.claude.json
scopes.
Undecided is kept apart from disabled throughout. One is waiting for the user
and the other is their answer, and a surface that shows both as off reads as
the project's MCP having quietly gone missing: MCPServerState carries Pending,
the project listing reports "pending" rather than "disabled", and the rail
panel — whose whole purpose is servers that need a decision — lists them beside
the broken ones with "去批准".
A security review of the first draft found four ways it failed open, all fixed
here:
- Every caller answered a store read error with ShouldAutoStart(), which is the
pre-change default and re-enables exactly what the gate is for. A corrupt
activation file was enough. DeclaredDefaultOn is that fallback now, and
AwaitingDecision reports pending rather than settled when it cannot read.
- Source carries toml:"-" and is assigned only by a successful merge, so a
failed one leaves a project file's own entries with none. Unknown provenance
now counts as repository-declared.
- Decide read a global row for an identity ServerOverrideFor pins to the
project, so one row could have approved a repo server in every project.
The global layer is skipped for those.
- `doctor --live` started every auto_start server, which is what a user runs to
find out why their MCP is off — answering the question by running the command.
Left open, and reported rather than fixed: /mcp connect, ReconnectMCPServer and
the manager's enable action start a pending server without recording a decision,
so they act as approval without being it, and the TUI's own status view still
derives from cfg.Plugins and shows pending as "deferred".
mcpjson.go says Reasonix reads .mcp.json "so an MCP server already configured
for Claude works here unchanged". Claude Code writes to three places and that
is the one `claude mcp add` does not use: its default is the per-project map
inside the user's own ~/.claude.json. The reporting machine had three servers
configured, none in a .mcp.json, and Reasonix loaded zero of them for every
workspace on it.
Both ~/.claude.json scopes are now read: the entry for this workspace first,
then the user-wide map, matching Claude Code's own local-over-user order. They
merge last, so a name Reasonix's own configuration claims keeps it — that one is
written for Reasonix, this is a compatibility read.
They auto-start like anything else, and they should: the file is one only the
user writes. A repo's .mcp.json is the one that arrives with a clone, and
Reasonix already starts that without asking — which is the trust asymmetry
inverted, and a separate thing to fix.
CLAUDE_CONFIG_DIR moves the file and is honoured. Project keys are compared as
paths: Claude writes them with forward slashes on Windows, where the same
directory is also spelled with backslashes. An unreadable or malformed file
yields nothing rather than failing the load — it belongs to another tool.
Verified against the reporting machine: D:\tygit\map_editor now resolves
unity-editor-mcp from claude_local, and a name held by both scopes there
resolves to the project's own entry.
A child's bytes became a Go string unchanged. On a Chinese Windows the console
tools answer in cp936, so the string held invalid UTF-8, and JSON coerced every
bad byte to U+FFFD on the way to the transcript — destroying the text before
anything could read it. "FIND: 参数格式不正确" reached the model as a row of
question marks, and a run that failed four times never learned why.
decodeShellOutput reinterprets only bytes that are not UTF-8. The guard matters
more than the decode: the tail buffer keeps the last N bytes and therefore
starts mid-character, so valid UTF-8 output arrives invalid — deciding on those
bytes would invent mojibake where truncation was the only problem. Both edges
are trimmed of a cut character before the question is asked.
Distinct from the grep peek fix: that one misread a file's bytes, this one never
decoded a process's at all.
A call's duration covers the host's preflight — capture, effect scans,
permission — and ShellExecution.DurationMs covers only the command. Both rode
the wire already and nothing subtracted them, so the overhead had no reading
anywhere: not in the run metrics, not in a panel, not in a log line.
Subtracting them over 406 recorded bash calls: one session sat at a 13.0s median
per call with p90 42.5s and a 172s worst case, while the shell answered in
milliseconds — about twenty minutes of one session spent inside the host. On an
ordinary repo the same figure is 0.00s, so this is not a constant to be tuned
away but a cliff that only some workspaces fall off.
A tool that reports no inner duration adds nothing rather than claiming its
whole runtime was overhead.
Which criteria exist is a fact about the workspace, not about the call that
might overwrite them. The evaluation half of this subsystem already reads it
that way — BaselineTestObligations reuses a verdict while its StateEpoch holds —
while the capture half re-derived the whole set per call.
captureCriteriaOnce keys the walk on mutationEpoch, which advances on every
recorded successful mutation. A call the host proved wrote nothing clears that
flag in settleUnchangedWorkspace, so it does not invalidate; one the host could
not prove keeps it, so it does. An unobserved external writer still slips
through, which is the gap the verification model already declares.
Measured over 125 recorded transcripts: 296 walks become 67. The first attempt
at this measured no gain at all — invalidating on "an unknown call ran" is
always dirty, because unknown calls are most of them. The epoch was the
difference, and it was already being computed.
This is also what makes the preceding walk-error fix a win rather than a trade.
Those D:\ calls were aborting the walk partway at the ACL error and still cost a
3.1s median against 0.39s on an ordinary repo; finishing the walk correctly
would have cost the full 6.5s. Now it costs that once per state.
filepath.Base answers the separator for a volume root, and six places named a
workspace with it: the sidebar, the session tab, the capability scope, the
@folder refs and the TUI's git line all showed a workspace opened at "D:\" as a
lone backslash, which names nothing and cannot be told from any other drive.
fileutil.RootName falls back to the volume when Base has nothing to say. One
place already handled this — botProjectName has its own fallback — which is the
shape of a judgement copied into some callers and not the rest.
The external-folder search now matches the name the list shows rather than
filepath.Base's, so typing what is on screen finds it.
The anonymous struct that function spelled out twice becomes externalRootRef:
the import this needed put refs.go one line over, and a type it wrote down two
ways is the line to get back.
Seen live: the Studio sidebar, on a session opened at D:\.
.file .p shrinks and clips its directory, but .f was flex: none and .p had no
overflow, so a filename longer than the row kept its full width inside a box
that no longer had it — and painted straight through the diff counts at the
right edge. At the 214px rail, "capability_discovery_effect_test.go" and
"+128 -0" were drawn on top of each other.
.p clips now, and .f ellipsizes as the last resort. The directory keeps its
priority for being cut through the shrink weights rather than through .f
refusing to shrink at all, so what the old comment promised — the directory may
go, the filename may not — is still what happens: a row with room loses the
directory first and keeps the whole filename.
Verified against the real stylesheet at the real rail width, before and after.
The provider schema hides the dispatchers, so this description and an explicit
action=list are the model's whole discovery surface for them — and it named
only task:subagent. Over 21 sessions the batch dispatchers were reached 6 times
against 74 single delegations, and parallel_tasks not once. A capability
nothing names is one the model has no reason to look for, whatever its own
description says once found.
task:fleet joins the named ids with one line on what separates it from
task:subagent. Two tests hold the pair: the description must name a way to
delegate more than one thing, and every id it names must be in
CapabilityIDExamples, which is what the boot effect test checks actually
resolves.
