docs: draft code signing policy page (not in force)

2026-11-07 17:10:43 -10:00 · 2026-09-30 01:46:32 -07:00
5227 changed files with 30250 additions and 395005 deletions
@@ -10,7 +10,6 @@

 # User-facing guides and references.
 /docs/                                    @SivanCola @esengine
-/docs/THEME_AUTHOR_GUIDE.md                @esengine @SivanCola
 /sdk/                                     @SivanCola @esengine
 /README.md                                @SivanCola @esengine
 /README.zh-CN.md                          @SivanCola @esengine
@@ -23,6 +22,7 @@
 /docs/*_CONTRACT.md                       @esengine @SivanCola
 /docs/TOOL_APPROVAL_MODES.md              @esengine @SivanCola
 /docs/CAPABILITY_DIAGNOSTICS.md           @esengine @SivanCola
+/docs/CODE_SIGNING_POLICY.md            @esengine @SivanCola
 /docs/CHECKPOINTS.md                      @esengine @SivanCola
 /docs/EXTENSION_*.md                      @esengine @SivanCola
 /docs/SUBAGENT_*.md                       @esengine @SivanCola
@@ -37,7 +37,6 @@
 /.github/workflows/studio-certum-signing-smoke.yml @esengine @SivanCola
 /.github/actions/setup-certum/            @esengine @SivanCola
 /cmd/signpath-contract/                   @esengine @SivanCola
-/scripts/install-smoke.ps1                @esengine @SivanCola
 /scripts/sign-certum.ps1                  @esengine @SivanCola
 /scripts/verify-windows-authenticode.ps1  @esengine @SivanCola
 /scripts/verify-windows-package.ps1       @esengine @SivanCola
@@ -6,9 +6,3 @@ contact_links:
  - name: Questions & discussions
    url: https://github.com/esengine/DeepSeek-Reasonix/discussions
    about: For usage questions, ideas, and general discussion — please use Discussions instead of opening an issue.
-  - name: Discord
-    url: https://discord.gg/XF78rEME2D
-    about: Bilingual community chat for setup help, workflow showcases, and feature ideas.
-  - name: QQ group (DeepSeek-Reasonix官方群, 1093562660)
-    url: https://qm.qq.com/q/i59b0z2R8s
-    about: Chinese-language community chat for setup help and everyday questions.
@@ -8,34 +8,6 @@ only, on `main-v2`.

 -

-## Cause
-
-
-
-## Blast radius
-
-
-
-## Neighbouring behaviours tested
-
-
-
-## Why this layer
-
-
-
-## UI changes
-
-<!--
-Delete this section if the PR touches nothing under `desktop/frontend-next/src`
-or the website pages.
-->
-
- Screenshots, before and after: light and dark, a wide window and a phone-width one (about 390 px). Attach them to this description.
- Entries moved, hidden or removed: none / list each one.
- Hiding or removing a visible control needs a linked issue and a release-notes line naming it. Do not retire UI with `display: none !important` or a feature flag.
- If a row of `docs/STUDIO_PARITY.md` changes, update it here.
-
 ## Issues

 <!--
@@ -54,7 +26,3 @@ the source-to-target contract here: easing syntax, time units, callbacks,
 cancellation, reduced-motion behavior, and failure fallback. Verification must
 assert that the target API was actually called; a mock that silently skips it
 does not count.
-
-## Disclosure
-
- [ ] AI assistance was used for this change (optional; for transparency only, it does not change how the change is reviewed)
@@ -1,19 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg id="_图层_2" data-name="图层 2" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 145.55 113.29">
-  <defs>
-    <style>
-      .cls-1 {
-        fill: #ffffff;
-        stroke: #ffffff;
-        stroke-miterlimit: 10;
-      }
-    </style>
-  </defs>
-  <g id="_图层_1-2" data-name="图层 1">
-    <g>
-      <path class="cls-1" d="M144.68,38.49l-.06-.23c-.88-3.28-2.5-5.94-4.58-8.06.14,5.65-2.96,11.02-6.22,16.66l-.39.68c-2.26,3.91-4.66,7.94-6.57,11.1l-.86,1.38c-3.36,5.44-6.27,10.14-12.18,14.18-8.34,5.87-18.2,5.81-26.92,5.76-2.81-.02-5.48-.03-7.95.14l-.35.02c-3.22.06-5.96,1.57-8.17,4.49l-.14.18c-.86,1.06-1.7,2.26-2.58,3.54-3.43,4.92-7.69,11.04-16.17,12.42-4.37.86-9.98.84-14.94.83h-1.95c-.52,0-1.06,0-1.61,0-6.95,0-16.08-.89-21.94-6.55-.15-.15-.3-.3-.44-.45.5,4.73,2.33,8.64,5.44,11.65,5.86,5.66,14.98,6.55,21.94,6.55.55,0,1.09,0,1.61-.01h1.93c4.96.02,10.58.04,14.96-.83,8.48-1.37,12.74-7.5,16.17-12.42.88-1.27,1.72-2.48,2.58-3.54l.14-.18c2.21-2.92,4.95-4.43,8.17-4.49l.35-.02c2.47-.17,5.13-.16,7.95-.14,8.72.05,18.58.11,26.91-5.76,5.92-4.03,8.82-8.73,12.19-14.17l.86-1.39c1.91-3.15,4.3-7.18,6.57-11.09l.39-.69c3.81-6.6,7.41-12.84,5.86-19.57ZM120.9,23.02c-.28,0-.56,0-.83,0-9.68-.19-24.03-.09-35.57-.01l-2.04.02c-.93.01-1.82.02-2.67.03-8.36.08-14.4.13-23.33,3.82l-.27.12c-10.76,4.68-16.91,12.16-22.83,21.95-5.53,8.76-12.62,20.57-16.32,26.79-.41.69-.77,1.3-1.09,1.84l-.49.84c-1.49,2.53-3.23,5.49-4.21,8.95,3.98,1.9,8.52,2.65,12.71,2.91.27-.77.64-1.56,1.07-2.38.48-.94,1.05-1.9,1.63-2.89l.49-.84c.96-1.62,2.38-3.99,4.05-6.78,3.82-6.36,8.98-14.88,13.19-21.55l.07-.11c5.02-8.31,9.2-13.45,16.91-16.81l.11-.05c6.57-2.7,10.54-2.74,18.43-2.81.87-.01,1.78-.02,2.69-.03l1.99-.02c9.17-.06,20.13-.14,29.01-.07,2.26.01,4.39.04,6.32.08h.12s.11,0,.11,0c1.25-.01,2.91.11,4.61.46,1.03.22,2.08.52,3.05.93.21-.35.41-.71.62-1.06l.39-.68c1.92-3.33,3.79-6.57,4.97-9.82-4.08-1.92-8.7-2.76-12.89-2.82Z"/>
-      <path class="cls-1" d="M115.07,11.81c-9.7-.19-24.07-.09-35.62-.01h-1.99c-.93.03-1.82.04-2.67.04-8.36.08-14.4.14-23.33,3.83l-.27.12c-10.76,4.67-16.91,12.16-22.83,21.95-6.13,9.71-14.19,23.21-17.41,28.63l-.5.84c-2.08,3.55-4.68,7.97-4.94,13.39v.2s0,.21,0,.21c.01.81.06,1.61.15,2.38.14.15.29.3.44.45,1.53,1.47,3.28,2.63,5.15,3.52,3.98,1.9,8.52,2.65,12.71,2.91,1.41.09,2.78.12,4.08.12.55,0,1.09-.01,1.61-.01h1.95c4.95.01,10.57.03,14.94-.83,8.48-1.38,12.74-7.5,16.17-12.42.88-1.28,1.72-2.48,2.58-3.54l.14-.18c2.21-2.92,4.95-4.44,8.17-4.49l.35-.02c2.47-.17,5.14-.16,7.95-.14,8.71.05,18.58.1,26.92-5.76,5.91-4.04,8.82-8.74,12.18-14.18l.86-1.39c1.74-2.86,3.87-6.45,5.95-10.03.21-.35.41-.71.62-1.06l.39-.68c1.92-3.33,3.79-6.57,4.97-9.82.82-2.26,1.31-4.53,1.25-6.84-5.18-5.29-13.22-7.25-19.97-7.19ZM122.56,40.37l-.39.67c-2.21,3.81-4.55,7.77-6.39,10.79l-.84,1.36c-3.01,4.87-4.83,7.81-8.48,10.29l-.1.07c-4.94,3.49-11.95,3.45-19.38,3.41-2.88-.02-5.87-.04-8.79.16-7.1.19-13.51,3.58-18.07,9.57-1.13,1.4-2.12,2.83-3.08,4.21-2.92,4.18-4.71,6.57-7.64,7.02l-.31.06c-3.09.63-8.28.61-12.45.6h-2.16c-3.85.07-7.01-.16-9.45-.69-2.24-.48-3.87-1.22-4.89-2.2-.66-.64-1.54-1.81-1.63-4.65.11-1.35.71-2.82,1.52-4.35.48-.94,1.05-1.9,1.63-2.89l.49-.84c3.17-5.33,11.19-18.75,17.24-28.33l.07-.11c5.02-8.32,9.2-13.45,16.92-16.81l.1-.05c6.57-2.7,10.54-2.74,18.43-2.82.87,0,1.78,0,2.69-.03h1.94c11.52-.09,25.86-.19,35.38,0h.23c1.25-.01,2.92.11,4.61.46,3.15.66,6.4,2.12,7.27,5.02.2,1.2-.89,3.62-2.27,6.18-.7,1.31-1.48,2.65-2.2,3.9ZM120.07,23.01c-9.68-.19-24.03-.09-35.57-.01l-2.04.02c-.93.01-1.82.02-2.67.03-8.36.08-14.4.13-23.33,3.82l-.27.12c-10.76,4.68-16.91,12.16-22.83,21.95-5.53,8.76-12.62,20.57-16.32,26.79-.78-.35-1.41-.77-1.9-1.24-.66-.64-1.54-1.81-1.63-4.65.18-2.18,1.62-4.64,3.15-7.25l.49-.83c3.17-5.32,11.18-18.73,17.24-28.33l.07-.12c5.02-8.31,9.2-13.45,16.92-16.81l.1-.04c6.57-2.7,10.54-2.74,18.43-2.82.87-.01,1.78-.01,2.69-.03h1.99c11.5-.09,25.82-.19,35.33,0h.23c3.57-.04,10.55,1.02,11.88,5.48.14.84-.35,2.27-1.13,3.93-.28,0-.56,0-.83,0Z"/>
-      <path class="cls-1" d="M134.68,16.09l-.06-.23c-3.07-11.45-15.08-15.33-24.55-15.25-9.68-.19-24.03-.09-35.57-.01h-2.04c-.93.03-1.82.04-2.67.04-8.36.08-14.4.14-23.33,3.83l-.27.12c-10.76,4.67-16.91,12.16-22.83,21.95-6.14,9.73-14.2,23.22-17.41,28.62l-.49.85c-2.09,3.55-4.69,7.96-4.95,13.39v.2s0,.21,0,.21c.09,5.57,1.82,10.13,5.15,13.58.14.15.29.3.44.45,1.53,1.47,3.28,2.63,5.15,3.52,3.98,1.9,8.52,2.65,12.71,2.91,1.41.09,2.78.12,4.08.12.55,0,1.09-.01,1.61-.01h1.95c4.95.01,10.57.03,14.94-.83,8.48-1.38,12.74-7.5,16.17-12.42.88-1.28,1.72-2.48,2.58-3.54l.14-.18c2.21-2.92,4.95-4.44,8.17-4.49l.35-.02c2.47-.17,5.14-.16,7.95-.14,8.71.05,18.58.1,26.92-5.76,5.91-4.04,8.82-8.74,12.18-14.18l.86-1.39c1.74-2.86,3.87-6.45,5.95-10.03.21-.35.41-.71.62-1.06l.39-.68c1.92-3.33,3.79-6.57,4.97-9.82.82-2.26,1.31-4.53,1.25-6.84-.02-.96-.14-1.93-.36-2.91ZM119.76,25.27c-.7,1.31-1.48,2.65-2.2,3.9l-.39.67c-1.19,2.04-2.41,4.13-3.57,6.09-1.01,1.7-1.97,3.31-2.82,4.7l-.84,1.36c-3.01,4.87-4.83,7.81-8.48,10.29l-.1.07c-4.94,3.49-11.96,3.45-19.38,3.41-2.89-.02-5.87-.04-8.79.16-7.1.18-13.51,3.58-18.07,9.57-1.13,1.4-2.12,2.83-3.08,4.21-2.92,4.18-4.71,6.57-7.64,7.02l-.31.06c-3.09.63-8.27.61-12.45.6h-2.16c-3.85.07-7.01-.16-9.45-.69-1.16-.25-2.16-.57-2.99-.96-.78-.35-1.41-.77-1.9-1.24-.66-.64-1.54-1.81-1.63-4.65.18-2.18,1.62-4.64,3.15-7.25l.49-.83c3.17-5.32,11.18-18.73,17.24-28.33l.07-.12c5.02-8.31,9.2-13.45,16.92-16.81l.1-.04c6.57-2.7,10.54-2.74,18.43-2.82.87-.01,1.78-.01,2.69-.03h1.99c11.5-.09,25.82-.19,35.33,0h.23c3.57-.04,10.55,1.02,11.88,5.48.14.84-.35,2.27-1.13,3.93-.34.72-.73,1.48-1.14,2.25Z"/>
-    </g>
-  </g>
-</svg>
@@ -1,19 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg id="_图层_2" data-name="图层 2" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 145.55 113.29">
-  <defs>
-    <style>
-      .cls-1 {
-        fill: #111111;
-        stroke: #111111;
-        stroke-miterlimit: 10;
-      }
-    </style>
-  </defs>
-  <g id="_图层_1-2" data-name="图层 1">
-    <g>
-      <path class="cls-1" d="M144.68,38.49l-.06-.23c-.88-3.28-2.5-5.94-4.58-8.06.14,5.65-2.96,11.02-6.22,16.66l-.39.68c-2.26,3.91-4.66,7.94-6.57,11.1l-.86,1.38c-3.36,5.44-6.27,10.14-12.18,14.18-8.34,5.87-18.2,5.81-26.92,5.76-2.81-.02-5.48-.03-7.95.14l-.35.02c-3.22.06-5.96,1.57-8.17,4.49l-.14.18c-.86,1.06-1.7,2.26-2.58,3.54-3.43,4.92-7.69,11.04-16.17,12.42-4.37.86-9.98.84-14.94.83h-1.95c-.52,0-1.06,0-1.61,0-6.95,0-16.08-.89-21.94-6.55-.15-.15-.3-.3-.44-.45.5,4.73,2.33,8.64,5.44,11.65,5.86,5.66,14.98,6.55,21.94,6.55.55,0,1.09,0,1.61-.01h1.93c4.96.02,10.58.04,14.96-.83,8.48-1.37,12.74-7.5,16.17-12.42.88-1.27,1.72-2.48,2.58-3.54l.14-.18c2.21-2.92,4.95-4.43,8.17-4.49l.35-.02c2.47-.17,5.13-.16,7.95-.14,8.72.05,18.58.11,26.91-5.76,5.92-4.03,8.82-8.73,12.19-14.17l.86-1.39c1.91-3.15,4.3-7.18,6.57-11.09l.39-.69c3.81-6.6,7.41-12.84,5.86-19.57ZM120.9,23.02c-.28,0-.56,0-.83,0-9.68-.19-24.03-.09-35.57-.01l-2.04.02c-.93.01-1.82.02-2.67.03-8.36.08-14.4.13-23.33,3.82l-.27.12c-10.76,4.68-16.91,12.16-22.83,21.95-5.53,8.76-12.62,20.57-16.32,26.79-.41.69-.77,1.3-1.09,1.84l-.49.84c-1.49,2.53-3.23,5.49-4.21,8.95,3.98,1.9,8.52,2.65,12.71,2.91.27-.77.64-1.56,1.07-2.38.48-.94,1.05-1.9,1.63-2.89l.49-.84c.96-1.62,2.38-3.99,4.05-6.78,3.82-6.36,8.98-14.88,13.19-21.55l.07-.11c5.02-8.31,9.2-13.45,16.91-16.81l.11-.05c6.57-2.7,10.54-2.74,18.43-2.81.87-.01,1.78-.02,2.69-.03l1.99-.02c9.17-.06,20.13-.14,29.01-.07,2.26.01,4.39.04,6.32.08h.12s.11,0,.11,0c1.25-.01,2.91.11,4.61.46,1.03.22,2.08.52,3.05.93.21-.35.41-.71.62-1.06l.39-.68c1.92-3.33,3.79-6.57,4.97-9.82-4.08-1.92-8.7-2.76-12.89-2.82Z"/>
-      <path class="cls-1" d="M115.07,11.81c-9.7-.19-24.07-.09-35.62-.01h-1.99c-.93.03-1.82.04-2.67.04-8.36.08-14.4.14-23.33,3.83l-.27.12c-10.76,4.67-16.91,12.16-22.83,21.95-6.13,9.71-14.19,23.21-17.41,28.63l-.5.84c-2.08,3.55-4.68,7.97-4.94,13.39v.2s0,.21,0,.21c.01.81.06,1.61.15,2.38.14.15.29.3.44.45,1.53,1.47,3.28,2.63,5.15,3.52,3.98,1.9,8.52,2.65,12.71,2.91,1.41.09,2.78.12,4.08.12.55,0,1.09-.01,1.61-.01h1.95c4.95.01,10.57.03,14.94-.83,8.48-1.38,12.74-7.5,16.17-12.42.88-1.28,1.72-2.48,2.58-3.54l.14-.18c2.21-2.92,4.95-4.44,8.17-4.49l.35-.02c2.47-.17,5.14-.16,7.95-.14,8.71.05,18.58.1,26.92-5.76,5.91-4.04,8.82-8.74,12.18-14.18l.86-1.39c1.74-2.86,3.87-6.45,5.95-10.03.21-.35.41-.71.62-1.06l.39-.68c1.92-3.33,3.79-6.57,4.97-9.82.82-2.26,1.31-4.53,1.25-6.84-5.18-5.29-13.22-7.25-19.97-7.19ZM122.56,40.37l-.39.67c-2.21,3.81-4.55,7.77-6.39,10.79l-.84,1.36c-3.01,4.87-4.83,7.81-8.48,10.29l-.1.07c-4.94,3.49-11.95,3.45-19.38,3.41-2.88-.02-5.87-.04-8.79.16-7.1.19-13.51,3.58-18.07,9.57-1.13,1.4-2.12,2.83-3.08,4.21-2.92,4.18-4.71,6.57-7.64,7.02l-.31.06c-3.09.63-8.28.61-12.45.6h-2.16c-3.85.07-7.01-.16-9.45-.69-2.24-.48-3.87-1.22-4.89-2.2-.66-.64-1.54-1.81-1.63-4.65.11-1.35.71-2.82,1.52-4.35.48-.94,1.05-1.9,1.63-2.89l.49-.84c3.17-5.33,11.19-18.75,17.24-28.33l.07-.11c5.02-8.32,9.2-13.45,16.92-16.81l.1-.05c6.57-2.7,10.54-2.74,18.43-2.82.87,0,1.78,0,2.69-.03h1.94c11.52-.09,25.86-.19,35.38,0h.23c1.25-.01,2.92.11,4.61.46,3.15.66,6.4,2.12,7.27,5.02.2,1.2-.89,3.62-2.27,6.18-.7,1.31-1.48,2.65-2.2,3.9ZM120.07,23.01c-9.68-.19-24.03-.09-35.57-.01l-2.04.02c-.93.01-1.82.02-2.67.03-8.36.08-14.4.13-23.33,3.82l-.27.12c-10.76,4.68-16.91,12.16-22.83,21.95-5.53,8.76-12.62,20.57-16.32,26.79-.78-.35-1.41-.77-1.9-1.24-.66-.64-1.54-1.81-1.63-4.65.18-2.18,1.62-4.64,3.15-7.25l.49-.83c3.17-5.32,11.18-18.73,17.24-28.33l.07-.12c5.02-8.31,9.2-13.45,16.92-16.81l.1-.04c6.57-2.7,10.54-2.74,18.43-2.82.87-.01,1.78-.01,2.69-.03h1.99c11.5-.09,25.82-.19,35.33,0h.23c3.57-.04,10.55,1.02,11.88,5.48.14.84-.35,2.27-1.13,3.93-.28,0-.56,0-.83,0Z"/>
-      <path class="cls-1" d="M134.68,16.09l-.06-.23c-3.07-11.45-15.08-15.33-24.55-15.25-9.68-.19-24.03-.09-35.57-.01h-2.04c-.93.03-1.82.04-2.67.04-8.36.08-14.4.14-23.33,3.83l-.27.12c-10.76,4.67-16.91,12.16-22.83,21.95-6.14,9.73-14.2,23.22-17.41,28.62l-.49.85c-2.09,3.55-4.69,7.96-4.95,13.39v.2s0,.21,0,.21c.09,5.57,1.82,10.13,5.15,13.58.14.15.29.3.44.45,1.53,1.47,3.28,2.63,5.15,3.52,3.98,1.9,8.52,2.65,12.71,2.91,1.41.09,2.78.12,4.08.12.55,0,1.09-.01,1.61-.01h1.95c4.95.01,10.57.03,14.94-.83,8.48-1.38,12.74-7.5,16.17-12.42.88-1.28,1.72-2.48,2.58-3.54l.14-.18c2.21-2.92,4.95-4.44,8.17-4.49l.35-.02c2.47-.17,5.14-.16,7.95-.14,8.71.05,18.58.1,26.92-5.76,5.91-4.04,8.82-8.74,12.18-14.18l.86-1.39c1.74-2.86,3.87-6.45,5.95-10.03.21-.35.41-.71.62-1.06l.39-.68c1.92-3.33,3.79-6.57,4.97-9.82.82-2.26,1.31-4.53,1.25-6.84-.02-.96-.14-1.93-.36-2.91ZM119.76,25.27c-.7,1.31-1.48,2.65-2.2,3.9l-.39.67c-1.19,2.04-2.41,4.13-3.57,6.09-1.01,1.7-1.97,3.31-2.82,4.7l-.84,1.36c-3.01,4.87-4.83,7.81-8.48,10.29l-.1.07c-4.94,3.49-11.96,3.45-19.38,3.41-2.89-.02-5.87-.04-8.79.16-7.1.18-13.51,3.58-18.07,9.57-1.13,1.4-2.12,2.83-3.08,4.21-2.92,4.18-4.71,6.57-7.64,7.02l-.31.06c-3.09.63-8.27.61-12.45.6h-2.16c-3.85.07-7.01-.16-9.45-.69-1.16-.25-2.16-.57-2.99-.96-.78-.35-1.41-.77-1.9-1.24-.66-.64-1.54-1.81-1.63-4.65.18-2.18,1.62-4.64,3.15-7.25l.49-.83c3.17-5.32,11.18-18.73,17.24-28.33l.07-.12c5.02-8.31,9.2-13.45,16.92-16.81l.1-.04c6.57-2.7,10.54-2.74,18.43-2.82.87-.01,1.78-.01,2.69-.03h1.99c11.5-.09,25.82-.19,35.33,0h.23c3.57-.04,10.55,1.02,11.88,5.48.14.84-.35,2.27-1.13,3.93-.34.72-.73,1.48-1.14,2.25Z"/>
-    </g>
-  </g>
-</svg>
@@ -1,37 +0,0 @@
-name: acp-conformance
-
-# The agent is driven over stdio by the official ACP TypeScript SDK, and every
-# message it writes is held to the schema that SDK ships. Not a required check:
-# it runs when the ACP frontend or the harness changes, and on request.
-on:
-  pull_request:
-    branches: [main-v2, studio]
-    paths:
-      - "internal/frontend/acp/**"
-      - "tools/acp-conformance/**"
-      - ".github/workflows/acp-conformance.yml"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: acp-conformance-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  conformance:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          cache: true
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: "22"
-      - run: make acp-conformance
@@ -15,7 +15,7 @@ permissions:

 concurrency:
  group: ci-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  cancel-in-progress: true

 jobs:
  # Cheap path gate for pull requests. PRs confined to docs/release-notes
@@ -26,9 +26,7 @@ jobs:
  # merges. Gated jobs skip only on an explicit `false` output: wrapped in
  # `always()`, a failed `changes` job (or a missing output) makes them run
  # the full matrix instead of silently passing required checks as skipped.
-  # Pushes to main-v2 always run everything. Pull requests run the macOS and
-  # Windows legs only when `platform` is not 'false'; the rule lives in
-  # scripts/ci-platform-scope.sh and fails toward running them.
+  # Pushes to main-v2 always run everything.
  changes:
    runs-on: ubuntu-latest
    outputs:
@@ -36,14 +34,13 @@ jobs:
      desktop: ${{ steps.filter.outputs.desktop }}
      sdk: ${{ steps.filter.outputs.sdk }}
      scripts: ${{ steps.filter.outputs.scripts }}
-      platform: ${{ steps.filter.outputs.platform }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
      - id: filter
        run: |
-          code=true; desktop=true; sdk=true; scripts=true; platform=true
+          code=true; desktop=true; sdk=true; scripts=true
          base=""
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            base="${{ github.event.pull_request.base.sha }}"
@@ -51,7 +48,7 @@ jobs:
            base="${{ github.event.before }}"
          fi
          if [ -n "$base" ] && git cat-file -e "$base^{commit}" 2>/dev/null; then
-            files=$(git diff --name-only --no-renames "$base" HEAD)
+            files=$(git diff --name-only "$base" HEAD)
            if [ -n "$files" ]; then
              code=false; desktop=false; sdk=false; scripts=false
              # Root-module CI: desktop/ is a separate module, so only the
@@ -65,11 +62,10 @@ jobs:
              # both paths must trigger the sdk job.
              if echo "$files" | grep -qE '^(sdk/|internal/ext/extension/)'; then sdk=true; fi
              # The release-note tests render every committed Studio note; npm/ holds the publish tests.
-              if echo "$files" | grep -qE '^(scripts/|npm/|release-notes/studio/|\.github/workflows/release-studio\.yml$)'; then scripts=true; fi
-              platform=$(git diff -z --name-only --no-renames "$base" HEAD | bash scripts/ci-platform-scope.sh)
+              if echo "$files" | grep -qE '^(scripts/|npm/|release-notes/studio/)'; then scripts=true; fi
            fi
          fi
-          { echo "code=$code"; echo "desktop=$desktop"; echo "sdk=$sdk"; echo "scripts=$scripts"; echo "platform=$platform"; } >> "$GITHUB_OUTPUT"
+          { echo "code=$code"; echo "desktop=$desktop"; echo "sdk=$sdk"; echo "scripts=$scripts"; } >> "$GITHUB_OUTPUT"

  release-notes-scripts:
    needs: changes
@@ -81,14 +77,10 @@ jobs:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: "22"
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          cache: true
-      - run: node --test scripts/linux-install-smoke.test.mjs scripts/studio-artifacts.test.mjs scripts/ci-platform-scope.test.mjs scripts/cli-archive-build.test.mjs scripts/cli-archive-contents.test.mjs scripts/release-credits.test.mjs scripts/update-contributors.test.mjs scripts/update-acknowledgments.test.mjs scripts/markdown-refs.test.mjs scripts/studio-release-notes.test.mjs scripts/publish-cli-pointer.test.mjs scripts/studio-release-flags.test.mjs scripts/studio-notes-publish.test.mjs scripts/withdraw-version.test.mjs scripts/brew-cask-guard.test.mjs scripts/feedback-sync.test.mjs npm/publish.test.mjs
+      - run: node --test scripts/release-credits.test.mjs scripts/markdown-refs.test.mjs scripts/studio-release-notes.test.mjs npm/publish.test.mjs

  # The ruleset requires the per-OS check names (test (ubuntu-latest) etc.).
  # A matrix job skipped at job level reports no per-leg checks at all, so
@@ -97,9 +89,6 @@ jobs:
  # detector reports the diff is unrelated, every step skips and each leg
  # reports success in seconds. `always()` also keeps the legs alive when
  # the changes job itself fails (fail-open: an empty output != 'false').
-  # A pull request with no platform-relevant change moves the macOS and
-  # Windows legs onto an ubuntu runner with every step skipped: the check
-  # names the ruleset requires still report, without a scarce runner.
  test:
    needs: changes
    if: always()
@@ -107,9 +96,9 @@ jobs:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
-    runs-on: ${{ github.event_name == 'pull_request' && needs.changes.outputs.platform == 'false' && 'ubuntu-latest' || matrix.os }}
+    runs-on: ${{ matrix.os }}
    env:
-      RUN_STEPS: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code != 'false' && (matrix.os == 'ubuntu-latest' || needs.changes.outputs.platform != 'false')) }}
+      RUN_STEPS: ${{ github.event_name != 'pull_request' || needs.changes.outputs.code != 'false' }}
    steps:
      - if: env.RUN_STEPS == 'true'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -186,9 +175,12 @@ jobs:
      # budget above normal 7-9 minute runner variance; each package test binary
      # remains independently bounded by Go's per-package timeout below.
      #
-      # The per-package timeout is 18m: internal/assembly/boot took 478-717s
-      # (12 push runs) on the Windows runner, so 18m is 1.5x the worst. A hang
-      # still trips the step budget (25m smoke, 35m full).
+      # That timeout is 8m, not 3m: across four consecutive runs of the same
+      # code, internal/assembly/boot measured 133s, 146s, 162s and then hit 180s, and
+      # internal/runtime/agent 82s, 92s, 144s and 180s — a 2.2x spread from runner
+      # variance alone, with four heavy packages sharing four vCPUs. At 3m the
+      # step failed on slow runners without a code change; a hang still trips
+      # the 15 minute job budget above.
      #
      # Every root-module `go test` that runs on Windows passes -count=1. With
      # the result cache on, go test records each file and environment access
@@ -199,17 +191,11 @@ jobs:
      # internal/base/testenv holds every such step to it.
      - name: test (Windows smoke)
        if: env.RUN_STEPS == 'true' && runner.os == 'Windows' && github.event_name == 'pull_request'
-        timeout-minutes: 25
+        timeout-minutes: 15
        env:
          REASONIX_RELEASE_CACHE_GUARD: "1"
          WINDOWS_SANDBOX_WAIT_MS: "20000"
-        run: go test -count=1 -p 4 -timeout=18m ./internal/runtime/agent/... ./internal/platform/appidentity/... ./internal/assembly/boot/... ./internal/state/checkpoint/... ./internal/frontend/cli/... ./internal/session/control/... ./internal/base/filelock/... ./internal/base/fileutil/... ./internal/ext/hook/... ./internal/state/instruction/... ./internal/ext/mcplaunch/... ./internal/platform/notify/... ./internal/base/proc/... ./internal/platform/remote/... ./internal/platform/repair/... ./internal/safety/sandbox/... ./internal/base/sysproxy/... ./internal/state/workspacelease/... ./cmd/...
-
-      # Worktree rollback is absent from the broad Windows PR smoke list.
-      - name: test (Windows worktree rollback)
-        if: env.RUN_STEPS == 'true' && runner.os == 'Windows' && github.event_name == 'pull_request'
-        timeout-minutes: 3
-        run: go test -count=1 -timeout=2m -run '^TestDiscardUnpublished.*OnWindows$|^TestCreateFromDetachedHEADAndOccupiedBranch$' ./internal/platform/worktree
+        run: go test -count=1 -p 4 -timeout=8m ./internal/runtime/agent/... ./internal/platform/appidentity/... ./internal/assembly/boot/... ./internal/state/checkpoint/... ./internal/frontend/cli/... ./internal/session/control/... ./internal/base/filelock/... ./internal/base/fileutil/... ./internal/ext/hook/... ./internal/state/instruction/... ./internal/ext/mcplaunch/... ./internal/platform/notify/... ./internal/base/proc/... ./internal/platform/remote/... ./internal/platform/repair/... ./internal/safety/sandbox/... ./internal/base/sysproxy/... ./internal/state/workspacelease/... ./cmd/...