This is a deliberate prefix change: tool schema tokens go 4545 to 4584 and
ToolsHash moves, so live sessions pay one cold prefix. The golden baselines are
re-recorded for it.
publishGraph had two callers, fleet and parallel_tasks, so every other
delegation — a task, a run_skill, a review capability — published no node at
all. A sub-agent ran eight steps in its own context and the graph tab answered
"这一轮没有派出并行的子代理", which reads as nothing having been delegated.
The graph was a fan-out visualiser; a person opening it is asking what this run
handed work to.
The hook goes on RunProfileSpec, where task.go already states the invariant
every entry point relies on: each one compiles to a spec and runs through it,
so a boundary added there cannot be missed by one caller. The two fan-outs mark
their items with withDeclaredGraphNode — only they can say it, having chosen
the node's id and kind, and without it the shared runner would redraw a fleet
worker as a group of one. A background run draws nothing: it settles after a
handoff this return never sees.
lanesOf needed no change — the group, the parentId and the spawn edge are the
shape it already reads.
Two extractions keep task.go and RunProfileSpec inside their budgets rather
than widening them: subSink/subSinkFor move to nested_sink.go, which is what
they are about, and the spec's prompt validation becomes settleSpecPrompts.
Both hand budget back.
PrefixShape hashes the system prompt and the tool schemas. The conversation is
not in it, so a full miss on a prefix the host itself hashed as unchanged had
no attribution at all: the diagnostic could not tell a dropped cache from a
message the host rewrote behind the boundary. session_types.ts already claimed
the hash "tells changed from the endpoint dropped it" — with the body
unobserved, it could not.
BodyChain hashes the provider-visible messages cumulatively, one entry per
message, so two requests compare at the length of the shorter and a rewrite
anywhere in the carried region moves every entry after it. It is taken from the
request that goes out, not from the conversation: a local-only message never
reaches the provider, and reporting a change to one as a cache change is the
mistake CompareShape's own comment already warns about.
A rewrite the session declared is already named through contentReasons. One it
did not declare gets "body_unreported" — the case this observation exists for,
because nothing else can see it.
Measured over 21 sessions before this: 118 full misses on an unchanged prefix,
10.6M prompt tokens re-paid, with cacheDiagnostics reporting prefixChanged
false on every one and nothing able to say who dropped them.
The desktop panel gets the second pill beside "前缀未变", so the answer reaches
the person who can act on it. event.go was at its 800-line ceiling and
session.ts at exactly 800, so CacheDiagnostics moves to its own file and the
metrics fold joins the usage helpers it belongs with — both lower a budget
rather than widen one.
grep detects a file's encoding from a fixed 8 KiB peek, and the comment said
utf8.Valid over that window was reliable. It is not: the window cuts a
multi-byte character in half, the cut byte alone fails the check, and GB18030 —
which accepts almost any byte string — wins. Over CJK text, where most bytes
are continuation bytes, a fixed window lands mid-character about two times in
three (measured: 2167 of 3000 offsets), so a Chinese UTF-8 source larger than
8 KiB came back as mojibake for its whole length.
TrimPartialRune drops a trailing sequence the window truncated, and only that:
a leading byte declaring more bytes than remain. A byte that is simply invalid
stays, so a file that should fail the check still fails it. read_file was never
affected — it reads whole files, so Detect always saw complete bytes.
Seen live: a grep over "Cocos-MCP进度.md" whose every matched line rendered as
UTF-8 read through GBK.
doublestar.SplitPattern hands back the bare volume for a pattern rooted at one:
"D:\**\*xray*" splits to root "D:", and on Windows "D:" names that drive's
current directory rather than its root. WalkDir therefore started somewhere the
caller never asked for, and every match came back drive-relative —
"D:DeepSeek-Reasonix\benchmarks\..." is not the path it looks like, and a model
handed it back through read_file addresses a different file or none.
globWalkRoot repairs that one root and now owns the split, so the test covers
the wiring rather than a helper the call site could stop using.
Seen live: a workspace at "D:\" where every glob result was drive-relative.
captureCriteriaUnder walks the writable domain before every call whose scope
the host cannot read — every mutating bash — and captureCriterionAt asked the
bytes a question the name already answers. It called os.ReadFile on each file
and then HoldsTestCriteria, whose first line is a "_test.go" suffix check. On a
workspace at a drive root that is the whole drive, read once per bash call.
The suffix check moves ahead of the read. Measured on the same tree (1020
files, 250 MiB of non-test content, page cache warm): 191ms to 3.3ms on the
first broad-scope call, 147ms to 1.6ms on every one after it, with the same 20
criteria held. The doc comment claiming only the first call pays was wrong
about the walk and now says so.
A subtree the walk cannot enter is skipped rather than refused. An unreadable
file was already skipped one function below, and the two disagreeing is what a
workspace at "D:\" ran into: "open D:\System Volume Information: Access is
denied" refused every write for the rest of the session, and the batch cascade
turned each refusal into four more. 14 blocks and 48 cascaded skips in twelve
observed sessions, over a directory nobody can open and nothing can write.
The walk also takes a context and checks it every 512 entries, the way
scanWorkspace already bounds its own: an uninterruptible walk across a drive is
what a user experiences as the stop button not working.
use_capability answered `unknown capability_id "parallel_tasks"` for a
capability the catalog was holding. Lookup matched an entry's id and its
declared aliases — "tool:parallel_tasks", "task:parallel" — but not the tool's
own name, which is what every other description, error message and skill body
calls it, and therefore what a model reaches for first.
The name now resolves when exactly one entry answers to it. Two tools sharing
a name refuse rather than route the call to whichever came first: guessing
sends work somewhere it was not asked for, which is worse than saying no.
Seen live: a run that tried use_capability with "parallel_tasks", was told it
does not exist, and went looking for another way to do what was available.
classifyResponseBoundary drops a trailing tool call the output limit cut in
half, and tells the model the host did it — but only when finish_reason says
"length". A provider that reports "tool_calls" alongside a half-written call
got that call executed, and the model answered for "invalid complete_subtask
JSON: unexpected end of JSON input" as if it had mistyped something.
Arguments that stop mid-value are the host's own evidence, and they do not
depend on a finish reason arriving correctly: a decoder running out of input
inside a token is not what a syntax error or a finished document looks like.
The classifier now reads that directly, so the cut is attributed and the round
is not spent on a call the model never finished writing.
A malformed call the model did finish is still its own to fix — the two need
opposite corrections, send less versus escape correctly, and the existing
normal-terminal test now uses a syntax error rather than a cut so it says which
of the two it is pinning.