      # The general Windows PR smoke list intentionally omits internal/contract/tool.
      # Keep the session-temp portability contract covered without widening the
@@ -228,12 +214,14 @@ jobs:
        timeout-minutes: 5
        run: go test -count=1 -timeout=3m -run '^TestBashPowerShellExecuteDetailedContract$|^TestBashPowerShell51PreflightRejectsAndAndDetailed$|^TestBashPowerShellOutputIsUTF8$|^TestBashPowerShellSurfacesNonZeroExit$|^TestBashPowerShellRejectsChaining$' ./internal/tools/builtin

-      # Full push suite uses the same 18m package timeout as Windows smoke and a
-      # 35m step budget above it. -count=1 as at the smoke step. A failure prints
-      # the failed tests' output and the 15 slowest boot tests.
+      # Full push suite still uses the same 8m package budget as Windows smoke:
+      # agent/boot/control already hit 180s package timeouts under runner load,
+      # so 3m fails on slow machines without a code regression. It runs with
+      # -count=1 for the reason given at the smoke step. A hang still dies here
+      # rather than on a package.
      - name: test (full)
        if: env.RUN_STEPS == 'true' && runner.os == 'Windows' && github.event_name != 'pull_request'
-        timeout-minutes: 35
+        timeout-minutes: 30
        env:
          # Run the prompt-cache prefix-stability guard (TestCacheHit*) in CI: a
          # regression there silently tanks the cache hit rate the project is
@@ -242,25 +230,7 @@ jobs:
          # Bound sandbox helper children in Windows tests so a failed OS-level
          # launch cannot pin the Actions step after Go's package timeout fires.
          WINDOWS_SANDBOX_WAIT_MS: "20000"
-        shell: bash
-        run: |
-          go test -count=1 -p 4 -timeout=18m -json ./... | tee "$RUNNER_TEMP/full.jsonl" |
-            jq -rj --unbuffered 'select(.Action == "output" and .Test == null) | .Output'
-
-      - name: test (full) failure detail
-        if: failure() && env.RUN_STEPS == 'true' && runner.os == 'Windows' && github.event_name != 'pull_request'
-        shell: bash
-        run: |
-          f="$RUNNER_TEMP/full.jsonl"
-          [ -s "$f" ] || exit 0
-          echo "::group::output of failed tests"
-          jq -rn '[inputs | select(.Test != null)] | group_by(.Package + "/" + .Test)
-            | map(select(any(.[]; .Action == "fail")))[]
-            | map(select(.Action == "output") | .Output) | join("")' "$f" || true
-          echo "::endgroup::"
-          echo "slowest internal/assembly/boot tests (seconds, name):"
-          jq -rn '[inputs | select((.Package | endswith("/internal/assembly/boot")) and .Test != null and .Action == "pass")]
-            | sort_by(-.Elapsed)[:15][] | "\(.Elapsed)\t\(.Test)"' "$f" || true
+        run: go test -count=1 -p 4 -timeout=8m ./...

  race:
    needs: changes
@@ -315,9 +285,9 @@ jobs:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
-    runs-on: ${{ github.event_name == 'pull_request' && needs.changes.outputs.platform == 'false' && 'ubuntu-latest' || matrix.os }}
+    runs-on: ${{ matrix.os }}
    env:
-      RUN_STEPS: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.sdk != 'false' && (matrix.os == 'ubuntu-latest' || needs.changes.outputs.platform != 'false')) }}
+      RUN_STEPS: ${{ github.event_name != 'pull_request' || needs.changes.outputs.sdk != 'false' }}
    defaults:
      run:
        working-directory: sdk/go
@@ -422,7 +392,7 @@ jobs:
  # compile it against a real macOS toolchain.
  desktop-macos:
    needs: changes
-    if: always() && (github.event_name != 'pull_request' || (needs.changes.outputs.desktop != 'false' && needs.changes.outputs.platform != 'false'))
+    if: always() && (github.event_name != 'pull_request' || needs.changes.outputs.desktop != 'false')
    runs-on: macos-latest
    defaults:
      run:
@@ -450,7 +420,7 @@ jobs:
  # (//go:build windows), so the ubuntu leg above never compiles them.
  desktop-windows:
    needs: changes
-    if: always() && (github.event_name != 'pull_request' || (needs.changes.outputs.desktop != 'false' && needs.changes.outputs.platform != 'false'))
+    if: always() && (github.event_name != 'pull_request' || needs.changes.outputs.desktop != 'false')
    runs-on: windows-latest
    defaults:
      run:
@@ -521,7 +491,6 @@ jobs:
        run: |
          go run github.com/rhysd/actionlint/cmd/[email protected] \
            -ignore 'label "windows-11-arm" is unknown' \
-            -ignore 'label "ubuntu-22.04-arm" is unknown' \
            .github/workflows/release-studio.yml \
            .github/workflows/studio-certum-signing-smoke.yml \
            .github/workflows/ci.yml
@@ -561,7 +530,7 @@ jobs:
        run: go test -coverprofile=coverage.out -covermode=atomic ./...

      - name: upload coverage
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: coverage-report
          path: coverage.out
@@ -43,20 +43,20 @@ jobs:
        if: matrix.branch != ''
        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.language == 'go' && 'autobuild' || 'none' }}
      - name: Perform CodeQL Analysis
        if: matrix.branch == ''
-        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
        with:
          category: "/language:${{ matrix.language }}"
      # Results from a checked-out line are filed under that line's ref, not the
      # default branch the schedule happened to run from.
      - name: Perform CodeQL Analysis (${{ matrix.branch }})
        if: matrix.branch != ''
-        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
        with:
          category: "/language:${{ matrix.language }}"
          ref: refs/heads/${{ matrix.branch }}
@@ -24,7 +24,7 @@ jobs:
        with:
          version: 10
          run_install: false
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: "24"
          cache: pnpm
@@ -20,7 +20,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: '22'
          cache: npm
@@ -24,7 +24,7 @@ jobs:
        with:
          version: 10
          run_install: false
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: "24"
          cache: pnpm
@@ -1,44 +0,0 @@
-name: Deploy ops events relay
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: deploy-ops-events
-  cancel-in-progress: false
-
-jobs:
-  deploy:
-    if: github.ref == 'refs/heads/platform'
-    runs-on: ubuntu-latest
-    environment: production
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: '22'
-          cache: npm
-          cache-dependency-path: workers/ops-events/package-lock.json
-      - name: Validate
-        working-directory: workers/ops-events
-        run: |
-          npm ci
-          npm run typecheck
-          npm test
-      - name: Deploy
-        working-directory: workers/ops-events
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-        run: npx wrangler deploy
-      - name: Sync secrets
-        working-directory: workers/ops-events
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          GITHUB_WEBHOOK_SECRET: ${{ secrets.OPS_GITHUB_WEBHOOK_SECRET }}
-          OPS_LISTEN_TOKEN: ${{ secrets.OPS_LISTEN_TOKEN }}
-          OPS_EMIT_TOKEN: ${{ secrets.OPS_EMIT_TOKEN }}
-        run: |
-          node -e 'process.stdout.write(JSON.stringify({GITHUB_WEBHOOK_SECRET:process.env.GITHUB_WEBHOOK_SECRET||null,OPS_LISTEN_TOKEN:process.env.OPS_LISTEN_TOKEN||null,OPS_EMIT_TOKEN:process.env.OPS_EMIT_TOKEN||null}))' | npx wrangler secret bulk
@@ -23,12 +23,12 @@ jobs:
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          version: 10
          run_install: false

-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: "24"
          cache: pnpm
@@ -1,77 +0,0 @@
-name: Sync in-app feedback
-
-# Turns feedback submitted from Reasonix Studio into issues and reports issue
-# state (in progress, fixed in a tag, won't fix, duplicate) back to the worker,
-# and mirrors the reporter's replies onto their issue as bot comments.
-# Text from the public reaches the script only through the worker's JSON and
-# the GitHub API, never through a shell command line or an expression.
-
-on:
-  schedule:
-    - cron: '*/10 * * * *'
-    - cron: '5 3 * * *'
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: Print what would happen without creating issues or writing back
-        required: false
-        default: false
-        type: boolean
-      full:
-        description: Re-read every open entry instead of only recently changed issues
-        required: false
-        default: false
-        type: boolean
-
-permissions:
-  contents: read
-  issues: write
-
-concurrency:
-  group: feedback-sync
-  cancel-in-progress: false
-
-jobs:
-  sync:
-    if: github.repository == 'esengine/DeepSeek-Reasonix'
-    runs-on: ubuntu-latest
-    timeout-minutes: 8
-    steps:
-      - name: Check secret
-        id: gate
-        env:
-          FEEDBACK_ADMIN_TOKEN: ${{ secrets.FEEDBACK_ADMIN_TOKEN }}
-        run: |
-          if [ -z "$FEEDBACK_ADMIN_TOKEN" ]; then
-            echo "::notice::FEEDBACK_ADMIN_TOKEN is not set; feedback sync skipped"
-            echo "run=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "run=true" >> "$GITHUB_OUTPUT"
-          fi
-      - if: steps.gate.outputs.run == 'true'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          # git tag --contains needs full history; the tag API would cost a request per entry.
-          fetch-depth: 0
-          persist-credentials: false
-      - if: steps.gate.outputs.run == 'true'
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: '22'
-      - name: Sync
-        if: steps.gate.outputs.run == 'true'
-        env:
-          FEEDBACK_ADMIN_TOKEN: ${{ secrets.FEEDBACK_ADMIN_TOKEN }}
-          # crash.reasonix.io answers runner IPs with a managed challenge; workers.dev serves only the converter's admin paths.
-          FEEDBACK_BASE_URL: https://reasonix-crash-report.reasonix.workers.dev
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          DRY_RUN: ${{ github.event.inputs.dry_run || 'false' }}
-          FULL: ${{ github.event.inputs.full || 'false' }}
-          SCHEDULE: ${{ github.event.schedule }}
-        run: |
-          set -euo pipefail
-          args=()
-          if [ "$DRY_RUN" = "true" ]; then args+=(--dry-run); fi
-          # The daily schedule sweeps everything the change window could have missed.
-          if [ "$FULL" = "true" ] || [ "$SCHEDULE" = "5 3 * * *" ]; then args+=(--full); fi
-          node scripts/feedback-sync.mjs "${args[@]}"
@@ -43,7 +43,7 @@ jobs:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: '22'
      - name: Test sweeper
@@ -46,7 +46,7 @@ jobs:
          version: 10
          run_install: false

-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: "24"
          cache: pnpm
@@ -99,7 +99,7 @@ jobs:
            -c.extraMetadata.version="${{ steps.version.outputs.version }}"
          sha256sum ../../dist/ReasonixStudio-windows-amd64-installer.exe | tee -a "$GITHUB_STEP_SUMMARY"

-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: studio-selftest-windows-${{ steps.version.outputs.version }}
          path: dist/ReasonixStudio-windows-amd64-installer.exe
@@ -16,7 +16,7 @@ permissions:

 concurrency:
  group: studio-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  cancel-in-progress: true

 jobs:
  frontend:
@@ -33,7 +33,7 @@ jobs:
          version: 10
          run_install: false

-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: "24"
          cache: pnpm
@@ -81,197 +81,9 @@ jobs:
            exit 1
          fi

-  # Real-Chromium guards that run without a kernel. Only the ones that passed
-  # three consecutive local runs are wired; the rest stay manual (see
-  # desktop/frontend-next/perf/README.md). Skipped unless the SPA changed.
-  browser-guards:
-    name: browser guards
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    defaults:
-      run:
-        working-directory: desktop/frontend-next
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-
-      - name: SPA changed?
-        id: spa
-        working-directory: .
-        run: |
-          if [ "${{ github.event_name }}" = "pull_request" ] &&
-             git diff --quiet "origin/${{ github.base_ref }}...HEAD" -- desktop/frontend-next; then
-            echo "run=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "run=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - if: steps.spa.outputs.run == 'true'
-        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        with:
-          version: 10
-          run_install: false
-
-      - if: steps.spa.outputs.run == 'true'
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: "24"
-          cache: pnpm
-          cache-dependency-path: desktop/frontend-next/pnpm-lock.yaml
-
-      - if: steps.spa.outputs.run == 'true'
-        name: Install
-        run: pnpm install --frozen-lockfile
-
-      - if: steps.spa.outputs.run == 'true'
-        name: Build the perf harness and install Chromium
-        run: |
-          pnpm exec vite build --config vite.perf.config.ts
-          pnpm exec playwright install --with-deps chromium
-
-      - if: steps.spa.outputs.run == 'true'
-        name: Guards
-        run: |
-          python3 -m http.server 4399 --directory dist-perf >/dev/null 2>&1 &
-          for _ in $(seq 30); do curl -sf http://localhost:4399/perf.html >/dev/null && break; sleep 1; done
-          node perf/intrinsic.mjs
-          node perf/firstscreen-fonts.mjs
-          node perf/contrast.mjs
-          node perf/stickyfold.mjs
-          node perf/crumb.mjs
-          node perf/hoverradius.mjs
-          node perf/jump-ends.mjs
-          node perf/modelrows.mjs
-          node perf/explorersize.mjs
-          node perf/git-panel.mjs
-          node perf/session-move-to.mjs
-          node perf/shell-refused.mjs
-          node perf/rail-search-hold.mjs
-          node perf/session-move.mjs
-          node perf/session-ref.mjs
-          node perf/browser-full.mjs
-          node perf/mod-ui.mjs
-          node perf/codeeditor-size.mjs
-          node perf/action-icons.mjs
-          node perf/rowhit.mjs
-          node perf/tab-pip.mjs
-          node perf/context-card-hover.mjs
-          node perf/sessquick.mjs
-          node perf/sessionrows.mjs
-          node perf/wheel.mjs
-          node perf/branch-tooltip.mjs
-          node perf/branch-menu.mjs
-          node perf/image-preview.mjs
-          node perf/user-images.mjs
-          node perf/toast-anchor.mjs
-          node perf/addfolder-rest.mjs
-          node perf/scroll-jump.mjs
-          node perf/add-project-selects.mjs
-          node perf/setup-defer.mjs
-          node perf/narrow.mjs
-          node perf/settings-rows.mjs
-          node perf/narrow-steps.mjs
-          node perf/job-names.mjs
-          node perf/mcp-actions.mjs
-          node perf/web-access.mjs
-          node perf/peers-settings.mjs
-          node perf/provider-ports.mjs
-          node perf/peer-threads.mjs
-          node perf/text-size.mjs
-          node perf/fs-scale.mjs
-          node perf/composer-feel.mjs
-          node perf/side-panel.mjs
-          node perf/card-shell.mjs
-          node perf/line-cards.mjs
-          node perf/detail-panel.mjs
-          node perf/brand-lockup.mjs
-          node perf/notice-line.mjs
-          node perf/brought-line.mjs
-          node perf/modal-focus.mjs
-          node perf/focus-ring.mjs
-          node perf/narrow-forms.mjs
-          node perf/i18n-rendered.mjs
-          node perf/narrow-rail.mjs
-          node perf/selfcheck.mjs branch-tooltip
-
-  # What a hosted page does over the relay, end to end: the production bundle,
-  # the real Studio host and kernel, a real Chromium; only the accounts API and
-  # the relay are stand-ins (tools/relayfake). Event-transport changes are
-  # judged here, because a unit test of one side cannot see the other.
-  relay-harness:
-    name: relay harness
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-
-      - name: Transport changed?
-        id: scope
-        env:
-          BASE_REF: ${{ github.base_ref }}
-        run: |
-          paths="desktop/frontend-next internal/frontend/serve internal/platform/remotecloud internal/platform/account tools/relayfake cmd/reasonix-studio-host"
-          if [ "$GITHUB_EVENT_NAME" = "pull_request" ] &&
-             git diff --quiet "origin/$BASE_REF...HEAD" -- $paths; then
-            echo "run=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "run=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - if: steps.scope.outputs.run == 'true'
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          cache: true
-
-      - if: steps.scope.outputs.run == 'true'
-        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        with:
-          version: 10
-          run_install: false
-
-      - if: steps.scope.outputs.run == 'true'
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: "24"
-          cache: pnpm
-          cache-dependency-path: desktop/frontend-next/pnpm-lock.yaml
-
-      - if: steps.scope.outputs.run == 'true'
-        name: Build the host, the stand-ins and the page
-        run: |
-          go build -o desktop/frontend-next/relay/bin/studio-host ./cmd/reasonix-studio-host
-          go build -o desktop/frontend-next/relay/bin/relayfake ./tools/relayfake
-          cd desktop/frontend-next
-          pnpm install --frozen-lockfile
-          pnpm exec vite build --outDir dist-relay --emptyOutDir
-          pnpm exec playwright install --with-deps chromium
-
-      - if: steps.scope.outputs.run == 'true'
-        name: Scenarios (hosted page over the relay; local page on a flapping network)
-        working-directory: desktop/frontend-next
-        env:
-          RELAY_HOST_BIN: ${{ github.workspace }}/desktop/frontend-next/relay/bin/studio-host
-          RELAY_FAKE_BIN: ${{ github.workspace }}/desktop/frontend-next/relay/bin/relayfake
-          RELAY_DIST: ${{ github.workspace }}/desktop/frontend-next/dist-relay
-        run: |
-          node relay/live.mjs
-          node relay/storm.mjs
-
-  # A pull request with no platform-relevant change (scripts/ci-platform-scope.sh)
-  # moves the Windows and macOS legs onto an ubuntu runner with every step
-  # skipped, so the check names still report without a scarce runner. A push to
-  # studio, or a failed `scope`, runs all three.
  desktop:
    name: desktop (${{ matrix.os }})
-    needs: scope
-    if: always()
-    runs-on: ${{ github.event_name == 'pull_request' && needs.scope.outputs.platform == 'false' && matrix.os != 'ubuntu-22.04' && 'ubuntu-latest' || matrix.os }}
-    env:
-      RUN_STEPS: ${{ github.event_name != 'pull_request' || needs.scope.outputs.platform != 'false' || matrix.os == 'ubuntu-22.04' }}
+    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
@@ -280,11 +92,9 @@ jobs:
      run:
        working-directory: desktop
    steps:
-      - if: env.RUN_STEPS == 'true'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

-      - if: env.RUN_STEPS == 'true'
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: desktop/go.mod
          cache: true
@@ -297,97 +107,20 @@ jobs:
      # carries build dependencies of its own.
      # Same command as `make studio-test`; this job is already in desktop/.
      - name: go test
-        if: env.RUN_STEPS == 'true'
        run: go test ./...

-      - if: env.RUN_STEPS == 'true'
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: "24"
-
-      - name: CUA process and packaging contracts
-        if: env.RUN_STEPS == 'true'
-        timeout-minutes: 2
-        run: node --test --test-name-pattern=CUA electron/test/unit.mjs
-
-      - name: Install Linux native CUA fixture dependencies
-        if: env.RUN_STEPS == 'true' && runner.os == 'Linux'
-        run: sudo apt-get update && sudo apt-get install -y xvfb openbox dbus-x11 libgtk-3-dev at-spi2-core
-
-      - name: Native CUA application acceptance
-        if: env.RUN_STEPS == 'true'
-        timeout-minutes: 6
-        shell: bash
-        run: |
-          if [ "$RUNNER_OS" = Linux ]; then
-            dbus-run-session -- xvfb-run -a sh -c 'openbox >/tmp/reasonix-openbox.log 2>&1 & export NO_AT_BRIDGE=0 GTK_MODULES=gail:atk-bridge; node electron/test/cua-native.mjs'
-          else
-            node electron/test/cua-native.mjs
-          fi
-
      # The host sits in the main module and nothing else builds it, so its
      # dependency closure is checked here: it must stay CGO-free and
      # platform-neutral or the Electron bundle cannot ship it. Cross-compiling
      # is host-independent, so once is enough.
      - name: host stays pure Go and platform-neutral
-        if: env.RUN_STEPS == 'true' && runner.os == 'Linux'
+        if: runner.os == 'Linux'
        working-directory: .
        run: |
          for os in windows linux darwin; do
-            for arch in amd64 arm64; do
-              CGO_ENABLED=0 GOOS=$os GOARCH=$arch go build -o /dev/null ./cmd/reasonix-studio-host
-            done
+            CGO_ENABLED=0 GOOS=$os GOARCH=amd64 go build -o /dev/null ./cmd/reasonix-studio-host
          done

-  # The ARM64 leg queues on a scarcer runner pool, so a pull request runs it
-  # only when it touches what the leg verifies; a push to studio always does.
-  # The macOS and Windows package legs follow `platform`, the same rule as the
-  # desktop matrix above.
-  scope:
-    name: package matrix
-    runs-on: ubuntu-latest
-    outputs:
-      matrix: ${{ steps.pick.outputs.matrix }}
-      arm64: ${{ steps.pick.outputs.arm64 }}
-      platform: ${{ steps.pick.outputs.platform }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-
-      - id: pick
-        env:
-          EVENT: ${{ github.event_name }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-        run: |
-          arm64=true
-          platform=true
-          if [ "$EVENT" = pull_request ]; then
-            arm64=false
-            platform=$(git diff -z --name-only --no-renames "$BASE_SHA" HEAD | bash scripts/ci-platform-scope.sh)
-            if git diff --name-only --no-renames "$BASE_SHA" HEAD |
-              grep -qE '^(desktop/electron/|desktop/packaging/|desktop/cmd/update-helper/|desktop/cmd/studio-manifest/|desktop/go\.(mod|sum)$|cmd/reasonix-studio-host/|internal/platform/(update|appupdate)/|go\.(mod|sum)$|scripts/(linux-install-smoke|verify-linux-package|verify-linux-appimage|verify-studio-artifacts)\.sh$|scripts/(windows-signing-lib|verify-windows-package|verify-windows-authenticode|install-smoke)\.ps1$|\.github/workflows/(studio|release-studio)\.yml$)'; then
-              arm64=true
-            fi
-          fi
-          legs='[
-            {"os":"macos-latest","arch":"arm64","platform":"darwin"},
-            {"os":"ubuntu-22.04","arch":"amd64","platform":"linux"},
-            {"os":"windows-latest","arch":"amd64","platform":"windows","ebarch":"x64"}
-          ]'
-          if [ "$platform" = false ]; then
-            legs="$(jq -c 'map(select(.platform == "linux"))' <<<"$legs")"
-          elif [ "$arm64" = true ]; then
-            legs="$(jq -c '. + [{"os":"windows-11-arm","arch":"arm64","platform":"windows","ebarch":"arm64"},{"os":"ubuntu-22.04-arm","arch":"arm64","platform":"linux"}]' <<<"$legs")"
-          else
-            legs="$(jq -c . <<<"$legs")"
-          fi
-          {
-            echo "arm64=$arm64"
-            echo "platform=$platform"
-            echo "matrix={\"include\":$legs}"
-          } >> "$GITHUB_OUTPUT"
-
  # The packaging contract, on real artifacts rather than on the config that
  # describes them. Unsigned on purpose: signing and notarization are a
  # distribution concern and belong to the release workflow, and treating their
@@ -395,12 +128,20 @@ jobs:
  # cross-compile while only Windows had ever produced a package.
  package:
    name: package (${{ matrix.os }})
-    needs: scope
    runs-on: ${{ matrix.os }}
-    timeout-minutes: 45
    strategy:
      fail-fast: false
-      matrix: ${{ fromJSON(needs.scope.outputs.matrix) }}
+      matrix:
+        include:
+          - os: macos-latest
+            arch: arm64
+            platform: darwin
+          - os: ubuntu-22.04
+            arch: amd64
+            platform: linux
+          - os: windows-latest
+            arch: amd64
+            platform: windows
    defaults:
      run:
        shell: bash
@@ -418,40 +159,24 @@ jobs:
          version: 10
          run_install: false

-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: "24"
          cache: pnpm
          cache-dependency-path: desktop/electron/pnpm-lock.yaml

-      # electron-builder shells out to dpkg-deb through fakeroot for the .deb and
-      # to rpmbuild for the .rpm.
+      # electron-builder shells out to dpkg-deb through fakeroot for the .deb.
      - name: Install Linux packaging deps
        if: runner.os == 'Linux'
-        run: sudo apt-get update && sudo apt-get install -y fakeroot rpm cpio xvfb xauth policykit-1
-
-      # The fpm electron-builder carries is an x86_64 program, so on an ARM64
-      # runner the .deb and .rpm are built with one installed from RubyGems.
-      - name: Use a native fpm on ARM64 Linux
-        if: runner.os == 'Linux' && runner.arch == 'ARM64'
-        run: |
-          sudo apt-get install -y ruby ruby-dev build-essential
-          sudo gem install --no-document fpm -v 1.16.0
-          echo "USE_SYSTEM_FPM=true" >> "$GITHUB_ENV"
+        run: sudo apt-get update && sudo apt-get install -y fakeroot

      - name: Build the SPA
        working-directory: desktop/frontend-next
        run: pnpm install --frozen-lockfile && pnpm build

-      # The Windows legs name their architecture instead of taking the
-      # toolchain's, so a runner whose Go or Node is the other architecture
-      # fails here rather than shipping a mislabelled package.
      - name: Build the kernel the shell speaks to
        working-directory: desktop/electron
-        env:
-          REASONIX_GOARCH: ${{ matrix.platform == 'windows' && matrix.arch || '' }}
-          REASONIX_VERSION: v0.0.0-ci
-        run: pnpm install --frozen-lockfile && pnpm test && pnpm run build:host
+        run: pnpm install --frozen-lockfile && pnpm run build:host

      # The .deb's absolute-path payload. A no-op off Linux, so it is not
      # guarded here: the one place it must not be forgotten is the one place
@@ -466,8 +191,7 @@ jobs:
        working-directory: desktop/electron
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: "false"
-          ELECTRON_BUILDER_7Z_FILTER: ${{ matrix.platform == 'windows' && matrix.arch == 'arm64' && 'BCJ' || '' }}
-        run: pnpm run build:dist ${{ matrix.ebarch && format('--{0}', matrix.ebarch) || '' }} -c.extraMetadata.version=0.0.0-ci
+        run: pnpm run build:dist

      # The release vocabulary is GOARCH. electron-builder's own is not, and the
      # rename that reconciles them runs here rather than in the manifest.
@@ -483,99 +207,6 @@ jobs:
            exit 1
          fi

-      # An emulated x64 program runs on ARM64 Windows, so a package that merely
-      # starts proves nothing about its architecture: every PE image in the
-      # bundle has to be built for the one the package is named for.
-      - name: Every PE image is built for the package's architecture
-        if: matrix.platform == 'windows'
-        run: |
-          dir=$(find dist -maxdepth 1 -type d -name 'win*-unpacked' | head -1)
-          test -n "$dir"
-          node desktop/electron/packaging/pe.js "$dir" "${{ matrix.arch }}"
-
-      # An update starts the installer with --updated, and that is what keeps the
-      # shortcuts (and the taskbar pin hanging off them) from being deleted and
-      # recreated. Installed twice over itself the way an update does it, the
-      # desktop shortcut has to still be the same file, pointing at a path with
-      # no version in it, or every update costs the user their pin.
-      - name: An update keeps the shortcuts and they name no version
-        if: matrix.platform == 'windows'
-        shell: pwsh
-        run: |
-          $installer = (Get-ChildItem dist -Filter 'ReasonixStudio-windows-*-installer.exe' | Select-Object -First 1).FullName
-          $dir = Join-Path $env:RUNNER_TEMP 'rx-update-guard'
-          Start-Process $installer -ArgumentList '/S', "/D=$dir" -Wait
-          $lnk = Join-Path ([Environment]::GetFolderPath('Desktop')) 'Reasonix Studio.lnk'
-          $target = (New-Object -ComObject WScript.Shell).CreateShortcut($lnk).TargetPath
-          if ($target -ne (Join-Path $dir 'Reasonix Studio.exe')) { throw "the desktop shortcut targets $target, not the stable executable" }
-          $mark = [datetime]'2020-01-01'
-          (Get-Item $lnk).LastWriteTime = $mark
-          Start-Process $installer -ArgumentList '/S', '--updated', "/D=$dir" -Wait
-          if ((Get-Item $lnk).LastWriteTime -ne $mark) { throw 'an update rewrote the desktop shortcut' }
-          Start-Process (Join-Path $dir 'Uninstall Reasonix Studio.exe') -ArgumentList '/S', '/currentuser' -Wait
-
-      # The release packages a signed copy of the bundle and then reads both
-      # packages back against it. The same recipe on an unsigned copy, so the
-      # packaging contract (the installer's one application archive, the pinned
-      # elevate.exe, every PE image's architecture) is exercised on pull
-      # requests and not first by a release.
-      - name: The packages read back against the bundle they were made from
-        if: matrix.platform == 'windows'
-        shell: bash
-        env:
-          ELECTRON_BUILDER_7Z_FILTER: ${{ matrix.arch == 'arm64' && 'BCJ' || '' }}
-        run: |
-          rm -rf payload nsis-src packed zip-src
-          cp -r "$(find dist -maxdepth 1 -type d -name 'win*-unpacked' | head -1)" payload
-          rm -f payload/resources/elevate.exe
-          # The NSIS run writes elevate.exe into the tree it packs, so each
-          # packager gets a copy and payload stays what was signed.
-          cp -r payload zip-src
-          cp -r payload nsis-src
-          cd desktop/electron
-          pnpm exec electron-builder --prepackaged ../../zip-src --win zip --${{ matrix.ebarch }} \
-            -c.extraMetadata.version=0.0.0-ci -c.directories.output=../../packed-zip
-          pnpm exec electron-builder --prepackaged ../../nsis-src --win nsis --${{ matrix.ebarch }} \
-            -c.extraMetadata.version=0.0.0-ci -c.directories.output=../../packed
-          mv ../../packed-zip/ReasonixStudio-windows-${{ matrix.arch }}.zip ../../packed/
-          ls -la ../../packed
-
-      - name: verify-windows-package.ps1 accepts them
-        if: matrix.platform == 'windows'
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = 'Stop'
-          . ./scripts/windows-signing-lib.ps1
-          $digest = Get-ManifestDigest -Manifest @(Get-TreeManifest -Root payload)
-          ./scripts/verify-windows-package.ps1 `
-            -PayloadDirectory payload `
-            -ExpectedPayloadDigest $digest `
-            -InstallerPath "packed/ReasonixStudio-windows-${{ matrix.arch }}-installer.exe" `
-            -PortableArchivePath "packed/ReasonixStudio-windows-${{ matrix.arch }}.zip" `
-            -OutputPath "$env:RUNNER_TEMP/verify-output.txt" `
-            -Architecture ${{ matrix.arch }}
-          Get-Content "$env:RUNNER_TEMP/verify-output.txt"
-
-      # The release's own install smoke, against the unsigned installer: the
-      # package is installed where it is meant to run, its tree checked, and
-      # removed.
-      - name: The package installs, runs and uninstalls
-        if: matrix.platform == 'windows'
-        shell: pwsh
-        run: |
-          ./scripts/install-smoke.ps1 `
-            -Installer "dist/ReasonixStudio-windows-${{ matrix.arch }}-installer.exe" `
-            -Architecture ${{ matrix.arch }}
-
-      - name: Keep the arm64 installer for the x64 refusal check
-        if: matrix.platform == 'windows' && matrix.arch == 'arm64'
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: studio-arm64-installer-ci
-          path: dist/ReasonixStudio-windows-arm64-installer.exe
-          if-no-files-found: error
-          retention-days: 1
-
      # The update channel is the signed manifest. A second answer to which
      # version is current is not a convenience. The .blockmap is the same
      # channel's differential index and carries the release prefix, so it also
@@ -602,17 +233,47 @@ jobs:
          echo "page:   ${page:-<missing>}"
          test -n "$host" -a -n "$page"

-      - name: Linux packages carry their declared architecture and update payload
+      # Read off the package rather than off the config that describes it. Both
+      # of these went wrong the same way once: electron-builder names a package
+      # after package.json unless told, and fpm records the owner it finds on
+      # disk. Either one leaves a Studio that cannot update itself on Linux and
+      # says nothing about it until a user asks.
+      - name: The .deb is Studio's own package and carries what updates it
        if: runner.os == 'Linux'
-        run: bash scripts/verify-linux-package.sh "dist/ReasonixStudio-linux-${{ matrix.arch }}.deb" "dist/ReasonixStudio-linux-${{ matrix.arch }}.rpm" "${{ matrix.arch }}"
+        run: |
+          deb=$(ls dist/ReasonixStudio-linux-*.deb)
+          name=$(dpkg-deb -f "$deb" Package)
+          if [ "$name" != "reasonix-studio" ]; then
+            echo "::error::the package is $name; dpkg holds that beside the installed reasonix-studio instead of upgrading it, and update.StudioLine asks for it by name"
+            exit 1
+          fi
+          dpkg-deb -c "$deb" > contents.txt
+          # The path is the polkit action's exec.path annotation, so it is the
+          # only one authorization is granted for; root because polkit will not
+          # run a helper the invoking user could have written. Either spelling
+          # of root: dpkg-deb prints the numeric ids it cannot map, and which
+          # one it prints is a property of the machine reading the package
+          # rather than of the package.
+          if ! grep -qE '^-rwxr-xr-x (root/root|0/0) +[0-9]+ .* \./usr/lib/reasonix-studio/reasonix-studio-update-helper$' contents.txt; then
+            echo "::error::no root-owned executable update helper at the path the polkit action names"
+            grep reasonix-studio-update-helper contents.txt || echo "(not in the package at all)"
+            exit 1
+          fi
+          if ! grep -q './usr/share/polkit-1/actions/io.reasonix.studio.update.policy$' contents.txt; then
+            echo "::error::the polkit action is not in the package, so pkexec has nothing to authorize against"
+            exit 1
+          fi

-      - name: The Linux package installs, runs, reinstalls and uninstalls
+      # The Electron shell sets the package's glibc floor; a Go binary linked
+      # with cgo would raise it to the runner's own.
+      - name: The .deb's Go binaries are statically linked
        if: runner.os == 'Linux'
-        run: bash scripts/linux-install-smoke.sh "dist/ReasonixStudio-linux-${{ matrix.arch }}.deb" "${{ matrix.arch }}" 0.0.0-ci
-
-      - name: The AppImage carries its architecture, the kernel and the page
-        if: runner.os == 'Linux'
-        run: bash scripts/verify-linux-appimage.sh "dist/ReasonixStudio-linux-${{ matrix.arch }}.AppImage" "${{ matrix.arch }}"
+        run: |
+          deb=$(ls dist/ReasonixStudio-linux-*.deb)
+          dpkg-deb -x "$deb" "$RUNNER_TEMP/deb"
+          host=$(find "$RUNNER_TEMP/deb" -type f -path '*/resources/bin/reasonix-studio-host')
+          test -n "$host"
+          node desktop/electron/packaging/elf.js "$host" "$RUNNER_TEMP/deb/usr/lib/reasonix-studio/reasonix-studio-update-helper"

      # Recorded, not asserted: the real bundle layout, so later work argues
      # from what electron-builder produced rather than from its documentation.
@@ -640,27 +301,3 @@ jobs:
            echo "::error::the manifest has no entry for ${{ matrix.platform }}-${{ matrix.arch }}"
            exit 1
          fi
-
-  # The arm64 installer carries one application and no other. Run anywhere but
-  # ARM64 Windows it has to say so and stop, instead of exiting 0 with nothing
-  # installed.
-  arm64-installer-refuses-x64:
-    name: arm64 installer refuses an x64 machine
-    needs: [scope, package]
-    if: needs.scope.outputs.arm64 == 'true'
-    runs-on: windows-latest
-    steps:
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          name: studio-arm64-installer-ci
-          path: installer
-
-      - name: Run it silently
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = 'Stop'
-          $target = Join-Path $env:RUNNER_TEMP 'rx-refused'
-          $run = Start-Process -FilePath installer/ReasonixStudio-windows-arm64-installer.exe -ArgumentList '/S', "/D=$target" -Wait -PassThru
-          Write-Host "exit code $($run.ExitCode)"
-          if ($run.ExitCode -eq 0) { throw 'the arm64 installer exited 0 on an x64 machine' }
-          if (@(Get-ChildItem -Recurse -Force $target -ErrorAction SilentlyContinue).Count -ne 0) { throw 'the arm64 installer wrote into the target on an x64 machine' }
@@ -14,7 +14,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: '22'
      - name: Update README contributor tables
@@ -33,6 +33,6 @@ jobs:
          body: |
            Refreshes the README acknowledgments tables from the GitHub contributors API.

-            - Source: `repos/esengine/DeepSeek-Reasonix/contributors?per_page=50&anon=1`
-            - The repository owner, declared aliases, tool identities, bots and entries without a GitHub login are left out (`scripts/credit-identities.json`).
+            - Source: `repos/esengine/DeepSeek-Reasonix/contributors?per_page=20&anon=1`
+            - Anonymous contributors are shown without email addresses.
          labels: documentation
@@ -27,7 +27,7 @@ jobs:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: '22'
      - name: Test chart generator
@@ -1,84 +0,0 @@
-name: Withdraw a Studio version
-
-# Pulls a published Studio release out of the update catalog (or puts it back),
-# so installs stop being offered it without waiting for a new release. Only the
-# catalog changes: the release's files stay where they are, and a withdrawn
-# release can be restored with the same run.
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to withdraw or restore, for example 2.36.0"
-        required: true
-        type: string
-      reason:
-        description: "Why it is withdrawn (shown to users on that version); ignored when restoring"
-        required: false
-        type: string
-      restore:
-        description: "Put a withdrawn version back instead of withdrawing it"
-        required: false
-        type: boolean
-        default: false
-
-concurrency:
-  group: studio-catalog
-  cancel-in-progress: false
-
-jobs:
-  withdraw:
-    name: ${{ inputs.restore && 'restore' || 'withdraw' }} ${{ inputs.version }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    environment: studio-release
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: studio
-          persist-credentials: false
-
-      - name: Update the Studio catalog
-        env:
-          VERSION: ${{ inputs.version }}
-          REASON: ${{ inputs.reason }}
-          RESTORE: ${{ inputs.restore }}
-          R2_BUCKET: ${{ secrets.R2_BUCKET }}
-          HAS_R2: ${{ secrets.R2_ACCESS_KEY_ID != '' && secrets.R2_SECRET_ACCESS_KEY != '' && secrets.R2_ACCOUNT_ID != '' && secrets.R2_BUCKET != '' }}
-        run: |
-          if [ "$HAS_R2" != "true" ]; then
-            echo "::error::R2 credentials are not configured, so the catalog cannot be changed"
-            exit 1
-          fi
-          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?$ ]]; then
-            echo "::error::version must look like 2.36.0"
-            exit 1
-          fi
-          aws configure set aws_access_key_id "${{ secrets.R2_ACCESS_KEY_ID }}"
-          aws configure set aws_secret_access_key "${{ secrets.R2_SECRET_ACCESS_KEY }}"
-          aws configure set default.region auto
-          endpoint="https://${{ secrets.R2_ACCOUNT_ID }}.r2.cloudflarestorage.com"
-          at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-          current=/tmp/studio-versions-current.json
-          next=/tmp/studio-versions-next.json
-          aws s3 cp "s3://${R2_BUCKET}/studio/versions.json" "$current" --endpoint-url "$endpoint"
-          if [ "$RESTORE" = "true" ]; then
-            bash scripts/withdraw-version.sh "$current" --restore "$VERSION" "$at" > "$next"
-            jq -e --arg v "$VERSION" '.versions | map(select((.version | ltrimstr("v")) == $v)) | length == 1' "$next" >/dev/null
-          else
-            bash scripts/withdraw-version.sh "$current" "$VERSION" "$REASON" "$at" > "$next"
-            jq -e --arg v "$VERSION" '(.versions | map(select((.version | ltrimstr("v")) == $v)) | length == 0) and (.withdrawn | map(select((.version | ltrimstr("v")) == $v)) | length == 1)' "$next" >/dev/null
-          fi
-          aws s3 cp "$next" "s3://${R2_BUCKET}/studio/versions.json" \
-            --endpoint-url "$endpoint" \
-            --content-type "application/json; charset=utf-8" \
-            --cache-control "public, max-age=300, stale-if-error=86400"
-          echo "Studio catalog updated for $VERSION (restore=$RESTORE)"
-
-      - name: Keep the GitHub release off the latest slot
-        if: ${{ !inputs.restore }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          VERSION: ${{ inputs.version }}
-        run: gh release edit "studio-v${VERSION}" --prerelease --latest=false --repo "$GITHUB_REPOSITORY"
@@ -15,7 +15,6 @@
 /runtime-resume
 /extension-protocol-gen
 /reasonix-plugin-example
-/mcp-line-counter-kit
 /reasonix-studio-host
 /signpath-contract
 /studio-delta
@@ -95,4 +94,3 @@ scripts/official-theme-art/__pycache__/
 # running, which on Windows is every rebuild while Studio is open.
 *.exe
 *.exe~
-/relayfake
@@ -11,7 +11,6 @@ fingerprint_files:
  - .github/workflows/release-studio.yml
  - .github/workflows/studio-certum-signing-smoke.yml
  - .github/actions/setup-certum/action.yml
-  - scripts/install-smoke.ps1
  - scripts/sign-certum.ps1
  - scripts/verify-windows-authenticode.ps1
  - scripts/verify-windows-package.ps1
@@ -181,35 +181,6 @@ porting to `studio`; do not open the same PR against both.
 5. Ensure `gofmt -l .` shows no changes
 6. Submit a pull request to that same branch

-## Pull request policy
-
-**Related changes.** If you have several related changes of one pattern, a
-tracking issue plus one pull request is easiest to review.
-
-**Issue first for features.** A change that adds behaviour rather than fixing a
-defect should link an issue the maintainers have agreed to before the work
-starts. A fix for a reproducible defect may open directly, with the failing test
-in the PR. Documentation-only and test-only PRs are reviewed at lower priority.
-
-**Review tiers.**
-
- Changes under the `sensitive:` paths declared in `REASONIX.md` get a full
-  review plus a security review, regardless of author.
- Every PR carries the four sections of the PR template: Cause, Blast radius,
-  Neighbouring behaviours tested, Why this layer.
- The new test must fail without the change.
- A UI change (`desktop/frontend-next/src` or the website pages) fills the
-  template's UI section: screenshots before and after, light and dark, wide
-  and phone width.
- The same section carries the line "Entries moved, hidden or removed".
- Hiding or removing a visible control needs a linked issue and a release-notes
-  line naming it, and updates `docs/STUDIO_PARITY.md` for a 1.x feature.
- Review holds these; no check reads them.
-
-**Transparency.** The PR template has an optional checkbox for disclosing AI
-assistance. It is for transparency only and does not change how a change is
-reviewed.
-
 ## Reporting issues

 Open an issue on GitHub with:
@@ -9,7 +9,7 @@ GOEXE := $(shell go env GOEXE)
 # One pin for the Makefile and the CI lint job; see .github/workflows/ci.yml.
 GOLANGCI_VERSION := $(shell cat .golangci-version)

-.PHONY: build vet fmt lint lint-go lint-install lint-cross lint-update coverage-gate coverage-gate-update pricecheck acp-conformance check test studio-test sdk-test sdk-test-race hooks cross clean studio
+.PHONY: build vet fmt lint lint-go lint-install lint-cross lint-update coverage-gate coverage-gate-update pricecheck check test studio-test sdk-test sdk-test-race hooks cross clean studio

 build:
 	CGO_ENABLED=0 go build -ldflags "$(LDFLAGS)" -o bin/reasonix$(GOEXE) ./cmd/reasonix
@@ -87,13 +87,6 @@ lint-cross:
 test: studio-test sdk-test
 	go test ./...

-# Drives `reasonix acp` with the official ACP TypeScript SDK and holds every
-# message it writes to the schema that SDK ships. Needs node and network for
-# `npm ci`, which runs without install scripts against a lockfile.
-acp-conformance: build
-	cd tools/acp-conformance && npm ci --ignore-scripts --no-audit --no-fund
-	cd tools/acp-conformance && REASONIX_BIN=$(CURDIR)/bin/reasonix$(GOEXE) npm test
-
 # The shell is a nested module, so the root `test` target never reaches it.
 studio-test:
 	cd desktop && go test ./...
@@ -18,8 +18,6 @@
  <a href="https://esengine.github.io/DeepSeek-Reasonix/">Website</a>
  &nbsp;·&nbsp;
  <strong><a href="https://discord.gg/XF78rEME2D">Discord</a></strong>
-  &nbsp;·&nbsp;
-  <strong><a href="https://qm.qq.com/q/i59b0z2R8s">QQ</a></strong>
 </p>

 <p align="center">
@@ -33,7 +31,6 @@
  <a href="https://github.com/esengine/DeepSeek-Reasonix/graphs/contributors"><img src="https://img.shields.io/github/contributors/esengine/DeepSeek-Reasonix.svg?style=flat-square&color=bc8cff&labelColor=161b22&logo=github&logoColor=white" alt="contributors"/></a>
  <a href="https://github.com/esengine/DeepSeek-Reasonix/discussions"><img src="https://img.shields.io/github/discussions/esengine/DeepSeek-Reasonix.svg?style=flat-square&color=58a6ff&labelColor=161b22&logo=github&logoColor=white" alt="Discussions"/></a>
  <a href="https://discord.gg/XF78rEME2D"><img src="https://img.shields.io/badge/discord-join-5865F2.svg?style=flat-square&labelColor=161b22&logo=discord&logoColor=white" alt="Discord"/></a>
-  <a href="https://qm.qq.com/q/i59b0z2R8s"><img src="https://img.shields.io/badge/QQ%20group-1093562660-12B7F5.svg?style=flat-square&labelColor=161b22&logo=tencentqq&logoColor=white" alt="QQ group 1093562660"/></a>
 </p>

 <p align="center">
@@ -43,73 +40,23 @@

 <br/>

-<p align="center"><strong>Open source · MIT · runs on your computer, model of your choice</strong></p>
-<h3 align="center">An open-source coding agent for your terminal, desktop, browser and editor.</h3>
-<p align="center">It reads your project, edits files and runs commands and tests. Have it ask before each step, or work on its own within limits you set. Files its edit tools changed can be rewound. New here? Start with the Studio desktop app.</p>
+<p align="center"><strong>Open source · MIT · a single Go binary</strong></p>
+<h3 align="center">A coding agent you can leave running.</h3>
+<p align="center">One local engine, four ways in — terminal, desktop app, browser, or your editor over ACP. Plan mode, permissions, a workspace sandbox and per-turn checkpoints keep a long autonomous run something you can still read and undo.</p>
 <p align="center">Maintained by <strong>Huahui Yu</strong>.</p>

 > [!IMPORTANT]
 > **Community · 加入社区** — bilingual Discord for setup help (`#help` / `#求助`), workflow showcases, and feature ideas. → **<https://discord.gg/XF78rEME2D>**
->
-> QQ group **DeepSeek-Reasonix官方群** (`1093562660`) → **<https://qm.qq.com/q/i59b0z2R8s>** ([QR code](./docs/assets/qq-group.svg))
-
-> Douyin: **做游戏的小鱼** (Douyin ID `22703872788`) · [QR code](./docs/assets/douyin.png)

 <br/>

-## ❤️Sponsor
-
-<table><tr><td width="180" align="center" valign="middle"><a href="https://www.rightapi.ai/register?aff=e083bf73" target="_blank" rel="sponsored noopener noreferrer"><img src="./.github/sponsor/rightcode.png" alt="Right Code" width="64"></a></td><td valign="middle">Thanks to Right Code for sponsoring this project! Right Code reliably provides routing services for models such as Claude Code, Codex, and Gemini, with both pay-as-you-go and monthly subscription billing options available. Invoices are available upon top-up, and enterprise and team users can receive dedicated one-on-one support. Register via <a href="https://www.rightapi.ai/register?aff=e083bf73" target="_blank" rel="sponsored noopener noreferrer">this link</a>.</td></tr><tr><td width="180" align="center" valign="middle"><a href="https://www.packyapi.ai/register?aff=rIbQ" target="_blank" rel="sponsored noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="./.github/sponsor/packycode-dark.svg"><img src="./.github/sponsor/packycode-light.svg" alt="PackyCode" width="80"></picture></a></td><td valign="middle">Thanks to PackyCode for sponsoring this project! Access leading AI models through PackyCode with one API endpoint and one API key, with automatic failover and dedicated high-speed routes for Codex and Claude Code. Register via <a href="https://www.packyapi.ai/register?aff=rIbQ" target="_blank" rel="sponsored noopener noreferrer">this link</a>.</td></tr></table>
-
-## What it is
-
-Reasonix is an open-source AI coding assistant. The program runs on your computer; the AI model is a service you configure, which receives what it reads. You describe a task in plain language; it reads code, edits files and runs commands and tests inside the project folder you choose, and shows you each step.
-
-You pick the model: a DeepSeek preset is built in, any OpenAI-compatible service is one config entry, and you pay the model provider directly.
-
-## What you get
-
- **Read, edit, run.** It reads code, edits files and runs tests and commands, all inside your project folder.
- **Permission levels.** Have it ask every time, or let everyday actions run on their own; your forbid rules always hold. To see the approach first, use plan mode: it starts work only once you approve.
- **Rewind.** A file is saved before it changes, so you can rewind by conversation turn without touching your git history. Only files its edit tools changed are covered, not what a shell command did.
-
-## 30-second start
-
-Download, add a model key, open a project. New here? Start with the Studio desktop app.
-
-1. Download and install the desktop app, Reasonix Studio, from the [releases page](https://github.com/esengine/DeepSeek-Reasonix/releases?q=studio-v&expanded=true).
-2. Open it and enter your model provider and key when asked.
-3. Open your project folder and write what you want, for example "add retry on failure to the http client".
-4. At the level you chose, it stops and asks before anything that needs your say-so. Allow it to continue, or refuse.
-
-Prefer a terminal? Download the `reasonix` command-line tool, run `reasonix setup` to pick a model, then run `reasonix`. See [Install](#install) and [Quick start](#quick-start).
-
-## Four ways to use it
-
- **Desktop app (Studio).** A graphical app; the best place to start.
- **Terminal.** A full-screen text interface; `reasonix run "task"` also works in scripts.
- **Browser.** `reasonix web` opens a web interface on your own machine.
- **Editor.** Install the extension in VS Code; other editors that support ACP (Agent Client Protocol, a common way for an editor to connect to an AI assistant) can connect to `reasonix acp`.
-
-All four are the same program underneath. What follows is for advanced users and contributors.
-
-## Use it from DeepSeek Harness
-
-DeepSeek Harness (`dsh`) can hand a task to Reasonix as a subagent over ACP. This repository publishes a plugin index for it:
-
-1. Run `reasonix setup` on the machine that runs `dsh`. In the DSH Web UI turn on Custom plugin markets (Plugins, More) and add this index in the Discover tab: `https://raw.githubusercontent.com/esengine/DeepSeek-Reasonix/studio/integrations/dsh-plugin/market-index.json`
-2. Install "Reasonix subagent" from it.
-3. Open the plugin's page and turn its switch on. While it is off the model has no `reasonix` tool and may run `reasonix -p` in its own shell, which looks like a delegation and is not one.
-
-Setup details, the permission policy and limits are in [Using Reasonix from DeepSeek Harness](./docs/DSH.md).
-
 ## Versions

 Reasonix ships on two lines. See the [version roadmap announcement](https://github.com/esengine/DeepSeek-Reasonix/discussions/10748) for the reasoning behind the split.

 | Line | Branch | Status | Get it |
 | --- | --- | --- | --- |
-| **Reasonix 2.x** | `studio` (this branch) | Active development | [Studio releases](https://github.com/esengine/DeepSeek-Reasonix/releases?q=studio-v&expanded=true) |
+| **Reasonix 2.x** | `studio` (this branch) | Active development, pre-release | [Studio releases](https://github.com/esengine/DeepSeek-Reasonix/releases?q=studio-v&expanded=true) |
 | **Reasonix 1.x** | [`main-v2`](https://github.com/esengine/DeepSeek-Reasonix/tree/main-v2) | Maintenance / stable | `npm i -g reasonix` · [desktop download](https://reasonix.io/?download=desktop#start) |

 - **Want something stable?** Stay on 1.x. It keeps receiving bug fixes,
@@ -128,8 +75,6 @@ or reimplemented on 2.x where they fit the new architecture.

 ## Features

-Technical highlights for advanced users.
-
 - **Config-driven.** Providers, the agent, enabled tools, and plugins are all
  declared in `reasonix.toml`. No hardcoded models.
 - **Multi-model & composable.** DeepSeek ships as a preset; any
@@ -154,14 +99,14 @@ Studio, and editor integrations all run the same local Reasonix engine.

 Download the package for your platform from the latest
 [Studio release](https://github.com/esengine/DeepSeek-Reasonix/releases?q=studio-v&expanded=true)
-(tagged `studio-v2.*`; candidates such as `-rc.N` are marked as
-pre-releases):
+(tagged `studio-v2.*`, published as pre-releases while 2.x is in active
+development):

 | Platform | Package | Architecture |
 | --- | --- | --- |
 | macOS | `.dmg` or `.zip` | Apple Silicon (`arm64`) / Intel (`amd64`) |
 | Windows | Installer `-installer.exe` or portable `.zip` | x64 |
-| Linux | `.deb`, `.rpm`, or `.AppImage` (download only) | x64 (`amd64`) / ARM64 (`arm64`, aarch64) |
+| Linux | `.deb` | x64 |

 Every package ships with a `.minisig` signature, and the release carries
 `SHA256SUMS`. Once installed, Studio updates itself in place.
@@ -250,8 +195,7 @@ For advanced CLI usage and configuration, see the **[CLI reference](./docs/CLI.m
 ## Documentation

 - **Getting started:** [Guide](./docs/GUIDE.md) · [CLI reference](./docs/CLI.md) ·
-  [Configuration paths](./docs/CONFIG_PATHS.md) · [ACP editor integration](./docs/ACP.md) ·
-  [Use from DeepSeek Harness](./docs/DSH.md)
+  [Configuration paths](./docs/CONFIG_PATHS.md) · [ACP editor integration](./docs/ACP.md)
 - **Features & troubleshooting:** [Subagent profiles](./docs/SUBAGENT_PROFILES.md) ·
  [Context Engine v2](./docs/SESSION_MEMORY_RETRIEVAL.md) ·
  [Capability diagnostics](./docs/CAPABILITY_DIAGNOSTICS.md) ·
@@ -287,11 +231,11 @@ A small list of folks whose work has shaped Reasonix the most — the current to
 <!-- reasonix-top-contributors:start -->
 | Contributor | Contributor | Contributor | Contributor |
 | --- | --- | --- | --- |
-| [**SivanCola**](https://github.com/SivanCola) | [**KHG420**](https://github.com/KHG420) | [**ttmouse**](https://github.com/ttmouse) | [**lifu963**](https://github.com/lifu963) |
-| [**HUQIANTAO**](https://github.com/HUQIANTAO) | [**Harbor404**](https://github.com/Harbor404) | [**GTC2080**](https://github.com/GTC2080) | [**mchenziyi**](https://github.com/mchenziyi) |
-| [**Li-Charles-One**](https://github.com/Li-Charles-One) | [**light-front-theory**](https://github.com/light-front-theory) | [**XTLine**](https://github.com/XTLine) | [**eghrhegpe**](https://github.com/eghrhegpe) |
-| [**noreply**](https://github.com/noreply) | [**chuiwenwei**](https://github.com/chuiwenwei) | [**xxoingr**](https://github.com/xxoingr) | [**Bernardxu123**](https://github.com/Bernardxu123) |
-| [**HaoyueQin**](https://github.com/HaoyueQin) | [**BuGlessRB**](https://github.com/BuGlessRB) | [**CVEngineer66**](https://github.com/CVEngineer66) | [**JesonChou**](https://github.com/JesonChou) |
+| [**SivanCola**](https://github.com/SivanCola) | [**esengine**](https://github.com/esengine) | [**ttmouse**](https://github.com/ttmouse) | [**lifu963**](https://github.com/lifu963) |
+| **reasonix** | [**HUQIANTAO**](https://github.com/HUQIANTAO) | [**GTC2080**](https://github.com/GTC2080) | [**mchenziyi**](https://github.com/mchenziyi) |
+| [**Li-Charles-One**](https://github.com/Li-Charles-One) | **merge-order-check** | [**light-front-theory**](https://github.com/light-front-theory) | **Yan Li** |
+| [**eghrhegpe**](https://github.com/eghrhegpe) | **wufengfan** | [**Bernardxu123**](https://github.com/Bernardxu123) | [**HaoyueQin**](https://github.com/HaoyueQin) |
+| [**CVEngineer66**](https://github.com/CVEngineer66) | [**KHG420**](https://github.com/KHG420) | [**JesonChou**](https://github.com/JesonChou) | [**SuMuxi66**](https://github.com/SuMuxi66) |
 <!-- reasonix-top-contributors:end -->

 Special thanks to [**Bernardxu123**](https://github.com/Bernardxu123) for designing the project logo and intro video.
@@ -321,9 +265,8 @@ coffee, not a contract — donations don't buy feature priority or change how
 issues get triaged.