Seen live: a three-way parallel_tasks run against this repo, where the first
complete_subtask of a sub-task came back truncated and cost a full round.
complete_subtask answers an unbacked report with needs_work and a count: "1
criterion claim(s) are not backed by anything the host observed". The host had
the list — AdjudicateCompletion returns a reason per criterion, naming it and
why — and threw away everything but its length.
A sub-agent that cannot tell which criterion failed, or what the host looked
for, resubmits with a different evidence shape and hopes. In a real three-way
parallel run against this repo, 6 of 11 complete_subtask calls were needs_work
loops; one sub-task cycled files-evidence -> rejected -> command-evidence ->
accepted with its unresolved count unchanged, which is the shape of guessing.
The verdict now lists the reasons, and the reasons say what the host looked
for rather than that it found nothing: "AC3: no read or write recorded for
internal/control/controller.go, ... (+5 more)", "c2: no successful run of
\"go test ./internal/agent/\"". Paths are capped at three and commands at 80
characters so one rejection cannot become the whole reply, and identical
reasons are said once — two review citations missing the same receipt read as
two problems otherwise.
No claim about the effect: a single run cannot measure a loop this noisy, and
the sample sizes here (11, 4, 9 calls over three runs of the same task) differ
by more than any change would. What is verified is the mechanism — the verdict
now carries what the host knew, checked by a test and seen in a live run.
parallel_tasks and fleet pre-nest the sink they also hand to the call context,
and RunProfileSpec nests again off that context, so every tool id from a child
was prefixed with its parent twice:
call_00_x/sub-3/call_00_x/sub-3/call_00_child
Measured on a real three-way parallel_tasks run against this repo: 317 of 332
tool dispatches — 95% — carried a doubled prefix. After, zero.
An id that does not start with its parent's is a child call that reads as
top-level, which is what a frontend's dispatch-to-result matching, the graph's
nesting, and every trajectory reader key on. It is why analysing that run
attributed all 41 complete_subtask dispatches to the root.
The fix is in the sink rather than the two callers because the invariant is the
type's: it namespaces into a parent, and doing that twice is never right. The
pre-nesting in those two callers is now a redundant layer rather than a bug,
and can go separately.
A failed modification stops later modifications and verifications in the same
batch. Delegation is neither — task, parallel_tasks, run_skill, use_capability
and the review tools spawn work rather than change state — which is why
batchCallIsMutatingFailure exempts them: a failed one does not open the barrier.
Its comment says so, and says why a bare !ReadOnly fallback would be wrong.
batchCallStaticallySkippable, which answers the other half of the same question
— who the barrier skips — used exactly that bare !ReadOnly. TaskTool.ReadOnly()
is false, so one failed edit_file dropped every delegation left in the batch as
a dependent modification, each reported as "skipped because an earlier
modification in this tool batch failed or was blocked".
Both halves now read the same exemption.
I went looking for a redesign of the turn lifecycle and did not find one to
justify. The run state is in better shape than the notes I had: turnGate already
groups the five admission flags into one type with the TOCTOU it closed written
down, and turn_orchestrator.go already owns running a turn. Turning the type's
stated invariant — running and rotating are mutually exclusive — into an
assertion and running the whole suite under it triggers nothing. There is no
bug here, so nothing is being rearranged to look tidier.
What the reading did find is smaller and real: c.cancel sat beside the gate
while having exactly the gate's lifetime. Three sites set `running = true`
and then `cancel` on the next line, verbatim; two cleared them together. Two
fields, one state, and the pairing enforced by everyone remembering it.
cancel moves into turnGate, with begin/end/requestCancel doing what those sites
each spelled out. The Controller loses a field. Behaviour is unchanged — the
methods contain the same assignments in the same order under the same lock, and
finishing stays the caller's to set because whether TurnDone is still fanning
out is a different question from whether the turn is over.
Verified where it counts: `go test -race -count=2 ./internal/control/`, full
suite, and sabotage-checked by making begin forget the cancel, which fails four
existing cancel tests.
applyPlanExec and applyGoalCommand have exactly one caller each, and it is the
command dispatch that moved out last commit. They were left behind because the
move went by name, not by call graph — which is the failure mode of splitting a
file by reading it top to bottom.
Verbatim move, 2 declarations; 161 methods present across both files, none
duplicated, no body changed. controller.go 3,386 -> 3,265.
This is where the splitting stops. What is left is 144 methods averaging 23
lines with no cluster larger than four related names — the facade itself, plus
RunShell and close. Cutting further would make files smaller without making
anything easier to find, which is the point past which this stops paying.
Cancelling is not one act. There is the request, the guarded window a turn runs
inside, and then the harder half: deciding what the conversation should look
like once a turn stopped mid-flight — which visible messages to strip, what
fallback stands in for the interrupted one, and when the session has to be
replaced outright. The 125-line strip is the largest method left in
controller.go and it was sitting nowhere near the Cancel that leads to it.
Verbatim move, 9 declarations: all 153 Controller methods present, none
duplicated, no body differs by a byte. controller.go 3,716 -> 3,386, and
5,837 -> 3,386 across the five splits — a 42% cut with no behaviour change.
Baseline carry-forward as before; finding count holds at 1,669.
I said last round that what was left had no nameable responsibility. That was
wrong, and reading it rather than assuming showed why: turn_orchestrator.go
owns running a turn, but how a turn comes to exist — every Submit variant the
frontends call, resolving its refs, deciding whether the text is a command or a
turn, preparing an invocation — was still spread through controller.go. Two
concerns with the same noun, which is what made them look like one.
Verbatim move, 17 declarations: all 170 Controller methods present, none
duplicated, no body differs by a byte. controller.go 4,092 -> 3,716, and
5,837 -> 3,716 across the four splits.
Baseline carry-forward as before; the finding count holds at 1,669 and repo
file-size falls 39,765 -> 39,388.
What waits on the user and which call answers it — tool approvals, plan
decisions, asks, the pending-prompt replay a reattaching frontend needs, and
the modes that decide whether any of it is reached — is one responsibility, and
it was the last cohesive cluster sharing controller.go with everything else.
approvalManager already owns the bookkeeping; this is the orchestration half,
the part that emits, records a receipt and rebuilds a gate.
Verbatim move, 24 declarations: all 194 Controller methods present, none
duplicated, no body differs by a byte. controller.go 4,649 -> 4,092, which is
5,837 -> 4,092 across the three splits.
The move is only half of it. internal/control/approval.go is a declared
sensitive path, so code leaving it for a file that is not one would drop out of
both effects that declaration has: the review gate, and the coverage floor.
REASONIX.md declares the new file too, which is why this could not be a tidy-up
— and the floor is real, recorded at 90.7% and sabotage-checked by raising it,
which fails the gate.
Two things surfaced while recording it, neither mine:
internal/providerbroker/** was declared sensitive without a floor ever being
recorded, so it has been passing the gate vacuously since it landed. It has one
now. Its coverage flickers between 83.1% and 83.6% across runs (5 and 2 of 7),
so the floor is the observed lower bound: a floor set at the higher number is a
gate that fails at random, which teaches people to rerun CI rather than read it.
internal/sandbox/** rises 73.5% -> 78.1%, which is a ratchet catching up with
coverage already written.
The live tool and plugin surface is already mcpManager's. What stayed on the
Controller is the config-facing half — adding a server to reasonix.toml,
connecting one on demand, importing a batch, naming what is configured versus
disconnected, removing one and unregistering its tools — and that half is a
responsibility, not leftovers. It is also one contiguous run of the file, which
is what a responsibility looks like when it has never been named.
Verbatim move, 14 declarations: all 208 Controller methods are present, none
duplicated, no body differs by a byte. controller.go 4,936 -> 4,649.
Baseline carry-forward again: repo file-size falls 40,609 -> 40,322, the finding
count is unchanged at 1,669, and controller.go hands the new file 12 of its
frontend-parity findings and 2 essays.
Not moved, deliberately: the approval orchestration, the other cohesive cluster
left. internal/control/approval.go is a declared sensitive path, so moving that
code into a file that is not one would quietly drop it out of the review and
coverage gates it is under. That move has to come with the declaration, and
that is a decision, not a tidy-up.
controller.go was 5,837 lines. The stateful subsystems with their own locks are
already extracted — memory, checkpoints, MCP, skills, goals, approval — so what
is left is not another collaborator: the session's run state IS c.mu, and
prising it out would buy a lock to reason about instead of a file. What it is
is two responsibilities sharing a file with everything else.
They move whole, to files named for what they own:
session_lifecycle.go — creating, clearing, branching, switching, resuming a
session, and where its path comes from.
session_snapshot.go — persisting one, and recovering when the persist finds
the file moved under it.
Nothing else changes. Every one of the 240 Controller methods is present after
the split, none is duplicated, and no method body differs by a byte — checked
by extracting each declaration from before and after and comparing, not by
reading the diff, because a diff that is only deletions on one side is exactly
what a botched move also looks like.
The baseline widens for the two new files and shrinks for controller.go by the
same debt, which is what -allow-widen is for. It is a carry-forward, not new
debt: the finding count is unchanged at 1,669 and every repo total falls
(file-size 41,525 -> 40,609, essay 3,243 -> 3,242, frontend-parity moves 8 of
controller.go's 87 across).
The immediate reason is that this file's ceiling has twice now been the thing
standing between a one-line change and landing it: adding a call meant first
finding another function to move out.
The prefix a provider caches is the system message and the tool schemas, and
the schemas are the larger half — 24KB against 2.8KB in the golden fixture.
The boundary test asserted only the message, so a per-project tool surface
would have diverged the prefix one message later with nothing failing.
Nothing diverges it today: no builtin composes its workspace into a name,
description or schema, and the one that listed per-project text — slash_command
naming the configured commands — stopped when the skills catalog moved to the
turn. This pins that. Sabotage-checked by prefixing read_file's description
with its workDir, which fails it.
`reasonix doctor` reads a session's usage out of a .telemetry.json beside it.
Nothing has written that file since the desktop that used to was retired, so
every report on every real session said "desktop telemetry is unavailable" and
dropped the whole usage and per-source section. The reader, its schema and its
GC entry all survived; only the writer was gone.
The kernel owns the accounting now. goalUsageTee is the one layer every
billable call passes through — executor, planner, subagent, compaction,
classifier, and the rest, whichever agent made them — so the tally hangs there
and the record is written at the session's own persistence point, which means
it names the session the transcript was written for and cannot drift onto
another. A session with no path or no billed request writes nothing rather
than a record of zeros, which a reader cannot tell from a session that made no
calls.
The schema moves to internal/usagereport so the writer and the reader stop
being two hand-written copies that meet over JSON, where a rename on one side
reads as zero forever on the other.
It carries one thing the old file did not: the cold start, the session's first
executor request kept apart from the totals it is also in. The session hit rate
averages over requests that reuse the prefix the first one paid for, so it says
whether the cache worked once warm and can never say how much of the prefix a
cold start could reuse — which is the number a per-project prefix moves, and
the one this branch's four prefix cuts were aimed at. Sidecar calls are
excluded because they carry their own prefixes; an empty source resolves to the
executor, as every other reader already resolves it.
The effect test asserts it end to end: a session that bills a cold 400/8600
request and a warm 9000/500 one leaves a record whose cold start is the first,
and doctor reports 4% against a session figure of 94% rather than collapsing
the two.
composeWithGoal built the turn by prepending to a string eight times, so the
order the model reads the blocks in was the reverse of the order they were
written in, and adding a ninth kind of dynamic state meant finding the right
line to insert before. The order was real contract — a block nearer the text is
read closer to the request — recorded nowhere.
The blocks are now a declared list and projectTurn renders it, with the one
that follows the user's text (retrieved facts, which answer the request) passed
as the tail. Same blocks, same order, same drain points: the projection is
byte-identical, which is what the existing tests check.
Two contracts come with it. The order is asserted against a written-out list,
so changing it fails a test that says what changed rather than a golden diff
somewhere downstream. And every projected tag must be in
agent.TransientUserBlockTags — the registration that the strippers, the search
indexer and the supersede pass all read. Nothing enforced that before: the
instructions block reached the supersede pass one commit late, and a block that
misses it is silently treated as the user's own words.
autoresearch-runtime stays registered with no producer on purpose. Sessions
saved before it was retired still carry the block, and the registration is what
keeps it out of their titles when they are resumed.
The block is re-owed whenever the instruction set changes and again after a
fold, so a long session accumulates copies of the largest thing a turn carries
— 18KB each on this repo — every one of them stating rules that a later copy
has already restated.
supersedeStandingState already keeps the newest block of each tag and drops the
rest; project-instructions belongs in that set for the same reason <workspace>
does. It is the newest copy that says what the rules are now, and at most one
survives the fold.
REASONIX.md / AGENTS.md / CLAUDE.md were composed into the system prompt at
boot, which made the prefix a per-project string by construction: this repo's
own instructions are 18,104 bytes, so a session here and a session in any other
project shared 3,259 bytes and then diverged on the first rule — and every byte
after the divergence, the rest of the prompt and every tool schema, missed the
provider's prefix cache on a project the machine had not warmed.
They now ride a user turn as <project-instructions>, owed once per session and
again whenever the set changes or a fold summarises the turn that carried them.
The three cuts before this one took version control, the saved-fact index and
the skills catalog out for the same reason; with instructions gone, two projects
that share nothing send the byte-identical system message — measured, 21,360 and
3,320 bytes before, 3,609 for both after.