 - **International** — PayPal: [paypal.me/yuhuahui](https://paypal.me/yuhuahui)
- **国内** — 微信支付 / 支付宝（扫码）
+- **国内** — 微信支付（扫码）

 <p align="center">
  <img src=".github/sponsor/wechat-pay.jpg" alt="WeChat Pay QR code" width="180"/>
-  <img src=".github/sponsor/alipay.jpg" alt="Alipay QR code" width="180"/>
 </p>
@@ -18,8 +18,6 @@
  <a href="https://esengine.github.io/DeepSeek-Reasonix/">官方网站</a>
  &nbsp;·&nbsp;
  <strong><a href="https://discord.gg/XF78rEME2D">Discord</a></strong>
-  &nbsp;·&nbsp;
-  <strong><a href="https://qm.qq.com/q/i59b0z2R8s">QQ</a></strong>
 </p>

 <p align="center">
@@ -33,7 +31,6 @@
  <a href="https://github.com/esengine/DeepSeek-Reasonix/graphs/contributors"><img src="https://img.shields.io/github/contributors/esengine/DeepSeek-Reasonix.svg?style=flat-square&color=bc8cff&labelColor=161b22&logo=github&logoColor=white" alt="contributors"/></a>
  <a href="https://github.com/esengine/DeepSeek-Reasonix/discussions"><img src="https://img.shields.io/github/discussions/esengine/DeepSeek-Reasonix.svg?style=flat-square&color=58a6ff&labelColor=161b22&logo=github&logoColor=white" alt="Discussions"/></a>
  <a href="https://discord.gg/XF78rEME2D"><img src="https://img.shields.io/badge/discord-join-5865F2.svg?style=flat-square&labelColor=161b22&logo=discord&logoColor=white" alt="Discord"/></a>
-  <a href="https://qm.qq.com/q/i59b0z2R8s"><img src="https://img.shields.io/badge/QQ%20group-1093562660-12B7F5.svg?style=flat-square&labelColor=161b22&logo=tencentqq&logoColor=white" alt="QQ group 1093562660"/></a>
 </p>

 <p align="center">
@@ -43,63 +40,13 @@

 <br/>

-<p align="center"><strong>开源 · MIT · 程序跑在你电脑上，模型自选</strong></p>
-<h3 align="center">终端、桌面、浏览器、编辑器里都能用的 AI 编程助手。</h3>
-<p align="center">它会读你的项目、改文件、跑命令和测试。每一步先问你，或在你划定的范围内自己做，由你选；它用编辑工具改过的文件可以退回去。第一次用，从桌面应用 Studio 开始。</p>
+<p align="center"><strong>开源 · MIT · 单个 Go 二进制</strong></p>
+<h3 align="center">可以一直开着跑的编码 Agent。</h3>
+<p align="center">一套本地引擎,四个入口——终端、桌面端、浏览器,或通过 ACP 接入你的编辑器。计划模式、权限、工作区沙箱与逐轮 checkpoint,让长时间自治运行始终可读、可撤销。</p>
 <p align="center">维护者：<strong>Huahui Yu</strong>。</p>

 > [!IMPORTANT]
 > **加入社区 · Community** — 双语 Discord，提供安装答疑（`#help` / `#求助`）、工作流展示与功能想法。→ **<https://discord.gg/XF78rEME2D>**
->
-> QQ 群 **DeepSeek-Reasonix官方群**（群号 `1093562660`）→ **<https://qm.qq.com/q/i59b0z2R8s>**（[二维码](./docs/assets/qq-group.svg)）
-
-> 抖音：**做游戏的小鱼**（抖音号 `22703872788`）· [二维码](./docs/assets/douyin.png)
-
-## ❤️赞助商
-
-<table><tr><td width="180" align="center" valign="middle"><a href="https://www.rightapi.ai/register?aff=e083bf73" target="_blank" rel="sponsored noopener noreferrer"><img src="./.github/sponsor/rightcode.png" alt="Right Code" width="64"></a></td><td valign="middle">感谢 Right Code 赞助了本项目！Right Code 稳定提供 Claude Code、Codex、Gemini 等模型的中转服务，并可选按量、包月两种计费模式。充值即可开票，企业、团队用户一对一对接。通过<a href="https://www.rightapi.ai/register?aff=e083bf73" target="_blank" rel="sponsored noopener noreferrer">此链接</a>注册。</td></tr><tr><td width="180" align="center" valign="middle"><a href="https://www.packyapi.ai/register?aff=rIbQ" target="_blank" rel="sponsored noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="./.github/sponsor/packycode-dark.svg"><img src="./.github/sponsor/packycode-light.svg" alt="PackyCode" width="80"></picture></a></td><td valign="middle">感谢 PackyCode 赞助了本项目！PackyCode 是一家稳定、高效的 API 中转服务商，统一域名、统一密钥、智能容灾切换。通过<a href="https://www.packyapi.ai/register?aff=rIbQ" target="_blank" rel="sponsored noopener noreferrer">此链接</a>注册。</td></tr></table>
-
-## 它是什么
-
-Reasonix 是一个开源的 AI 编程助手。程序跑在你的电脑上；AI 模型是你自己配置的服务，它读到的内容会发给这个服务。你用大白话描述任务，它在你选的项目文件夹里读代码、改文件、跑命令和测试，每一步都摆给你看。
-
-模型你自己选：内置 DeepSeek 预设，其他兼容 OpenAI 接口的服务填一条配置就行，费用直接付给模型服务商。
-
-## 你能得到什么
-
- **读、改、跑**：读你的项目、改文件、跑测试和命令，都在你选的项目文件夹里。
- **权限分档**：每次都问你，或让日常操作自动放行；你设的禁止规则始终有效。想先看方案，就开计划模式，批准后它才动手。
- **可回退**：改文件前先存快照，按对话轮次回退，不碰 git 历史。只覆盖编辑工具改的文件，命令行命令造成的改动不在内。
-
-## 30 秒上手
-
-下载、填模型密钥、打开项目。第一次用，从桌面应用 Studio 开始。
-
-1. 从[发布页](https://github.com/esengine/DeepSeek-Reasonix/releases?q=studio-v&expanded=true)下载并安装桌面应用 Reasonix Studio。
-2. 打开应用，按提示填入模型服务商和密钥。
-3. 打开你的项目文件夹，写下想做的事，例如“给 http 客户端加上失败重试”。
-4. 按你选的档位，该问你的操作它会先停下来问；同意就继续，不同意就拒绝。
-
-更喜欢终端的话，下载 `reasonix` 命令行后运行 `reasonix setup` 配好模型，再运行 `reasonix` 即可。详见[安装](#安装)和[快速开始](#快速开始)。
-
-## 四种用法
-
- **桌面应用（Studio）**：图形界面，适合第一次使用。
- **终端**：全屏文字界面，也能用 `reasonix run "任务"` 在脚本里运行。
- **浏览器**：`reasonix web` 在本机打开网页界面。
- **编辑器**：VS Code 安装扩展即可；其他支持 ACP（Agent Client Protocol，编辑器接入某个 AI 助手的通用约定）的编辑器，可连接 `reasonix acp`。
-
-四种用法背后是同一套程序。下面的内容写给进阶用户和贡献者。
-
-## 在 DeepSeek Harness 里使用
-
-DeepSeek Harness（`dsh`）可以通过 ACP 把任务交给 Reasonix 作为子智能体去做。本仓库为此发布了一个插件索引：
-
-1. 在运行 `dsh` 的机器上先运行 `reasonix setup`。在 DSH 网页界面打开“自定义插件市场”（插件，更多），再到 Discover 页添加这个索引：`https://raw.githubusercontent.com/esengine/DeepSeek-Reasonix/studio/integrations/dsh-plugin/market-index.json`
-2. 从中安装“Reasonix subagent”。
-3. 打开这个插件的页面，把它的开关打开。关着的时候模型没有 `reasonix` 工具，可能改在自己的 shell 里直接运行 `reasonix -p`，看起来像委派，其实不是。
-
-配置细节、权限策略和限制见 [在 DeepSeek Harness 中使用 Reasonix](./docs/DSH.md)。

 ## 版本

@@ -107,7 +54,7 @@ Reasonix 分为两条版本线，调整的原因见[版本路线公告](https://

 | 版本线 | 分支 | 状态 | 获取方式 |
 | --- | --- | --- | --- |
-| **Reasonix 2.x** | `studio`（当前分支） | 活跃开发 | [Studio 发布页](https://github.com/esengine/DeepSeek-Reasonix/releases?q=studio-v&expanded=true) |
+| **Reasonix 2.x** | `studio`（当前分支） | 活跃开发，预发布 | [Studio 发布页](https://github.com/esengine/DeepSeek-Reasonix/releases?q=studio-v&expanded=true) |
 | **Reasonix 1.x** | [`main-v2`](https://github.com/esengine/DeepSeek-Reasonix/tree/main-v2) | 维护 / 稳定 | `npm i -g reasonix` · [桌面端下载](https://reasonix.io/?download=desktop#start) |

 - **想要稳定**：继续使用 1.x。它会持续收到 Bug 修复、Provider / API 兼容、
@@ -122,8 +69,6 @@ Reasonix 分为两条版本线，调整的原因见[版本路线公告](https://

 ## 特性

-以下是写给进阶用户的技术要点。
-
 - **配置驱动**：provider、agent、启用的工具、插件全部在 `reasonix.toml` 中声明，
  内核无硬编码模型。
 - **多模型 · 可组合**：DeepSeek 作为预设内置；任何 OpenAI 兼容
@@ -143,13 +88,13 @@ Reasonix 分为两条版本线，调整的原因见[版本路线公告](https://
 ### Reasonix Studio（2.x）

 从最新的 [Studio 发布](https://github.com/esengine/DeepSeek-Reasonix/releases?q=studio-v&expanded=true)
-下载对应平台的安装包（标签为 `studio-v2.*`；`-rc.N` 等候选版本标为预发布）：
+下载对应平台的安装包（标签为 `studio-v2.*`，2.x 活跃开发期间以预发布形式发布）：

 | 平台 | 安装包 | 架构 |
 | --- | --- | --- |
 | macOS | `.dmg` 或 `.zip` | Apple Silicon（`arm64`）/ Intel（`amd64`） |
 | Windows | 安装器 `-installer.exe` 或便携 `.zip` | x64 |
-| Linux | `.deb`、`.rpm` 或 `.AppImage`（只提供下载） | x64（`amd64`）/ ARM64（`arm64`，aarch64） |
+| Linux | `.deb` | x64 |

 每个安装包都附带 `.minisig` 签名，发布页另有 `SHA256SUMS`。安装后 Studio 会在
 应用内自行更新。
@@ -231,7 +176,7 @@ CLI 进阶用法和详细配置见 **[CLI 命令参考](./docs/CLI.zh-CN.md)**

 - **开始使用：** [指南](./docs/GUIDE.zh-CN.md) ·
  [CLI 命令参考](./docs/CLI.zh-CN.md) · [配置路径](./docs/CONFIG_PATHS.md) ·
-  [ACP 编辑器接入](./docs/ACP.md) · [在 DeepSeek Harness 中使用](./docs/DSH.md)
+  [ACP 编辑器接入](./docs/ACP.md)
 - **功能与排障：** [子智能体 Profile](./docs/SUBAGENT_PROFILES.md) ·
  [Context Engine v2](./docs/SESSION_MEMORY_RETRIEVAL.md) ·
  [能力诊断](./docs/CAPABILITY_DIAGNOSTICS.md) ·
@@ -268,11 +213,11 @@ CLI 进阶用法和详细配置见 **[CLI 命令参考](./docs/CLI.zh-CN.md)**
 <!-- reasonix-top-contributors:start -->
 | Contributor | Contributor | Contributor | Contributor |
 | --- | --- | --- | --- |
-| [**SivanCola**](https://github.com/SivanCola) | [**KHG420**](https://github.com/KHG420) | [**ttmouse**](https://github.com/ttmouse) | [**lifu963**](https://github.com/lifu963) |
-| [**HUQIANTAO**](https://github.com/HUQIANTAO) | [**Harbor404**](https://github.com/Harbor404) | [**GTC2080**](https://github.com/GTC2080) | [**mchenziyi**](https://github.com/mchenziyi) |
-| [**Li-Charles-One**](https://github.com/Li-Charles-One) | [**light-front-theory**](https://github.com/light-front-theory) | [**XTLine**](https://github.com/XTLine) | [**eghrhegpe**](https://github.com/eghrhegpe) |
-| [**noreply**](https://github.com/noreply) | [**chuiwenwei**](https://github.com/chuiwenwei) | [**xxoingr**](https://github.com/xxoingr) | [**Bernardxu123**](https://github.com/Bernardxu123) |
-| [**HaoyueQin**](https://github.com/HaoyueQin) | [**BuGlessRB**](https://github.com/BuGlessRB) | [**CVEngineer66**](https://github.com/CVEngineer66) | [**JesonChou**](https://github.com/JesonChou) |
+| [**SivanCola**](https://github.com/SivanCola) | [**esengine**](https://github.com/esengine) | [**ttmouse**](https://github.com/ttmouse) | [**lifu963**](https://github.com/lifu963) |
+| **reasonix** | [**HUQIANTAO**](https://github.com/HUQIANTAO) | [**GTC2080**](https://github.com/GTC2080) | [**mchenziyi**](https://github.com/mchenziyi) |
+| [**Li-Charles-One**](https://github.com/Li-Charles-One) | **merge-order-check** | [**light-front-theory**](https://github.com/light-front-theory) | **Yan Li** |
+| [**eghrhegpe**](https://github.com/eghrhegpe) | **wufengfan** | [**Bernardxu123**](https://github.com/Bernardxu123) | [**HaoyueQin**](https://github.com/HaoyueQin) |
+| [**CVEngineer66**](https://github.com/CVEngineer66) | [**KHG420**](https://github.com/KHG420) | [**JesonChou**](https://github.com/JesonChou) | [**SuMuxi66**](https://github.com/SuMuxi66) |
 <!-- reasonix-top-contributors:end -->

 特别感谢 [**Bernardxu123**](https://github.com/Bernardxu123) 设计的项目 logo和开场视频。
@@ -300,10 +245,9 @@ CLI 进阶用法和详细配置见 **[CLI 命令参考](./docs/CLI.zh-CN.md)**
 如果 Reasonix 帮你省了时间或 token，欢迎请杯咖啡。捐助不会换来 feature
 优先级，也不会影响 issue 的处理顺序——就是「谢谢」。

- **国内** — 微信支付 / 支付宝（扫下方二维码）
+- **国内** — 微信支付（扫下方二维码）
 - **海外** — PayPal: [paypal.me/yuhuahui](https://paypal.me/yuhuahui)

 <p align="center">
  <img src=".github/sponsor/wechat-pay.jpg" alt="微信支付收款码" width="180"/>
-  <img src=".github/sponsor/alipay.jpg" alt="支付宝收款码" width="180"/>
 </p>
@@ -219,11 +219,9 @@ otherwise the block the model already has goes on reading as current.
 - `#<note>` in chat quick-adds an always-on instruction. The `remember` tool
  instead saves a fallible background fact (frontmatter file + `MEMORY.md`
  index). Fact `type` classifies content; independent `scope` controls whether it
-  is project-only (the default) or explicitly global.
- The saved-fact index stays out of the stable prefix and is reached through the
-  `memory` tool; pinned bodies and global user/feedback bodies load into it, the
-  latter as lower-priority compatibility guidance. The current turn receives a
-  tail note.
+  is project-only (the default) or explicitly global. The index loads into the
+  stable prefix on the next session; global user/feedback bodies also load as
+  lower-priority compatibility guidance. The current turn receives a tail note.

 ## Notes

@@ -322,31 +320,6 @@ Use `go test ./path/to/target/` to detect cycles **before** pushing. A `[setup f
 - **Keep the PR diff minimal.** Only the files relevant to the PR's purpose — no stray changes from other branches.
 - **Amend, don't add commits, for review feedback** — keeps the commit history clean.

-## Change discipline
-
-**Assess before editing.** For every change, humans and agents list callers,
-consumers of the same state, sibling features, reload/replay/restart paths,
-error and edge states, TUI/CLI and desktop equivalents, and wire mirrors.
-
-A fix that breaks a neighbouring behaviour is a failed fix.
-
-**Test the neighbourhood.** UI changes add or extend interaction tests for
-adjacent functions of the same component or flow (composer: submit, clear,
-queue, withdraw, restore, steer, failure, replay after reload) and run the whole
-affected suite.
-
-Write tests first; they must fail without the change.
-
-**Fix at the owning layer.** Use the existing unified pattern: no special-case
-flags, duplicated paths, or workarounds at the symptom site.
-
-If the design is duplicated or wrong, make the smallest unifying change:
-one path instead of two, deleting what becomes dead. Use current language and
-framework idioms; do not add a new pattern where one exists.
-
-**PR evidence.** Every PR description carries: Cause, Blast radius,
-Neighbouring behaviours tested, and Why this layer.
-
 ## Reasonix host checks

 The paths below decide what the agent is allowed to do — a wrong change here
@@ -369,14 +342,9 @@ out of how a path is spelled, which cannot tell `internal/auth` from
 - sensitive: internal/ext/pluginpkg/**
 - sensitive: internal/base/netclient/**
 - sensitive: internal/safety/redirectguard/**
- sensitive: internal/safety/endpointclient/**
 - sensitive: internal/safety/egress/**
 - sensitive: internal/platform/browser/**
 - sensitive: internal/platform/computer/**
- sensitive: internal/platform/gitpush/**
- sensitive: internal/session/control/git_push.go
- sensitive: internal/frontend/serve/git_push.go
- sensitive: internal/frontend/serve/host_routes.go

 One declaration, two effects: the same list is also the coverage gate's subject.
 `make coverage-gate` holds each path to the coverage it already has, because
@@ -407,8 +375,8 @@ observation, never by a check that ran afterwards.
 What follows bounds Observable today. It is not a restatement of the invariant:
 moving a number here must not move the promise.

- `scanWorkspace` walks the workspace and every granted extra root recursively,
-  skips VCS store dirs, and is `complete` only below 50k files in total. Over that, or past a walk error, it
+- `scanWorkspace` walks the workspace recursively, skips VCS store dirs, and is
+  `complete` only below 50k files. Over that, or past a walk error, it
  establishes nothing and the mutation stays unproven.
 - Symlinks are recorded by `Lstat`, so a write through one lands outside what
  the walk compares. Confining the resolved target is the sandbox's job.
@@ -420,7 +420,7 @@ own outcome).
 | `-suite` | `benchmarks/e2e` | Suite root (must contain `tasks/<id>/`). |
 | `-task` | *(all)* | Suite mode: run only these comma-separated task IDs (e.g. `-task fix-add-bug`); unknown IDs fail with the available list. |
 | `-attempts` | `1` | Suite and diff modes: retry a task until an attempt passes, up to N; enables the `Pass@≤N` KPI, and TTCS charges a retried solve with its failed attempts' wall. |
-| `-trials` | `1` | Suite mode: run every task N times and keep every outcome. Adds a **Reliability** line: `pass^N` (complete tasks that passed every trial) and `pass@N` (complete tasks with any pass), both over the tasks that ran all N trials only (`n/a` when none did), mean `pass@1` over every graded trial, and the flaky tasks by name; a task the token budget cut short is listed on an **Incomplete** line and is in neither. `Pass@≤N` asks whether the agent can solve a task; `pass^N` asks whether it does so every time. Cannot be combined with `-attempts`. |
+| `-trials` | `1` | Suite mode: run every task N times and keep every outcome. Adds a **Reliability** line: `pass^N` (tasks that passed every trial), `pass@N` (any trial), mean `pass@1` over all trials, and the flaky tasks by name. `Pass@≤N` asks whether the agent can solve a task; `pass^N` asks whether it does so every time. Cannot be combined with `-attempts`. |
 | `-tape-record DIR` | — | Suite mode, with `-meter`: record every provider exchange at the meter, one tape per task and trial (`DIR/<task>/trial-N/0001.request.json`, `.response.json`, `.response.body`). Taped runs use a fixed workdir path and pin the seeded files' times, because both reach the model through the workspace block and file listings. |
 | `-tape-replay DIR` | — | Suite mode, with `-meter`: answer each run from its tape instead of the provider, and add a **Replay** line naming the first request whose body differs from the recorded one, down to the message (`request 2, message 4 (tool)`), the tool list, or a field. The diverging request is kept as `NNNN.replayed.json` beside the recorded one. A kernel change that should not alter what the model is asked replays with every request matched. |
 | `-bin` | `reasonix` | Path to the reasonix binary. |
@@ -1,35 +0,0 @@
-# Compaction prefix probe
-
-## Method
-
-1. Measured on 2026-10-17 against the official `https://api.deepseek.com` OpenAI adapter, using the model returned by `/models`: `deepseek-flash`. Thinking was disabled. Inputs were synthetic; no workspace history or credentials are recorded here.
-2. Each of three text and three rich-history trials sent a main request to warm the prefix, then called the actual agent summary path, then an independent summary control. Rich history included a synthetic closed `read_file` call, result and reasoning. Warmup outputs were discarded, never executed.
-3. A summary had a 1,024-token output cap; warmups had 64. Success means a heading, preservation of the fixture's `ParseDuration` and zero-value constraint, no emitted tool calls, and `finish_reason=stop`. This checks the fixture's contract, not arbitrary-summary factual completeness.
-4. First-attempt reuse success counts successful reused summaries / six reused summaries. Fallback rate counts independent requests initiated by the reuse coordinator / six reuse trials; the six explicit independent controls are excluded. Both were 6/6 success and 0/6 fallbacks. Independent controls also succeeded 6/6.
-5. The raw result file records provider-reported usage and full stream latency, measured from adapter `Stream` until channel close. Token rows below sum only the three indicated summary requests; they exclude warmup, model listing and any earlier exploratory requests. Cache residency was uncontrolled; prior probes had warmed these synthetic prefixes.
-
-## Results
-
-| History | Shape | N | Prompt | Hit | Miss | Output | Median ms | Estimated USD |
-| --- | --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: |
-| Text | Reused | 3 | 3,714 | 3,072 | 642 | 636 | 1,713 | 0.000487116 |
-| Text | Independent | 3 | 1,218 | 768 | 450 | 644 | 1,610 | 0.000456204 |
-| Rich | Reused | 3 | 3,780 | 3,072 | 708 | 742 | 1,774 | 0.000560616 |
-| Rich | Independent | 3 | 1,341 | 768 | 573 | 921 | 1,815 | 0.000640854 |
-
-1. Estimates use the [official pricing](https://api-docs.deepseek.com/quick_start/pricing/) checked on the measurement date: off-peak Flash USD per million tokens, hit 0.003, miss 0.15, output 0.6. October 17 was a Saturday. Formula: `(hit*0.003 + miss*0.15 + output*0.6)/1_000_000`. These are token estimates, not account deductions.
-2. Reuse hit fractions were 82.7% (text) and 81.3% (rich), versus 63.1% and 57.3% for controls. This small fixture does **not** establish cost savings: retaining the system/catalog increased both total input and input cost. Text total cost increased 6.8%; rich total decreased 12.5% because output was shorter, not because input was cheaper.
-3. The six warmups consumed 7,032 prompt and 231 output tokens, estimated USD 0.000346680. All 18 recorded generation calls together cost an estimated USD 0.002491470. No failed-digest retry occurred in these live trials; the deterministic fallback tests establish its behavior and accounting.
-4. A rejected nonempty reused answer earns one independent-shape fallback. A separate truncation retry may enlarge the output cap, for at most three logical model calls total. Every actual attempt emits and records its own spend; returned usage is their sum. Empty output, stream errors and cancellation do not earn shape retries.
-5. These sequential, six-pair trials establish interoperability for one model, mode and short fixture. They do not estimate production failure probability, thinking-mode behavior, other models, cold-cache cost, or large-history savings.
-
-## Reproduction
-
-1. Provide a test key through an existing secret environment configuration. Do not put credentials in source, command arguments or captured logs. Select a model currently returned by `/models`.
-2. Run the opt-in probe; it skips without `DEEPSEEK_API_KEY`. The dedicated build tag avoids enabling unrelated live tests.
-
-```sh
-REASONIX_LIVE_MODEL=deepseek-flash go test -tags live_compaction ./internal/runtime/agent -run '^TestLiveCompactionPrefix$' -v -count=1
-```
-
-3. This probe exercises actual summary construction and the HTTP adapter. The hermetic `TestEffectCompactionSharesThePreviouslySentPrefix` separately exercises manual, automatic pressure and rich history through `boot.Build`, comparing actual JSON request-prefix and schema bytes. Its sparse-history case also proves an interleaved retained user turn survives the fold.
@@ -1,512 +0,0 @@
-[
-  {
-    "model": "deepseek-flash",
-    "rich": false,
-    "trial": 1,
-    "results": [
-      {
-        "kind": "warm",
-        "milliseconds": 828,
-        "digest": false,
-        "grounded": false,
-        "tool_calls": 1,
-        "usage": {
-          "PromptTokens": 1127,
-          "CompletionTokens": 38,
-          "TotalTokens": 1165,
-          "CacheHitTokens": 896,
-          "CacheMissTokens": 231,
-          "CacheWriteTokens": 0,
-          "CacheWriteBilledTokens": 0,
-          "ReasoningTokens": 0,
-          "FinishReason": "tool_calls",
-          "Estimated": false,
-          "RequestCount": 1,
-          "ServerToolRequests": 0,
-          "ContextPromptTokens": 0,
-          "ContextCompletionTokens": 0,
-          "ContextReasoningTokens": 0,
-          "ContextCacheHitTokens": 0,
-          "ContextCacheMissTokens": 0
-        }
-      },
-      {
-        "kind": "reuse",
-        "milliseconds": 2006,
-        "digest": true,
-        "grounded": true,
-        "tool_calls": 0,
-        "usage": {
-          "PromptTokens": 1238,
-          "CompletionTokens": 234,
-          "TotalTokens": 1472,
-          "CacheHitTokens": 1024,
-          "CacheMissTokens": 214,
-          "CacheWriteTokens": 0,
-          "CacheWriteBilledTokens": 0,
-          "ReasoningTokens": 0,
-          "FinishReason": "stop",
-          "Estimated": false,
-          "RequestCount": 1,
-          "ServerToolRequests": 0,
-          "ContextPromptTokens": 0,
-          "ContextCompletionTokens": 0,
-          "ContextReasoningTokens": 0,
-          "ContextCacheHitTokens": 0,
-          "ContextCacheMissTokens": 0
-        }
-      },
-      {
-        "kind": "independent",
-        "milliseconds": 1817,
-        "digest": true,
-        "grounded": true,
-        "tool_calls": 0,
-        "usage": {
-          "PromptTokens": 406,
-          "CompletionTokens": 234,
-          "TotalTokens": 640,
-          "CacheHitTokens": 256,
-          "CacheMissTokens": 150,
-          "CacheWriteTokens": 0,
-          "CacheWriteBilledTokens": 0,
-          "ReasoningTokens": 0,
-          "FinishReason": "stop",
-          "Estimated": false,
-          "RequestCount": 1,
-          "ServerToolRequests": 0,
-          "ContextPromptTokens": 0,
-          "ContextCompletionTokens": 0,
-          "ContextReasoningTokens": 0,
-          "ContextCacheHitTokens": 0,
-          "ContextCacheMissTokens": 0
-        }
-      }
-    ]
-  },
-  {
-    "model": "deepseek-flash",
-    "rich": false,
-    "trial": 2,
-    "results": [
-      {
-        "kind": "warm",
-        "milliseconds": 820,
-        "digest": false,
-        "grounded": false,
-        "tool_calls": 1,
-        "usage": {
-          "PromptTokens": 1127,
-          "CompletionTokens": 38,
-          "TotalTokens": 1165,
-          "CacheHitTokens": 896,
-          "CacheMissTokens": 231,
-          "CacheWriteTokens": 0,
-          "CacheWriteBilledTokens": 0,
-          "ReasoningTokens": 0,
-          "FinishReason": "tool_calls",
-          "Estimated": false,
-          "RequestCount": 1,
-          "ServerToolRequests": 0,
-          "ContextPromptTokens": 0,
-          "ContextCompletionTokens": 0,
-          "ContextReasoningTokens": 0,
-          "ContextCacheHitTokens": 0,
-          "ContextCacheMissTokens": 0
-        }
-      },
-      {
-        "kind": "reuse",
-        "milliseconds": 1633,
-        "digest": true,
-        "grounded": true,
-        "tool_calls": 0,
-        "usage": {
-          "PromptTokens": 1238,
-          "CompletionTokens": 187,
-          "TotalTokens": 1425,
-          "CacheHitTokens": 1024,
-          "CacheMissTokens": 214,
-          "CacheWriteTokens": 0,
-          "CacheWriteBilledTokens": 0,
-          "ReasoningTokens": 0,
-          "FinishReason": "stop",
-          "Estimated": false,
-          "RequestCount": 1,
-          "ServerToolRequests": 0,
-          "ContextPromptTokens": 0,
-          "ContextCompletionTokens": 0,
-          "ContextReasoningTokens": 0,
-          "ContextCacheHitTokens": 0,
-          "ContextCacheMissTokens": 0
-        }
-      },
-      {
-        "kind": "independent",
-        "milliseconds": 1555,
-        "digest": true,
-        "grounded": true,
-        "tool_calls": 0,
-        "usage": {
-          "PromptTokens": 406,
-          "CompletionTokens": 202,
-          "TotalTokens": 608,
-          "CacheHitTokens": 256,
-          "CacheMissTokens": 150,
-          "CacheWriteTokens": 0,
-          "CacheWriteBilledTokens": 0,
-          "ReasoningTokens": 0,
-          "FinishReason": "stop",
-          "Estimated": false,
-          "RequestCount": 1,
-          "ServerToolRequests": 0,
-          "ContextPromptTokens": 0,
-          "ContextCompletionTokens": 0,
-          "ContextReasoningTokens": 0,
-          "ContextCacheHitTokens": 0,
-          "ContextCacheMissTokens": 0
-        }
-      }
-    ]
-  },
-  {
-    "model": "deepseek-flash",
-    "rich": false,
-    "trial": 3,
-    "results": [
-      {
-        "kind": "warm",
-        "milliseconds": 905,
-        "digest": false,
-        "grounded": false,
-        "tool_calls": 1,
-        "usage": {
-          "PromptTokens": 1127,
-          "CompletionTokens": 38,
-          "TotalTokens": 1165,
-          "CacheHitTokens": 896,
-          "CacheMissTokens": 231,
-          "CacheWriteTokens": 0,
-          "CacheWriteBilledTokens": 0,
-          "ReasoningTokens": 0,
-          "FinishReason": "tool_calls",
-          "Estimated": false,
-          "RequestCount": 1,
-          "ServerToolRequests": 0,
-          "ContextPromptTokens": 0,
-          "ContextCompletionTokens": 0,
-          "ContextReasoningTokens": 0,
-          "ContextCacheHitTokens": 0,
-          "ContextCacheMissTokens": 0
-        }
-      },
-      {
-        "kind": "reuse",
-        "milliseconds": 1713,
-        "digest": true,
-        "grounded": true,
-        "tool_calls": 0,
-        "usage": {
-          "PromptTokens": 1238,
-          "CompletionTokens": 215,
-          "TotalTokens": 1453,
-          "CacheHitTokens": 1024,
-          "CacheMissTokens": 214,
-          "CacheWriteTokens": 0,
-          "CacheWriteBilledTokens": 0,
-          "ReasoningTokens": 0,
-          "FinishReason": "stop",
-          "Estimated": false,
-          "RequestCount": 1,
-          "ServerToolRequests": 0,
-          "ContextPromptTokens": 0,
-          "ContextCompletionTokens": 0,
-          "ContextReasoningTokens": 0,
-          "ContextCacheHitTokens": 0,
-          "ContextCacheMissTokens": 0
-        }
-      },
-      {
-        "kind": "independent",
-        "milliseconds": 1610,
-        "digest": true,
-        "grounded": true,
-        "tool_calls": 0,
-        "usage": {
-          "PromptTokens": 406,
-          "CompletionTokens": 208,
-          "TotalTokens": 614,
-          "CacheHitTokens": 256,
-          "CacheMissTokens": 150,
-          "CacheWriteTokens": 0,
-          "CacheWriteBilledTokens": 0,
-          "ReasoningTokens": 0,
-          "FinishReason": "stop",
-          "Estimated": false,
-          "RequestCount": 1,
-          "ServerToolRequests": 0,
-          "ContextPromptTokens": 0,
-          "ContextCompletionTokens": 0,
-          "ContextReasoningTokens": 0,
-          "ContextCacheHitTokens": 0,
-          "ContextCacheMissTokens": 0
-        }
-      }
-    ]
-  },
-  {
-    "model": "deepseek-flash",
-    "rich": true,
-    "trial": 1,
-    "results": [
-      {
-        "kind": "warm",
-        "milliseconds": 561,
-        "digest": false,
-        "grounded": false,
-        "tool_calls": 1,
-        "usage": {
-          "PromptTokens": 1217,
-          "CompletionTokens": 39,
-          "TotalTokens": 1256,
-          "CacheHitTokens": 1024,
-          "CacheMissTokens": 193,
-          "CacheWriteTokens": 0,
-          "CacheWriteBilledTokens": 0,
-          "ReasoningTokens": 0,
-          "FinishReason": "tool_calls",
-          "Estimated": false,
-          "RequestCount": 1,
-          "ServerToolRequests": 0,
-          "ContextPromptTokens": 0,
-          "ContextCompletionTokens": 0,
-          "ContextReasoningTokens": 0,
-          "ContextCacheHitTokens": 0,
-          "ContextCacheMissTokens": 0
-        }
-      },
-      {
-        "kind": "reuse",
-        "milliseconds": 1774,
-        "digest": true,
-        "grounded": true,
-        "tool_calls": 0,
-        "usage": {
-          "PromptTokens": 1260,
-          "CompletionTokens": 256,
-          "TotalTokens": 1516,
-          "CacheHitTokens": 1024,
-          "CacheMissTokens": 236,
-          "CacheWriteTokens": 0,
-          "CacheWriteBilledTokens": 0,
-          "ReasoningTokens": 0,
-          "FinishReason": "stop",
-          "Estimated": false,
-          "RequestCount": 1,
-          "ServerToolRequests": 0,
-          "ContextPromptTokens": 0,
-          "ContextCompletionTokens": 0,
-          "ContextReasoningTokens": 0,
-          "ContextCacheHitTokens": 0,
-          "ContextCacheMissTokens": 0
-        }
-      },
-      {
-        "kind": "independent",
-        "milliseconds": 2271,
-        "digest": true,
-        "grounded": true,
-        "tool_calls": 0,
-        "usage": {
-          "PromptTokens": 447,
-          "CompletionTokens": 381,
-          "TotalTokens": 828,
-          "CacheHitTokens": 256,
-          "CacheMissTokens": 191,
-          "CacheWriteTokens": 0,
-          "CacheWriteBilledTokens": 0,
-          "ReasoningTokens": 0,
-          "FinishReason": "stop",
-          "Estimated": false,
-          "RequestCount": 1,
-          "ServerToolRequests": 0,
-          "ContextPromptTokens": 0,
-          "ContextCompletionTokens": 0,
-          "ContextReasoningTokens": 0,
-          "ContextCacheHitTokens": 0,
-          "ContextCacheMissTokens": 0
-        }
-      }
-    ]
-  },
-  {
-    "model": "deepseek-flash",
-    "rich": true,
-    "trial": 2,
-    "results": [
-      {
-        "kind": "warm",
-        "milliseconds": 610,
-        "digest": false,
-        "grounded": false,
-        "tool_calls": 1,
-        "usage": {
-          "PromptTokens": 1217,
-          "CompletionTokens": 39,
-          "TotalTokens": 1256,
-          "CacheHitTokens": 1024,
-          "CacheMissTokens": 193,
-          "CacheWriteTokens": 0,
-          "CacheWriteBilledTokens": 0,
-          "ReasoningTokens": 0,
-          "FinishReason": "tool_calls",
-          "Estimated": false,
-          "RequestCount": 1,
-          "ServerToolRequests": 0,
-          "ContextPromptTokens": 0,
-          "ContextCompletionTokens": 0,
-          "ContextReasoningTokens": 0,
-          "ContextCacheHitTokens": 0,
-          "ContextCacheMissTokens": 0
-        }
-      },
-      {
-        "kind": "reuse",
-        "milliseconds": 2263,
-        "digest": true,
-        "grounded": true,
-        "tool_calls": 0,
-        "usage": {
-          "PromptTokens": 1260,
-          "CompletionTokens": 276,
-          "TotalTokens": 1536,
-          "CacheHitTokens": 1024,
-          "CacheMissTokens": 236,
-          "CacheWriteTokens": 0,
-          "CacheWriteBilledTokens": 0,
-          "ReasoningTokens": 0,
-          "FinishReason": "stop",
-          "Estimated": false,
-          "RequestCount": 1,
-          "ServerToolRequests": 0,
-          "ContextPromptTokens": 0,
-          "ContextCompletionTokens": 0,
-          "ContextReasoningTokens": 0,
-          "ContextCacheHitTokens": 0,
-          "ContextCacheMissTokens": 0
-        }
-      },
-      {
-        "kind": "independent",
-        "milliseconds": 1783,
-        "digest": true,
-        "grounded": true,
-        "tool_calls": 0,
-        "usage": {
-          "PromptTokens": 447,
-          "CompletionTokens": 242,
-          "TotalTokens": 689,
-          "CacheHitTokens": 256,
-          "CacheMissTokens": 191,
-          "CacheWriteTokens": 0,
-          "CacheWriteBilledTokens": 0,
-          "ReasoningTokens": 0,
-          "FinishReason": "stop",
-          "Estimated": false,
-          "RequestCount": 1,
-          "ServerToolRequests": 0,
-          "ContextPromptTokens": 0,
-          "ContextCompletionTokens": 0,
-          "ContextReasoningTokens": 0,
-          "ContextCacheHitTokens": 0,
-          "ContextCacheMissTokens": 0
-        }
-      }
-    ]
-  },
-  {
-    "model": "deepseek-flash",
-    "rich": true,
-    "trial": 3,
-    "results": [
-      {
-        "kind": "warm",
-        "milliseconds": 834,
-        "digest": false,
-        "grounded": false,
-        "tool_calls": 1,
-        "usage": {
-          "PromptTokens": 1217,
-          "CompletionTokens": 39,
-          "TotalTokens": 1256,
-          "CacheHitTokens": 1024,
-          "CacheMissTokens": 193,
-          "CacheWriteTokens": 0,
-          "CacheWriteBilledTokens": 0,
-          "ReasoningTokens": 0,
-          "FinishReason": "tool_calls",
-          "Estimated": false,
-          "RequestCount": 1,
-          "ServerToolRequests": 0,
-          "ContextPromptTokens": 0,
-          "ContextCompletionTokens": 0,
-          "ContextReasoningTokens": 0,
-          "ContextCacheHitTokens": 0,
-          "ContextCacheMissTokens": 0
-        }
-      },
-      {
-        "kind": "reuse",
-        "milliseconds": 1575,
-        "digest": true,
-        "grounded": true,
-        "tool_calls": 0,
-        "usage": {
-          "PromptTokens": 1260,
-          "CompletionTokens": 210,
-          "TotalTokens": 1470,
-          "CacheHitTokens": 1024,
-          "CacheMissTokens": 236,
-          "CacheWriteTokens": 0,
-          "CacheWriteBilledTokens": 0,
-          "ReasoningTokens": 0,
-          "FinishReason": "stop",
-          "Estimated": false,
-          "RequestCount": 1,
-          "ServerToolRequests": 0,
-          "ContextPromptTokens": 0,
-          "ContextCompletionTokens": 0,
-          "ContextReasoningTokens": 0,
-          "ContextCacheHitTokens": 0,
-          "ContextCacheMissTokens": 0
-        }
-      },
-      {
-        "kind": "independent",
-        "milliseconds": 1815,
-        "digest": true,
-        "grounded": true,
-        "tool_calls": 0,
-        "usage": {
-          "PromptTokens": 447,
-          "CompletionTokens": 298,
-          "TotalTokens": 745,
-          "CacheHitTokens": 256,
-          "CacheMissTokens": 191,
-          "CacheWriteTokens": 0,
-          "CacheWriteBilledTokens": 0,
-          "ReasoningTokens": 0,
-          "FinishReason": "stop",
-          "Estimated": false,
-          "RequestCount": 1,
-          "ServerToolRequests": 0,
-          "ContextPromptTokens": 0,
-          "ContextCompletionTokens": 0,
-          "ContextReasoningTokens": 0,
-          "ContextCacheHitTokens": 0,
-          "ContextCacheMissTokens": 0
-        }
-      }
-    ]
-  }
-]
@@ -3,12 +3,12 @@
 Two questions about long-horizon memory, and the harness that makes their
 answers trustworthy.

-    -mode=preflight     build all 18 tasks under every arm and check the contract
+    -mode=preflight     build all 12 tasks under every arm and check the contract
    -mode=snippet       does a rank-1 hit hand over the whole answer?
    -mode=adversarial   send a model after the answer through every host surface
    -mode=run-search    Experiment R: is searchable canonical a real capability?
-    -mode=run-boundary  Experiment I, paired: the 6 efficiency tasks across their boundary
-    -mode=run-index     Experiment I, full: the 6 efficiency tasks x 4 budgets
+    -mode=run-boundary  Experiment I, paired: 6 tasks across their own cue boundary
+    -mode=run-index     Experiment I, full: 6 tasks x 4 index budgets
    -mode=calibrate     find each index task's PlantAfterGen for its cue tier

 `-dry` drives any run mode with a scripted provider, for nothing. Real runs need
@@ -22,28 +22,17 @@ addresses by hand at roughly nine times the page-in cost (139 vs 1292
 tokens/task). Measured after three separate leaks were closed, so the numbers
 are from a clean environment.

-**Fold index marginal utility: direction reproduced, size still conditional.** On the v2
-substrate the direction holds in six of six tasks and in the pooled paired batch: with the
-cue visible the index addresses the target, so the same task is searched less and pages in
-less (0.67 searches and 70 recall tokens per task, against 1.50 and 120 with the cue
-absent).
+**Fold index marginal utility: unresolved.** Both the positive and the negative
+estimates are invalidated. The first Stage 2 ran in a contaminated environment.
+The clean paired batch found a consistent effect (six of six tasks searched less
+and paged in less with the cue visible), and the same-batch dose-response did
+not reproduce it (`boundary-aligned 0/4`, recall-token delta reversing sign).
+The most likely reason is that two of the six index tasks carry heavy-tail
+stopping behaviour that swamps the effect being measured.

-A size is visible but is not yet quotable. On the four tasks whose absent-cue arm stayed
-out of a loop, the index cost 64,952 prompt tokens against 115,551 without, 44% less
-(`i106-budgetseal` -35,147, `i70-ingestfloor` -8,222, `i37-dispatchlag` -7,599, and
-`i112-lagquota` +369, the prefix rent a task that never searches pays). That is a
-**post-hoc subset**: `i118-fencelag` and `i47-tenantlease` are excluded because their
-absent-cue arm looped in this batch (five and three retrieval rounds, three escapes each;
-together 80% of the absent-cue total), and the qualification above does not screen for
-stopping behaviour — holding on both boundary arms across three passes shows a stable cue
-boundary, not a stopping arm. Quoting 44% as the index's effect would mean choosing the
-sample after seeing the result; a batch screened on stopping stability is what would make
-a size quotable, and one arm also reverses either way (`i70-ingestfloor` default, +11,135
-prompt tokens over three escapes).
-
-Batch facts, because the counts differ: 36 runs were executed (12 paired, 24 index), and
-the token totals here cover the 24-run index batch — the paired batch ran before the
-per-run usage line existed.
+Existing evidence is not sufficient to tune the shipped 1% budget in either
+direction. Reopening this wants a new corpus, not more samples: see
+"Index corpus v2" below.

 **Things that turned out not to be problems**, each after being measured rather
 than argued about:
@@ -85,83 +74,11 @@ scanned for answer literals before the first provider request and again after
 the turn. Any answer reaching the model through a tool that is not `recall`
 marks the run contaminated and takes it out of every statistic.

-## Index corpus v2
+## Index corpus v2, if this is reopened

-The efficiency substrate is six tasks that hold on both arms: `i37-dispatchlag`
-and `i118-fencelag` (quarter), `i106-budgetseal` and `i70-ingestfloor` (half),
-`i47-tenantlease` and `i112-lagquota` (default).
-
-They came out of five batches of candidates, each screened the same way: one
-`-mode=run-index` pass over the batch, then two more only for the candidates that
-were clean on both boundary arms, and only the candidates that held on both arms
-in all three passes stayed. A candidate that does not hold is dropped, not
-promoted. The numbers are candidates, per tier:
-
-| batch | quarter | half | default |
-| --- | --- | --- | --- |
-| first pool, `i31`-`i54` | 1 of 8 | 0 of 8 | 2 of 8 |
-| second pool, `i61`-`i84` | 1 of 4 screened | 4 of 8 | 0 of 8 |
-| third pool, `i85`-`i108` | 2 of 8 | 8 of 16 | none authored |
-| replacement pool, `i109`-`i116` | - | - | 4 of 8 |
-| replacement pool, `i92`, `i117`-`i124` | 3 of 9 | - | - |
-
-That table counts candidates that held on both arms in all three passes, which is
-not the size of the substrate. 89 candidates were authored, 77 were screened (the
-second pool's quarter tier stopped at 4 of 8 and its default tier was never run),
-and 25 held: 7 quarter, 12 half, 6 default. The substrate keeps two per tier, so
-the other 19 survivors are spares rather than corpus members. Candidates from the
-earlier round are not counted here.
-
-| task | tier | cue present | cue absent |
-| --- | --- | ---: | ---: |
-| `i37-dispatchlag` | quarter | 3/3 | 3/3 |
-| `i118-fencelag` | quarter | 3/3 | 3/3 |
-| `i106-budgetseal` | half | 3/3 | 3/3 |
-| `i70-ingestfloor` | half | 3/3 | 3/3 |
-| `i47-tenantlease` | default | 3/3 | 3/3 |
-| `i112-lagquota` | default | 3/3 | 3/3 |
-
-Across their 36 judged cells: `SnippetStop` 23, `SnippetThenRead` 10 and
-`DefensiveRead` 3 - every cell clean, nothing post-sufficient and nothing
-`NeverSufficient`.
-
-Four of the first six were flagged in review for sharing answer values, probe
-queries and prompt wording within a tier. Separating them and re-screening those
-four changed two of them: `i37` and `i47` held, `i62` and `i51` did not, so they
-were replaced - `i90-recoverylag` was tried first and did not hold either, and
-`i118-fencelag` and `i112-lagquota` are what did. The separation was not
-cosmetic: the shared wording had been carrying two of the six.
-
-Nothing in the task shape separates the survivors from the rest: within the half
-tier, plain-number answers survived 0 of 8 in the first pool and 4 of 8 in the
-second, and codename answers survived 8 of 16 in the third. An earlier claim here
-that the answer kind decides whether a candidate holds does not survive this
-table and is withdrawn. The dirty class was `PostSufficientRetrieval` in most
-failures - the model re-checking a value it already had - but which tasks hit it
-was not predictable from their shape at this sample.
-
-`i01`-`i06` are the frozen study's six tasks, kept as `roleStopping`. Measured
-once each with `-mode=run-index -task <id>`, per task and per arm:
-
-| task | tier | cue present | cue absent |
-| --- | --- | --- | --- |
-| `i01-transport-fallback` | quarter | SnippetStop | DefensiveRead |
-| `i02-scheduler-handoff` | quarter | PostSufficientRetrieval | PostSufficientRetrieval |
-| `i03-coalescing` | half | PostSufficientRetrieval | PostSufficientRunaway |
-| `i04-recovery-fence` | half | DefensiveRead | PostSufficientRunaway |
-| `i05-cache-probe` | default | SnippetThenRead | PostSufficientRetrieval |
-| `i06-dispatch-handoff` | default | SnippetStop | PostSufficientRetrieval |
-
-Five of the six show post-sufficient behaviour in at least one arm (`i02`-`i06`),
-and `i01` is clean on both. The cue-present arm is clean for four of them
-(`i01`, `i04`, `i05`, `i06`), which is why they stay in the corpus as the
-stopping side rather than being retitled. All six are excluded from `run-index`
-and `run-boundary` batches and stay measurable one at a time with `-task <id>`. A
-task added to the corpus declares a role, so it cannot arrive without one.
-
-A task qualifies only if it is clean on both of its boundary arms - the
-cue-present run and the cue-absent run - in every run of a screening batch. Clean
-means a `stopping_class` other than `PostSufficientRetrieval` or
+The present index tasks are not a fit substrate: two of six carry stopping
+behaviour that dominates the signal. A task should qualify only if a run-index
+run reports a `stopping_class` other than `PostSufficientRetrieval` or
 `PostSufficientRunaway`: `SnippetStop`, `SnippetThenRead` and `DefensiveRead`
 all qualify, and a defensive read is deliberately not counted as waste. The
 class comes from the three counts in that report — `searches_after_sufficient`,
@@ -169,7 +86,8 @@ class comes from the three counts in that report — `searches_after_sufficient`
 sufficiency was reached and how many rounds followed it. The remaining
 requirements still apply — successful tool call, answer in the output rather
 than the cue, rank 1, `FirstHitCoverage` complete, one or two simple values,
-nothing in the workspace.
+nothing in the workspace. Keep i03 and i04 — as a stopping corpus, not an
+efficiency one.