Be precise about what that buys. The text is not saved: it is one copy either
way, in a different message. What changes is that the copy is no longer in front
of everything else, so the prefix is reusable across projects and sessions
instead of only within one session.
Instructions arriving in a user turn must not read as a demotion, so a fixed
paragraph in the prefix states where they come from and that they carry the
authority they had here. It names no project, so every session on the machine
sends the same bytes; it costs 618 of them (the golden system prompt goes 2,163
→ 2,781) and is the whole per-session price of the move.
The planner composes its prompt once and never projects a turn, so it takes
memory.Set.StaticContext and is unchanged. Set.Block is gone rather than left
meaning half of what it says: Compose takes background, the turn takes
instructions, and there is no third caller to get it wrong.
TestEffectNoProjectStateReachesThePrefix is the standing boundary, upgraded
from the version that still allowed instructions. Sabotage-checked by composing
them back in, which fails it.
autoRouteOrder gained the remote-fetch route and moved npm last, which left
this test asserting npm at index 0 and expecting three routes. It failed on
the branch as pushed: an index is a claim about ordering that the assertions
never meant to make.
Each route is now looked up by name and the count is tied to autoRouteOrder,
so adding a route fails only the count, and reordering them fails nothing.
The download route keeps its own check because its closed reason is an
unwrapped error on purpose.
The skills catalog now rides the user turn, so the runner's input starts with
<available-skills> and an equality check against the expanded command failed.
The block is already declared in agent.TransientUserBlockTags, so the test
drops the host's prefixes the same way history's indexer does and keeps
asserting the expansion exactly.
The three cuts that took version control, the saved-fact index and the skills
catalog out of the system prompt each assert their own piece at the provider
boundary. None of them fails when a fourth kind of project state is composed
in, which is the way this erodes: one line appended in buildPromptAssembly and
every project stops sharing the prefix after it.
Measured on this repo's own REASONIX.md, two projects differing in skills,
saved facts and version control shared 1,754 bytes of system prompt before the
cuts and are byte-identical after them, so the boundary is now stateable as a
test rather than three separate claims: instructions are the only project state
left in there. Sabotage-checked by appending the workspace root to the prompt,
which fails it.
Instructions are still in the prefix. When they move to a session bootstrap
this test's projects can disagree on those too.
The version-control and skills-catalog cuts landed on separate branches and
each needed the same two accessors over a provider.Request, so each wrote its
own: systemOf/userMessages and systemOfRequest/userMessagesOf, byte-identical
bodies. Merging them put both pairs in one package, where the duplication is
visible and the next effect test has two names to choose between.
MEMORY.md was folded into the system prompt at boot, ahead of the project
instructions and the skills index. Measured on this repo's own REASONIX.md with
eight saved facts: the memory block sits 2,192 bytes into a 23,731-byte system
message, so one `remember` re-sent 21,539 bytes — 90.8% of the prompt — on the
next session, of which roughly 19KB was instruction text that had not changed.
PrefixCost counted the index's own 881 bytes and called that the cost.
The facts were already reachable without it. The `memory` tool has search, read
and list — list is the index — and relevant facts already ride the user-turn
tail through auto-recall. The prompt copy was a third path to the same data,
and the only one that charged the prefix for it.
What replaces it is a fixed protocol paragraph: how to reach saved facts, how
to treat them, which tools write them. It names no fact, so it is byte-identical
for every project and session on the machine. Pinned bodies stay in the prefix:
`activation: pinned` is explicit, off by default, and documented as an
always-available fact, so it is not a churn source the way an ordinary save is.
`Set.Index` goes with it — a field nothing reads is where the index grows back —
and PrefixCost now counts pinned bodies only, because a number named for the
prefix that included something not in the prefix was measuring the store.
<memory-update> survives for changes made outside the conversation — a "#"
quick-add, the memory panel — which nothing else tells a running session about.
It no longer fires for the model's own remember/forget: that tool result is
already in the conversation, and echoing it also suppressed the turn's recall,
which says the same thing better and in context.
For an empty store the prefix grows 349 bytes (the protocol is longer than the
"no facts yet" notice it replaced); with facts saved it shrinks, and either way
it stops moving. The golden baseline is re-recorded for that text.
The effect test asserts the claim where it has to hold: a session that saves a
fact leaves the next session's system message byte-identical, and the test
fails if the index is composed back in.
The skills index was folded into the system prompt at boot: 2,250 bytes of
per-project catalog inside the prefix every project on the machine otherwise
shares (the golden fixture's system prompt goes 4,064 → 1,814 bytes). It was
also stale by construction — a skill installed mid-session never reached the
model, and the built-in guide told users to reopen the session.
The listing now rides a user turn as <available-skills>, owed once per session
and again whenever the catalog changes. A session that installs a skill and runs
/reload-cmd reaches it on the next turn. The token cost is unchanged for a
session that never reloads: one copy either way, in a different message.
A fold can summarise away the turn that carried it, and standing state said only
once does not survive that, so a completed compaction owes it again.
slash_command's description stopped listing the configured names. Be precise
about what that buys: under the default token profile the tool is not
provider-visible at all — it sits behind use_capability — so this is not a
measured cache win today. What it fixes is real but narrower: /reload-cmd
rewrote a provider-visible tool's description under a live session, which is a
prefix mutation wherever the full tool surface is in use. The names are a result
of the tool, not part of its contract; "list" returns them.
Not done, deliberately: per-turn top-k skill retrieval. At this catalog size it
loses. The whole index is 2,250 bytes sent once; injecting candidates costs new
tokens on every turn and breaks even only around fifteen of them, and it trades
a complete list for a ranking that can hide a relevant skill. Retrieval is the
right answer for a catalog orders of magnitude larger than this one.
ApplyIndex goes with the fold — nothing composed an index into a prompt any
more, and leaving the function is leaving the invitation.
The Environment section is composed into the cache-stable system prompt, and it
carried the workspace's version control. That is a per-project fact sitting at
byte ~1,740 of a 23KB prompt, ahead of memory, the project instructions and the
skills index — so a repository and a non-repository on the same machine shared
only 1,755 bytes before diverging, and everything after the divergence, the
rest of the prompt and every tool schema, missed the provider's prefix cache.
The comment above it claimed the prefix was identical for every project on the
machine; the line below it was the reason that was false.
It now rides the transient <workspace> block, next to the path, which moved out
for exactly this reason. Both are stated once per turn instead of once per
session, and the fact still reaches the model either way — unsaid, it reaches
for `git diff` in a workspace that is no repository. Resolution stays at boot,
so no turn pays a filesystem walk for it.
Measured the same way on this repo's own REASONIX.md: the shared head between a
git and a non-git project goes from 1,755 to 2,674 bytes, and the first
divergence moves off the environment section onto the project instructions.
That is the whole win here — the remaining divergence is memory, instructions
and the skills index, which are their own changes.
The effect test asserts it at the provider boundary, where the claim is: two
projects that disagree on version control send the byte-identical system
message, and each turn states its own.
Two things stood between an SSH host and a working session, and neither
was the connection. That host needed a reasonix installed on it, and it
needed the model provider configured a second time, with its own API key
and its own route to the internet.
Model credentials now stay here. A remote session resolves providers
over a reverse forward back to a broker this machine runs on loopback:
the Selection and Request cross the tunnel, the provider is built and
run at home, and the answer streams back. The far side holds an address
on its own loopback and a token, and nothing else — no endpoint, no key,
no headers, no proxy settings — so a host with no egress to the model
API works, and the key is never written to its disk.
The provider runs here rather than the tunnel reverse-proxying its HTTP
because endpoint identity decides request shaping in dozens of places
across the adapters: DeepSeek's beta prefix endpoint, Kimi's K3
contract, Gemini's model resource names, MiniMax's reasoning split. All
of them read a base URL, and a remote pointed at 127.0.0.1 would take
the default branch of every one, silently.
For the same reason errors cross as identities rather than sentences.
IsContextOverflow reads *provider.APIError's status and the code inside
its body; flattened to a string it classifies as nothing, and a remote
turn would fail where a local one compacts and replays.
Getting the kernel there is a transfer, not an install — the binary is a
static CGO_ENABLED=0 build. So auto has the host download its own
release first: this side resolves SHA256SUMS and hands over the URL and
the digest, and the host fetches over its own link, which for a machine
in a datacenter is far faster than a laptop pushing 62MB of extracted
binary. The digest is resolved here on purpose: a host fetching both the
archive and its checksums would be verifying one against the other from
the same network. npm moves from first to last, because it installs the
identical static binary and needs Node to do it, and it stays only
because a network that mirrors npm while throttling GitHub is a real one.
That order lives in one list both the installer and the probe read, so a
probe cannot promise a route the installer would not take.
Two guards this needed. A serve resolves providers over the address it
was launched with, so one bound to a retired broker is not reusable. And
retireOutdated, which stopped only kernels below the version floor,
becomes retireReplaced: whatever made a record unreusable, leaving its
process running orphans it, since that record is the only note this side
keeps of the pid.
Per-host `provider = "local" | "remote"` picks which side answers, and
defaults to local. `reasonix remote serve start` never publishes a
broker: that serve is meant to outlive the command that started it, and
a broker published from a command that has exited is a port nobody holds.
Verified against a real SSH reverse forward, not only against the codec:
a kernel holding no credentials completes a turn, an overflow keeps its
classification, and a tunnel dropped mid-answer reads as an interruption
the agent replays rather than a completion it commits. The fetch script
is executed rather than string-matched — it installs a served release,
refuses a mismatched digest, and leaves nothing behind on a 404. The
three EnsureServe cases model a POSIX remote and skip on Windows; they
were cross-vetted for linux and run in CI.
A remote listener is torn down on every disconnect and re-listened on
Attach, and a spec asking for 127.0.0.1:0 was handed a fresh port each
time. Whatever was told where to find it outlives that reconnect, so the
address it is still holding is one nobody listens on any more.
The runner now remembers the address it was given and re-requests it,
falling back to a fresh one when that port has since been taken. A spec
that named its own port is unaffected: it already asked for one.
The test failed at first for a reason that was not the code. sshtest
replied true to cancel-tcpip-forward and never closed the listener, so
re-requesting the same port failed there and nowhere else. The fake now
releases the port the way sshd does, which is what lets the test observe
the fix at all.
The Wails shell installs as ReasonixStudio.app and this one as "Reasonix
Studio.app", so a person who downloaded 2.11 with 2.10 on disk has both.
They share a data home, and the single-instance lock means clicking
either raises the same window: two icons, one application, and nothing
saying which is which. Windows already takes its predecessor over from
the installer and Linux upgrades by package name; macOS had no
equivalent, because a dmg is a drag and has no hook to put one in.
So the first launch asks. Trash rather than delete, because this removes
an application somebody may still want and only one of those is
reversible; after the window rather than before it, because a modal in
front of an unpainted window reads as a failed start; detached from boot,
because a launch must not wait on it.
Bundles are found by identifier through Spotlight rather than by name — a
bundle someone renamed is the same application, and a name match would
miss it. The published path is the fallback for a machine with Spotlight
off: that one is a fact about what we shipped, not a guess about what a
user typed.
A refusal is recorded per bundle. Asked again every launch is the
annoyance this exists to end.
Verified by breaking it. The first version of the running-application
test passed with both guards removed, because the search it used returns
nothing under a temporary directory and the loop never ran; it hands the
filter its own bundle now, and removing the guard fails it.
A universal bundle carries both architectures of Chromium and of the
kernel, and every machine runs one of them: 279MB downloaded to use 146.
Split into two jobs and the same release ships 150MB to an Intel Mac and
146MB to an Apple Silicon one, with nothing else given up — the same
targets, the same signing, the same notarization, one bundle each.
It also removes the shape that has now produced two defects in a row.
2.11.0 named a universal app darwin-arm64 because --prepackaged never
reads what is inside the bundle it is handed, and the fix for that had to
teach the packaging step a flag the bundle step already had. Per
architecture there is nothing to infer: the matrix row states electron
-builder's spelling beside the release one, both steps read the same
field, and an artifact is named for what it actually contains.
studio-manifest needed no change — it already keyed a non-universal
darwin archive to its own platform, and keeps handling universal for
anything that still ships one.
Two guards move with it. The artifact count is 7, because two macOS
architectures are four files rather than two. And the update-channel
check names each darwin archive instead of globbing darwin-*: a glob
passes on whichever architecture shipped, and the missing one is exactly
the platform this check exists to refuse a release without.
Verified locally per architecture, as the jobs run it: --x64 produces
dist/mac and is renamed to amd64, --arm64 produces dist/mac-arm64, and
studio-manifest keys darwin-amd64 and darwin-arm64 off their own
archives.
context_soft_limit_tokens has been the economic maintenance boundary since
it was added and there has been no way to set it but editing config.toml.
A declared 1M window folds at 160k under the default, which reads as the
window being ignored — and no screen said otherwise, because the two
bounds are configured separately and only the lower one ever fires.
So the settings carry both, and the number in force beside them. That
number is read from the agent rather than recomputed: min(window x ratio,
soft limit) written twice is how what a user reads stops matching what
happens, and the agent already owns the rule.
Zero and negative are answers, not absences: zero restores the default,
negative turns the boundary off, so the wire carries a pointer and the
field's empty state is the default rather than nothing.