 `-mode=calibrate` is not a screening tool: it builds and reads back the
 fixtures, and reads nothing else, so its cue-visibility profile is the same for
@@ -1,86 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// runBlockedBatch runs one dry index batch where every arm's runOne fails
-// before any model turn: the task's own directory is a regular file, so the
-// fixture cannot be built. In production the same early return happens when the
-// fixture build, the session load, or the answer-on-disk guard fails.
-func runBlockedBatch(t *testing.T) string {
-	t.Helper()
-	tk := indexTasks()[0]
-	root := t.TempDir()
-	if err := os.WriteFile(filepath.Join(root, tk.ID), []byte("not a directory\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if code := runExperiment("run-index", experimentIndex, root, true, []contextTask{tk}); code != 0 {
-		t.Fatalf("runExperiment exit = %d, want 0 (every run failed, but the batch finished)", code)
-	}
-	return root
-}
-
-func readResultLines(t *testing.T, root string) ([]contextMetrics, []string) {
-	t.Helper()
-	raw, err := os.ReadFile(filepath.Join(root, "results.jsonl"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	var runs []contextMetrics
-	var lines []string
-	for text := range strings.SplitSeq(strings.TrimSpace(string(raw)), "\n") {
-		var m contextMetrics
-		if err := json.Unmarshal([]byte(text), &m); err != nil {
-			t.Fatalf("results.jsonl: %v", err)
-		}
-		runs = append(runs, m)
-		lines = append(lines, text)
-	}
-	return runs, lines
-}
-
-// A run that failed before the model turn produced no measurement. Recording it
-// as a zero-valued contextMetrics puts it in the funnel's Scored denominator,
-// in "Where it broke", and in the dose curve as a real zero.
-func TestBatchDoesNotRecordAFailedRunAsAResult(t *testing.T) {
-	root := runBlockedBatch(t)
-	runs, lines := readResultLines(t, root)
-	if len(runs) == 0 {
-		t.Fatal("no runs recorded at all")
-	}
-	for i, m := range runs {
-		if m.Task == "" || m.Arm == "" || m.FailureStage == "" {
-			t.Fatalf("results.jsonl line %d records a run that never ran as a result "+
-				"(task=%q arm=%q failure_stage=%q):\n  %s", i+1, m.Task, m.Arm, m.FailureStage, lines[i])
-		}
-	}
-}
-
-// The manifest is the artefact that says which runs counted, so a failed run
-// must not be added to CompletedRuns or to the task id list.
-func TestBatchManifestDoesNotReportFailedRunsAsCompleted(t *testing.T) {
-	root := runBlockedBatch(t)
-	var manifest batchManifest
-	data, err := os.ReadFile(filepath.Join(root, "batch.json"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := json.Unmarshal(data, &manifest); err != nil {
-		t.Fatal(err)
-	}
-	for _, id := range manifest.TaskIDs {
-		if id == "" {
-			t.Fatalf("manifest lists an empty task id: task_ids=%q (completed=%d planned=%d)",
-				manifest.TaskIDs, manifest.CompletedRuns, manifest.PlannedRuns)
-		}
-	}
-	if manifest.CompletedRuns == manifest.PlannedRuns {
-		t.Fatalf("manifest reports every planned run completed although none produced evidence: "+
-			"completed=%d planned=%d task_ids=%q", manifest.CompletedRuns, manifest.PlannedRuns, manifest.TaskIDs)
-	}
-}
@@ -1,155 +0,0 @@
-package main
-
-import (
-	"crypto/sha256"
-	"encoding/json"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"sort"
-	"strings"
-	"time"
-)
-
-// batchInfo is what the mode itself knows before any run happens. Everything
-// else in the manifest is derived from the runs that were written, so a figure
-// in it cannot drift from the artifact beside it.
-type batchInfo struct {
-	Mode    string
-	Planned int
-	Started time.Time
-	Dry     bool
-	// Repo is the checkout the batch ran from, captured before the harness
-	// isolates its workspace: git cannot describe a directory that is gone.
-	Repo string
-}
-
-// batchManifest is written beside results.jsonl so a later reader does not have
-// to reconstruct what the batch was from a terminal scrollback.
-type batchManifest struct {
-	SchemaVersion int      `json:"schema_version"`
-	Mode          string   `json:"mode"`
-	StartedAt     string   `json:"started_at"`
-	FinishedAt    string   `json:"finished_at"`
-	GitCommit     string   `json:"git_commit"`
-	GitDirty      *bool    `json:"git_dirty,omitempty"`
-	Model         string   `json:"model"`
-	Window        int      `json:"window"`
-	Generations   int      `json:"generations"`
-	TaskIDs       []string `json:"task_ids"`
-	Arms          []string `json:"arms"`
-	PlannedRuns   int      `json:"planned_runs"`
-	CompletedRuns int      `json:"completed_runs"`
-	// FailedRuns counts the planned runs that ended before a transcript existed.
-	// They are rows in results.jsonl, never part of CompletedRuns, and the field
-	// is absent when there were none so an intact batch is unchanged.
-	FailedRuns int `json:"failed_runs,omitempty"`
-	// Usage totals are absent when nothing reported any: an unmeasured cost must
-	// not read as a measured zero. UsageReportedRuns stays, because zero there
-	// is a fact about the batch.
-	UsageReportedRuns     int    `json:"usage_reported_runs"`
-	UsageReportedRequests int    `json:"usage_reported_requests,omitempty"`
-	PromptTokens          int    `json:"prompt_tokens,omitempty"`
-	CompletionTokens      int    `json:"completion_tokens,omitempty"`
-	CacheHitTokens        int    `json:"cache_hit_tokens,omitempty"`
-	CacheMissTokens       int    `json:"cache_miss_tokens,omitempty"`
-	UsageEstimated        bool   `json:"usage_estimated,omitempty"`
-	ResultsSHA256         string `json:"results_sha256"`
-	TrajectoriesSHA256    string `json:"trajectories_sha256"`
-}
-
-// gitCommitAndDirty reports the checkout the batch ran from. Unknown is written
-// rather than omitted, so an absent field is never mistaken for a clean tree.
-func gitCommitAndDirty(repo string) (commit string, dirty *bool) {
-	commit = "unknown"
-	if repo == "" {
-		return commit, nil
-	}
-	in := func(args ...string) ([]byte, error) {
-		cmd := exec.Command("git", args...)
-		cmd.Dir = repo
-		return cmd.Output()
-	}
-	if out, err := in("rev-parse", "--short", "HEAD"); err == nil {
-		commit = strings.TrimSpace(string(out))
-	}
-	if out, err := in("status", "--porcelain"); err == nil {
-		state := strings.TrimSpace(string(out)) != ""
-		dirty = &state
-	}
-	return commit, dirty
-}
-
-func fileSHA256(path string) (string, error) {
-	data, err := os.ReadFile(path)
-	if err != nil {
-		return "", err
-	}
-	return fmt.Sprintf("%x", sha256.Sum256(data)), nil
-}
-
-func sortedKeys(set map[string]bool) []string {
-	out := make([]string, 0, len(set))
-	for k := range set {
-		out = append(out, k)
-	}
-	sort.Strings(out)
-	return out
-}
-
-// writeBatchManifest records the batch beside the runs it describes. It runs
-// last, so its digests are of what is already on disk.
-func writeBatchManifest(root string, info batchInfo, all []contextMetrics) error {
-	ids, arms := map[string]bool{}, map[string]bool{}
-	var prompt, completion, cacheHit, cacheMiss, requests, reported, failed int
-	estimated := false
-	for _, m := range all {
-		// A failed run has no task, arm or evidence to contribute: it is counted
-		// as a failure below and is not part of what the batch measured.
-		if m.Failed {
-			failed++
-			continue
-		}
-		ids[m.Task] = true
-		arms[m.Arm] = true
-		if m.UsageReportedRequests > 0 {
-			reported++
-			requests += m.UsageReportedRequests
-			prompt += m.PromptTokens
-			completion += m.CompletionTokens
-			cacheHit += m.CacheHitTokens
-			cacheMiss += m.CacheMissTokens
-			estimated = estimated || m.UsageEstimated
-		}
-	}
-	commit, dirty := gitCommitAndDirty(info.Repo)
-	model := runModel
-	if info.Dry {
-		model = "scripted"
-	}
-	manifest := batchManifest{
-		SchemaVersion: 1, Mode: info.Mode,
-		StartedAt:  info.Started.UTC().Format(time.RFC3339),
-		FinishedAt: time.Now().UTC().Format(time.RFC3339),
-		GitCommit:  commit, GitDirty: dirty,
-		Model: model, Window: fixtureWindow, Generations: fixtureGenerations,
-		TaskIDs: sortedKeys(ids), Arms: sortedKeys(arms),
-		PlannedRuns: info.Planned, CompletedRuns: len(all) - failed, FailedRuns: failed,
-		UsageReportedRuns: reported, UsageReportedRequests: requests,
-		PromptTokens: prompt, CompletionTokens: completion,
-		CacheHitTokens: cacheHit, CacheMissTokens: cacheMiss, UsageEstimated: estimated,
-	}
-	var err error
-	if manifest.ResultsSHA256, err = fileSHA256(filepath.Join(root, "results.jsonl")); err != nil {
-		return err
-	}
-	if manifest.TrajectoriesSHA256, err = fileSHA256(filepath.Join(root, "trajectories.jsonl")); err != nil {
-		return err
-	}
-	data, err := json.MarshalIndent(manifest, "", "  ")
-	if err != nil {
-		return err
-	}
-	return os.WriteFile(filepath.Join(root, "batch.json"), append(data, '\n'), 0o644)
-}
@@ -1,91 +0,0 @@
-package main
-
-import (
-	"crypto/sha256"
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-)
-
-func seedArtifacts(t *testing.T, root string) {
-	t.Helper()
-	for _, name := range []string{"results.jsonl", "trajectories.jsonl"} {
-		if err := os.WriteFile(filepath.Join(root, name), []byte("{}\n"), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-}
-
-func readManifest(t *testing.T, root string) (batchManifest, string) {
-	t.Helper()
-	data, err := os.ReadFile(filepath.Join(root, "batch.json"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	var got batchManifest
-	if err := json.Unmarshal(data, &got); err != nil {
-		t.Fatal(err)
-	}
-	return got, string(data)
-}
-
-func TestBatchManifestRecordsWhatTheBatchWas(t *testing.T) {
-	root := t.TempDir()
-	seedArtifacts(t, root)
-	all := []contextMetrics{
-		{Task: "b", Arm: "index-off"},
-		{Task: "a", Arm: "index-off"},
-		{Task: "a", Arm: "index-half", UsageReportedRequests: 2, PromptTokens: 100,
-			CompletionTokens: 10, CacheHitTokens: 60, CacheMissTokens: 40},
-	}
-	if err := writeBatchManifest(root, batchInfo{Mode: "run-index", Planned: 4, Started: time.Now().Add(-time.Minute)}, all); err != nil {
-		t.Fatal(err)
-	}
-	got, _ := readManifest(t, root)
-	if got.SchemaVersion != 1 || got.Mode != "run-index" || got.PlannedRuns != 4 || got.CompletedRuns != 3 {
-		t.Fatalf("manifest header = %+v", got)
-	}
-	if strings.Join(got.TaskIDs, ",") != "a,b" || strings.Join(got.Arms, ",") != "index-half,index-off" {
-		t.Fatalf("ids/arms = %v / %v, want sorted and unique", got.TaskIDs, got.Arms)
-	}
-	if got.UsageReportedRuns != 1 || got.UsageReportedRequests != 2 || got.PromptTokens != 100 ||
-		got.CompletionTokens != 10 || got.CacheHitTokens != 60 || got.CacheMissTokens != 40 {
-		t.Fatalf("usage totals = %+v", got)
-	}
-	// No repo means git could not describe the checkout: unknown commit, and no
-	// dirty flag at all, because "clean" is a claim this batch cannot make.
-	if got.GitCommit != "unknown" || got.GitDirty != nil {
-		t.Fatalf("git state = %q / %v, want unknown and no dirty flag", got.GitCommit, got.GitDirty)
-	}
-	want := fmt.Sprintf("%x", sha256.Sum256([]byte("{}\n")))
-	if got.ResultsSHA256 != want || got.TrajectoriesSHA256 != want {
-		t.Fatalf("digests = %q / %q, want %q", got.ResultsSHA256, got.TrajectoriesSHA256, want)
-	}
-}
-
-// A dry batch pays nothing, so its cost fields must be absent rather than zero:
-// an unmeasured spend must not read as a measured one.
-func TestBatchManifestLeavesUnreportedUsageAbsent(t *testing.T) {
-	root := t.TempDir()
-	seedArtifacts(t, root)
-	all := []contextMetrics{{Task: "a", Arm: "index-off"}, {Task: "a", Arm: "index-half"}}
-	if err := writeBatchManifest(root, batchInfo{Mode: "run-index", Planned: 2, Started: time.Now(), Dry: true}, all); err != nil {
-		t.Fatal(err)
-	}
-	got, raw := readManifest(t, root)
-	if got.UsageReportedRuns != 0 {
-		t.Fatalf("usage_reported_runs = %d, want 0 reported", got.UsageReportedRuns)
-	}
-	if got.Model != "scripted" {
-		t.Fatalf("dry batch model = %q, want scripted", got.Model)
-	}
-	for _, absent := range []string{"usage_reported_requests", "prompt_tokens", "completion_tokens", "cache_hit_tokens"} {
-		if strings.Contains(raw, absent) {
-			t.Fatalf("a dry batch wrote %q:\n%s", absent, raw)
-		}
-	}
-}
@@ -1,69 +0,0 @@
-package main
-
-import (
-	"strings"
-	"testing"
-)
-
-// boundaryRuns builds the input reportBoundaries reads: one scored run for an
-// index task's cue side, and one failed run for another index task's cue side.
-// The runs are constructed because the report is a pure function of the slice;
-// the batch path that produces them is covered by the failed-batch tests.
-func boundaryRuns(t *testing.T) (all []contextMetrics, scoredTask, failedTask string) {
-	t.Helper()
-	index := indexTasks()
-	if len(index) < 2 {
-		t.Fatalf("need at least two index tasks, have %d", len(index))
-	}
-	scored, failed := index[0], index[1]
-	cue, noCue := boundaryPair(scored.CueTier)
-	if cue == "" || noCue == "" {
-		t.Fatalf("task %s has an empty boundary pair (%q, %q)", scored.ID, cue, noCue)
-	}
-	failedCue, _ := boundaryPair(failed.CueTier)
-	if failedCue == "" {
-		t.Fatalf("task %s has no cue side", failed.ID)
-	}
-	all = []contextMetrics{
-		{Task: scored.ID, Arm: "index-" + cue, AnswerRecovered: true, SearchCalls: 1, RecallReturnedTokens: 318},
-		{Task: scored.ID, Arm: "index-" + noCue, AnswerRecovered: false},
-		{Task: failed.ID, Arm: "index-" + failedCue, Failed: true, FailureStage: stageNoEvidence},
-	}
-	return all, scored.ID, failed.ID
-}
-
-// TestBoundaryReportExcludesFailedRuns: a run that never produced a transcript
-// must not appear in the cue-boundary table, which was the last reporting exit
-// that still folded it in as a zero measurement.
-func TestBoundaryReportExcludesFailedRuns(t *testing.T) {
-	all, scoredTask, failedTask := boundaryRuns(t)
-	out := captureStdout(t, func() { reportBoundaries(all) })
-	if strings.Contains(out, failedTask) {
-		t.Fatalf("the boundary table printed the failed task %q as a measurement:\n%s", failedTask, out)
-	}
-	if !strings.Contains(out, scoredTask) {
-		t.Fatalf("the boundary table dropped the scored task %q, so the exclusion is not specific to failures:\n%s", scoredTask, out)
-	}
-	if !strings.Contains(out, "cue-present") || !strings.Contains(out, "cue-absent") {
-		t.Fatalf("the pooled comparison disappeared:\n%s", out)
-	}
-}
-
-// TestBoundaryReportSaysNothingToCompareWhenEveryRunFailed: with no scored run
-// the report must say so, rather than printing a comparison of zeros.
-func TestBoundaryReportSaysNothingToCompareWhenEveryRunFailed(t *testing.T) {
-	all, _, _ := boundaryRuns(t)
-	failedOnly := make([]contextMetrics, 0, len(all))
-	for _, m := range all {
-		m.Failed = true
-		m.FailureStage = stageNoEvidence
-		failedOnly = append(failedOnly, m)
-	}
-	out := captureStdout(t, func() { reportBoundaries(failedOnly) })
-	if !strings.Contains(out, "scored=0") || !strings.Contains(out, "failed=") {
-		t.Fatalf("an all-failed batch did not report scored=0 with a failed count:\n%s", out)
-	}
-	if strings.Contains(out, "cue-present") || strings.Contains(out, "cue-absent") {
-		t.Fatalf("an all-failed batch still printed a pooled comparison of zeros:\n%s", out)
-	}
-}
@@ -18,8 +18,7 @@ import (
 // canonical position, and never the model's prose. "I will search the history"
 // is not a search; a recall call with a query is.

-// failure stages, in funnel order. Exactly one is reported per run, except for
-// NoEvidence: that stage belongs to a run with no measurement at all.
+// failure stages, in funnel order. Exactly one is reported per run.
 const (
 	stageReadMissed   = "NoSearch"           // never asked, and never read the target either
 	stageSearchMiss   = "SearchMiss"         // searched, target never came back
@@ -27,7 +26,6 @@ const (
 	stageAnswerWrong  = "ReadButAnswerWrong" // opened it and still answered wrong
 	stageRecovered    = "Recovered"
 	stageContaminated = "Contaminated"
-	stageNoEvidence   = "NoEvidence"

 	// Routing is judged by model round, not by the linear order of tool events:
 	// two calls in one round are one parallel fan-out, and calling that
@@ -91,15 +89,6 @@ type contextMetrics struct {
 	// resident prefix; this is what is paid dynamically instead.
 	RecallReturnedTokens int `json:"recall_returned_tokens"`

-	// Provider usage as reported on the stream, or empty for a dry run. The count
-	// is completions that reported usage, so it is not a count of attempts.
-	UsageReportedRequests int  `json:"usage_reported_requests,omitempty"`
-	PromptTokens          int  `json:"prompt_tokens,omitempty"`
-	CompletionTokens      int  `json:"completion_tokens,omitempty"`
-	CacheHitTokens        int  `json:"cache_hit_tokens,omitempty"`
-	CacheMissTokens       int  `json:"cache_miss_tokens,omitempty"`
-	UsageEstimated        bool `json:"usage_estimated,omitempty"`
-
 	Searches []searchAttempt `json:"searches,omitempty"`
 	// PostHitSearches are queries issued after the target had already been
 	// returned: not a query problem, a result-to-read problem.
@@ -118,12 +107,6 @@ type contextMetrics struct {
 	FailureStage  string `json:"failure_stage"`
 	TimeoutReason string `json:"timeout_reason,omitempty"`

-	// Failed marks a run that ended before a transcript existed: it has no score
-	// and no place in the statistics. The row stays in results.jsonl with its
-	// task, arm and stage, so a failure is counted rather than dropped.
-	Failed bool   `json:"failed,omitempty"`
-	Reason string `json:"reason,omitempty"`
-
 	// UnexpectedWorkTools are investigation tools used instead of recall.
 	// Reaching for the workspace is behaviour, not noise: how a model routes
 	// its uncertainty when memory is missing is part of what is measured.
@@ -470,12 +453,6 @@ type funnel struct {
 func summarize(arm string, runs []contextMetrics) funnel {
 	f := funnel{Arm: arm, Runs: len(runs), Stages: map[string]int{}, Routes: map[string]int{}}
 	for _, r := range runs {
-		// A run that never produced a transcript is not a scored run and has no
-		// stage to place: counting it would put an empty name in the funnel, the
-		// stage table and the routes.
-		if r.Failed {
-			continue
-		}
 		if r.Contaminated {
 			f.Contaminated++
 			f.Stages[r.FailureStage]++
@@ -645,7 +622,7 @@ func reportStopping(all []contextMetrics) string {
 	var extraRounds, extraTokens []float64
 	sufficient, answeredNext := 0, 0
 	for _, m := range all {
-		if m.Failed || m.Contaminated {
+		if m.Contaminated {
 			continue
 		}
 		classes[m.StoppingClass]++
@@ -26,12 +26,6 @@ const (
 	tierDefault = "default" // visible at default only
 )

-// role places an index task in the efficiency substrate or the stopping corpus.
-const (
-	roleEfficiency = "efficiency"
-	roleStopping   = "stopping"
-)
-
 // plantKind is how a task's target enters the transcript.
 const (
 	plantAssistant = "assistant" // the model's own account: never index-addressed
@@ -51,8 +45,6 @@ type contextTask struct {
 	AnswerVars []string
 	CueVar     string
 	CueTier    string
-	// Role is roleEfficiency or roleStopping; it decides the batch a task enters.
-	Role string
 	// PlantAfterGen ages the target: mergeFoldIndex trims from its oldest end,
 	// so what follows a cue decides which budget addresses it. Frozen, because
 	// a run that searched for it would let the tested code move its goalposts.
@@ -129,20 +121,6 @@ func num(name string, lo, hi int) varSpec {
 	return varSpec{Name: name, Kind: varInt, Min: lo, Max: hi}
 }

-// efficiencyTasks is the substrate a study measures on. Every task in it
-// qualifies under the corpus bar; the stopping corpus is deliberately excluded,
-// because a task carrying post-sufficient stopping behaviour swamps the effect
-// an efficiency batch exists to measure.
-func efficiencyTasks() []contextTask {
-	var out []contextTask
-	for _, t := range indexTasks() {
-		if t.Role == roleEfficiency {
-			out = append(out, t)
-		}
-	}
-	return out
-}
-
 func searchTasks() []contextTask {
 	return []contextTask{
 		{
@@ -214,104 +192,10 @@ func searchTasks() []contextTask {
 	}
 }

-// efficiencyIndexTasks is what a study measures on: two tasks per cue tier.
-func efficiencyIndexTasks() []contextTask {
-	out := indexQuarterTasks()
-	out = append(out, indexHalfTasks()...)
-	out = append(out, indexDefaultTasks()...)
-	return out
-}
-
-// indexQuarterTasks holds the quarter-tier literals.
-func indexQuarterTasks() []contextTask {
+func indexTasks() []contextTask {
 	return []contextTask{
 		{
-			ID: "i37-dispatchlag", Experiment: experimentIndex, TargetKind: "tool_input", Role: roleEfficiency,
-			Prompt:     "早前会话里执行过 ./scripts/dispatchlag，它打印出的 dispatch lag epoch 是多少？",
-			ProbeQuery: "dispatchlag dispatch lag epoch",
-			Vars:       []varSpec{code("cue", "dispatchlag"), code("epoch", "cobalt")},
-			AnswerVars: []string{"epoch"}, CueVar: "cue", CueTier: tierQuarter,
-			PlantAfterGen: 4,
-			Plant:         plantCall, CallID: "p37", CallTool: "bash",
-			CallArgs:  `{"command":"./scripts/dispatchlag {{cue}}"}`,
-			PlantBody: "dispatch lag epoch = {{epoch}}",
-		},
-		{
-			ID: "i118-fencelag", Experiment: experimentIndex, TargetKind: "tool_input", Role: roleEfficiency,
-			Prompt:     "早前会话里运行过 ./scripts/fencelag，它打印出的 fence lag 是多少？",
-			ProbeQuery: "fencelag fence lag",
-			Vars:       []varSpec{code("cue", "fencelag"), code("v", "slate")},
-			AnswerVars: []string{"v"}, CueVar: "cue", CueTier: tierQuarter,
-			PlantAfterGen: 4,
-			Plant:         plantCall, CallID: "x118", CallTool: "bash",
-			CallArgs:  `{"command":"./scripts/fencelag {{cue}}"}`,
-			PlantBody: "fence lag = {{v}}",
-		},
-	}
-}
-
-// indexHalfTasks holds the half-tier literals.
-func indexHalfTasks() []contextTask {
-	return []contextTask{
-		{
-			ID: "i70-ingestfloor", Experiment: experimentIndex, TargetKind: "tool_input", Role: roleEfficiency,
-			Prompt:     "早前会话里执行过 ./scripts/ingestfloor，它打印出的 route quota 是多少？",
-			ProbeQuery: "ingestfloor quota",
-			Vars:       []varSpec{code("cue", "ingestfloor"), num("quota", 1200, 9800)},
-			AnswerVars: []string{"quota"}, CueVar: "cue", CueTier: tierHalf,
-			PlantAfterGen: 2,
-			Plant:         plantCall, CallID: "q70", CallTool: "bash",
-			CallArgs:  `{"command":"./scripts/ingestfloor {{cue}}"}`,
-			PlantBody: "route quota = {{quota}}",
-		},
-		{
-			ID: "i106-budgetseal", Experiment: experimentIndex, TargetKind: "tool_input", Role: roleEfficiency,
-			Prompt:     "早前会话里执行过 ./scripts/budgetseal，它打印出的 route quota 是多少？",
-			ProbeQuery: "budgetseal route quota",
-			Vars:       []varSpec{code("cue", "budgetseal"), code("quota", "amber")},
-			AnswerVars: []string{"quota"}, CueVar: "cue", CueTier: tierHalf,
-			PlantAfterGen: 2,
-			Plant:         plantCall, CallID: "h106", CallTool: "bash",
-			CallArgs:  `{"command":"./scripts/budgetseal {{cue}}"}`,
-			PlantBody: "route quota = {{quota}}",
-		},
-	}
-}
-
-// indexDefaultTasks holds the default-tier literals.
-func indexDefaultTasks() []contextTask {
-	return []contextTask{
-		{
-			ID: "i47-tenantlease", Experiment: experimentIndex, TargetKind: "tool_input", Role: roleEfficiency,
-			Prompt:     "早前会话里执行过 ./scripts/tenantlease，它打印出的 tenant lease（秒）是多少？",
-			ProbeQuery: "tenantlease tenant lease",
-			Vars:       []varSpec{code("cue", "tenantlease"), {Name: "lease", Kind: varDuration, Min: 15, Max: 300}},
-			AnswerVars: []string{"lease"}, CueVar: "cue", CueTier: tierDefault,
-			PlantAfterGen: 0,
-			Plant:         plantCall, CallID: "p47", CallTool: "bash",
-			CallArgs:  `{"command":"./scripts/tenantlease {{cue}}"}`,
-			PlantBody: "tenant lease = {{lease}}",
-		},
-		{
-			ID: "i112-lagquota", Experiment: experimentIndex, TargetKind: "tool_input", Role: roleEfficiency,
-			Prompt:     "早前会话里执行过 ./scripts/lagquota，它打印出的 lagquota lease 是多少？",
-			ProbeQuery: "lagquota lagquota lease",
-			Vars:       []varSpec{code("cue", "lagquota"), {Name: "lease", Kind: varDuration, Min: 20, Max: 420}},
-			AnswerVars: []string{"lease"}, CueVar: "cue", CueTier: tierDefault,
-			PlantAfterGen: 0,
-			Plant:         plantCall, CallID: "d112", CallTool: "bash",
-			CallArgs:  `{"command":"./scripts/lagquota {{cue}}"}`,
-			PlantBody: "lagquota lease = {{lease}}",
-		},
-	}
-}
-
-// stoppingIndexTasks is the frozen study's six tasks, kept out of efficiency
-// batches and measurable on their own with -task <id>.
-func stoppingIndexTasks() []contextTask {
-	return []contextTask{
-		{
-			ID: "i01-transport-fallback", Experiment: experimentIndex, TargetKind: "tool_input", Role: roleStopping,
+			ID: "i01-transport-fallback", Experiment: experimentIndex, TargetKind: "tool_input",
 			Prompt:     "transport fallback probe 当时报告的 selector 是什么？",
 			ProbeQuery: "transport fallback probe selector",
 			Vars:       []varSpec{code("cue", "tfprobe"), code("selector", "fern")},
@@ -322,7 +206,7 @@ func stoppingIndexTasks() []contextTask {
 			PlantBody: "fallback selector = {{selector}}",
 		},
 		{
-			ID: "i02-scheduler-handoff", Experiment: experimentIndex, TargetKind: "tool_input", Role: roleStopping,
+			ID: "i02-scheduler-handoff", Experiment: experimentIndex, TargetKind: "tool_input",
 			Prompt:     "scheduler handoff 当时记录的 grace 和 marker 是什么？",
 			ProbeQuery: "scheduler handoff grace marker",
 			Vars: []varSpec{
@@ -336,7 +220,7 @@ func stoppingIndexTasks() []contextTask {
 			PlantBody: "handoff grace = {{grace}}\nmarker = {{marker}}",
 		},
 		{
-			ID: "i03-coalescing", Experiment: experimentIndex, TargetKind: "tool_input", Role: roleStopping,
+			ID: "i03-coalescing", Experiment: experimentIndex, TargetKind: "tool_input",
 			Prompt:     "job completion 的 coalescing probe 最后记录的 window 和 marker 是多少？",
 			ProbeQuery: "coalescing policy completion window",
 			Vars: []varSpec{
@@ -350,7 +234,7 @@ func stoppingIndexTasks() []contextTask {
 			PlantBody: "completion coalesce window = {{window}}\nmarker = {{marker}}",
 		},
 		{
-			ID: "i04-recovery-fence", Experiment: experimentIndex, TargetKind: "tool_input", Role: roleStopping,
+			ID: "i04-recovery-fence", Experiment: experimentIndex, TargetKind: "tool_input",
 			Prompt:     "recovery fence 那次检查报告的 marker 和两个 epoch 是什么？",
 			ProbeQuery: "recovery fence epoch check",
 			Vars: []varSpec{
@@ -364,7 +248,7 @@ func stoppingIndexTasks() []contextTask {
 			PlantBody: "{{marker}}\nexpected epoch {{expected}}\nobserved epoch {{observed}}",
 		},
 		{
-			ID: "i05-cache-probe", Experiment: experimentIndex, TargetKind: "tool_input", Role: roleStopping,
+			ID: "i05-cache-probe", Experiment: experimentIndex, TargetKind: "tool_input",
 			Prompt:     "cache probe 当时记录的 prefix salt 和 scope 是什么？",
 			ProbeQuery: "cache probe prefix salt scope",
 			Vars:       []varSpec{code("cue", "cacheprobe"), code("salt", "comet"), code("scope", "lineage")},
@@ -375,7 +259,7 @@ func stoppingIndexTasks() []contextTask {
 			PlantBody: "prefix salt = {{salt}}\nscope = {{scope}}",
 		},
 		{
-			ID: "i06-dispatch-handoff", Experiment: experimentIndex, TargetKind: "tool_input", Role: roleStopping,
+			ID: "i06-dispatch-handoff", Experiment: experimentIndex, TargetKind: "tool_input",
 			Prompt:     "dispatch handoff probe 当时确认的 mode 和 marker 是什么？",
 			ProbeQuery: "dispatch handoff probe mode",
 			Vars:       []varSpec{code("cue", "dispatchhandoff"), code("mode", "trigger"), code("marker", "iris")},
@@ -388,12 +272,6 @@ func stoppingIndexTasks() []contextTask {
 	}
 }