The capability goes on RuntimeSettings, so it is owed to every frontend
that names SessionAPI. serve gets GET/POST /compaction, saving through
rebuildInPlace because boot binds the bounds into every agent it
assembles and a live session would otherwise keep folding where it was
built to. The chat TUI gets it as "/context fold <n>" rather than a
command of its own: the report it extends already prints these numbers,
and the dispatch switch it would have joined is 1083 lines at complexity
276, where one more case costs three budgets.
Both route tables learn /compaction. They match whole path segments, so
/compact does not cover it — the same gap that answered /plan-decision
with index.html.
The compaction setters leave edit.go for edit_compaction.go: the two
bounds are one subject, and that file is 1622 lines over its ceiling
already. It shrinks by both.
CompactionSettings joins wire-parity beside SandboxSettings: the desktop
hand-writes the mirror, and a field the panel cannot read is a threshold
a user sets and never sees applied.
595MB unpacked, and two of the largest pieces are there by default rather
than by need.
Chromium carries 220 locale bundles, 49MB, where the interface draws two
languages. Both spellings are listed because the match is against the file
name and the platforms disagree — macOS names them zh_CN.lproj, Windows
and Linux zh-CN.pak — which the first attempt got wrong in the direction
that says nothing: only en survived, and a Chinese system would have found
Chromium's own surfaces in English.
The kernel carried its symbol table and DWARF, 28% of a 43MB binary, which
a shipped build never reads: a panic's traceback comes from the pclntab,
and -w leaves that alone.
Measured on a real universal build: 595MB to 524MB, with en, zh_CN and
zh_TW kept and the kernel at 61MB from 85MB.
2.11.0 published a universal application as ReasonixStudio-darwin-arm64,
and studio-manifest reads the artifact name: it keyed darwin-arm64 alone
where 2.10.0 keyed both. An Intel Mac asks for darwin-amd64, finds
nothing, and is never offered the update — the package runs there, the
catalog just does not mention it.
The flag was on the bundle build and not on the packaging step. Splitting
the two so notarization can happen between them left --prepackaged to
name the targets, and it never reads what is inside the directory it was
handed, so it used the runner's own architecture.
Verified end to end on a real build: the targets come out
ReasonixStudio-darwin-universal.{zip,dmg} at arch=universal, and
studio-manifest keys darwin-amd64 and darwin-arm64 off the one archive.
2026-09-01 09:01:31 -07:00
5771 changed files with 457814 additions and 343661 deletions
Write-Output "::error title=studio-signing.unexpected-signer::STUDIO_SIGNING_SUBJECT is '$($env:EXPECTED_SUBJECT)' but $file is signed by '$($certificate.Subject)'"
$failed = $true
}
}
if ($failed) { exit 1 }
'Certum payload and installer signing, signer, trust and timestamps passed.' >> $env:GITHUB_STEP_SUMMARY
<p align="center"><strong>Open source · MIT · a single Go binary</strong></p>
<h3 align="center">A coding agent you can leave running.</h3>
<p align="center">One local engine, four ways in — terminal, desktop app, browser, or your editor over ACP. Plan mode, permissions, a workspace sandbox and per-turn checkpoints keep a long autonomous run something you can still read and undo.</p>
<p align="center">Maintained by <strong>Huahui Yu</strong>.</p>
> [!IMPORTANT]
> **Community · 加入社区** — bilingual Discord for setup help (`#help` / `#求助`), workflow showcases, and feature ideas. → **<https://discord.gg/XF78rEME2D>**
<br/>
## Versions
Reasonix ships on two lines. See the [version roadmap announcement](https://github.com/esengine/DeepSeek-Reasonix/discussions/10748) for the reasoning behind the split.
- HTTP `serve` protections for the unauthenticated local server, including
localhost binding assumptions, JSON-only state-changing requests, and CORS
restrictions.
- HTTP `serve` protections, including the default per-launch token, the launch
token every state-changing request requires when authentication is opted
out, localhost binding assumptions, JSON-only state-changing requests, and
CORS restrictions.
- Desktop and bot session isolation, including per-workspace session metadata
and configured bot allowlists.
- Updater, install, and release verification paths.
@@ -67,10 +68,10 @@ The following are normally treated as trusted local/operator-controlled inputs
unless another bug lets an untrusted actor supply them:
- CLI arguments and text typed directly by the local user.
-Project configuration files intentionally loaded from the current workspace.
-The user's own configuration under the Reasonix home directory.
- Explicit `@path` references supplied by the local user to attach local files.
- MCP servers, language servers, hooks, and slash commands installed or enabled
by the local user.
- MCP servers, language servers, hooks, and slash commands installed, enabled,
or approved by the local user.
- Provider base URLs and model names configured by the local user.
The following can be security issues when reachable by an untrusted actor or
@@ -89,6 +90,56 @@ when they bypass the intended boundary:
- Trusting unverified update artifacts, plugin definitions, or downloaded
binaries.
## Project Configuration
Files that arrive with a workspace are untrusted input: `reasonix.toml`,
`.reasonix/settings.json`, `.mcp.json` and the project `.env`. Cloning a
repository is not a decision to trust its author, so these files may narrow
what the user configured and never widen it.
| Setting | What a workspace file may do |
| --- | --- |
| `sandbox.bash` | Move `off` to `enforce`, never back |
| `sandbox.network` | Move `true` to `false`, never back |
| `sandbox.forbid_read`, `sandbox.denied_domains` | Add to the user's lists |
| `sandbox.allow_write`, `sandbox.workspace_root` | Apply only when they resolve inside the workspace, symlinks followed; `${VAR}` in any sandbox path expands from the process environment only |
| `sandbox.host_authorities`, a user's `sandbox.allowed_domains` | Nothing |
| `permissions.deny`, `permissions.ask` | Add to the user's rules |
| `[[providers]]`, `tools.system_one` endpoints | Declare them; they stay out of use until approved, and model settings naming them fall back to the user's |
An "always allow" answer, or extra write access, granted in a workspace is
stored under the Reasonix home, not in the workspace.
Programs a workspace names for the host to run stay off until the user
approves them for that workspace:
- Hooks, language server commands, `tools.search.rg_path`,
`tools.shell.path`, `[browser]` and `tools.system_one.laya.python` are
approved with `reasonix trust`, or for hooks by saving them from the hooks
editor.
- An approval is stored under the Reasonix home with a digest of the
declaration and of the workspace files it names; any change needs approval
again. Approvals and grants belong to one workspace folder.
- Hooks and language servers are checked against their approval again before
each start, and refused if a file they name changed, appeared or now
resolves elsewhere.
- A single program path (`tools.shell.path`, `tools.search.rg_path`,
`[browser]`, `laya.python`) may not point into the workspace, an
`allow_write` root, a temporary directory or a toolchain cache the bash jail
leaves writable, and may not climb with `..`; its approval covers the
program file's content.
-`tools.system_one.laya.local` is read from the user's configuration only.