-// indexTasks is the whole index corpus, the efficiency substrate first.
-func indexTasks() []contextTask {
-	out := efficiencyIndexTasks()
-	return append(out, stoppingIndexTasks()...)
-}
-
 func allTasks() []contextTask {
 	return append(searchTasks(), indexTasks()...)
 }
@@ -454,9 +332,6 @@ func validateCorpus() error {
 			if t.CueVar == "" {
 				return fmt.Errorf("%s: an index task needs a cue var", t.ID)
 			}
-			if t.Role != roleEfficiency && t.Role != roleStopping {
-				return fmt.Errorf("%s: an index task needs a role (%s or %s)", t.ID, roleEfficiency, roleStopping)
-			}
 			if v, _ := tierScales(t.CueTier); v == nil {
 				return fmt.Errorf("%s: unknown cue tier %q", t.ID, t.CueTier)
 			}
@@ -121,7 +121,7 @@ var doseMetrics = []struct {
 func reportDoseResponse(all []contextMetrics) string {
 	valid := map[string]map[string]contextMetrics{}
 	for _, m := range all {
-		if m.Failed || m.Contaminated || m.FailureStage == "RunError" {
+		if m.Contaminated || m.FailureStage == "RunError" {
 			continue
 		}
 		scale := strings.TrimPrefix(m.Arm, "index-")
@@ -1,306 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strconv"
-	"strings"
-	"testing"
-)
-
-// blockTask makes one task fail before its first model turn: its own directory
-// is a regular file, so buildFixture cannot create the session under it. It is
-// the same early exit as a failed fixture build, session load, or
-// answer-on-disk guard, and it needs no provider.
-func blockTask(t *testing.T, root, id string) {
-	t.Helper()
-	if err := os.WriteFile(filepath.Join(root, id), []byte("not a directory\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-}
-
-// mixedTaskPair is one task whose runs all fail and one whose runs all succeed.
-// Both are drawn from the corpus, so the batch is the real pipeline.
-func mixedTaskPair() (blocked, ok contextTask) {
-	blocked, ok = indexTasks()[0], indexTasks()[1]
-	for _, t := range indexTasks() {
-		if t.Role == roleEfficiency && len(armsFor(t)) == 2 {
-			ok = t
-			break
-		}
-	}
-	return blocked, ok
-}
-
-// runBlockedExperiment runs one dry index batch over the given tasks, with the
-// named task failing before any model turn, and returns the batch directory, the
-// runs, the manifest, and everything the run printed.
-func runBlockedExperiment(t *testing.T, tasks []contextTask, blocked ...string) (string, []contextMetrics, batchManifest, string) {
-	t.Helper()
-	root := t.TempDir()
-	for _, id := range blocked {
-		blockTask(t, root, id)
-	}
-	out := captureStdout(t, func() {
-		if code := runExperiment("run-index", experimentIndex, root, true, tasks); code != 0 {
-			t.Errorf("runExperiment exit = %d, want 0 (the batch finished)", code)
-		}
-	})
-	runs, _ := readResultLines(t, root)
-	manifest, _ := readManifest(t, root)
-	return root, runs, manifest, out
-}
-
-// captureStdout reads everything the function prints. os.Pipe is unbuffered, so
-// the reader must run beside the call.
-func captureStdout(t *testing.T, f func()) string {
-	t.Helper()
-	r, w, err := os.Pipe()
-	if err != nil {
-		t.Fatal(err)
-	}
-	old := os.Stdout
-	os.Stdout = w
-	done := make(chan string, 1)
-	go func() {
-		var b strings.Builder
-		buf := make([]byte, 4096)
-		for {
-			n, err := r.Read(buf)
-			b.Write(buf[:n])
-			if err != nil {
-				break
-			}
-		}
-		done <- b.String()
-	}()
-	f()
-	os.Stdout = old
-	w.Close()
-	text := <-done
-	r.Close()
-	return text
-}
-
-// funnelScored reads the "runs=N" column of the named arm's funnel line out of
-// the printed tables, so the assertion is on the number a reader sees.
-func funnelScored(t *testing.T, out, arm string) int {
-	t.Helper()
-	for line := range strings.SplitSeq(out, "\n") {
-		fields := strings.Fields(line)
-		if len(fields) < 2 || fields[0] != arm || !strings.HasPrefix(fields[1], "runs=") {
-			continue
-		}
-		n, err := strconv.Atoi(strings.TrimPrefix(fields[1], "runs="))
-		if err != nil {
-			t.Fatalf("funnel line for %s: %v\n%s", arm, err, line)
-		}
-		return n
-	}
-	t.Fatalf("no funnel line for arm %s:\n%s", arm, out)
-	return 0
-}
-
-// The batch report states both counts on one line, so a reader of the scrollback
-// sees the scored set and the failures without counting funnel rows.
-func reportCounts(t *testing.T, out string) (scored, failed int) {
-	t.Helper()
-	for line := range strings.SplitSeq(out, "\n") {
-		if !strings.Contains(line, " scored=") || !strings.Contains(line, " failed=") {
-			continue
-		}
-		for f := range strings.FieldsSeq(line) {
-			switch {
-			case strings.HasPrefix(f, "scored="):
-				scored, _ = strconv.Atoi(strings.TrimPrefix(f, "scored="))
-			case strings.HasPrefix(f, "failed="):
-				failed, _ = strconv.Atoi(strings.TrimPrefix(f, "failed="))
-			}
-		}
-		return scored, failed
-	}
-	t.Fatalf("no line reports scored= and failed=:\n%s", out)
-	return 0, 0
-}
-
-// A batch that mixes a task that never ran with one that did must read as its
-// successful runs only: the failed task leaves Scored, the funnel, and the
-// completed count, and is reported as a failure with its identity instead.
-// Every assertion here is a number, not the absence of an empty row.
-func TestMixedBatchCountsOnlyTheRunThatProducedEvidence(t *testing.T) {
-	blocked, ok := mixedTaskPair()
-	_, runs, manifest, out := runBlockedExperiment(t, []contextTask{blocked, ok}, blocked.ID)
-
-	wantScored, wantFailed := len(armsFor(ok)), len(armsFor(blocked))
-	if manifest.CompletedRuns != wantScored || manifest.FailedRuns != wantFailed {
-		t.Fatalf("manifest completed=%d failed=%d, want %d and %d (planned=%d)",
-			manifest.CompletedRuns, manifest.FailedRuns, wantScored, wantFailed, manifest.PlannedRuns)
-	}
-	if len(runs) != manifest.CompletedRuns+manifest.FailedRuns {
-		t.Fatalf("results.jsonl has %d rows but completed=%d failed=%d",
-			len(runs), manifest.CompletedRuns, manifest.FailedRuns)
-	}
-	for _, id := range manifest.TaskIDs {
-		if id == blocked.ID {
-			t.Fatalf("task_ids lists %s, which produced no evidence: %v", blocked.ID, manifest.TaskIDs)
-		}
-	}
-	scored, failures := 0, 0
-	for _, m := range runs {
-		if m.Failed {
-			failures++
-			if m.Task != blocked.ID || m.FailureStage == "" || m.Reason == "" {
-				t.Fatalf("failed row lost its identity or stage: %+v", m)
-			}
-			continue
-		}
-		scored++
-		if m.Task != ok.ID {
-			t.Fatalf("a run scored from the wrong task: %+v", m)
-		}
-	}
-	if scored != wantScored || failures != wantFailed {
-		t.Fatalf("rows scored=%d failed=%d, want %d and %d", scored, failures, wantScored, wantFailed)
-	}
-	// Each arm's funnel holds exactly the successful task's runs, and the two
-	// scored counts agree with each other and with the manifest.
-	total := 0
-	for _, arm := range armsFor(ok) {
-		total += funnelScored(t, out, arm.name)
-	}
-	if total != manifest.CompletedRuns {
-		t.Fatalf("funnels scored %d runs, manifest completed_runs = %d:\n%s", total, manifest.CompletedRuns, out)
-	}
-	if gotScored, gotFailed := reportCounts(t, out); gotScored != manifest.CompletedRuns || gotFailed != manifest.FailedRuns {
-		t.Fatalf("report says scored=%d failed=%d, manifest says %d and %d",
-			gotScored, gotFailed, manifest.CompletedRuns, manifest.FailedRuns)
-	}
-	if strings.Contains(out, "## Where it broke") && strings.Contains(out, "=-\n") {
-		t.Fatalf("the stage table kept an empty stage:\n%s", out)
-	}
-}
-
-// A batch where every run fails must not read as an empty success: zero scored
-// runs, a nonzero failed count, and both stated.
-func TestAllFailedBatchReportsZeroScoredAndNonzeroFailed(t *testing.T) {
-	blocked, _ := mixedTaskPair()
-	_, runs, manifest, out := runBlockedExperiment(t, []contextTask{blocked}, blocked.ID)
-
-	if manifest.CompletedRuns != 0 {
-		t.Fatalf("completed_runs = %d, want 0 (nothing produced evidence)", manifest.CompletedRuns)
-	}
-	if manifest.FailedRuns != manifest.PlannedRuns || manifest.FailedRuns == 0 {
-		t.Fatalf("failed_runs = %d, planned_runs = %d: every planned run failed",
-			manifest.FailedRuns, manifest.PlannedRuns)
-	}
-	if len(manifest.TaskIDs) != 0 {
-		t.Fatalf("task_ids = %v, want none", manifest.TaskIDs)
-	}
-	for i, m := range runs {
-		if !m.Failed || m.FailureStage == "" || m.Task != blocked.ID {
-			t.Fatalf("results.jsonl line %d is not a marked failure: %+v", i+1, m)
-		}
-	}
-	total := 0
-	for _, arm := range armsFor(blocked) {
-		total += funnelScored(t, out, arm.name)
-	}
-	if total != 0 {
-		t.Fatalf("funnels scored %d runs although nothing ran:\n%s", total, out)
-	}
-	if gotScored, gotFailed := reportCounts(t, out); gotScored != 0 || gotFailed != manifest.FailedRuns {
-		t.Fatalf("report says scored=%d failed=%d, want 0 and %d", gotScored, gotFailed, manifest.FailedRuns)
-	}
-}
-
-// The control: with nothing blocked, a batch is what it always was. Every run
-// is completed with a stage, two identical batches write byte-identical results
-// and the same manifest header, and the new failure field stays out of it.
-func TestAllSuccessfulBatchKeepsItsArtifacts(t *testing.T) {
-	tasks := indexTasks()
-	first, runs, manifest, out := runBlockedExperiment(t, tasks)
-	second, again, repeat, _ := runBlockedExperiment(t, tasks)
-	if manifest.CompletedRuns != len(runs) || manifest.FailedRuns != 0 {
-		t.Fatalf("completed=%d failed=%d rows=%d, want every row completed",
-			manifest.CompletedRuns, manifest.FailedRuns, len(runs))
-	}
-	if manifest.CompletedRuns != manifest.PlannedRuns {
-		t.Fatalf("completed=%d planned=%d, want all planned", manifest.CompletedRuns, manifest.PlannedRuns)
-	}
-	for i, m := range runs {
-		if m.Failed || m.Task == "" || m.Arm == "" || m.FailureStage == "" {
-			t.Fatalf("results.jsonl line %d is not a completed run: %+v", i+1, m)
-		}
-	}
-	if gotScored, gotFailed := reportCounts(t, out); gotScored != manifest.CompletedRuns || gotFailed != 0 {
-		t.Fatalf("report says scored=%d failed=%d, want %d and 0", gotScored, gotFailed, manifest.CompletedRuns)
-	}
-	if !reflect.DeepEqual(runs, again) {
-		t.Fatal("two identical successful batches scored differently")
-	}
-	// Byte-for-byte on the runs. Trajectories carry per-message wall-clock
-	// stamps, so they are compared field by field instead.
-	if got, want := readFile(t, second, "results.jsonl"), readFile(t, first, "results.jsonl"); got != want {
-		t.Fatalf("an unchanged batch wrote different results.jsonl:\n%s\n---\n%s", want, got)
-	}
-	gotTraj, wantTraj := withoutStamps(t, readFile(t, second, "trajectories.jsonl")),
-		withoutStamps(t, readFile(t, first, "trajectories.jsonl"))
-	if gotTraj != wantTraj {
-		t.Fatalf("an unchanged batch wrote different trajectories:\n%s\n---\n%s", wantTraj, gotTraj)
-	}
-	repeat.StartedAt, repeat.FinishedAt = manifest.StartedAt, manifest.FinishedAt
-	repeat.TrajectoriesSHA256 = manifest.TrajectoriesSHA256
-	if !reflect.DeepEqual(repeat, manifest) {
-		t.Fatalf("an unchanged batch wrote a different manifest:\n%+v\n---\n%+v", manifest, repeat)
-	}
-	if repeat.FailedRuns != 0 {
-		t.Fatalf("a batch with no failure reports failed_runs=%d", repeat.FailedRuns)
-	}
-}
-
-// withoutStamps drops the createdAt stamp every message carries, which is the
-// one field a dry batch cannot reproduce between two runs.
-func withoutStamps(t *testing.T, text string) string {
-	t.Helper()
-	var b strings.Builder
-	for line := range strings.SplitSeq(strings.TrimSpace(text), "\n") {
-		var row map[string]any
-		if err := json.Unmarshal([]byte(line), &row); err != nil {
-			t.Fatal(err)
-		}
-		stripStamp(row)
-		out, err := json.Marshal(row)
-		if err != nil {
-			t.Fatal(err)
-		}
-		b.Write(out)
-		b.WriteByte('\n')
-	}
-	return b.String()
-}
-
-func stripStamp(v any) {
-	switch typed := v.(type) {
-	case map[string]any:
-		delete(typed, "createdAt")
-		delete(typed, "workDurationMs")
-		for _, child := range typed {
-			stripStamp(child)
-		}
-	case []any:
-		for _, child := range typed {
-			stripStamp(child)
-		}
-	}
-}
-
-func readFile(t *testing.T, root, name string) string {
-	t.Helper()
-	data, err := os.ReadFile(filepath.Join(root, name))
-	if err != nil {
-		t.Fatal(err)
-	}
-	return string(data)
-}
@@ -36,7 +36,7 @@ func (p *digestProvider) Name() string { return "fixture-digest" }
 func (p *digestProvider) Stream(_ context.Context, _ provider.Request) (<-chan provider.Chunk, error) {
 	p.calls++
 	ch := make(chan provider.Chunk, 2)
-	ch <- provider.Chunk{Type: provider.ChunkText, Text: "## Earlier work\nEarlier work continued across several files; nothing outstanding was recorded."}
+	ch <- provider.Chunk{Type: provider.ChunkText, Text: "Earlier work continued across several files; nothing outstanding was recorded."}
 	ch <- provider.Chunk{Type: provider.ChunkDone}
 	close(ch)
 	return ch, nil
@@ -5,7 +5,6 @@ import (
 	"crypto/rand"
 	"fmt"
 	"hash/fnv"
-	"io"
 	mathrand "math/rand"
 	"strings"
 )
@@ -91,25 +90,15 @@ func seededRand(parts ...string) *mathrand.Rand {
 // liveRand is the generator a paid run uses: every run gets values that existed
 // nowhere before it started.
 func liveRand() *mathrand.Rand {
-	rng, err := liveRandFrom(rand.Reader)
-	if err != nil {
-		panic("contextbench: no entropy for a live run: " + err.Error())
-	}
-	return rng
-}
-
-// liveRandFrom seeds a generator from an entropy source, so what a run's values
-// are unpredictable from is the source and nothing else.
-func liveRandFrom(entropy io.Reader) (*mathrand.Rand, error) {
 	var seed [8]byte
-	if _, err := io.ReadFull(entropy, seed[:]); err != nil {
-		return nil, err
+	if _, err := rand.Read(seed[:]); err != nil {
+		panic("contextbench: no entropy for a live run: " + err.Error())
 	}
 	var n int64
 	for _, b := range seed {
 		n = n<<8 | int64(b)
 	}
-	return mathrand.New(mathrand.NewSource(n)), nil
+	return mathrand.New(mathrand.NewSource(n))
 }

 // instantiate substitutes {{name}} and refuses anything left over. The grammar
@@ -54,22 +54,15 @@ func main() {
 	case "preflight":
 		os.Exit(runPreflight(tasks, root))
 	case "run-search":
-		os.Exit(runExperiment(*mode, experimentSearch, root, *dry, tasks))
+		os.Exit(runExperiment(experimentSearch, root, *dry, tasks))
 	case "run-boundary":
-		os.Exit(runBoundaries(*mode, root))
+		os.Exit(runBoundaries(root))
 	case "snippet":
 		os.Exit(runSnippetAudit(root, 100))
 	case "adversarial":
 		os.Exit(runAdversarial(root))
 	case "run-index":
-		batch := tasks
-		if *only == "" {
-			// A batch measures the efficiency substrate only. Naming one task
-			// with -task runs that task, role included, so the stopping corpus
-			// stays measurable on its own.
-			batch = efficiencyTasks()
-		}
-		os.Exit(runExperiment(*mode, experimentIndex, root, *dry, batch))
+		os.Exit(runExperiment(experimentIndex, root, *dry, tasks))
 	default:
 		fmt.Fprintf(os.Stderr, "unknown mode %q\n", *mode)
 		os.Exit(2)
@@ -1,10 +1,7 @@
 package main

 import (
-	"bytes"
 	"fmt"
-	"maps"
-	mathrand "math/rand"
 	"os/exec"
 	"slices"
 	"strings"
@@ -22,24 +19,16 @@ func TestCorpusIsWellFormed(t *testing.T) {
 	if got := len(searchTasks()); got != 6 {
 		t.Errorf("search experiment has %d tasks, want 6", got)
 	}
-	if got := len(indexTasks()); got != 12 {
-		t.Errorf("index experiment has %d tasks, want 12", got)
+	if got := len(indexTasks()); got != 6 {
+		t.Errorf("index experiment has %d tasks, want 6", got)
 	}
-	stopping := map[string]bool{}
 	tiers := map[string]int{}
 	for _, task := range indexTasks() {
-		if task.Role == roleStopping {
-			stopping[task.ID] = true
-			continue
-		}
 		tiers[task.CueTier]++
 	}
-	if !stopping["i03-coalescing"] || !stopping["i04-recovery-fence"] {
-		t.Errorf("the stopping corpus is %v; it must keep i03-coalescing and i04-recovery-fence", stopping)
-	}
-	// Two per tier, over the efficiency substrate, is what makes the staircase
-	// readable: the same task can be compared across the boundary its cue sits
-	// on, instead of two different questions being compared across two arms.
+	// Two per tier is what makes the staircase readable: the same task can be
+	// compared across the boundary its cue sits on, instead of two different
+	// questions being compared across two arms.
 	for _, tier := range []string{tierQuarter, tierHalf, tierDefault} {
 		if tiers[tier] != 2 {
 			t.Errorf("tier %s has %d tasks, want 2", tier, tiers[tier])
@@ -47,21 +36,6 @@ func TestCorpusIsWellFormed(t *testing.T) {
 	}
 }

-// The role decides which batch a task enters; the literal lists are only where
-// it is declared, so the two must not drift.
-func TestIndexListsMatchTheirRoles(t *testing.T) {
-	for _, task := range append(append(indexQuarterTasks(), indexHalfTasks()...), indexDefaultTasks()...) {
-		if task.Role != roleEfficiency {
-			t.Errorf("%s sits in an efficiency list with role %q", task.ID, task.Role)
-		}
-	}
-	for _, task := range stoppingIndexTasks() {
-		if task.Role != roleStopping {
-			t.Errorf("%s sits in the stopping list with role %q", task.ID, task.Role)
-		}
-	}
-}
-
 // The invariant the whole instantiation layer exists for: no literal a scorer
 // needs may be readable in this repository before a run starts.
 func TestNoAnswerLiteralExistsInTheRepository(t *testing.T) {
@@ -85,46 +59,20 @@ func TestNoAnswerLiteralExistsInTheRepository(t *testing.T) {
 	}
 }

-// A run's values are unpredictable from a previous run only if the live
-// generator is seeded from entropy. Comparing answers across two instances
-// cannot assert that: a task whose answer is a bounded number collides by
-// chance (1/8601 to 1/286 per task), so the check is on the seed source.
-func TestLiveRandDrawsFromEntropy(t *testing.T) {
-	a, b := liveRand(), liveRand()
-	for range 4 {
-		if a.Int63() != b.Int63() {
-			return
-		}
-	}
-	t.Fatal("two live generators produced the same stream: they are seeded alike")
-}
-
-// The source alone decides an instance: the same entropy gives the same
-// answers, different entropy gives different values.
-func TestLiveRandSourceDecidesTheInstance(t *testing.T) {
-	same := func() *mathrand.Rand {
-		rng, err := liveRandFrom(bytes.NewReader(bytes.Repeat([]byte{7}, 8)))
+// Two runs of the same task must not share an answer, or one leaked run leaks
+// every future one.
+func TestInstancesDifferBetweenRuns(t *testing.T) {
+	for _, task := range allTasks() {
+		a, err := instantiateTask(task, liveRand())
 		if err != nil {
 			t.Fatal(err)
 		}
-		return rng
-	}
-	other, err := liveRandFrom(bytes.NewReader(bytes.Repeat([]byte{9}, 8)))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := liveRandFrom(bytes.NewReader(nil)); err == nil {
-		t.Fatal("an empty entropy source was accepted")
-	}
-	for _, task := range allTasks() {
-		a, _ := instantiateTask(task, same())
-		b, _ := instantiateTask(task, same())
-		if !slices.Equal(a.AnswerMarkers, b.AnswerMarkers) || !maps.Equal(a.Vars, b.Vars) {
-			t.Errorf("%s: the same entropy gave different instances", task.ID)
+		b, err := instantiateTask(task, liveRand())
+		if err != nil {
+			t.Fatal(err)
 		}
-		c, _ := instantiateTask(task, other)
-		if maps.Equal(a.Vars, c.Vars) {
-			t.Errorf("%s: different entropy gave the same values", task.ID)
+		if slices.Equal(a.AnswerMarkers, b.AnswerMarkers) {
+			t.Errorf("%s produced the same answers twice: %v", task.ID, a.AnswerMarkers)
 		}
 	}
 }
@@ -130,7 +130,7 @@ type queryAudit struct {
 func auditQueries(runs []contextMetrics) queryAudit {
 	a := queryAudit{Reformulations: map[string]int{}, MissedProbeTerms: map[string]int{}}
 	for _, r := range runs {
-		if r.Failed || r.Contaminated {
+		if r.Contaminated {
 			continue
 		}
 		a.Runs++
@@ -14,6 +14,7 @@ import (

 	"reasonix/internal/assembly/boot"
 	"reasonix/internal/contract/ablation"
+	"reasonix/internal/contract/event"
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/contract/tool"
 	_ "reasonix/internal/model/openai"
@@ -85,7 +86,6 @@ func runAdversarial(root string) int {
 			adversarialPrompts[t.Experiment])
 		if err != nil {
 			fmt.Fprintf(os.Stderr, "%s: %v\n", id, err)
-			m = failedMetrics(t, "adversarial", err)
 		}
 		verdict := "isolated"
 		if m.EscapeFoundAnswer {
@@ -132,11 +132,10 @@ func runOne(p provider.Provider, t contextTask, arm ablation.Set, armName, root
 	}
 	boot.ApplyUnifiedProviderToolSurface(reg, false, arm)

-	var usage usageSink
 	a := agent.New(p, reg, sess, agent.Options{
 		ContextWindow: fixtureWindow, CompactRatio: 0.5, RecentKeep: 2,
 		SessionPath: f.Path, KeepPolicy: agent.KeepErrors, Ablation: arm,
-	}, &usage)
+	}, event.Discard)
 	a.LoadProjectionSidecar(f.Path)
 	// From here the transcript lives only in memory. On disk it is the answer.
 	sealFixture(f.Path)
@@ -162,10 +161,6 @@ func runOne(p provider.Provider, t contextTask, arm ablation.Set, armName, root
 	appended := sess.Snapshot()[before:]
 	m := scoreRun(appended, inst, f.Target, armName, cueVisible)
 	m.trajectory = appended
-	if u, requests := usage.snapshot(); requests > 0 {
-		m.UsageReportedRequests, m.PromptTokens, m.CompletionTokens = requests, u.PromptTokens, u.CompletionTokens
-		m.CacheHitTokens, m.CacheMissTokens, m.UsageEstimated = u.CacheHitTokens, u.CacheMissTokens, u.Estimated
-	}
 	m.scoreAnswer(finalAnswer(appended), inst)
 	if runErr != nil {
 		m.FailureStage = "RunError"
@@ -174,16 +169,6 @@ func runOne(p provider.Provider, t contextTask, arm ablation.Set, armName, root
 	return m, runErr
 }

-// failedMetrics is what a run that never reached a transcript leaves behind. It
-// carries the run's identity and the stage that ended it, so the failure stays a
-// countable fact; Failed keeps it out of every statistic.
-func failedMetrics(t contextTask, armName string, err error) contextMetrics {
-	return contextMetrics{
-		Task: t.ID, Arm: armName, Failed: true,
-		FailureStage: stageNoEvidence, Reason: err.Error(),
-	}
-}
-
 // finalAnswer is the last assistant text the turn produced.
 func finalAnswer(msgs []provider.Message) string {
 	for _, m := range slices.Backward(msgs) {
@@ -227,10 +212,7 @@ func isolateWorkspace() (func(), error) {

 // The two arms get separate nonces: reusing one would leave the first arm's
 // answer in a host-readable history for the second to find.
-func runBoundaries(mode, root string) int {
-	started := time.Now()
-	planned := 0
-	repo, _ := os.Getwd()
+func runBoundaries(root string) int {
 	root, err := filepath.Abs(root)
 	if err != nil {
 		fmt.Fprintln(os.Stderr, err)
@@ -250,18 +232,16 @@ func runBoundaries(mode, root string) int {

 	var all []contextMetrics
 	var cueSide, noCueSide []contextMetrics
-	for _, t := range efficiencyTasks() {
+	for _, t := range indexTasks() {
 		cue, noCue := boundaryPair(t.CueTier)
 		for _, side := range []struct {
 			scale string
 			has   bool
 		}{{cue, true}, {noCue, false}} {
 			name := "index-" + side.scale
-			planned++
 			m, err := runOne(p, t, armFor(side.scale, false), name, root, side.has, false)
 			if err != nil {
 				fmt.Fprintf(os.Stderr, "%s [%s]: %v\n", t.ID, name, err)
-				m = failedMetrics(t, name, err)
 			}
 			all = append(all, m)
 			if side.has {
@@ -269,14 +249,14 @@ func runBoundaries(mode, root string) int {
 			} else {
 				noCueSide = append(noCueSide, m)
 			}
-			fmt.Printf("%-24s %-14s cue=%-3v %-14s search=%d read=%d direct=%-5v recall-tok=%-5d%s escape=%d\n",
+			fmt.Printf("%-24s %-14s cue=%-3v %-14s search=%d read=%d direct=%-5v recall-tok=%-5d escape=%d\n",
 				t.ID, name, side.has, m.FailureStage, m.SearchCalls, m.ReadCalls,
-				m.CueDirectRead, m.RecallReturnedTokens, promptTokenSuffix(m), m.EscapeCalls)
+				m.CueDirectRead, m.RecallReturnedTokens, m.EscapeCalls)
 		}
 	}
 	reportDeltas(cueSide, noCueSide)
 	fmt.Print(reportStopping(all))
-	return writeResults(root, batchInfo{Mode: mode, Planned: planned, Started: started, Repo: repo}, all)
+	return writeResults(root, all)
 }

 // reportDeltas is the paired reading: each task against itself, then pooled.
@@ -318,10 +298,7 @@ func deltaBool(a, b bool) string {
 // runExperiment runs one experiment's tasks across its arms. A dry run drives
 // the same pipeline with a scripted provider: it proves fixture, run, scoring
 // and report hold together before any of it is paid for.
-func runExperiment(mode, experiment, root string, dry bool, tasks []contextTask) int {
-	started := time.Now()
-	planned := 0
-	repo, _ := os.Getwd()
+func runExperiment(experiment, root string, dry bool, tasks []contextTask) int {
 	root, err := filepath.Abs(root)
 	if err != nil {
 		fmt.Fprintln(os.Stderr, err)
@@ -357,17 +334,15 @@ func runExperiment(mode, experiment, root string, dry bool, tasks []contextTask)
 		// test: a bad minute would land entirely on one arm.
 		for _, arm := range shuffledArms(t) {
 			cueVisible := t.Experiment == experimentIndex && cueExpectedVisible(t, arm.scale)
-			planned++
 			m, err := runOne(p, t, armFor(arm.scale, arm.searchOff), arm.name, root, cueVisible, dry)
 			if err != nil {
 				fmt.Fprintf(os.Stderr, "%s [%s]: %v\n", t.ID, arm.name, err)
-				m = failedMetrics(t, arm.name, err)
 			}
 			byArm[arm.name] = append(byArm[arm.name], m)
 			all = append(all, m)
-			fmt.Printf("%-24s %-14s %-18s search=%d hit=%d read=%d recall-tok=%d%s %v\n",
+			fmt.Printf("%-24s %-14s %-18s search=%d hit=%d read=%d recall-tok=%d %v\n",
 				t.ID, arm.name, m.FailureStage, m.SearchCalls, m.TargetSearchHits, m.ReadCalls,
-				m.RecallReturnedTokens, promptTokenSuffix(m), m.UnexpectedWorkTools)
+				m.RecallReturnedTokens, m.UnexpectedWorkTools)
 		}
 	}
 	reportFunnels(byArm)
@@ -380,7 +355,7 @@ func runExperiment(mode, experiment, root string, dry bool, tasks []contextTask)
 	if experiment == experimentIndex {
 		reportBoundaries(all)
 	}
-	return writeResults(root, batchInfo{Mode: mode, Planned: planned, Started: started, Dry: dry, Repo: repo}, all)
+	return writeResults(root, all)
 }

 func cueExpectedVisible(t contextTask, scale string) bool {
@@ -435,7 +410,7 @@ func writeTrajectories(root string, all []contextMetrics) error {
 	return nil
 }

-func writeResults(root string, info batchInfo, all []contextMetrics) int {
+func writeResults(root string, all []contextMetrics) int {
 	path := filepath.Join(root, "results.jsonl")
 	f, err := os.Create(path)
 	if err != nil {
@@ -443,30 +418,17 @@ func writeResults(root string, info batchInfo, all []contextMetrics) int {
 		return 2
 	}
 	defer f.Close()
-	scored, failed := 0, 0
 	for _, m := range all {
 		if err := writeJSONLine(f, m); err != nil {
 			fmt.Fprintln(os.Stderr, err)
 			return 2
 		}
-		if m.Failed {
-			failed++
-		} else {
-			scored++
-		}
 	}
 	if err := writeTrajectories(root, all); err != nil {
 		fmt.Fprintln(os.Stderr, "write trajectories:", err)
 		return 2
 	}
-	if err := writeBatchManifest(root, info, all); err != nil {
-		fmt.Fprintln(os.Stderr, "write batch manifest:", err)
-		return 2
-	}
-	// Both counts are named: a reader who sees only the batch size cannot tell
-	// measurements from attempts.
-	fmt.Printf("\n%d runs written to %s: scored=%d failed=%d (with trajectories.jsonl and batch.json)\n",
-		len(all), path, scored, failed)
+	fmt.Printf("\n%d runs written to %s (with trajectories.jsonl)\n", len(all), path)
 	return 0
 }

@@ -475,21 +437,9 @@ func writeResults(root string, info batchInfo, all []contextMetrics) int {
 // what a four-arm average cannot do.
 func reportBoundaries(all []contextMetrics) {
 	byKey := map[string]contextMetrics{}
-	scored, failed := 0, 0
 	for _, m := range all {
-		if m.Failed {
-			// No transcript, no boundary to compare: count the failure instead of
-			// printing the zero it left behind as a measurement.
-			failed++
-			continue
-		}
-		scored++
 		byKey[m.Task+"|"+m.Arm] = m
 	}
-	if scored == 0 {
-		fmt.Printf("\n## Across each task's cue boundary\n  no scored runs: scored=%d failed=%d (nothing to compare)\n", scored, failed)
-		return
-	}
 	var cueSide, noCueSide []contextMetrics
 	fmt.Println("\n## Across each task's cue boundary")
 	fmt.Printf("  %-24s %-16s %-4s %-10s %-9s %-12s %-11s %s\n",
@@ -1,59 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"sync"
-
-	"reasonix/internal/contract/event"
-	"reasonix/internal/contract/provider"
-)
-
-// usageSink reads what a run cost from the events the agent already emits. Every
-// billed completion reports event.Usage — the round path, compaction, command
-// routing and failure diagnosis all do — so the bench reads the same record the
-// product reads instead of wrapping a provider and counting a second time.
-type usageSink struct {
-	mu       sync.Mutex
-	requests int
-	usage    provider.Usage
-}
-
-func (s *usageSink) Emit(e event.Event) {
-	if e.Kind != event.Usage || e.Usage == nil {
-		return
-	}
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	// One event is one completion that reported usage; RequestCount covers a
-	// completion that merged attempts. A request that failed before reporting
-	// leaves no event, so this is not a count of attempts.
-	if e.Usage.RequestCount > 0 {
-		s.requests += e.Usage.RequestCount
-	} else {
-		s.requests++
-	}
-	u := *e.Usage
-	s.usage.PromptTokens += u.PromptTokens
-	s.usage.CompletionTokens += u.CompletionTokens
-	s.usage.TotalTokens += u.TotalTokens
-	s.usage.CacheHitTokens += u.CacheHitTokens
-	s.usage.CacheMissTokens += u.CacheMissTokens
-	s.usage.ReasoningTokens += u.ReasoningTokens
-	s.usage.Estimated = s.usage.Estimated || u.Estimated
-}
-
-func (s *usageSink) snapshot() (provider.Usage, int) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	return s.usage, s.requests
-}
-
-// promptTokenSuffix renders what a run cost only when something reported it. A
-// dry run reports nothing, and a trailing "prompt-tok=0" would read as a
-// measured zero rather than as no measurement.
-func promptTokenSuffix(m contextMetrics) string {
-	if m.UsageReportedRequests == 0 {
-		return ""
-	}
-	return fmt.Sprintf(" prompt-tok=%d", m.PromptTokens)
-}
@@ -1,54 +0,0 @@
-package main
-
-import (
-	"testing"
-
-	"reasonix/internal/contract/event"
-	"reasonix/internal/contract/provider"
-)
-
-// The cost a run reports must be what the agent reported, summed across every
-// completion it billed — including one that merged attempts and one that could
-// only estimate. Any other event kind is not a cost.
-func TestUsageSinkAccumulatesWhatTheAgentReports(t *testing.T) {
-	var sink usageSink
-	sink.Emit(event.Event{}) // a kind that is not Usage
-	sink.Emit(event.Event{Kind: event.Usage, Usage: &provider.Usage{
-		PromptTokens: 100, CompletionTokens: 10, TotalTokens: 110, CacheHitTokens: 60, CacheMissTokens: 40,
-	}})
-	sink.Emit(event.Event{Kind: event.Usage, Usage: &provider.Usage{
-		PromptTokens: 7, CompletionTokens: 3, CacheHitTokens: 2, CacheMissTokens: 5, RequestCount: 2, Estimated: true,
-	}})
-	sink.Emit(event.Event{Kind: event.Usage}) // a Usage event with no payload is not a cost
-
-	usage, requests := sink.snapshot()
-	if requests != 3 {
-		t.Fatalf("requests = %d, want 3 (1 + the merged attempt's 2; the empty event adds none)", requests)
-	}
-	if usage.PromptTokens != 107 || usage.CompletionTokens != 13 || usage.TotalTokens != 110 {
-		t.Fatalf("accumulated usage = %+v", usage)
-	}
-	if usage.CacheHitTokens != 62 || usage.CacheMissTokens != 45 {
-		t.Fatalf("cache split = %+v", usage)
-	}
-	if !usage.Estimated {
-		t.Fatal("Estimated was dropped when one completion reported an estimate")
-	}
-}
-
-// A dry run must not claim a cost it never paid, in the JSON or in the line a
-// person reads: an empty suffix, not "prompt-tok=0".
-func TestUsageSinkStaysEmptyWithoutUsage(t *testing.T) {
-	var sink usageSink
-	sink.Emit(event.Event{})
-	usage, requests := sink.snapshot()
-	if requests != 0 || usage.PromptTokens != 0 || usage.CompletionTokens != 0 {
-		t.Fatalf("nothing reported usage, got %+v requests=%d", usage, requests)
-	}
-	if suffix := promptTokenSuffix(contextMetrics{}); suffix != "" {
-		t.Fatalf("a run with no reported usage still printed %q", suffix)
-	}
-	if suffix := promptTokenSuffix(contextMetrics{UsageReportedRequests: 1, PromptTokens: 12}); suffix != " prompt-tok=12" {
-		t.Fatalf("a reported cost printed %q", suffix)
-	}
-}
@@ -1,3 +0,0 @@
-alpha=QORVEX-7741
-beta=MIRALD-3208
-gamma=TESSIK-9155
@@ -1,87 +0,0 @@
-# Desktop surface evaluation
-
-This protocol supplies the fixed-task trajectory comparison required by
-[RFC #12584](https://github.com/esengine/DeepSeek-Reasonix/issues/12584).
-There are no measured results yet. Component tests and scripted providers prove
-delivery, validation and replay; they do not measure a model's choice of interface
-or a person's effort.
-
-## Paired runs
-
-Run each task twice in fresh desktop sessions: ordinary text/ask interaction and
-native surfaces. Use the same model, sampling settings, initial workspace,
-permission mode and task prompt. Record commit, model, configuration and the
-native-surface capability setting. Alternate condition order across repetitions.
-Keep the hidden tool out of the provider prefix in both conditions; only its
-availability through capability discovery differs.
-
-The baseline may batch questions or accept a single text reply. Never force it to
-ask one question per field. Do not tell either model how many turns to use or
-which component to render. If the surface-enabled model chooses text, retain
-that run in the surface condition. Interface choice is part of the experiment.
-
-The operator knows the private values below but does not volunteer them before
-the model requests the corresponding information. Supply all requested values
-together, regardless of presentation. Allow inspection and local editing before
-submission. Save the trajectory and an observer ledger locally; raw transcripts
-and draft content must not enter the aggregate report.
-
-## Fixed tasks
-
-| Task | Initial prompt, identical in both conditions | Private operator input | Completion criterion |
-| --- | --- | --- | --- |
-| `release-brief` | Prepare a release brief. Ask me for the audience, release date and whether this is a staged rollout before writing it. | audience: existing desktop users; date: 2026-11-03; staged rollout: yes | Final brief contains all three values and adds no release commitment. |
-| `storage-choice` | Help me choose storage for a small desktop app. Present reasonable choices, ask me to choose and ask whether offline operation is required. Then summarize the decision. | storage: SQLite; offline: yes | Final decision states SQLite and offline operation, with no installation or file changes. |
-| `draft-revision` | Draft a two-line release announcement and let me revise it before returning the final version verbatim. | Replace with the exact string `  Desktop release ready.\nKeep existing settings.\n` (decode the escapes). | Final returned string has exactly the specified leading spaces and newlines. Formatting wrappers are excluded from the comparison. |
-| `preview-decision` | Show a plain-text before/after preview changing retry count from 2 to 3. Ask whether to keep that change and whether to include a release note. Return a decision summary; do not change files. | keep change: yes; release note: no | Preview shows 2 to 3; final summary preserves both decisions; workspace is unchanged. |
-
-Freeze this task set before collecting results. Record a new protocol version if
-prompts, private inputs, completion criteria or metric definitions change.
-Neither the model's final claim nor a successful input acknowledgment establishes
-completion. The observer checks the resulting output against the criterion.
-
-## Metric definitions (version 1)
-
-The anchor is acknowledgment of the initial task prompt. The observation ends
-when the criterion is verified, the operator abandons the task, or the run fails.
-The initial prompt is excluded from subsequent-input counts because both
-conditions start from the same request.
-
-| Metric | Count and population | Exclusions |
-| --- | --- | --- |
-| `acknowledged_inputs` | Distinct operator submissions acknowledged after the anchor: chat replies, ask answers, surface answers and surface actions. Includes acknowledged input later withdrawn or superseded. | Initial task prompt, local draft edits, retries with the same acknowledged request identity, automatic dispatch, replay and observer grading. This counts input exchanges, not provider rounds. |
-| `submission_attempts` | Explicit operator send attempts, including rejected submissions and manual retries. | Automatic transport retries, replay, local edits and model tool calls. |
-| `withdrawals` | Successful operator withdrawals of admitted input. | Failed withdrawals, automatic cancellation and replay. |
-| `completed` | Runs whose output meets the fixed criterion. Denominator: every started run in each condition. | None; failures and abandoned runs remain in the denominator. |
-
-Record these in a content-free ledger: task id, repetition, condition, observer
-event ordinal, event type, opaque request identity, acknowledgment status and
-completion verdict. Record the source trajectory reference and observed start
-and end anchors alongside it. Distinguish manual observation from host-recorded
-events. Do not copy labels, prompts, private values, drafts or answer strings into
-the ledger. Identities are local correlation handles, not account identifiers.
-
-The current pane counters and rendered trajectory export cannot reconstruct all
-acknowledgments, refusals and withdrawals. Do not infer them from `ask` calls,
-tool-result counts, final prose, message wording or card mounts. Until structural
-acknowledgment records cover every channel, an observer ledger is required.
-
-## Report and decision
-
-Report the number started, completed, failed and abandoned for each condition,
-then paired input-count differences for repetitions where **both** conditions
-meet the same criterion. List excluded pairs and their reason beside that
-comparison. Also report submission attempts and withdrawals; fewer admitted
-inputs with more failures is not automatically less effort.
-
-Keep per-task results visible. Do not combine scripted fixtures with observed
-model/operator runs or describe this small task set as an account-wide result.
-Report model/configuration differences and missing evidence as limitations.
-
-The RFC's benefit remains unproven until observed trajectories show fewer input
-exchanges to the same verified outcome. These results alone do not justify P3;
-adaptive layout or MCP Apps needs a measured problem in addition to this result.
-
-The owner-requested map, comparison and dashboard workspaces extend the delivery
-scope independently of this study. Their scripted acceptance fixtures verify
-rendering and interaction only; they do not count as observed benefit evidence.
@@ -1,4 +1,5 @@
 prompt = "为本项目新建一个数据库迁移脚本文件（空文件即可），文件名必须符合项目的迁移命名规范。"
 class = "cjk"
+max_steps = 8
 timeout_sec = 180
 memory_markers = ["MEMKEY-CJK5T"]
@@ -1,4 +1,5 @@
 prompt = "Write the deploy region for this project (just the region string) into answer.txt."
 class = "conflict"
+max_steps = 8
 timeout_sec = 180
 memory_markers = ["MEMKEY-CONF2P"]
@@ -1,4 +1,5 @@
 prompt = "Write the command to install this project's dependencies into answer.txt."
 class = "contradiction"
+max_steps = 8
 timeout_sec = 180
 memory_markers = ["MEMKEY-CONTRA"]
@@ -1,4 +1,5 @@
 prompt = "Write this project's canonical fast-check command (the exact command line, nothing else) into answer.txt."
 class = "distractor"
+max_steps = 8
 timeout_sec = 180
 memory_markers = ["MEMKEY-DIST5Q"]
@@ -1,4 +1,5 @@
 prompt = "Write this project's canonical fast-check command (the exact command line, nothing else) into answer.txt."
 class = "exact"
+max_steps = 8
 timeout_sec = 180
 memory_markers = ["MEMKEY-EXACT7Q"]
@@ -1,3 +1,4 @@
 prompt = "Add a function add(a, b) returning a+b to util.py."
 class = "generic"
+max_steps = 8
 timeout_sec = 180
@@ -1,4 +1,5 @@
 prompt = "Copy the exact server timeout configuration line from config/server.conf into answer.txt, unchanged."
 class = "history"
+max_steps = 8
 timeout_sec = 180
 memory_markers = ["MEMKEY-HIST6M"]
@@ -1,4 +1,5 @@
 prompt = "Which tool do we install dependencies with here? Write the exact install command into answer.txt."
 class = "paraphrase"
+max_steps = 8
 timeout_sec = 180
 memory_markers = ["MEMKEY-PARA3X"]
@@ -1,5 +1,6 @@
 prompt = "Create a file named notes.txt containing one line: hello."
 class = "pinned"
+max_steps = 8
 timeout_sec = 180
 memory_markers = ["MEMKEY-PIN4D"]
 memory_markers_prefix = true
@@ -1,4 +1,5 @@
 prompt = "Confirm the current release branch of this repo and write it into answer.txt."
 class = "stale"
+max_steps = 8
 timeout_sec = 180
 memory_markers = ["MEMKEY-STALE1"]
@@ -1,4 +1,5 @@
 prompt = "Set the retry max backoff to 250 in this project's configuration."
 class = "symbol"
+max_steps = 8
 timeout_sec = 180
 memory_markers = ["MEMKEY-SYM9K"]
@@ -1,4 +1,5 @@
 prompt = "Write the current API base URL for this project into answer.txt."
 class = "update"
+max_steps = 8
 timeout_sec = 180
 memory_markers = ["MEMKEY-UPD8R"]
@@ -1,4 +1,5 @@
 prompt = "查一下灰度的放量比例，写进 answer.txt。"
 class = "v1miss"
+max_steps = 8
 timeout_sec = 180
 memory_markers = ["MEMKEY-VM1GR"]
@@ -1,4 +1,5 @@
 prompt = "这个项目的部署审批人是谁？把审批人的用户名写进 answer.txt。"
 class = "v1miss"
+max_steps = 8
 timeout_sec = 180
 memory_markers = ["MEMKEY-VM1XL"]
@@ -1,4 +1,5 @@
 prompt = "Set the max idle connection seconds to 30 in this project's configuration."
 class = "v1miss"
+max_steps = 8
 timeout_sec = 180
 memory_markers = ["MEMKEY-VM1SYM"]
@@ -1,3 +0,0 @@
-def total(items):
-    """Sum the items."""
-    return sum(x for x in items if x > 0)
@@ -1,3 +0,0 @@
-def total(items):
-    """Sum the items."""
-    return sum(x for x in items if x > 0)
@@ -1,3 +0,0 @@
-def total(items):
-    """Sum the items."""
-    return sum(x for x in items if x > 0)
@@ -1,3 +0,0 @@
-def total(items):
-    """Sum the items."""
-    return sum(x for x in items if x > 0)
@@ -1,3 +0,0 @@
-def total(items):
-    """Sum the items."""
-    return sum(x for x in items if x > 0)
@@ -1,3 +0,0 @@
-def total(items):
-    """Sum the items."""
-    return sum(x for x in items if x > 0)
@@ -1,3 +0,0 @@
-def total(items):
-    """Sum the items."""
-    return sum(x for x in items if x > 0)
@@ -1,3 +0,0 @@
-def total(items):
-    """Sum the items."""
-    return sum(x for x in items if x > 0)
@@ -1,2 +0,0 @@
-value=7
-file=limits/budget.py
@@ -1,2 +0,0 @@
-handler=h07.py
-missing=validate_payload
@@ -1,8 +0,0 @@
-def wire_fee(amount):
-    """Return the wire fee for `amount`: the greater of 15.0 and 0.1% of it.
-
-    A zero or negative amount has no wire fee, so it returns 0.0.
-    """
-    if amount <= 0:
-        return 0.0
-    return max(15.0, amount * 0.001)
@@ -1,13 +0,0 @@
-def convert(amount, rate):
-    """Convert `amount` at `rate` and return the product.
-
-    Both units belong to the caller. A negative amount converts unchanged.
-    """
-    return amount * rate
-
-def spread(bid, ask):
-    """Return `ask - bid`, the spread between the two quoted prices.
-
-    A negative result means the bid is above the ask.
-    """
-    return ask - bid
@@ -1,4 +0,0 @@
-EARTH_RADIUS_KM = 6371.0
-
-def dist(left, right):
-    return abs(left - right) * EARTH_RADIUS_KM
@@ -1,4 +0,0 @@
-import geo
-
-def near_by(point, other):
-    return geo.dist(point, other) < 10
@@ -1,16 +0,0 @@
-import json
-import sys
-
-def upgrade(row):
-    parts = row["fullname"].rsplit(" ", 1)
-    out = {k: v for k, v in row.items() if k != "fullname"}
-    out["first"] = parts[0]
-    out["last"] = parts[1] if len(parts) > 1 else ""
-    return out
-
-def main():
-    for line in sys.stdin:
-        line = line.strip()
-        if not line:
-            continue
-        print(json.dumps(upgrade(json.loads(line))))
@@ -1,7 +0,0 @@
-import logging
-
-log = logging.getLogger("orders")
-
-def place(order, request_id):
-    log.info("placing order %s", order["id"], extra={"request_id": request_id})
-    return {"ok": True}
@@ -1,7 +0,0 @@
-import logging
-
-log = logging.getLogger("shipping")
-
-def dispatch(order, request_id):
-    log.info("dispatching %s", order["id"], extra={"request_id": request_id})
-    return {"ok": True}
@@ -1,11 +0,0 @@
-import math
-
-def p95(sorted_values):
-    if not sorted_values:
-        return 0
-    return sorted_values[math.ceil(len(sorted_values) * 0.95) - 1]
-
-def rate(events, seconds):
-    if seconds <= 0:
-        return 0.0
-    return len(events) / seconds
@@ -1,9 +0,0 @@
-import core
-
-_cache = None
-
-def list_records_cached():
-    global _cache
-    if _cache is None:
-        _cache = core.list_records()
-    return _cache
@@ -1,5 +0,0 @@
-import cache
-
-def main():
-    for k, v in sorted(cache.list_records_cached().items()):
-        print(f"{k}={v}")
@@ -1,4 +0,0 @@
-DATA = {"a": 1, "b": 2}
-
-def list_records():
-    return dict(DATA)
@@ -1 +0,0 @@
-DEFAULTS = {"host": "localhost", "port": 8080}
@@ -1,6 +0,0 @@
-import json
-import defaults
-
-def load(text):
-    data = json.loads(text) if text.strip() else {}
-    return dict(defaults.DEFAULTS, **data)
@@ -1,4 +0,0 @@
-import json
-
-def dump(cfg):
-    return json.dumps(cfg, sort_keys=True)
@@ -1,2 +0,0 @@
-STATES = ("new", "paid", "delivered", "cancelled")
-TERMINAL = ("delivered", "cancelled")
@@ -1,11 +0,0 @@
-import states
-
-LEGAL = {
-    "new": ("paid", "cancelled"),
-    "paid": ("delivered", "cancelled"),
-    "delivered": (),
-    "cancelled": (),
-}
-
-def can_move(a, b):
-    return b in LEGAL[a]
@@ -1,5 +0,0 @@
-import schema, serializer
-
-def display_name(line):
-    rec = serializer.load(line)
-    return rec["handle"] or rec["email"]
@@ -1,4 +0,0 @@
-FIELDS = ("handle", "email")
-
-def blank():
-    return {f: "" for f in FIELDS}
@@ -1,4 +0,0 @@
-import timings
-
-def is_slow(entry):
-    return entry["elapsed_s"] > timings.SLOW_SECONDS
@@ -1,4 +0,0 @@
-import timings
-
-def within_budget(entries):
-    return sum(e["elapsed_s"] for e in entries) <= timings.BUDGET_SECONDS
@@ -1,5 +0,0 @@
-SLOW_SECONDS = 2.0
-BUDGET_SECONDS = 60.0
-
-def record(seconds):
-    return {"elapsed_s": seconds}
@@ -203,11 +203,6 @@ func answerLeakDetected(r result) bool {
 }

 func recordTaskTrajectory(r *result, path string, t task) {
-	if r.SFT != nil && r.Segments <= 1 {
-		if err := bindSFTTrajectory(path, r.SFT); err != nil {
-			r.Note = appendNote(r.Note, "SFT provenance: "+err.Error())
-		}
-	}
 	if summary, err := summarizeTrajectory(path); err == nil {
 		r.Trajectory = summary
 	}
@@ -1,218 +0,0 @@
-package main
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"reasonix/internal/base/testenv"
-)
-
-// writeKilledAgentStub writes a stand-in for the reasonix binary that leaves
-// exactly what a killed child leaves behind: no final metrics record, but the
-// in-flight snapshot the metrics sink writes every two seconds.
-func writeKilledAgentStub(t *testing.T, dir string) string {
-	t.Helper()
-	path := filepath.Join(dir, "stub-agent.sh")
-	script := "#!/bin/sh\n" +
-		"metrics=\"\"\n" +
-		"prev=\"\"\n" +
-		"for arg in \"$@\"; do\n" +
-		"  if [ \"$prev\" = \"--metrics\" ]; then metrics=\"$arg\"; fi\n" +
-		"  prev=\"$arg\"\n" +
-		"done\n" +
-		"printf '%s' '{\"prompt_tokens\":1200,\"completion_tokens\":80,\"steps\":9," +
-		"\"cost\":0.0123,\"currency\":\"USD\",\"complete\":false}' > \"$metrics.partial\"\n" +
-		"exit 137\n"
-	if err := os.WriteFile(path, []byte(script), 0o755); err != nil {
-		t.Fatalf("write stub: %v", err)
-	}
-	return path
-}
-
-func killedRun(t *testing.T) result {
-	t.Helper()
-	requireShellStub(t)
-	work := testenv.TempDir(t)
-	tk := task{ID: "stub-task", Prompt: "do the thing"}
-	r := result{task: tk}
-	cfg := suiteConfig{bin: writeKilledAgentStub(t, work)}
-	if err := runSegments(context.Background(), cfg, tk, work, "", nil, &r); err == nil {
-		t.Fatal("the stub exits 137; a leg that died must be reported as failed")
-	}
-	return r
-}
-
-// writeSilentAgentStub writes a stand-in that leaves neither a final record nor
-// a snapshot: what it spent is simply gone, so nothing can bound it.
-func writeSilentAgentStub(t *testing.T, dir string) string {
-	t.Helper()
-	requireShellStub(t)
-	path := filepath.Join(dir, "silent-agent.sh")
-	if err := os.WriteFile(path, []byte("#!/bin/sh\nexit 0\n"), 0o755); err != nil {
-		t.Fatalf("write stub: %v", err)
-	}
-	return path
-}
-
-// A run recovered from its snapshot is still accounted: its numbers are real and
-// stop at the last write, which is exactly what Partial says. Marking it
-// Unaccounted would drop them from every total and hide the lower bound.
-func TestSuiteSidecarRecoveredRunStaysAccountedAsALowerBound(t *testing.T) {
-	r := killedRun(t)
-	if r.Unaccounted || !r.Partial {
-		t.Fatalf("a run recovered from its snapshot was reported as unmeasured:\n"+
-			"  partial=%v unaccounted=%v, want partial=true unaccounted=false", r.Partial, r.Unaccounted)
-	}
-	stats := gatherSuiteStats([]result{r})
-	if stats.unaccounted != 0 || stats.accounted != 1 || stats.partial != 1 {
-		t.Fatalf("a recovered run changed category:\n"+
-			"  unaccounted=%d accounted=%d partial=%d", stats.unaccounted, stats.accounted, stats.partial)
-	}
-	if stats.pTok != 1200 || stats.cTok != 80 || stats.cost != 0.0123 {
-		t.Fatalf("the recovered numbers never reached the aggregates:\n"+
-			"  tokens=%d/%d cost=%.4f, want 1200/80 at 0.0123", stats.pTok, stats.cTok, stats.cost)
-	}
-	if out := renderBody([]result{r}); !strings.Contains(out, "contributed partial accounting") {
-		t.Fatalf("the lower-bound hint is unreachable:\n%s", out)
-	}
-}
-
-// A leg that leaves neither record has no surviving evidence at all, so the run
-// is unmeasured and must stay out of the totals rather than count as zero.
-func TestSuiteRunWithNoRecordAtAllIsUnaccounted(t *testing.T) {
-	work := testenv.TempDir(t)
-	tk := task{ID: "silent-task", Prompt: "do the thing"}
-	r := result{task: tk}
-	cfg := suiteConfig{bin: writeSilentAgentStub(t, work)}
-	if err := runSegments(context.Background(), cfg, tk, work, "", nil, &r); err != nil {
-		t.Fatalf("the stub exits 0; a silent leg must not fail the run: %v", err)
-	}
-	if !r.Unaccounted || r.Partial {
-		t.Fatalf("a run that left no record at all was not marked unmeasured:\n"+
-			"  partial=%v unaccounted=%v, want partial=false unaccounted=true", r.Partial, r.Unaccounted)
-	}
-	stats := gatherSuiteStats([]result{r})
-	if stats.unaccounted != 1 || stats.accounted != 0 {
-		t.Fatalf("a record-less run was counted as accounted:\n"+
-			"  unaccounted=%d accounted=%d", stats.unaccounted, stats.accounted)
-	}
-	if stats.pTok != 0 || stats.cTok != 0 || stats.cost != 0 {
-		t.Fatalf("a record-less run contributed numbers: tokens=%d/%d cost=%.4f",
-			stats.pTok, stats.cTok, stats.cost)
-	}
-	if out := renderBody([]result{r}); !strings.Contains(out, "Accounting incomplete for 1 of 1 instances") {
-		t.Fatalf("the record-less run was not disclosed as unaccounted:\n%s", out)
-	}
-}
-
-// The killed child did leave its numbers: the metrics sink snapshots in flight
-// into <metrics>.partial. Swebench mode reads that sidecar; the suite path must
-// do the same rather than let the directory removal destroy the evidence.
-func TestSuiteRunRecoversTheInFlightSnapshotItsChildLeft(t *testing.T) {
-	r := killedRun(t)
-	if r.PromptTokens != 1200 || r.CompletionTokens != 80 {
-		t.Fatalf("the child's in-flight snapshot was dropped:\n"+
-			"  prompt_tokens=%d completion_tokens=%d cost=%.4f partial=%v unaccounted=%v\n"+
-			"  want the 1200/80 the <metrics>.partial sidecar carries",
-			r.PromptTokens, r.CompletionTokens, r.Cost, r.Partial, r.Unaccounted)
-	}
-}
-
-// The meter-vs-harness divergence line divides one side by the other. Whether a
-// run has a harness side is the suite's Unaccounted state, not the token values:
-// a run with no record at all has no side, and pricing it against the meter
-// invents a divergence and blames the harness for it.
-func TestMeterDivergenceDoesNotPriceAMetricslessRun(t *testing.T) {
-	r := result{task: task{ID: "killed"}, Unaccounted: true,
-		Meter: &meterUsage{PromptTokens: 1200, CompletionTokens: 80}}
-	got := renderMeterAccounting([]result{r})
-	if strings.Contains(got, "self-report divergence") {
-		t.Fatalf("a run with no harness-side number was priced as a self-report divergence:\n%s", got)
-	}
-}
-
-// A persisted record that says zero tokens is a measurement of zero, not an
-// absence: the harness side exists, so it belongs on both sides of the ratio
-// even when the number it reports disagrees with the meter.
-func TestMeterAccountingKeepsAPersistedZeroOnBothSides(t *testing.T) {
-	r := result{task: task{ID: "zero"}, Meter: &meterUsage{PromptTokens: 1200, CompletionTokens: 80}}
-	got := renderMeterAccounting([]result{r})
-	if !strings.Contains(got, "-100.0% (harness 0 vs meter 1,280 over 1 runs)") {
-		t.Fatalf("a real zero-token measurement was dropped as if it were missing:\n%s", got)
-	}
-}
-
-func TestCorrectBoundaryMediansExcludeRunsWithNoRecordedSplit(t *testing.T) {
-	cp := []checkpoint{{Seq: 1, ElapsedMs: 1_000}, {Seq: 2, ElapsedMs: 2_000, Pass: true}}
-	measured := result{
-		task: task{ID: "measured"}, Passed: true, WallMs: 200_000, Checkpoints: cp,
-		FirstCorrectMs: 50_000, PostSolveWasteMs: 150_000,
-		MutationsBeforeCorrect: 1, RoundsBeforeCorrect: 3, RoundsAfterCorrect: 4,
-		CallsAfterCorrect: 5, VerifyAfterCorrect: 2,
-		Trajectory: &trajectorySummary{ModelRounds: 8},
-	}
-	// the same run twice, but -trajectories was omitted: no digest, so no split
-	// was ever taken and the before/after tallies stay at their zero value.
-	unmeasured := result{
-		task: task{ID: "unmeasured"}, Passed: true, WallMs: 200_000, Checkpoints: cp,
-		FirstCorrectMs: 50_000, PostSolveWasteMs: 150_000,
-		MutationsBeforeCorrect: 1,
-	}
-	unmeasured2 := unmeasured
-	unmeasured2.task = task{ID: "unmeasured-2"}
-	// The audit read the rendered line as plain text; the renderer emits
-	// markdown emphasis around each label, so compare with it stripped.
-	const want = "**rounds before** 3 · **rounds after** 4"
-	got := renderSolveProfiles([]result{measured, unmeasured, unmeasured2})
-	if !strings.Contains(got, want) {
-		t.Fatalf("medians folded in a run whose trajectory was never split:\n%s\n"+
-			"want %q (the measured run only)", got, want)
-	}
-}
-
-// Control (a): when every run recorded its split, the exclusion must not touch
-// a single number — the medians stay the measured ones.
-func TestCorrectBoundaryMediansAllMeasuredUnchanged(t *testing.T) {
-	cp := []checkpoint{{Seq: 1, ElapsedMs: 1_000}, {Seq: 2, ElapsedMs: 2_000, Pass: true}}
-	mk := func(id string, before, after, verify, mutations int) result {
-		return result{
-			task: task{ID: id}, Passed: true, WallMs: 200_000, Checkpoints: cp,
-			FirstCorrectMs: 50_000, PostSolveWasteMs: 150_000,
-			RoundsBeforeCorrect: before, RoundsAfterCorrect: after,
-			VerifyAfterCorrect: verify, MutationsBeforeCorrect: mutations,
-			Trajectory: &trajectorySummary{ModelRounds: 8},
-		}
-	}
-	got := renderSolveProfiles([]result{mk("a", 2, 6, 1, 0), mk("b", 3, 4, 2, 1), mk("c", 4, 5, 3, 2)})
-	const want = "**mutations before** 1 · **rounds before** 3 · **rounds after** 5 · **verifications after** 2"
-	if !strings.Contains(got, want) {
-		t.Fatalf("all-measured medians changed:\n%s\nwant %q", got, want)
-	}
-}
-
-// Control (b): with -trajectories off no split was ever taken for any run, so
-// there is nothing to average. Printing zeros would publish them as
-// observations; the report must say the boundary is unmeasured instead.
-func TestCorrectBoundaryWithNoRecordedSplitSaysNothingToAverage(t *testing.T) {
-	cp := []checkpoint{{Seq: 1, ElapsedMs: 1_000}, {Seq: 2, ElapsedMs: 2_000, Pass: true}}
-	run := func(id string, mutations int) result {
-		return result{
-			task: task{ID: id}, Passed: true, WallMs: 200_000, Checkpoints: cp,
-			FirstCorrectMs: 50_000, PostSolveWasteMs: 150_000,
-			MutationsBeforeCorrect: mutations,
-		}
-	}
-	got := renderSolveProfiles([]result{run("a", 1), run("b", 3)})
-	if strings.Contains(got, "rounds before") || strings.Contains(got, "verifications after") {
-		t.Fatalf("a boundary that was never split printed as a measurement:\n%s", got)
-	}
-	if !strings.Contains(got, "**mutations before** 3") {
-		t.Fatalf("the checkpoint-derived mutation count is measured without a trajectory and must still be printed:\n%s", got)
-	}
-	if !strings.Contains(got, "nothing to average") {
-		t.Fatalf("the report must say the boundary was never measured:\n%s", got)
-	}
-}
				`@@ -1 +0,0 @@`
				`DEFAULTS = {"host": "localhost", "port": 8080}`