- Without an interactive frontend they stay off.
- MCP servers a workspace declares stay off until the user enables them for
that workspace.
A project value that is not applied is reported as a load warning with the
reason. A way for workspace files to widen any of the above without the
user's approval is a security issue.
## `@` File References
Reasonix supports `@path` references so users can include local files and images
| `-task` | *(all)* | Suite mode: run only these comma-separated task IDs (e.g. `-task fix-add-bug`); unknown IDs fail with the available list. |
| `-attempts` | `1` | Suite and diff modes: retry a task until an attempt passes, up to N; enables the `Pass@≤N` KPI, and TTCS charges a retried solve with its failed attempts' wall. |
| `-trials` | `1` | Suite mode: run every task N times and keep every outcome. Adds a **Reliability** line: `pass^N` (tasks that passed every trial), `pass@N` (any trial), mean `pass@1` over all trials, and the flaky tasks by name. `Pass@≤N` asks whether the agent can solve a task; `pass^N` asks whether it does so every time. Cannot be combined with `-attempts`. |
| `-tape-record DIR` | — | Suite mode, with `-meter`: record every provider exchange at the meter, one tape per task and trial (`DIR/<task>/trial-N/0001.request.json`, `.response.json`, `.response.body`). Taped runs use a fixed workdir path and pin the seeded files' times, because both reach the model through the workspace block and file listings. |
| `-tape-replay DIR` | — | Suite mode, with `-meter`: answer each run from its tape instead of the provider, and add a **Replay** line naming the first request whose body differs from the recorded one, down to the message (`request 2, message 4 (tool)`), the tool list, or a field. The diverging request is kept as `NNNN.replayed.json` beside the recorded one. A kernel change that should not alter what the model is asked replays with every request matched. |
| `-bin` | `reasonix` | Path to the reasonix binary. |
| `-profile` | `baseline` | Tool-surface/runtime tier: `baseline` \| `economy` \| `balanced` \| `delivery`. All but `baseline` append `--profile <tier>` to the agent invocation; `baseline` passes no flag (byte-identical legacy control, behaviorally `balanced`). Economy starts with the core tool set and pays `connect_tool_source` rounds plus prefix resets to grow it — the report's Tool surface line prices that trade. |
| `-json` | *(none)* | Write the JSON report here (optional). |
| `-trajectories` | *(none)* | Suite mode: write one `<task-id>.trajectory.jsonl` per task into this directory (the agent's full event stream with timestamps — see `reasonix run --trajectory`). The report gains a time-attribution line (tools vs. model) and each JSON result a `trajectory` digest. |
| `-force-planner` | `false` | Suite mode: prefix each prompt with a plan-first directive so the two-model turn engages regardless of the planner gate. Use for the "with planner" arm of an A/B; results carry `plan_forced` so arms are only comparable with equal forcing. |
| `-anchor` | `blind` | Suite mode: which hypothesis the agent holds before it looks at anything — `blind` (none, the control) \| `correct` \| `wrong`. The seeded arms prefix each prompt with the task's authored seed and **skip** tasks that have none, so an unseeded control run never lands in a seeded denominator. Results carry `anchor`. See [Anchor resistance](#anchor-resistance). |
| `-cache` | `cold` | Suite mode: `cold` runs each task as a fresh session (the fair cross-agent comparison arm); `warm` primes the provider prefix cache with a one-step run in the same workdir first, measuring the long-lived-session steady state. Never mix arms in one report — compare them with `-mode compare cold.json warm.json`. |
| `-policy` | *(none)* | Suite mode: experiment arm. `memory-off` hides the memory store, which is the MemoryBench counterfactual arm; the empty default runs the baseline. |
| `-budget` | `800000` | Abort once total tokens cross this (`0` = no cap). Remaining tasks are reported as skipped. |
| `-meter` | *(off)* | Suite mode: route the benchmarked provider through the neutral measuring proxy, using this `config.toml` as the source. Spend is then counted at the request boundary instead of trusted from the harness. See [Neutral metering](#neutral-metering). |
| `-faults` | *(none)* | Suite mode: inject provider failures through the meter — absolute indices (`3:429`) and/or a cadence that scales with the run (`every:5:500`). Requires `-meter`. See [Fault recovery](#fault-recovery). |
@@ -538,33 +542,32 @@ writer.
## context-maintenance-e2e
This harness measures what happens when a long session goes idle past the
provider's cache TTL and then resumes: it A/B-compares cold-restart miss tokens
with and without pruning, and checks that the agent re-reads a file behind a
prune placeholder instead of hallucinating.
A cost-capped smoke for content-driven maintenance, in three legs over one state
directory: seed a session just below the compaction trigger, load it back and
check nothing is re-derived, then grow it past the trigger and check exactly one
summary lands.
It is hardcoded to the `deepseek-v4-flash` model at `https://api.deepseek.com`
and requires the `DEEPSEEK_API_KEY` environment variable.
Seed and resume take no provider; `continue` samples and needs
`DEEPSEEK_API_KEY`. The model is hardcoded to `deepseek-v4-flash` at
`https://api.deepseek.com`.
```sh
export DEEPSEEK_API_KEY=...
# Seed below the trigger: no checkpoint installed, no summary started
go run ./benchmarks/context-maintenance-e2e -offline seed
# Seed both arms (pruned + control) with a large session and warm the cache
go run ./benchmarks/context-maintenance-e2e seed
# Wait past the provider's cache TTL, then resume: prune the "pruned" arm and
# compare cold-restart miss tokens
# Reload: the projection version must not move and no summary may run
go run ./benchmarks/context-maintenance-e2e resume
# Run the comprehension trials (agent must re-read a pruned file and answer
# from it); exits non-zero unless every trial passes
go run ./benchmarks/context-maintenance-e2e comprehension
# Grow past the trigger: one summary, version +1, then no further summary
export DEEPSEEK_API_KEY=...
go run ./benchmarks/context-maintenance-e2e continue
```
| Flag | Default | Purpose |
| --- | --- | --- |
| `-dir` | `benchmarks/context-maintenance-e2e/run` | State directory for `seed`/`resume` (sessions + `meta.json`, `resume-<ts>.json`). |
| `-trials` | `5` | Number of comprehension trials. |
| `-dir` | `benchmarks/context-maintenance-e2e/run` | State directory shared by the three legs (session + `meta.json`). |
| `-max-usd` | `0.50` | Hard cost cap for the live legs. |
| `-offline` | off | Skip the live provider; `seed` only. |
returnos.WriteFile(path,[]byte(strings.Replace(string(old),"Body paragraph the index never renders.","A different body paragraph, longer than the one it replaces.",1)),0o644)
return"an item was skipped rather than cancelled; parallel_tasks' skipped branch was thought unreachable"
}
return""
}
Loaded 100 of 5771 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
esengine